Article

Internet kiosks and the law

Pay-per-use Internet is one of the oldest and most established segments in the industry. But are there big-picture legal ramifications that operators may not have considered?

June 7, 2005 by James Bickers — Editor, Networld Alliance

In the early days of the Internet, a public access kiosk was a dream come true for countless users. They were hearing all of the buzz about this great new online frontier, but prices on broadband service (or perhaps even dial-up) were still out of their range. And the era of "a computer in every home" is still fairly new.

So what could have been better - for both user and operator - than a kiosk that lets everyone have Internet access, paying only for how much they use?

By anybody's measure, the application has been a success. Summit Research Associates estimated 195,000 Internet kiosks on the ground in 2000, with a forecast of 600,000 by the end of 2005. The report also said that Internet kiosks could be a $750 million industry by the end of the year.

But as public libraries and school systems have learned, offering unfettered access to the information on the Web comes with its own hazards. And while the industry hasn't seen major legal stumbling blocks so far, that doesn't mean caution isn't called for.

"There are plenty of open legal issues facing any person or any application that connects with the Internet," said Andrew Konstantaras, executive director of the Internet Law & Policy Forum.

Potential pitfalls

Given the multifaceted nature of the Internet itself, it is not surprising that public Internet access offers up a similarly complex array of potential hazards to the operator. According to Konstantaras, Internet kiosk businesses need to be wary of three chief issues: laws aimed at protecting children, relationships with law enforcement, and "intermediary liabilities."

When it comes to dealing with children, the Child Online Privacy Protection Act comes into play.

"The Federal Trade Commission has shown it is committed to prosecuting companies that violate the COPPA," he said, "so to the extent the kiosk application solicits any type of personal data from a user, it should make sure that it either has a way of complying with regulations like COPPA or proving that such laws do not apply to their products or services."

For the second issue, he advises operators to plan ahead for issues that might be down the road. For instance, if someone commits a crime using an Internet kiosk, it is not hard to imagine law enforcement wanting to involve the company that provided the service.

What's Important Internet law is an emerging field, and there is much room for future interpretation when it comes to liability and responsibility. "Terms and conditions" sign-on screens are one of the ways Internet kiosk companies attempt to indemnify themselves. Internet kiosks should be very thorough when it comes to cache- and cookie-clearing; time-out settings and activity monitors also help protects users, which in turn protects the company.

"If such kiosks become the preferred method of criminals to access the Internet, you can bet the police will use the broad powers they already have to get the kiosk operator involved in their investigations," he said. "Such involvement can cost operators substantial time and money, so finding ways to minimize your expenses in complying with subpoena requests will be time well spent."

"Intermediary liabilities" also calls into question the access that was provided, and if it allowed someone to do something inflammatory or illegal.

"Such liability might arise in the context of copyright violations, libel, hate speech or even criminal activities," he said. "The question usually comes down to what did you allow people to do, was it reasonable to let them do that and was the ultimate wrong that was committed predictable enough so that you should have planned for it."

It's not hard to imagine any number of legal repercussions that might stem from this. In much the same way that file-sharing companies like Napster were sued for facilitating copyright violation - even though the network in question wasn't doing anything wrong - companies that offer Internet access in a public space might question their ultimate role in any unsavory activity that is committed via those connections.

What to do?

So what are Internet kiosk operators doing in the face of such potential risks?

In many cases, users of the kiosks must agree to a "terms and conditions of use" screen before they can log on. According to Michelle Pillers, managing partner for Kirland, Wash.-based Advanced Internet Access, this solution is in place in a number of the company's installations for Best Western hotels.

Such an agreement might be thought of as a "bare minimum," but Jeremy Zaretsky, spokesperson for Fort Lauderdale, Fla.-based WireSpring Technologies, said the kiosk itself needs to also take some basic precautions to make sure users remain protected from one another.

"It would seem to me that kiosk operators need to take at least some minimum number of precautions, such as an idle timer that clears session info, cookies, and history, to make sure that personal information is not kept indefinitely on the unit after the user departs, even if they leave abruptly," he said.

For many, this leads to a concern bigger than, say, a libel lawsuit: what if someone uses an Internet kiosk, visits their online bank but forgets to clear the cookies and cache, and becomes a victim of identity theft as a result? Who exactly is to blame?

It's a tricky question, and one with no clear answer. According to Konstantaras, kiosk operators need to tread very carefully, as even well-intentioned measures can have unexpected results.

"Is installing Â… defensive software enough? It depends, enough for what? If the question is, is it enough to limit all liability, well, that is something you will probably never get a lawyer to say," he said. "It can go a long way to reducing most of the risk.

"However, installing defensive software and not updating it frequently may get you in more trouble than not installing it in the first place. By installing it you are implicitly saying that the software is necessary and you have some responsibility to protect the system and your users. If you do not install it properly or if you do not update it as required or recommended, you might be held accountable for either creating a false sense of security or derelict in the duty you implicitly acknowledged when you loaded the software."

Talk about it! Click here to visit our discussion board and share your thoughts on this topic.

About James Bickers

---

None

Connect with James: