Voting machine showdown
A leading maker of computer election equipment defends itself in court against charges that it overreached itself in trying to stifle critics.

By Farhad Manjoo

Feb. 10, 2004  |  SAN JOSE, Calif. Diebold, one of the nation's leading manufacturers of computerized voting machines, faced off against some of its critics on Monday in U.S. District Court. But this time, the question at issue wasn't whether the machines could be hacked, but whether Diebold was abusing the principles of free speech in an attempt to quash the critics.

Late in the summer of 2003, Diebold found itself at the center of a white-hot controversy over the trustworthiness of the American democratic process. For several months, activists and academics concerned about the security of touch-screen voting systems had closely scrutinized the company, and they'd found much to worry about: Diebold's voting machines were said to be full of security flaws, and its CEO turned out to be a major supporter of George W. Bush. Then, activists found what they called the smoking gun a stash of thousands of internal e-mail messages that appeared to prove that Diebold was up to no good.
 

In the e-mail messages, which were quickly posted on left-leaning sites across the Web, Diebold engineers seem to acknowledge that their products aren't very secure, and they appear to discuss methods of hiding the problems rather than fixing them. The documents were, naturally, extremely embarrassing to Diebold, which had always maintained that its engineers were the paragon of professionalism, and the firm moved quickly to stifle their publication.

The company claimed that its internal messages were property protected by the Digital Millennium Copyright Act, and it sent out dozens of cease-and-desist letters to Web sites and Internet service providers (ISPs) involved in the publication of the documents. The company targeted not only ISPs that hosted sites that posted the messages but also ISPs that hosted sites that merely linked to the documents, and even ISPs that provided Internet service to other ISPs that hosted sites that linked to documents.

In court on Monday, the Electronic Frontier Foundation and other guardians of digital civil liberties argued that Diebold went too far. By hastily sending out cease-and-desist letters, Diebold abused the powers of the DMCA, EFF attorneys said. Even though Diebold ultimately withdrew its threatening letter to ISPs and promised not to sue anyone "for copyright infringement for the non-commercial use of the materials posted to date," the plaintiffs argued that Diebold ought to be punished for initially attempting use copyright law to stifle speech. "We think it's important that the court make it clear that if you misuse the powers the DMCA has granted copyright holders, there are going to be serious consequences," said Cindy Cohn, EFF's legal director, in an interview before the hearing.

For critics of the long reach of the DMCA, the EFF's argument is an attractive one. In recent years, copyright law has been used to "chill" many instances of seemingly legitimate, First Amendment-protected speech everything from research papers showing the vulnerabilities in music copy-protection schemes to Harry Potter-inspired erotic fan fiction. (The Chilling Effects Clearinghouse, run by the EFF and several universities, documents this trend.)

But Diebold argued at the hearing that its actions were not obviously beyond the pale. Temporarily chilling speech, it suggested, is a right that Congress has sanctioned in copyright legislation, and Diebold acted well within the DMCA when it sent takedown notices to ISPs. Under the law, said Robert Mittelstaedt, Diebold's attorney, a firm can ask providers to remove content as long as they have a reasonable sense that the content is copyrighted. Because Diebold did not "make a knowing misrepresentation" that its content was protected by the DMCA, it should not be liable for any damages stemming from its letters, he said.

In the case, the EFF is representing the Online Policy Group, a San Francisco ISP that provides Internet services to hundreds of nonprofit groups, including the San Francisco Indymedia site, which published several links to other sites hosting the Diebold memos last fall. On Oct. 10, Diebold sent OPG a letter demanding that it remove the links. For technical reasons, OPG could not just remove the links it could only pull down the entire Indymedia site, which officials at OPG thought was an overreaction to a simple link. Diebold also sent a cease-and-desist letter to Hurricane Electric, a firm that provides what's known as "upstream" Internet access to OPG meaning that Hurricane is essentially OPG's ISP. For similar technical reasons, Hurricane also could not force Indymedia to remove the offending link; it could only block Internet access to OPG, meaning that Indymedia as well as every other site hosted by OPG would go dark, all for a simple link.

The EFF argues that because Diebold was never going to publish and sell its internal discussions, the company's copyright claims on the e-mails were obviously weak, and that the activists who published the e-mails were acting within their "fair use" rights. Diebold ought to have investigated whether the activists had a legitimate fair-use claim before it sent out the takedown notices, Cohn argued; its rash action suggested that it was more interested in stifling speech than in pursuing a legitimate DMCA claim.

"What happened at Diebold was, they said, 'Hey, there's this embarrassing stuff online,'" Cohn said in an interview. "So their lawyers said, 'Here's this easy way to get them down we don't have to go to a judge, we just say they're copyrighted.' Diebold says, 'Sure, that's cheaper.' What we'd like to have interjected in that conversation is a lawyer saying, 'Wait a minute, we don't have a valid copyright claim.'" EFF asked the judge to make Diebold pay the OPG's attorneys fees and other damages as a way to deter other firms from too quickly reaching for the DMCA.

At the center of this case is the question of whether it should have been obvious to Diebold that its copyright claim was weak. Diebold argues that it isn't obvious that the people who posted the material online had a fair-use right to do so. There is, for instance, no fair-use right to publish documents that are judged especially important to the public good, and publishing all of the e-mails (rather than excerpts from them) might also have run afoul of fair-use doctrines. Diebold's claim was not frivolous, Mittelstaedt said, "therefore no damages."

Diebold could very well be right. The firm might reasonably have decided that activists had no fair-use right to publish the company's internal discussions but if Diebold is correct, and it turns out that the DMCA does, as the company asserts, give a company the right to shut down hundreds of Web sites just to get at one hyperlink, that by itself would be a damning commentary on current copyright law.

The judge in the case, Jeremy Fogel, seemed troubled by this prospect but was also deferential to Diebold's view that what it did was within the law. Fogel said he'd try to issue his decision within a month or two.