Title Legal Ramifications of IP Geolocation

					                  DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.




         "There is no Geography on the Internet"
                   and other Hyperbole

                                        For Presentation at
                                           TPRC 2004



                         This paper is far from finished. Please excuse while I apply a few
                         more layers of polish and prose.




                                                                                    Robert Cannon1
                                                                                    September 2005


1
  Robert Cannon is Senior Counsel for Internet Policy at the Federal Communications Commission. He is
also the Director of Cybertelecom, an open law project on federal Internet policy. Notes and background
information for this paper can be found at Cybertelecom :: Notes :: Geolocation
http://www.cybertelecom.org/notes/geolocation.htm. Views express do not represent those of the FCC,
Cybertelecom, or my dogs. Special thanks goes to Richard Hovey who keeps enlightening me of my errant
ways. Robert Cannon can be reached at cannon@cybertelecom.org.


DRAFT
                              DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.



                                                                    Table of Contents
INTRODUCTION ........................................................................................................................................ 3
THE HYPERBOLE OF GEOGRAPHY .................................................................................................... 3
    WHAT THE COURTS THINK ......................................................................................................................... 4
     "Geography is Meaningless" ................................................................................................................ 4
             Strike One: The Communications Decency Act................................................................................................ 5
             Strike Two: Children's Online Protection Act................................................................................................... 6
             Strike Three: American Libraries Ass'n v. Pataki ............................................................................................. 8
        "You Are Here" ..................................................................................................................................... 9
             France v. Yahoo!............................................................................................................................................... 9
             iCraveTV ........................................................................................................................................................ 11
             Sony Music ..................................................................................................................................................... 11
             MaryCLE ........................................................................................................................................................ 11
      Observations ....................................................................................................................................... 13
    THE ILLUSIVE TRUTH ............................................................................................................................... 14
    AVAILABLE TOYS ..................................................................................................................................... 14
      Projects ............................................................................................................................................... 15
             IETF RFC 1876 DNS LOC............................................................................................................................. 15
             CAIDA's NetGeo ............................................................................................................................................ 16
             IETF GeoPriv.................................................................................................................................................. 18
             IETF ECRIT.................................................................................................................................................... 18
      Network Tools (Forensics).................................................................................................................. 19
      On the Shelf......................................................................................................................................... 21
      Other Possible Geolocation information Solutions............................................................................. 25
      Geography in the Application Layer versus in the Network Layer ..................................................... 25
    OBSTACLES TO GEOLOCATION ................................................................................................................. 25
IMPLICATIONS........................................................................................................................................ 28
    JURISDICTION ........................................................................................................................................... 28
    SECURITY ................................................................................................................................................. 29
    PRIVACY ................................................................................................................................................... 29
    SPAM ........................................................................................................................................................ 30
THE ABILITY TO REBUILD WALLS................................................................................................... 30




DRAFT
                 DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.


Introduction
It has been argued that an Internet service has no means of identifying the geographic
location of a subscriber. The inability to determine the location of an individual on the
Internet has direct legal consequences. This inability dictates which governments have
jurisdiction over the Net, which laws apply, and whether local laws can have any bearing.
But is the premise correct? Is it impossible to identify the geographic location of an
individual on the Internet?
Google "geolocation" and you will find a plethora of applications that can "identify the
geographic location of" an individual online. These services analyze IP numbers and
other data to produce an individual's location.
On the other hand, Internet jurisprudence has long accepted that on the Net geography is
meaningless. The First Amendment litigations of the Communications Decency Act and
the Children's Online Protection Act both made much of the lack of geography and
therefore an inability to determine "community standards" based on local standards. In
time, however, this assumption has eroded. ICraveTV, a Canadian online rebroadcaster
of TV shows, legal in Canada, was found in violation of US law when its server logs
revealed that 45 percent of those accessing the service were from the United States. A
spam litigation in Maryland was thrown out on the grounds that the IP number of the
plaintiff revealed that he was actually in Virginia. France found that Yahoo! violated
French laws prohibiting the sale of Nazi souvenirs, finding that Yahoo! knew it was
serving individuals in France because advertisements on Yahoo! pages came up in French
if a surfer was physically located in France. The VoIP industry is solving the E911
problem, providing location information of callers to emergency responders.
Cyber-libertarians declared that the Internet was the death of distance and borders. In
2005, it is not clear that this is true. This paper will review legal precedent and how
geolocation has been pivotal legal determinations. The paper will then review the current
state of technology and services, and their ability to provide geolocation information.
The proposed conclusion is that, while it is not true that "an Internet service has no means
of identifying the geographic location" of an individual, it may generally be true that
geolocation information is insufficiently reliable to alter jurisdictional analysis, online
First Amendment jurisprudence, or other legal uses of network addressing information.
Certain pressures may dramatically change the factual situation of the Internet, and
thereby change the legal analysis. In the mean time, Geolocation tools may be fruitful for
improving the relevancy of Internet advertising; this is not the same as the certainty
necessary for legal analysis.

The Hyperbole of Geography
        The Internet has been declared “the death of distance” and “the death of borders.”
The Internet is proclaimed as a unified global (even interplanetary) network where all
online individuals have access to everything online everywhere, where geography has no
meaning and no relevance. Judges have taken note, noting that speakers have no ability
to discern the location of listeners, and listeners have no ability to discern the location of


DRAFT
                   DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

speakers. “"cyberspace" [is] located in no particular geographical location but available
to anyone, anywhere in the world, with access to the Internet.”2
         But is this true?

         What the Courts Think
                  "Geography is Meaningless"
        Traditional First Amendment jurisprudence for “offensive” content is premised on
geography. Whether something is classified as “indecent” is determined by community
standards, where “community” is defined geographically. If geography has no meaning,
and if the confines of communities are illusive, First Amendment jurisprudence is
befuddled. On a global Internet, it is argued a publisher publishes to everyone
everywhere and has no ability to know about access or limit access by geography. In this
scenario, either community standards can have no meaning, or, perhaps, content must be
judged in all locations3 (which means the authors must create according to the standards
of the community most likely to be offended4).
        Justices have wrestled with the notion of a community that has no “there.” An
anxiety is revealed between extremes: either a community in Northern Virginia of
fundamentalist druids becomes the gatekeepers of all permissible content in all of
cyberspace, or any ability to identify offensive content – to know it when we see it – will
be lost and anything goes. Justices have toiled to either resolve or evade this issue.
      But what if the premise was invalidated. What if geography had meaning on the
Net? What ramifications might this have for First Amendment analysis?




2
 Reno v. ACLU, S.Ct.
http://supct.law.cornell.edu/supct/search/display.html?terms=aclu%20reno&url=/supct/html/historics/USS
C_CR_0521_0844_ZO.html
3
  See ACLU v. Reno, District Court case J. Buckwalter Sec. III B
http://www.pas.rochester.edu/~mbanks/CDA/decision/buckwalter.html (“the Conference Report with
regard to the CDA states that the Act is "intended to establish a uniform national standard of content
regulation."”)
4
  In other words, content producers seeking to avoid punishment for content judged offensive, must create
content to comport with the standards of the most conservative jurisdiction online. If the Foo community is
the most conservative jurisdiction, and if the Foo community has access to all content online, then all
content online would have to comport with the standards of the Foo community in order to avoid arrest in
the Foo jurisdiction. See ACLU v. Reno, District Court case J. Buckwalter Sec. III B
http://www.pas.rochester.edu/~mbanks/CDA/decision/buckwalter.html (stating “This conflict inevitably
leaves the reader of the CDA unable to discern the relevant "community standard," and will undoubtedly
cause Internet users to "steer far wider of the unlawful zone" than if the community standard to be applied
were clearly defined.”); ACLU v. Reno, District Court case J. Dalzell Sec. D.3 (“Because the creation and
posting of a Web site allows users anywhere in the country to see that site, many speakers will no doubt
censor their speech so that it is palatable in every community. Other speakers will decline to enter the
medium at all.”)


DRAFT
                      DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

                              Strike One: The Communications Decency Act
        The Communications Decency Act (Sen. Exon, Sen. Dan Coats) marked both the
lowest and the highest point in Internet jurisprudence. It is the lowest point as a Senator
who reportedly had never been online drafted legislation which would have chilled free
speech on the Internet, and was struck down by a unanimous Supreme Court. It was the
highest point in that, as the Courts had their first impression of Internet communications,
their idealistic review of the values of medium set the tone for all forthcoming Internet
jurisprudence. The Internet was proclaimed a never ending market place of ideas for
which the government had no business attempting censorship.
       In this clash of overreaching and uninformed censorship with utopian visions of a
new era of democratic discourse came a single sentence in the Supreme Courts decision:
           Moreover, the "community standards" criterion as applied to the Internet means
           that any communication available to a nation wide audience will be judged by the
           standards of the community most likely to be offended by the message.5
This was premised on the factual finding that the Internet is a unique medium “located in
no particular geographical location but available to anyone, anywhere in the world, with
access to the Internet.”6
       This was a minimal observation of the issue of geolocation,7 yet it would result in
years of litigation and became an accepted premise for Internet policy.




5
    Reno v. ACLU, S.Ct.
6
    Reno v. ACLU, S.Ct.
7
    Contrast it to the conclusions of the lower court:
ACLU v. Reno, 929 F. Supp. 824 (E.D. PA 1996)
           Unlike other media, there is no technologically feasible way for an Internet speaker to limit the
           geographical scope of his speech (even if he wanted to), or to "implement[] a system for screening
           the locale of incoming" requests. – J Dalzell District Court
           ACLU v. Reno, District Court case J. Buckwalter Sec. III B
           http://www.pas.rochester.edu/~mbanks/CDA/decision/buckwalter.html (stating “This conflict
           inevitably leaves the reader of the CDA unable to discern the relevant "community standard," and
           will undoubtedly cause Internet users to "steer far wider of the unlawful zone" than if the
           community standard to be applied were clearly defined.”); ACLU v. Reno, District Court case J.
           Dalzell Sec. D.3 (“Because the creation and posting of a Web site allows users anywhere in the
           country to see that site, many speakers will no doubt censor their speech so that it is palatable in
           every community. Other speakers will decline to enter the medium at all.”)
           “The Internet is not a physical or tangible entity” ACLU v. Reno, District Court case, Finding of
           Facts II.1.
           “Foreign content is otherwise indistinguishable from domestic content (as long as it is in English),
           since foreign speech is created, named, and posted in the same manner as domestic speech. There
           is no requirement that foreign speech contain a country code in its URL. It is undisputed that some
           foreign speech that travels over the Internet is sexually explicit.” ACLU v. Reno, District Court
           case, Finding of Facts II.1.


DRAFT
                    DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

                           Strike Two: Children's Online Protection Act
       Believing that he knew where the CDA had gone awry, and not to be outdone by
a unanimous Supreme Court, Sen. Dan Coats tried again. This time he passed the
Children’s Online Protection Act, which focused on commercial speech on the web that
was harmful to minors. Once again the ACLU sued. Once again the legislation fell
within days; the district court imposed a preliminary injunction, barring enforcement of
the Act.
        Upon review, the Third Circuit disregarded the decision of the lower court in
granting the injunction, and instead based its review entirely upon that one sentence from
the Supreme Court’s CDA opinion:8 “[T]he "community standards" criterion as applied
to the Internet means that any communication available to a nation wide audience will be
judged by the standards of the community most likely to be offended by the message.” If
true, then any attempt to censor the Internet would necessarily fail, concluded the Third
Circuit. The lack of a definable “community” meant there could be no definable
community standard. Lacking a community standard, there could be no analysis of what
content is harmful to minors.
         In terms of geolocation, the Third Circuit noted that
     •   “material posted on the Web is accessible by all Internet users worldwide”9 and
     •   “current technology does not permit a Web publisher to restrict access to its site
         based on the geographic locale of each particular Internet user”10
In terms of First Amendment analysis, according to the Third Circuit, this meant that



8
 See also COPA, 3rd Cir, Sec. II.A. slip at 21 (June 22, 2000)
http://vls.law.vill.edu/locator/3d/Jun2000/991324.txt
         One concern noted by the Supreme Court was that, as a part of the wholly unprecedented broad
         coverage of the CDA, "the `community standards' criterion as applied to the Internet means that
         any communication available to a nationwide audience will be judged by the standards of the
         community most likely to be offended by the message." Reno II, 521 U.S. at 877-78.

9
   See also COPA 3rd Cir. 2000 (“Indeed, the Internet "negates geometry. . . it is fundamentally and
profoundly anti-spatial. You cannot say where it is or describe its memorable shape and proportions or tell
a stranger how to get there. But you can find things in it without knowing where they are. The [Internet] is
ambient -- nowhere in particular and everywhere at once." Doe v. Roe, 955 P.2d 951, 956 (Ariz. 1998).”)
10
  See also COPA, 3rd Cir, Sec. I.C. slip at 13 (June 22, 2000)
http://vls.law.vill.edu/locator/3d/Jun2000/991324.txt
         It is essential to note that under current technology, Web publishers cannot "prevent [their site's]
         content from entering any geographic community." Reno III, 31 F. Supp. 2d at 484. As such, Web
         publishers cannot prevent Internet users in certain geographic locales from accessing their site;
         and in fact the Web publisher will not even know the geographic location of visitors to its site. See
         American Libraries, 969 F. Supp. at 171. Similarly, a Web publisher cannot modify the content of
         its site so as to restrict different geographic communities to access of only certain portions of their
         site. Thus, once published on the Web, existing technology does not permit the published material
         to be restricted to particular states or jurisdictions.


DRAFT
                      DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

           COPA essentially requires that every Web publisher subject to the statute abide
           by the most restrictive and conservative state's community standards in order to
           avoid criminal liability. Thus, because the standard by which COPA gauges
           whether material is "harmful to minors" is based on identifying "contemporary
           community standards," the inability of Web publishers to restrict access to their
           Web sites based on the geographic locale of the site visitor, in and of itself,
           imposes an impermissible burden on constitutionally protected First Amendment
           speech.11
Based specifically on the lack of ability to determine geolocation, the Third Circuit
concluded that “community standards” could not possibly be applied to the Internet.
        The reaction of the Supreme Court was “Sure it can!” The Supreme Court still
accepted the premise that the Internet is without geography.12 However, it argued
(perhaps a bit unconvincingly) that the inability to determine location is not fatal for this
type of content.13 While not reversing the outcome (COPA remained enjoined), the
Supreme Court remanded the case for further consideration.

        Being responsive to the Supreme Court, the Third Circuit reconsidered COPA and
found, once again, that COPA was unconstitutional. This time the Third Circuit focused
on the failure of COPA to utilize the least restrictive means for achieving a legitimate
government interest. Nevertheless, the Third Circuit, could not resist another crack at the
geolocation argument.

           As the Supreme Court has now explained, community standards by itself did not
           suffice to render COPA substantially overbroad. Justice Kennedy’s concurring
           opinion, however, explained that community standards, in conjunction with other
           provisions of the statute, might render the statute substantially overbroad.
In the Third Circuit's mind, this geolocation void resulted in an unresolvable overbreadth
problem.14
      When COPA returned to the Supreme Court, the Supremes did not take the bait.
The majority opinion affirmed the primary holding of the Third Circuit concerning least


11
     COPA, 3rd Cir, Intro (June 22, 2000) http://vls.law.vill.edu/locator/3d/Jun2000/991324.txt
12
  COPA S.Ct. I Sec. B (“We noted that “the ‘community standards’ criterion as applied to the Internet
means that any communication available to a nationwide audience will be judged by the standards of the
community most likely to be offended by the message.” Reno, 521 U.S., at 877—878.”)
13
  COPA S.Ct. I Sec. C (“When the scope of an obscenity statute’s coverage is sufficiently narrowed by a
“serious value” prong and a “prurient interest” prong, we have held that requiring a speaker disseminating
material to a national audience to observe varying community standards does not violate the First
Amendment.”).
14
   Ashcroft v. ACLU, Sec. II.B.5. Community Standards (3rd Cir. Mar. 2003) (“As we have just discussed
earlier, the expansive definitions of “material harmful to minors” and “for commercial purposes,” as well as
the burdensome affirmative defenses, likely render the statute substantially overbroad. COPA’s application
of “community standards” exacerbates these constitutional problems in that it further widens the spectrum
of protected speech that COPA affects.”)

DRAFT
                   DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

restrictive means, and did not touch again on the issue of geolocation and community
standards.
       Both courts assume that geography means nothing on the Internet. One court
concluded this was fatal where the other concluded that it was incidental. However, the
assumption is common to both.

                 Strike Three: American Libraries Ass'n v. Pataki
         While the Federal courts reviewed Congressional attempts to muddle about the
Internet, the state of New York got into the act. New York amended N.Y. Penal Law @
235.21 to make it illegal to send offensive content to minors. The Federal Court in
striking down this law took great note of the lack of ability to determine geolocation on
the Internet. This analysis can be distinguished, however, from the CDA and COPA.
Where one state passes a law that has the potential of impacting other states, this has the
potential of running afoul of the Commerce Clause (as opposed to the First Amendment
and “community standards”). The Federal Court struck down the new law on the
grounds that it has extraterritorial application to transactions involving citizens of other
states, it imposes a burden on interstate commerce, and the nature of the Internet
“necessitates uniform national treatment.”15
      As with the CDA and COPA, the Federal Court concludes that geography is
meaningless on the Internet.
        The Internet is wholly insensitive to geographic distinctions. In almost every case,
        users of the Internet neither know nor care about the physical location of the
        Internet resources they access. Internet protocols were designed to ignore rather
        than document geographic location; while computers on the network do have
        "addresses," they are logical addresses on the network rather than geographic
        addresses in real space. The majority of Internet addresses contain no geographic
        clues and, even where an Internet address provides such a clue, it may be
        misleading.16
In terms of the New York law, this means that publishers on the Net could not know
when they are interacting with someone from New York, nor could the publishers
prohibit those alleged New Yorkers from interacting with the material. “[T]here is no
feasible way to preclude New Yorkers from accessing a Web site, receiving a mail
exploder message or a newsgroup posting, or participating in a chat room.”17 As such,
the Court concluded that the New York law violated the Commerce Clause.




15
  American Libraries Ass'n v. Pataki, 969 F. Supp. 160, Conclusion (S.D.N.Y. 1997)
http://www.loundy.com/CASES/ALA_v_Pataki.html.
16
  American Libraries Ass'n v. Pataki, 969 F. Supp. 160, Discussion (S.D.N.Y. 1997)
http://www.loundy.com/CASES/ALA_v_Pataki.html.
17
  American Libraries Ass'n v. Pataki, 969 F. Supp. 160, Discussion (S.D.N.Y. 1997)
http://www.loundy.com/CASES/ALA_v_Pataki.html.


DRAFT
                   DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

                 "You Are Here"

                          France v. Yahoo!
        The case of LICRA v. Yahoo! marks a clear confrontation between content on the
Internet being available to anyone anywhere, and local laws that demand local treatment.
In LICRA v. Yahoo!, France brought suit against Yahoo! for violating a prohibition
French law against the selling of Nazi paraphernalia.18 The paraphernalia in
question was sold by third parties on Yahoo! auction sites.
       Yahoo! argued against the charges, arguing in part, that geography is
meaningless on the Internet. Yahoo! argued that it is not possible for Yahoo! to
be bound by the local laws of a local jurisdiction when content posted to the
service is available to everyone everywhere on the globe without restriction.
       France, however, was unpersuaded. When individuals from France
surfed the Yahoo! website, the Yahoo! website displayed advertisements in
French. How could it possibly be true that Yahoo! cannot know from where an
individual surfer comes when it is serving up language appropriate advertising.
        The answer, according to the French Court, was IP geolocation. The
Court concluded that the use of IP numbers (as opposed, for example, to domain
names) is the most reliable means of ascertaining geolocation, that there are
several companies offering geolocation services, and that using these services, it
would be possible to identify 70 percent of the IP addresses of individual residing
in France as being in France. If these 70 percent can be identified, than they can
be filtered and their access to the Nazi content can be blocked. The Court had
some ideas about how to deal with the other 30 percent, for which IP geolocation
would not work, but those methods (such as having those individuals certify that
they are not from France) are not relevant to this paper.
       A part of the 30 percent failure rate, as noted by the Court, is what could
be called the AOL-problem. The AOL-problem exists because AOL has a cluster
of proxies located in Northern Virginia which serve individuals who subscribe to
AOL around the world. If one logs onto AOL, one is assigned an IP number from
these Virginian servers. Regardless of where the individual is in fact, the IP
number will thereby suggest that the individual is located in Virginia.19
       Based on available technology, the court concluded that Yahoo! could
comply with French law by blocking access to individuals from France. The
Court fined Yahoo! for violating the law and ordered Yahoo! to block access
henceforth. The fines would accrue for ongoing violations of the French law.


18
   Note that LICRA did not bring suit against yahoo.fr, the French subsidiary of Yahoo!, which itself did
not display the content in question. Rather, the suit was against yahoo.com, which the court acknowledged
is written in English and is designed primarily for an American audience. CHECK
19
 Get Court Citation. See Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of
Geographic Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 2.1 Fundamental Limitations
Due to Proxies (n.d.) http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf


DRAFT
                  DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

        This decision was not well received either by Yahoo! or by the
Cyberlibertarian community. Yahoo! opted, instead of appealing the law in
France, to challenge the law in the United States. Yahoo! argued that the French
court order and the ongoing fines were an abridgement of Yahoo!’s First
Amendment rights. A locality in Europe was seeking to dictate what content an
American company could display to Americans (and to the world). The Federal
District Court agreed. After all, the Internet is available to everyone everywhere,
reasoned this court. A restriction by France was a restriction of speech by a U.S.
company in the United States.

         What is at issue here is whether it is consistent with the Constitution and laws of
         the United States for another nation to regulate speech by a United States resident
         within the United States on the basis that such speech can be accessed by Internet
         users in that nation. In a world in which ideas and infomration transcend borders
         and the Internet in particular renders the physical distance between speaker and
         audience virtually meaningless, the implications of this question go far beyond the
         facts of this case. The modern world is home to widely varied cultures with
         radically divergent value systems. There is little doubt that Internet users in the
         United States routinely engage in speech that violates, for example, China's laws
         against religious expression, the laws of various nations against advocacy of
         gender equality or homosexuality, or even the United Kingdom;s restrictions on
         freedom of the press.

         .....

         In light of the Court's conclusion that enforcement of the French order by a
         United States court would be inconsistent with the First Amendment, the factual
         question of whether Yahoo! possesses the technology to comply with the order is
         immaterial. Even assuming for purposes of the present motion that Yahoo! does
         possess such technology, compliance still would involve an impermissible
         restriction on speech. 20

There was one problem with the Federal District Court’s decision. No one had in
fact tried to penalize or suppress Yahoo!’s speech in the United States. What had
happened, had happened in France. The LICRA had yet to seek enforcement of
the order in the United States, and had stated that it would not. On these
grounds, the Federal Appeals Court reversed the lower court (but then agreed to
a rehearing en banc).21 This litigation is ongoing.




20
  Yahoo! v. La Ligue Contre Le Racisme et L'Antisemitisme, Case Number C-00-21275, slip at 8
& 22 (NDCa Nov. 7, 2001).
21
     CITATION


DRAFT
                    DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

                           iCraveTV
         iCraveTV was an innovative web service that sought to rebroadcast television
shows in Canada, an activity apparently legal in Canada but not in the United States.
Twentieth Century Fox sued claiming that iCraveTV was engaged in unauthorized public
performance of the shows in the United States. The Defendants argued that iCraveTV
was a Canadian service and that they had no intention of serving viewers in the United
States. Disregarding intention as irrelevant, the Court noted that, according to iCraveTV
itself, 45 percent of viewers were based in the United States. This figure was determined
after an examination of the IP numbers in the server log of the iCraveTV server, which
recorded the IP number address of computers which accessed the iCraveTV server. The
Court found for the plaintiffs, concluding that “defendants are unlawfully publicly
performing plaintiffs' copyrighted works in the United States.”22

                           Sony Music
        Having argued that geography is meaningless and therefore First Amendment
"community standards" are dubious on the Internet,23 CITATION EFF made a
fascinating about face in the P2P music wars. In the case Sony Music Entertainment v.
Does 1-40, Sony Music had sued 40 John Does in New York District Court, serving
subpoenas on their ISP in order to obtain their identities. Four of the defendants, and
EFF through an amicus brief, moved to quash the subpoenas. Why? Because, according
to EFF, there is geography in the Internet. According to EFF, based on the IP numbers
that Sony had, 36 of the 40 defendants were "likely" not from New York. Without
evaluating the reliability of the method EFF used to determine geolocation, the Court
denied the motion to quash on the grounds that "likely" is not good enough for a
determination of jurisdiction.24

                           MaryCLE
        Seeking to protect its citizens from the slings and arrows of outrageous spam, the
state of Maryland passed the Commercial Electronic Email Act, which, in its relevant
part, made it illegal to transmit unsolicited, false, and misleading commercial email
where the sender knows or should have known that the recipient is a resident of
Maryland. Plaintiff MaryCLE sued First Choice Internet alleging a violation of the act.
Plaintiff, employing a neat trick, argued that defendant knew or should have known that

22
  Twentieth Century Fox Film Corporation, V. IcraveTV, 2000 WL 255989, ¶ 22 (W.D.Pa.). The Court
granted a restraining order and the litigation did not proceed further. See Motion Picture Association of
America, iCraveTV Signs Settlement Agreement that Shuts Down Website, Feb. 28, 2000, available at
http://www.mpaa.org/Press/iCrave_Settlement.htm
23
   EFF served as co-counsel with the ACLU in the challenge to COPA. See COPA
("CDA II") Legal Challenge Page, EFF (n.d.) (accessed April 8, 2005)
http://www.eff.org/legal/cases/ACLU_v_Reno_II/; EFF Press Release, Supreme Court
Supports Library Internet Blocking Law (June 23, 2003)
http://www.eff.org/Censorship/Censorware/20030623_eff_cipapr.php
24
     Sony Music Entertainment Inc. v. Does 1-40, 326 F.Supp.2d 556, 567-68 (S.D.N.Y. 2004).


DRAFT
                      DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

MaryCLE was a Maryland resident on the grounds that the address used for the email
was the domain name Maryland-state-resident.com.25 The Court, however, summarily
rejected this argument, stating
           In order to determine the physical location where an email address is based, the
           most reliable technique is to plug the IP locator for the email address into an "IP
           Tracker" such as www.discoveryvip.com/ipaddress.htm, which will then provide
           the physical location of a computer using a particular email address. In the case
           of MarylandCLE, the IP address of the computer that was used when
           MarylandCLE "opted-in" was 66.171.38.224, which is located in Reston,
           Virginia, not Maryland.26
         But than this Court does an apparent unacknowledged about face. Making the
initial rejection of the utility of the cute domain name, the Maryland Court picks up on
the jurisprudence of the ALA v. Pataki case, concluding that the Internet is wholly
insensitive to geography, and therefore a state law restricting Internet communications
violates the dormant Commerce Clause. On the one hand, the Maryland law cannot
apply because the plaintiff was in Virginia, and on the other hand the Maryland law is
unconstitutional because we cannot possibly know where the plaintiff was.
       But then the Court does yet another, not fully explained, change of direction.
Instead of basing its argument on the lack of geography, the Maryland court ultimately
concludes that the Maryland law is unconstitutional explicitly on the geographic grounds
that we know where all the players to the transaction were, and none of them were in
Maryland. The spam in question was sent from the defendants in New York, routed


25
     Indeed a visit to the website of Maryland-state-resident.com reveals a declaration:

       •   Commercial Electronic Mail may not be sent to any address at Maryland-State-
           Resident.com without the express, written, and affirmatively sealed or signed consent of
           the recipients. No permission to receive CEM is ever granted implicitly.
       •   All e-mail addresses at Maryland-State-Resident are held by legal entities incorporated in
           Maryland.
       •   The computers hosting the Maryland-State-Resident servers are owned by a Maryland
           Internet Service Provider ("ISP").
       •   The domain registrar will show Maryland-State-Resident.com to be held by a Maryland
           individual or organization.
       •   The Maryland-State-Resident.com domain name or web servers may not be used for
           sending CEM of any kind or in any way.
       •   Violations of this policy are subject to suit under the State of Maryland's Commercial
           Electronic Mail Act ("CEMA"), which provides for damages of $500 for the recipient and
           $1000 for the ISP for each separate action. See Md. Code Ann., Com. Law. §14-3001
           et seq.

Maryland State Resident.com (assessed April 1, 2005) http://maryland-state-resident.com/.
26
  MarylandCLE, LLC v. First Choice Internet, Cv. No. 248514 (Circuit Court Montgomery County 2004)
http://www.courts.state.md.us/businesstech/opinions/mdbt11_04_opinion.wpd. On April 1, 2005,
Discoveryvip.com revealed that "maryland-state-resident.com (216.180.242.202) is located in Atlanta,
Georgia, United States." Discoveryvip.com (assessed April 1, 2005)
http://www.discoveryvip.com/ipaddress.htm.


DRAFT
                  DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

through email servers in Virginia, and received at Plaintiffs primary place of business,
Washington, D.C. The Court noted "Plaintiffs are asking the court to apply Maryland
law to a situation which never occurred in Maryland." As the Maryland statute as written
applies to transactions that can occur outside the state of Maryland, the Court concluded
that Maryland spam law is an unconstitutional violation of the dormant Commerce
Clause.
       It is fascinating to observe in this case the oscillation between knowledge of
geography, and lack of knowledge of geography determining outcome in the same
decision.

                Observations
       What do we make of all of this? It is clear that geolocation has been a part of
some of the most contentious legal confrontations that have occurred in Internet law.
Indeed, it is also clear that geolocation has been a linchpin to those decisions.
Geolocation is a bit of a nuclear option in this jurisprudence, particularly in First
Amendment analysis. Lower courts have relied upon the Community Standards problem
to come down like a sledgehammer on attempts to censor the Internet. Perhaps
recognizing the implications, the Supreme Court backed off of the community standards
problem in order to permit a glimmer of a hope that some censorship provision might
withstand constitutional muster – but in doing so, the Supreme Court’s analysis of how
the community standards problem is resolved was anemic at best. Going further than the
Supreme Court, other courts have discovered geography on the Internet.
         The implications are extreme. If geolocation cannot be determined, then there is
no community standards, ICraveTV was decided incorrectly and there are significant
implications for intellectual property, and other local ordinance on the Internet, at least in
the United States, would likely violate the Commerce clause. If on the other hand, there is
geolocation on the Internet, there is no problem with community standards, intellectual
property owners can demand compliance with stricter intellectual property laws of
stricter jurisdictions, and local authorities can pass whatever local ordinance they wish
without being defeated by that pesky constitutional issue.
       The factual conclusion concerning geolocation has a great deal riding on it, and it
is understandable why there is so much apparent anxiety surrounding it. Concluding one
way means any significant dot com enterprise must comply with a lexicon of local
ordinances, and miles of code to ensure automatic compliance. Concluding the other way
means that the Barbarians have stormed the gates and we are powerless to protect the
youth of America from reading offensive content such as Huckleberry Finn.27
        One way other the other, the sky is falling.




27
   See The 100 Most Frequently Challenged Books of 1990–2000, American Library Association
http://www.ala.org/ala/oif/bannedbooksweek/bbwlinks/100mostfrequently.htm


DRAFT
                  DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

        The Illusive Truth
         As my engineering peers are quick to point out, simply because a court resolves a
technical issue does not make it so. Although authorities of the highest legal caliber
resolved at one time that the world was flat, dolphins continued to roam the seas free and
in blatant violation of the flat-earth edict. Between one court’s decision that geography is
meaningless, and another’s surprising discovery that it was right here all along, where
lies the truth?
        Every device (“host”) on the Internet is assigned an IP number Internet address.
If a device has an IP number, it can be reached. If a device lacks an IP number, it is
invisible to the network even if physically attached. Interactions on the Internet transpire
through two devices communicating based on those IP numbers. Device A desires
something and so contacts Device B. Device B responds, addressing the response with
the IP number address provided by Device A. The two devices interact, with each
interaction addressed with those IP numbers. It is normal for devices on the Internet to
keep a log which records a history of the addresses of the devices that have interacted
with it during that time frame.
        The entire set of IP numbers is managed by the Internet Assigned Number
Authority (IANA).28 IANA distributes blocks of numbers to Regional Internet Registries
(RIRs) for further distribution.29 RIRs distribute blocks of numbers to large ISPs, and to
local Internet registries (LIRs) and national Internet registries (NIRs). Small ISPs,
corporate networks, and individual users acquire numbers from large ISPs, LIRs, or
NIRs. The architecture is topologically hierarchical without direct connection to
geography.
        Nevertheless, there is a degree of geography to this design. A local ISP in Austin
Texas may be assigned a small block of IP numbers. Those numbers may be assigned by
a large ISP, a US Internet backbone. The US Internet backbone would have acquired its
numbers from the American RIR, the American Registry for Internet Numbers (ARIN).
This distribution is a regional distribution. The US Internet backbone would not receive
numbers from the European RIR. In addition, the numbers in the block assigned to the
Austin Texas ISP are associated with Austin Texas. If that number shows up in a server
log, then it has some connection to the Austin ISP. In this manner, some degree of
geography is suggested into the IP numbering structure.

        Available Toys
       Bring together a demand for better geographic information, and a knowledge of
how the Internet works, and you have a potential business plan. There have been a
number attempts to produce services responsive to this demand. Questions remain,



28
  IANA is currently under the authority of the Internet Corporation for Assigned Names and Numbers
(“ICANN”).
29
  There are currently five RIRs: ARIN, RIPE, APNic, AFRINIC, and LACNIC. See IANA IP Address
Services http://www.iana.org/ipaddress/ip-addresses.htm (accessed April 14, 2005).


DRAFT
                    DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

however, of how specific the geographic information provided is, how reliable it is, and
how widely deployed the services are.

                  Projects

                           IETF RFC 1876 DNS LOC
        IP numbers are bothersome things that are hard for human's to remember. In
order for the Internet to accommodate stupid humans, the domain name system was
created.30 Domain names can be any text or numeric string used to identify a device or
resource on the network. Domain names are hierarchical with top level domains such as
.com, .gov, .org, .us., .eu, and .tu; secondary domains such as cybertelecom.org or
tcrc.net, and subdomains such as www.cybertelecom.org or mail.cybertelecom.org.
        To understand the domain name system is to understand that domain names are
not addresses; they are tokens keys for access a database. In that database can be any
type of information. Traditionally, when the DNS database is queried with the domain
name "cybertelecom.org," the response is the IP number associated with that domain
name. But it could be anything. It could be a phone number, enabling an interconnection
between SIP telephony addresses and PSTN phone numbers.31 It could also be longitude,
latitude and altitude information.
       A means of including location information was proposed at the IETF: RFC 1876,
A Means for Expressing Location Information in the Domain Name System (Jan.
1996).32 Longitude, latitude, and altitude could be represented in resource records for
devices (hosts), networks, and subnets. Included in the resource records can be
information on how precise the location information is.
        Information is not provided in RFC 1876 on how individuals would interface with
these records and how rapidly these records would be refreshed.33 Note that this method
of inserting geographic location information into the DNS is constrained by the speed at
which the DNS is refreshed. In other words, for stationary hosts, latency in the refreshing
of DNS files would have minimal impact. But with mobile or portable hosts, latency in
refreshing DNS files would mean that during the latency cycle, the geographic



30
  See P. Mockepetris, RFC 1034, Domain Names – Concepts and Facilities, IETF (Nov. 1987)
http://www.ietf.org/rfc/rfc1034.txt; P. Mockepetris, RFC 1035, Domain Names – Implementation and
Specification, IETF (Nov. 1987) http://www.ietf.org/rfc/rfc1035.txt. See also Management of Internet
Names and Addresses (White Paper), Department of Commerce (June 5, 1998)
http://www.ntia.doc.gov/ntiahome/domainname/6_5_98dns.htm (recounting history of DNS).
31
     ENUM
32
  C. Davis, P. Vixie, T. Goodwin, and I. Dickinson, RFC 1876, A Means for Expressing Location
Information in the Domain Name System (Jan. 1996) (Experimental RFC)
http://www.ietf.org/rfc/rfc1876.txt.
33
  The DNS is a distributed database. Copies of records are cached locally and then refreshed on a regular
cycle. If a record is revised, there can be a latency while the revision is being propagated through out the
system.


DRAFT
                   DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

information would potentially be inaccurate. The IETF in proposing Location Resource
Records had in mind network management and traffic monitoring as a primary use.34
        The DNS software BIND supports RFC 1876 location resource records.35
However, as noted by CAIDA, RFC 1876 was experimental; LOC resource records are
not required nor are they necessary for the DNS to work. This method places the burden
on network administrators to enter location information for all records and presents no
means of verifying the accuracy of the information in the database.36 The method of
injecting location information into the DNS is rarely utilized.37
                  RFC 3825, J. Polk, J. Schnizlein, M. Linsner, Dynamic Host Configuration Protocol
        Option for Coordinate-based Location Configuration Information (July 2004)
        http://www.ietf.org/rfc/rfc3825.txt?number=3825 proposes using Dynamic Host Control Protocol
        to inform a device of its location at host configuration time, acquiring location information from
        the local network. This assumes of course, that the location of the ports in the local network is
        accurate.
        But see wifi location devices

                          CAIDA's NetGeo
        Another notable attempt in experimenting with geographic information was
CAIDA’s NetGeo project.38 NetGeo sought to identify geographic information related to
the Internet by accessing the WHOIS database for Autonomous System numbers, IP
numbers, and domain names. NetGeo also took advantage of RFC 1876 DNS LOC
information where available and utilized geographic hints that may be, for instance, in

34
  C. Davis, P. Vixie, T. Goodwin, and I. Dickinson, RFC 1876, A Means for Expressing Location
Information in the Domain Name System, Sec. 5.1 (Jan. 1996) (Experimental RFC)
http://www.ietf.org/rfc/rfc1876.txt. See also Christopher Davis, Other Applications using DNS LOC (last
modified Mar. 18, 2001) http://www.ckdhr.com/dns-loc/apps.html (listing network management programs)
35
   BIND Administrator Reference Manual, Internet Software Consortium (2001) p. 91
http://www.nominum.com/content/documents/bind9arm.pdf. See also Christopher Davis, Publishing your
own location data, ckdhr.com (last modified Mar. 18, 2001) http://www.ckdhr.com/dns-loc/howto.html
(indicating that BIND 4 and BIND 8 support DNS LOC).
36
  See Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic
Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 2 (n.d.) (critiquing DNS LOC)
http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf
37
  See David Moore, Ram Periakaruppan, Jim Donohoe, Where in the World is netgeo.caida.org, CAIDA
(2000) (“In reality, because LOC resource records are not required to make DNS work, few network
administrators support them”) http://www.caida.org/outreach/papers/2000/inet_netgeo/inet_netgeo.html;
Andrew Turner, Geolocation by IP Address, Linux Journal (Oct. 24, 2004)
http://www.linuxjournal.com/article/7856 (“Several popular servers have employed this standard but not
enough to be directly useful as of yet.”). Compare Christopher Davis, DNS LOC: Geo-enabling the
Domain Name System (last updated Mar. 18, 2001) http://www.ckdhr.com/dns-loc/ (a site dedicated to
persuading people to use DNS LOC. However, site was last updated four years ago and author has moved
his current work to a different website).
38
  See CAIDA: NetGeo – The Internet Geographic Database (last updated Jul. 31, 2003)
http://www.caida.org/tools/utilities/netgeo/; David Moore, Ram Periakaruppan, Jim Donohoe, k claffy,
Where in the World is netgeo.caida.org? CAIDA (2000)
http://www.caida.org/outreach/papers/2000/inet_netgeo/inet_netgeo.html


DRAFT
                   DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

domain names. Correlating data from varying sources, NetGeo would return “a record
containing: a location, the data source of the location, the granularity determining the
location, and additional meta-data (date of query, date of last whois update, and server
used). The location section contains fields for city, state/province/administrative-unit,
country, latitude, and longitude.”39 An example of a result is shown below:
     NAME:                 CAIDA.ORG
     NUMBER:
     CITY:                 LA JOLLA
     STATE:                CALIFORNIA
     COUNTRY:              US
     LAT:                  32.85
     LONG:                 -117.25
     LAT_LONG_GRAN:        City
     LAST_UPDATED:         11-Jul-98
     NIC:                  INTERNIC
     LOOKUP_TYPE:          Domain Name
     RATING:
     DOMAIN_GUESS:
     STATUS:               OK40

Notice that the data returned in the example is broad, at a granularity level of a city.
        There are several self acknowledged limitations of this effort. First, WHOIS
databases41 produce location information for the registrant, not necessarily for the
computer hosting for which the IP number or domain name is assigned.42 Assuming that
the location of the entity responsible for the internet resource is useful information, this
information may be specific for small entities on the edge of the network, but vague for
large entities. In other words, all of IBM’s resources may be managed by a single
administrative office and location; while that administrative office identified on all of the
WHOIS records is in one place, IBM’s resources are spread across the globe. In addition,
as time transpires, the information in the records may become stale and inaccurate.43
Finally, CAIDA notes that WHOIS DNS records are not standard. As new registrars
come online with “arbitrary” WHOIS formats, anyone who systematically seeks to utilize
WHOIS databases will have a great deal of work.



39
  David Moore, Ram Periakaruppan, Jim Donohoe, k claffy, Where in the World is netgeo.caida.org?
CAIDA, Section: Overview (2000)
http://www.caida.org/outreach/papers/2000/inet_netgeo/inet_netgeo.html
40
 David Moore, Ram Periakaruppan, Jim Donohoe, k claffy, Where in the World is netgeo.caida.org?
CAIDA, Figure 1 (2000) http://www.caida.org/outreach/papers/2000/inet_netgeo/inet_netgeo.html
41
  WHOIS records are records created when domain names are created and registered. There reveal contact
information about the registrant of the domain name. See K. Harrenstien, M. Stahl, E. Feinler, RFC 954,
Nickname/WHOIS (Oct. 1985) http://www.ietf.org/rfc/rfc0954.txt.
42
 For example, my address in WHOIS is in Arlington, Virginia but my website is hosted on a machine in
Wyoming.
43
  See Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic
Mapping Techniques for Internet Hosts, Microsoft Research, Sec. 2 (n.d.) (critiquing reliance on WHOIS
data) http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf


DRAFT
                     DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

        CAIDA’s NetGeo project attempted to compensate for these limitations by
looking for clues. The hostnames of some large networks include geographic references,
at times, utilizing the standard three letter airport codes to identify the location of, for
example, backbone routers. Where RFC 1876 DNS LOC is used, NetGeo takes
advantage of that information.
       NetGeo was a CAIDA research project and is no longer supported. The
technology was licensed to IXIA, but use of the NetGeo technology in the form of a
product is not readily apparent from the IXIA website.44
       CAIDA’s purpose in exploring the capabilities of NetGeo was in support of its
ongoing efforts to measure and study the Internet and Internet traffic patterns. In other
words, CAIDA’s purposes like DNS LOC was infrastructure management.

                           IETF GeoPriv
        A more recent endeavor to grapple with geography and the Internet is the IETF’s
Geographic Location/Privacy (GeoPriv) Working Group.45 This project stands apart
from the other projects in several ways. First, GeoPriv is not a means of generating
location information for network devices; it assumes that geolocation has been provided
somehow. GeoPriv is a protocol for how that information should be handled. Second,
unlike DNS LOC which sought geographic information for network infrastructure,
GeoPriv is aimed more at the application layer, attempting to be responsive to the needs
of emergency services, navigation services, and other location based services.46
       While GeoPriv is fascinating for its work on handling geolocation information, it
turns out not to be relevant to the task at hand. In terms of GeoPriv, this paper is all
about and only about the first step, "Location Generation."47 GeoPriv is expressly not
about that but rather deals with the next step; having generated location, who is that
information exposed to, under what conditions, and how is it exposed.

                           IETF ECRIT
       The IETF recently established a working group known as Emergency Context
Resolution with Internet Technologies (ECRIT). The purpose of this working group is to


44
 The link from the CAIDA NetGeo website to Ixia ---- produces a “Resource Not Found” website. See
CAIDA, NetGeo – The Internet Geographic Database (last updated July 31, 2003) ; Ixia – Leader of IP
Network Testing (n.d.) http://www.ixiacom.com/products/paa/netops/IxMapping.php. A search of the Ixia
website produces no results for “netgeo.”
45
  IETF Geographic Location/Privacy (geopriv) Chater http://www.ietf.org/html.charters/geopriv-
charter.html (accessed April 21, 2005). See also M. Danley, D. Mulligan, J. Morris, J. Peterson, Threat
Analysis of the Geopriv Protocol, IETF RFC 3694 (Feb. 2004) http://www.ietf.org/rfc/rfc3694.txt.
46
   J. Cuellar, J. Morris, D. Mulligan, J. Peterson, J. Polk, Geopriv Requirements IETF RFC 3693, Sec.
Abstract (Feb. 2004) (“Location-based services, navigation applications, emergency services, management
of equipment in the field, and other location-dependent services need geographic location information
about a Target (such as a user, resource or other entity)).”
47
     GeoPriv RFC 3693, Sec. 4.


DRAFT
                     DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

“show how the availability of location data and call routing information at different steps
in session setup would enable communication between a user and a relevant emergency
response center.”48 Like GeoPriv, this working group is focused on information handling
and delivery, as opposed to information generation. The assumption is that location
information will be generated or provided by some outside-the-network means.
        ECRIT released in May 2005 a draft for discussion Requirements for Emergency
Context Resolution with Internet Technologies.49 In discussing how the location of a
caller will be identified, the draft anticipates that the location will be “inserted” or
“referenced.”
            UA-inserted: The caller's user agent inserts the location information, derived from
            sources such as GPS, DHCP or link-layer announcements (LLDP).
            UA-referenced: The caller's user agent provides a reference, via a permanent or
            temporary identifier, to the location which is stored by a location service
            somewhere else and then retrieved by the PSAP.50
While this draft cites the GeoPriv effort, it does not reference DNS LOC. This working
group expands upon GeoPriv, constructing a clear framework for 911 calling
requirements. With the framework maturing for 911 location information handling, this
begs the opportunity for a location identification solution to step forward, although the
issue of location generation has not be resolved, and ECRIT is not about resolving that
part of the problem.

                    Network Tools (Forensics)
       Several Internet tools facilitate acquiring geographic information. To walk
through these tools, let us assume that the bad people at Cybertelecom.org did something
abominable. What could we learn about Cybertelecom.org?
        A WHOIS record is the registration record of the domain name.51 The WHOIS
record for Cybertelecom.org would reveal that it is owned by Robert Cannon with the
listed address in Arlington, Virginia. However, the technical point of contact is listed in
Wyoming, and the DNS servers for this record are listed as NS2.WYOMING.COM and
CENTRAL.WYOMING.COM.52 We learn that www.cybertelecom.org is hosted on a
webserver with the address 216.67.146.101. This is part of an IP number block held by
Wyoming.com.53 WHOIS is able to distinguish between and identify the location of the

48
  Emergency Context Resolution with Internet Technologies Working Group Charter (accessed May 10,
2005) http://www.ietf.org/html.charters/ecrit-charter.html.
49
  H. Schulzrinne & R. Marshall, Requirements for Emergency Context Resolution with Internet
Technologies, IETF Internet Draft (May 5, 2005) http://www.ietf.org/internet-drafts/draft-schulzrinne-ecrit-
requirements-00.txt
50
     Id., Sec. 5.
51
  Internic | FAQs on the Domain Names, Registrars, and Registration (last updated Sept. 25, 2003)
http://www.internic.net/faqs/domain-names.html.
52
     WHOIS, Network Solutions (2005) http://www.networksolutions.com/en_US/whois/index.jhtml.
53
     ARIN WHOIS http://www.arin.net/.

DRAFT
                      DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

individual who owns the resource and the location of the facility that hosts the resource.
WHOIS is highly dependant upon the accuracy of the information provided in the
record.54
        Traceroute is a tool that reveals the route through the network a packet might
take, reporting back the hops traversed and the time lapse of the hops.55 Traceroute
shows that the traffic to 216.67.146.101 is carried over the Broadwing backbone. The
last hop on Broadwing is p0-0-0.a1.slkc.broadwing.net.56 The SLKC is a convention for
networks, offering a clue as to geographic location of the router in its name.57 SLKC in
this case refers to Salt Lake City. Different traceroutes may provide slightly different
results. Traceroute also reveals that as the traffic nears, Cybertelecom.org (hosted at
Wyoming.com), it traverses CHYNWYQCORTR3-FE0-0.CONTACTCOM.NET.
Contact Communications (Contactcom.net) is the CLEC of Wyoming.com.58 Note in this
routers name the geographical reference to Cheyenne, Wyoming. The administrative
address of Contact Communications is 937 W Main St, Riverton, WY 82501,59 which is
the same as the administrative address of Wyoming.com.60 Using Traceroute to
determine location assumes the accuracy of the reported location of hosts.
        Similar to Traceroute is referred to by some as GeoPing is based on the speed of
light. If you have a site but don’t know its location, you have through traceroute a nearby
host and you know its location, and you have the delay between the two, it is possible to
produce a guess as to the distance between the known and the unknown host. Given the
limits of the speed of light,61 the time between hops62 means that the site in question can


54
  The accuracy of WHOIS information is currently a significant issue. See, e.g., Final
Report of the GNSO Council's WHOIS Task Force Accuracy and Bulk Access, ICANN
(Feb. 6, 2003) http://www.icann.org/gnso/whois-tf/report-19feb03.htm.
55
  Traceroute, Wikipedia (last updated April 20, 2005) http://en.wikipedia.org/wiki/Traceroute. See
Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping
Techniques for Internet Hosts, Microsoft Research, Sec. 2 (n.d.)
http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf (listing traceroute as a tool to
map traffic paths, noting geographic locations of routers and hosts in path).
56
 The Traceroute from DNSStuff.com at this point fails, providing the explanation that it
may have hit a fire wall that blocks pings. Tracert to 216.67.146.101 Generated by
www.DNSstuff.com at 20:40:07 GMT on 16 May 2005.
57
  Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping
Techniques for Internet Hosts, Microsoft Research, Sec. 4 (n.d.)
http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf
58
     Contact Communications http://www.contactcom.net/ (accessed May 16, 2005).
59
  Contact Communications: Contact Us http://www.contactcom.net/contactus.htm (accessed May 16,
2005).
60
     Wyoming.com (accessed May 16, 2005).
61
     Speed of Light, Wikipedia (last updated May 16, 2005) http://en.wikipedia.org/wiki/speed_of_light
62
  In order to compensate for network congestion, several Traceroutes may be necessary where the
calculation uses the smallest delay between hosts. CITE


DRAFT
                     DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

only be so far away from the last geographically identified hop (speed-of-light * time =
maximum possible distance). If the last known hop is Wyoming.com in Riverton,
Wyoming, and if the maximum possible calculated distance is 100 miles, these give some
idea of where the device in question might be.63
        GeoClustering is a technique suggested by Venkata Padmanabhan, at Microsoft
Research, and Lakshminarayanan Subramanian, at the University of California at
Berkeley.64 To understand GeoClustering, one must understand IP number delegations.65
`The assumption is that IP numbers are utilized or distributed by an Internet network in
given geographic location. If the addresses of a few of the IP numbers is known, that it
can be assumed that any other number in that IP number block is also in that location
(Geoclustering has a mechanism for being IP number blocks down into sub blocks until
either the location is known or the location is determined to be not knowable). So how
does Geoclustering get the location of the IP addresses? Individuals constantly provide
their location when they sign up for services such as Hotmail, website registrations, or
TV program guides.66 The proposers of GeoClustering suggest that with reasonable
samples, a database can be satisfactorily created to provide for the location of IP
numbers.67

                    On the Shelf
       There is geography in the Net. The above referenced techniques establish that it
was possible and predecessors have pursued the prize. If an advertising service wishing
to improve the targeting of advertisements, so that Boston advertisements are shown to
people in Boston, and advertisements in French are shown to people in France, these
services may prove useful.68 A site may have a different appearance and display different


63
  Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping
Techniques for Internet Hosts, Microsoft Research, Sec. 4 (n.d.)
http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf
64
  Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping
Techniques for Internet Hosts, Microsoft Research, Sec. 6 (n.d.)
http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf.
65
     See discussion of IP numbers, footnotes 28 and accompanying text.
66
  These examples were used by Padmanabhan and Subramanian for their database connecting IP numbers
to locations. Sec. 3.5.
67
     The authors conclude
          Our findings suggest that GeoCluster is the most promising one of the IP2Geo techniques. The
          median error distance for GeoCluster varies from 28 km for well-connected university hosts to a
          few hundred kilometers for a more heterogeneous set of clients. Importantly, however, GeoCluster
          is self-calibrating in that the dispersion metric offers an indication of how accurate a location
          estimate is likely to be. Furthermore, the sub-clustering technique is often able to infer more fine-
          grained (geographic) structure in Internet address ranges than is present in BGP routing data.
Id., Sec. 7.
68
  See Mark Ward, Net Addresses Come Down to Earth, BBC News (July 29, 2005)
http://news.bbc.co.uk/1/hi/technology/4665351.stm (noting the desire of advertisers to have geographic
location in order to make advertisements more relevant)


DRAFT
                     DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

content depending on where the site believes a visitor is from. They also may prove
useful for fraud detection.69 If, for example, the individual logging on claims to be from
Florida but the service’s database indicates the individual is in Australia, there could be a
fraud issue. Geolocation can be used for legal compliance70 and to avoid hostile
jurisdictions. If online gambling, for example, is illegal in a nation, geolocation could
improve a casino’s chances of avoiding that jurisdiction.
        These services are about probabilities, not certainty. In terms of advertising, it is
not necessary for all ads to reach the targeted audience with 100 percent certainty.
However, if the targeted audience can be improved from 50 percent to 70 percent, then
the value of those advertisements will increase. Advertisers would have an incentive to
use these products simply to improve the probability of knowing where someone is from,
without achieving certainty of knowing where someone is from.
       There are a large number of services on the market.71 A few of the better known
include Akamai’s Edgescape and Quova’s GeoPoint. Most telling perhaps is how the
services are marketed.
        Akamai markets Edgescape as an ecommerce tool designed to better capture,
retain, and convert online customers through targeted marketing strategies. Akamai
promotes the service as making web content more relevant and presented in a means
more agreeable to the individual visitor. Akamai also suggests that Edgescape could be
used to “Reduce risk of fraud and misuse by validating every end-user location and
delivering only to authorized users/geographies.”72 Akamai claims that it is able to
achieve an effective solution by leveraging its “massive server deployment and
relationships with networks throughout the world [in order to] enable optimal collection
of geography and bandwidth-sensing information.”73 Of note, the narrowest range that
Akamai represents that it could target geographically is on a zip code basis.74
        Quova is a widely regarded company that markets its GeoPoint service as a
solution for marketing, fraud, compliance, and security. Quova claims 180 customers
including Major League Baseball,75 VeriSign, and Absolute Vodka.76 The service is

69
  See Mark Ward, Net Addresses Come Down to Earth, BBC News (July 29, 2005)
http://news.bbc.co.uk/1/hi/technology/4665351.stm ("A study by credit scoring firm Experian has found
evidence of fraud in 68% of orders where the IP address was in a different state from a customer's listed
billing address.")
70
   Mark Ward, Net Addresses Come Down to Earth, BBC News (July 29, 2005)
http://news.bbc.co.uk/1/hi/technology/4665351.stm ("Stringent compliance regulations increasingly force
firms to know who they are trading with")
71
  See Cybertelecom :: Notes :: Geolocation http://www.cybertelecom.org/notes/geolocation.htm for a more
complete list of services.
72
     Akamai: Edgescape (accessed May 23, 2005) http://www.akamai.com/en/html/services/edgescape.html.
73
  Akamai: How It Works (accessed May 23, 2005)
http://www.akamai.com/en/html/services/edge_how_it_works.html.
74
     Id.
75
  MLB streams video of games in compliance with traditional broadcast blackout rules. See
http://mlb.mlb.com/NASApp/mlb/mlb/video/mlb_tv.jsp


DRAFT
                      DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

marketed as offering geographic location down to the city level.77 News reports indicate
the Quova has been able to solve the “AOL Problem,” as referenced above in the France
v. Yahoo! case.78
       An alternative product has been released promising to use wifi access points.
Skyhook Wireless has proposed a triangulation solution which uses known access points
and their mapped out locations to triangulate the location of an individual.79 Intel is
likewise reported to be testing this type of technology.80 Other solutions may simply
know the location of the access point in question – and use that location information for
anyone connecting through that access point.
        The limitation of such systems is, as always, that the location is only as reliable as
the information in the database. Where the creators of the information have no obligation
to be accurate or to maintain the information, the information in the database could have
a relative margin of error and could become corrupted. Other limitations include noisy
data and locations where only one access point is within reach (or for that matter no
access points within reach that are in the service's database). Other limitations include
moved and reconfigured networks corrupting the data used to generate geographic
location.
                                   Sample of Location Services
                             Conducted on a WiFi Net in Arlington, VA
                                        September 3, 2005


76
  Geolocation Solutions by Quova: Factsheet (accessed May 23, 2005)
http://www.quova.com/company/quova-factsheet.shtml.
77
     Id.
78
   Stefanie Olsen, Quova upgrade pins down AOL users, CNET (Feb. 13, 2002)
http://news.com.com/2100-1023-836138.html.
79
  See Marguerite Reardon, Wi-Fi used for location service, CNET (Jun. 20, 2005)
http://news.com.com/Wi-Fi+used+for+location+services/2100-7351_3-5754288.html
           The way it works is that the company has compiled a database of every wireless access point in a
           given a city. It did this by having people literally drive the streets "listening" for 802.11 signals.
           Using the unique identifier of the wireless router, it notes in the database where the access point is
           located.

           When a mobile user running the Skyhook client pops up in a neighborhood, the software scans for
           access points. It then calculates a user's location by selecting several signals and comparing them
           to the reference database. The more densely populated the area is with Wi-Fi signals, the more
           accurate the software is at locating the device.

See Skyhook Wireless http://www.skyhookwireless.com/; Skyhook Wireless Press Release,
TeleCommunications Systems & Skyhook Wireless Collaborate for E-911 July 7, 2005
http://www.skyhookwireless.com/news/press_rel_8.pdf.

80
  Michael Kanellos, Intel Experiments with Wi-Fi as GPS substitute, CNET (July 12, 2005)
http://news.com.com/Intel+experiments+with+Wi-Fi+as+GPS+substitute/2100-7351_3-
5785565.html?tag=st.rc.targ_mb


DRAFT
                      DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

Service                       Location                   Comment
DOTS                          Arlington Virginia         2 miles off82
GeoPinpoint81                 United States
                              Longitude: -77.1078
                              Latitude: 38.8783
                              Certainty: 99%
Akamai                                                   No Online Demo
Edgescape83
Digital Envoy84                                          No Online Demo
Discoveryvip.com85            cannot be located.
IP2Location86                 Va, ARLINGTON              2 miles off
                              38.8783°
                              LATITUDE
                              77.1078°
                              LONGITUDE
GeoBytes87                    United States              2 miles off
                              Virginia
                              Arlington
                              Certainty 99%
                              Longitude: -77.1078
                              Latitude: 38.8783
High Earth Orbit88            You at are located         After my input,
                              in Lat, Lon:               reflected locations
                              (0.000000,                 as Arlington, VA
                              0.000000)
Jgsoft Associates89           Cherry Hill, NJ            IP number had to be
                                                         manually entered
MaxMind90                                                No Online Demo
Quova91                                                  No Online Demo


81
     Service Objects – DOTS GeoPinpoint http://www.serviceobjects.com/demos/geopinpointdemo.asp
82
  According to Mapquest, this longitude and latitude is 2 miles away from where I was sitting at the time I
did this survey.
83
     Akamai Edgescape http://www.akamai.com/en/html/services/edgescape.html
84
     Digital Envoy http://www.digitalenvoy.net/
85
     Discoveryvip.com IP Checker http://www.discoveryvip.com/ipaddress.htm
86
     IP2Location http://www.ip-to-location.com/
87
     GeoBytes IP Address Locator http://www.geobytes.com/IpLocator.htm
88
     High Earth Orbit http://highearthorbit.com/projects/geolocation/index.php
89
     IP Address Finder, Jgsoft Associates http://www.analysespider.com/ip2country/lookup.php
90
     MaxMind http://www.maxmind.com/
91
     Quova http://www.quova.com/index.shtml


DRAFT
                      DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

Verifia NetGeo92                                          No Online Demo


                    Other Possible Geolocation information Solutions
Wireless Geolocation
GPS

                    Geography in the Application Layer versus in the Network
                    Layer
        Many of the geolocation solutions above attempt to detect location from
information within the Internet network (layer 3&4). Another solution is to maintain
location information at the application layer, and to maintain the location information not
with the user but in some off network database. The only time that the location
information would be relevant is when the application is in use. When the application in
not in use, there is no connection to the location information. When the application is in
use, the individual using the end application is assigned a data token. When the database
is queried with that data token, the database will respond to an authorized query with the
geographic location. In other words, simply because the individual in on-net, and simply
because the individual is using that application, does not mean that the location of that
individual can be derived from the individual's existence on net. The data token that the
individual carries is meaningless unless access is gained to the location database.
         For example, in the case above, the geolocation tools determined that the IP
number XXXX was in Northern Virginia. Likewise, on the telephone network, if I make
a case, caller ID reveals an area code of 703, which indicates that I am in Northern
Virginia. But with the data token for the application, for example AEV235, this token in
and of itself correlates to nothing. Thus even if one were to access the individual's device
and application, acquiring the data token93 would not reveal location information in and
of itself (of course this still begs how the database is made aware of the location of the
individual, particularly if the Internet device is mobile).
       What this shows is that limited geolocation solutions could be employed.
Geography could be known for one application that would otherwise be unknown for
other applications.

           Obstacles to GeoLocation
        While geolocation services make great promises, the need they seek to fill is proof
of the very problem. Geography is difficult to determine on the Net. That is why, if
successful, these services would be valuable. The service providers recognize the
difficulty of their task:



92
     Verifia NetGeo http://www.netgeo.com/index.htm
93
     It could be assumed that the application would also employ some level of security to protect the token.


DRAFT
                     DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

           The challenge of creating a geolocation solution arises from the fact that there is
           no single way to determine Internet geography information. Data needs to be
           gathered from a multitude of sources and the heuristics and algorithms, developed
           over time with extensive experience, must be applied in order to combine these
           streams of information and arrive at accurate conclusions. Simply using public
           registration information, scanning the Internet across multiple servers, or running
           trace routes alone will not yield results accurate enough for most business
           applications.94
The issue of the accuracy of geolocation tools has been reviewed in judicial settings, as
noted above, with some courts accepting the services as accurate, some noting
limitations, and others dismissing geolocation information is insufficient.95 The
geolocation solutions have had a varying degree of success.96
        An initial problem is that many of these technologies are new and are in the
process of being developed. In other words, these technologies are not tested and mature.
While this may be fine where an entity is merely looking for an increased probability of
knowing the location of an individual, it may be problematic where accurate location
reporting is critical.
       Some solutions rely upon local networks accurately configuring their networks
with location information.97 Local networks, however, are under no obligation to
configure their networks, accurately configure their networks, or maintain the accuracy of
the configuration with location information.
        Tunneling and Virtual Private Networks (VPN) can make individuals appear
where they are not. These are frequently employed, for example, in work environments in
order to ensure a secure connection between the telecommuting individual and the work
campus. Traffic goes from the individual, through a secure tunnel, to the employer's
network. If the individual interacts with the outside network, it will appear that the
individual is coming from the place of work and not the individual remote location.98



94
     Internet Geography Guide: A NetGeo White Paper, p. 2 (2003)
95
  See also Expert Report of Seth Finkelstein, Nitke v. Ashcroft, 01 Civ. 11476 (Nov. 10, 2003)
http://www.sethf.com/nitke/ashcroft.php (“A provider of content via the Internet cannot reasonably be
expected to know the location of readers, if the context is one in which location would lead to a denial of
the ability to read the content.”).
96
   Venkata N. Padmanabhan, Lakshminarayanan Subramanian, An Investigation of Geographic Mapping
Techniques for Internet Hosts, Microsoft Research (n.d.)
http://www.research.microsoft.com/%7Epadmanab/papers/sigcomm2001.pdf (“While none of the
techniques is perfect, their performance is encouraging. The median error in our location estimate varies
from 28 km to several hundred kilometers depending on the technique used and the nature of the hosts
being located (e.g., well-connected clients versus proxy clients).”).
97
     CUWireless
98
  This is apparently the AOL scenario, where a virtual private network is established with AOL in
Northern Virginia, and then all traffic with the Net appears as if it is interacting with AOL in Northern
Virginia.


DRAFT
                   DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

        Anonimizers likewise can distort and thwart geolocation information. An
annonymizer is a third-party-in-the-middle service between the individual and the
destination that masks the identity and the address of the individual. The destination
service will see the IP address, domain name, identity and perhaps location of the
inbetween annonymizing service and not the individual.
        Individuals launching denial of service attacks likewise may use third-party-in-
the-middle computers in order to mask their identity and location. These individuals with
infect a set of computers seeking to gain at least some control over these targeted
machines. Having gained control, these machines become what is referred to as
"zombies." The individual seeking to initiate a denial of service attack can now use the
zombies to launch the attack so that (a) the targeted service sees the address of the
zombies, not the attacker, (b) the targeted service sees multiple addresses, each carrying a
small pay load, and therefore may not initially know that it is a DOS attack, and (c) the
targeted service will have difficulty thwarting the attack simply by blocking the addresses
of the zombies as there are too many of them.
       Caching, as noted by the Supreme Court, also can frustrate geolocation
information.
         The use of "caching" makes it difficult to determine whether the material
         originated from foreign or domestic sources. Because of the high cost of using the
         trans- Atlantic and trans-Pacific cables, and because the high demand on those
         cables leads to bottleneck delays, content is often "cached", or temporarily stored,
         on servers in the United States. Material from a foreign source in Europe can
         travel over the trans-Atlantic cable to the receiver in the United States, and pass
         through a domestic caching server which then stores a copy for subsequent
         retrieval. This domestic caching server, rather than the original foreign server,
         will send the material from the cache to the subsequent receivers, without placing
         a demand on the trans-oceanic cables. This shortcut effectively eliminates most of
         the distance for both the request and the information and, hence, most of the
         delay. The caching server discards the stored information according to its
         configuration (e.g., after a certain time or as the demand for the information
         diminishes). Caching therefore advances core Internet values: the cheap and
         speedy retrieval of information.”99
         Another consideration is contexts where the individual desires, is indifferent to, or
antagonistic to providing location information. In the first and perhaps second situation,
the individual may be willing to provide location information themselves. In the second
situation, the individual may be willing to not obstruct location information. But in the
third situation, individuals may use the above techniques to obstruct location information.


99
   ACLU v. Reno, District Court case, Finding of Facts II.18. See also ALA v. Pataki, discussion
("'Caching' is the Internet practice of storing partial or complete duplicates of materials from frequently
accessed sites to avoid repeatedly requesting copies from the original server. The recipient has no means of
distinguishing between the cached materials and the original. Thus, the user may be accessing materials at
the original site, or he may be accessing copies of those materials cached on a different machine located
anywhere in the world.")


DRAFT
                   DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

For example, in a country that blocks access to certain content, individuals may use
tunnels or annonymizing service to defeat those blocks.
        Many geolocation services derive location information from the network based on
IP number and DNS registration information. One report suggests that up to seven
percent of IP numbers shift every month. Another percentage of the data base simply has
inaccurate information in it. Given the size of the IP number registration database and
given the constant revisions to the database, this method of geolocation determination
requires a high degree of maintenance in order to avoid become stale.100
IPv6
         Conversely, overly strong geolocation information can thwart the utility of the
Internet. If I desire to learn about pizza making in Italy (and I am in Northern Virginia),
it is not useful for me if the search engine fills the search result with noise about all the
great pizza delivery joints in Northern Virginia.

Implications
        Jurisdiction
      There is the forthright implication for jurisdiction that it is difficult to reliably
know where an individual is on the Internet.
         However, there is another point which I want to highlight. Classical jurisdictional
analysis tends to be a point-to-point analysis. In cases such as Volkswagen, the question
largely was, where is party A, where is party B, and did party A and party B intend to
interact with each other in each other's forum. The Internet is much more of a mesh
network with multiple points interacting with each other. What I want to suggest is that it
is at times appropriate to migrate from a point-to-point analysis to a network analysis.
        Let's look at the example of X. X seeks to interact with website X. For this to
happen, A must set up and operate the web server. A contracts with N' for network
service. B, the website creator registers a domain name with C and points the registration
to A. B subscribes to content feeds from D, ecommerce services from E, and traffic
analysis services from F. The website is created with a combination of content from B,
D, and E. B then publicizes the website with search engine G. X acquires Internet access
from N''. X seeks to find the website and queries G. G displays B's website, H's website,
and advertisements from I. X clicks on the link to the B website. X's computer queries
the domain name service J for the IP number of the website. X's computer then queries
the A server for the B website. The B website provides B's content directs X to D for the
content feed and E for the ecommerce service. A queries and receives the content from D
and E. B's website interacts with the F traffic service to provide traffic analysis. X
reviews the information received and…. And this is a simplified model of the
interaction.


100
   Mark Ward, Net Addresses Come Down to Earth, BBC News (July 29, 2005)
http://news.bbc.co.uk/1/hi/technology/4665351.stm ("In any one month, up to 7% of the 1.4 billion IP
addresses will change location.")


DRAFT
                    DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

        A successful interaction of information on the Internet involves multiple pieces
from multiple services and multiple locations. There is not a clear beginning to the
Interaction (unless it was October 29, 1969), and there is not a clear end. X is interacting
with content created long before X's interaction. X's interaction will cause a ripple effect,
like a pebble thrown into a pond, of interactions resulting from X's query.
        So what's the point? It's not clear. In different situations, with different legal
questions, the point will be different. But what is clear is to resist, or at least be hesitant
in using, a simplistic point-to-point analysis. Jurisdiction in part asks whether an event is
confined to a locale, whether it crosses state borders, and whether it crosses national
borders. On the Internet, this question begins to lose real meaning. Every interaction
involves entities from multiple jurisdictions.
      A new paradigm for jurisdictional analysis: lose point-to-point. Consider
“network” communications.

         Security
        Assume a world in which something like RFC 3825, Dynamic Host Configuration
Protocol Option for Coordinate-based Location Configuration Information is employed.
In this world, either hosts on the Internet are provided with latitude, longitude, and
latitude information, or if not, a neighbor host that is topologically near the first host is
provided that information. In this world, the Internet is providing a detailed map of the
geographic location of everything on the Internet.
       The obvious implications of this world are so disturbing that I probably need not
go on. The Internet becomes a road map for attacks.
Obviously the ability to achieve geolocation information, with specific longitude and
latitude information, could also have significant implications for the current environment
of warfare and terrorism. The anonymity of Internet communications would be degraded
and posting which cause geolocation to be divulged would have immediate targeting
implications. In addition, it could cause security issues for critical infrastructure, the
location of which is theoretically secure and unknown.

         Privacy
        The privacy concerns for geolocation information have been well documented.
These concerns are the drivers for such efforts as the IETF's GEOPRIV. Much like the
security concern, the privacy concern is that the introduction of reliable location
information into the network means creating the knowledge of the location of all things at
all times. It is the surveillance society. It is the surveillance society on steroids.101


101
    In the Surveillance Society version 1, everything that we do is under surveillance. There are cameras on
every street corner, ATM machine, and Qwikie Mart. But while the surveillance devices create records,
those records have little meaning without further forensics. Who is the person in the picture is still
unknown, without further effort. But with the Internet, an identifiable network address is associated with
all transactions. All transactions generally create a log, a record of the interaction and the identifier that
was involved in the interaction. Add to that information location based knowledge, and it is possible to
establish who, what, when, and where.


DRAFT
                 DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

        Spam
        Spam works becomes of the economics. The cost of transmission is so cheap that
a microscopic response rate is sufficient to make the effort profitable. What would the
impact be if spammers could more accurately tailor spam for the geographic location of
the recipient? What if the response rate using this could be raised from 0.2% to 2%.
Spam becomes more profitable and the amount of spam might flourish.
        Conversely, an optimist might believe that if spammers know the location of the
recipient, they will be less likely to send the spam to recipients who cannot possibly
respond to the spam. In other words, spam targeted at Korea would be sent to Korea and
not New Guinea.

The Ability to Rebuild Walls
        What do we conclude from all this? Tension!
        It is inaccurate to characterize the Internet as devoid of geography. It is
inaccurate to say that an entity categorically "cannot know the location of individuals"
with whom that entity interacts. Clearly, geography is in the network at the network
layer and can be utilized.
        However, it is also inaccurate to say that one can know the location of an
individual with certainty. For many legal purposes, legal certainty is a prerequisite. It
would not do to throw Fred into the slammer for violating local community law, when
there is no certainty that Fred ever interacted with that local jurisdiction. Likewise, it
would not do to dismiss a local action on the grounds that Fred could not possibly be
within that jurisdiction. Geographic information derived from the network lacks the level
of reliability suitable for those legal purposes that require certainty.
        Geographic information that is available is largely on the level of a probability.
Using current techniques, one might be fairly certain of the location of perhaps seventy
percent of traffic. Or one might have a 60 percent chance of knowing the location of a
particular individual. This may be excellent for certain purposes. It may do wonders for
improving the targeting of advertising campaigns. It may be quite useful in detecting
fraud, causing triggers that require further levels of authentication. But this is all it is, a
reasonable probability, which for some purposes is quite valuable.
       But all this is changing. There are projects where success mandates certainty of
geographic information. This information may be quite specific. This information may
be available only for a limited purpose and not available to other applications or
individuals. But having established reliable location information somewhere in the
network even with limited access, this access could begin to creep as further access could
become justifiable. Location information limited for emergency purposes may find itself
available for fraud detection, and then for protecting the children, and then for military
operations, and then for advertising discount coffee.




DRAFT
                    DRAFT DRAFT DRAFT DRAFT DRAFT Do not Cite.

        Whether detection of location information in the Net is a good thing or a bad
         102
thing, it should not be underestimated that this is the tail that is wagging the dog.
Reliable location information introduced into the network for relatively limited purposes
could in the end utterly transform the network. What was global and borderless, could
quickly transform into local and limited. Local bans on online access to Alice in
Wonderland,103 which previously were engagements in the futile, suddenly could become
effective measures of information control. Restrictions on interactions with foreign
infidels suddenly become quite effective.
        The introduction of geographic location information radically alters decades of
jurisprudence. It solidifies the role of local community standards. It reinvents long arm
jurisdiction. It enables Chinese walls restricting the flow of information. It empowers
the tax man. It curtails free trade. And it shuts down the "never ending world wide
market place of ideas."
       The Information Revolution is the empowerment of and interaction with all
voices worldwide. Remove the "worldwide" and the Information Revolution becomes
what the local authority with the guns permits it to be.




102
   I am not attempting to conclude that the introduction or discover of geolocation in the Net is good and
desirable, or bad and loathsome. I mere wish to elucidate the dramatic ramifications of injecting space into
cyberspace.
103
      Cite to ALA Book Censorship


DRAFT

				
DOCUMENT INFO