Links to author's official homepage and unofficial homepage.
Published at 15 Pitt. J. Law & Commerce 395 (1996).
This page has been accessed
A. Michael Froomkin{*}
Published at 15 U. Pittsburgh Journal of Law and Commerce 395 (1996)
Changes in the technology used to create, disseminate, and store information are likely to present some of the most complex challenges to lawyers, policymakers, and citizens throughout the world in the next century. Some of these challenges present broad choices; others present the more constrained, and perhaps more difficult, problem of adopting legal rules to reflect new and not always welcome technological realities. It is important to establish what choices exist, if only to navigate intelligently in the coming policy turbulence. The set of legal and policy options is shaped not just by culture, history, and politics but by the constraints of technology. This article seeks to explore the limits that technology imposes on the legal and policy options available to those concerned about anonymous communication, digital cash, and distributed databases, and the ways in which proposed limits on anonymous communication might reduce personal privacy in unexpected ways.
Anonymity lies at the heart of three interrelated problems arising from computer-aided communications over distributed networks (which I will call "the Internet" for short{1} ). First, communicative anonymity is an issue in itself: the Internet makes anonymous communication easy, and this has both good and bad consequences. Legislation to restrict anonymous electronic speech has been introduced in state legislatures and in Congress.{2} Second, the availability of anonymous electronic communication directly affects the ability of governments to regulate electronic transactions over the Internet (both licit and illicit). Third, anonymity may be the primary tool available to citizens to combat the compilation and analysis of personal profile data, although data protection laws also may have some effect also. The existence of profiling databases, whether in corporate or public hands, may severely constrict the economic and possibly even the political freedoms of the persons profiled; although profiling may not necessarily change the amount of actual data in existence about a person, organizing the data into easily searchable form reduces her effective privacy{3} by permitting "data mining" and correlations that were previously impossible. As U.S. lawyers we are most accustomed to thinking about the problems of data creation, dissemination, and access in certain delimited categories such as the First Amendment, intellectual property rules, the torts of invasion of privacy and defamation, and perhaps in the ambit of a few narrowly defined statutes such as the Privacy Act{4} or the Fair Credit Reporting Act.{5} These categories are valuable, but are collectively inadequate to the regulatory and social challenges posed by the information production, collection, and processing booms now under way.
The policy choices left open in each of these three areas--anonymous electronic speech, anonymous electronic commerce, and the conflict between data profilers and privacy-seekers--varies, and depends critically on the nature and number of the potential targets of regulation. In the course of a description of these new technologies and their possible effects, this Article will make the following arguments and assertions:
Anonymous Electronic Speech. Once Internet access becomes widely deployed it is not realistically possible for any government to monitor the content of every citizen's Internet communications, especially if cryptographic tools are easily obtained.{6} Part II suggests that the same is true of monitoring the sending of anonymous communications: So long as the tools to communicate anonymously remain widely available in other countries, there is not much that any single country can do about it. Nations could, however, make it difficult for their own citizens to provide those tools to others, and if essentially all nations connected to the Internet did this independently or as the result of a concerted effort, the result would be to make anonymous electronic communication more difficult and more risky. Whether this would be constitutional in the U.S. is, however, debatable. It is even less likely that all other major industrialized nations would agree to such a policy. If even one nation with extensive Internet connections chooses not regulate the provision of anonymizing technology, the effect is to make anonymous communication possible by all persons connected to the Internet.
Anonymous Digital Cash. Part III describes a number of competing digital cash products. It is too soon to tell which if any of these products will become widely used. Whatever products persist, national governments are likely to be concerned about digital cash because they will fear that it facilitates illicit transactions, and makes money laundering easy. While digital cash enables rapid, electronic, and even international transactions, only anonymous digital cash is likely to raise regulatory hackles since the non-anonymous variety leaves easily audited records. Furthermore, as Part III explains, different types of digital cash have significantly different implications for law and policy regarding anonymous digital commerce. Many types of digital cash do not allow anonymous transactions at all. Others allow the payor, but not the payee, to be anonymous, although digital money laundries might be able to provide two-way anonymity. Only one of the schemes discussed in Part III is designed to allow direct peer-to-peer fund transfers without the intermediation of an entity functioning as a bank, and even that system could be configured to keep records of every transaction.
Until very large amounts of untraceable anonymous currency are in wide circulation, and these funds are widely accepted for physical purchases as well as electronic commerce, the owners of electronic cash will need a means of transferring funds from electronic cash to ordinary cash. In most cases, the owners of significant sums of electronic cash will also want to invest their funds. In either case they will require the services of a financial service provider, such as a bank. Thus, at least in the medium term, governments may be able to control anonymous commerce by concentrating on financial service providers. Financial service providers are already highly regulated, and present a relatively easy target for governments seeking to prevent fully anonymous fund transfers. Regulators may also benefit from the reluctance of consumers to bank abroad, even when offered accounts denominated in their home currency. If, however, consumers become more willing to bank abroad, the ability of governments to control anonymous transactions will be reduced further, unless all or almost all governments are able to agree on common rules.
Anonymity as a Privacy-Enhancing Response to Profiling. Part IV suggests that the policy decision to limit anonymous commerce could itself have large costs. Diverse data become more valuable when aggregated. If, as tends to be the case today, the aggregations are carried out by small numbers of parties who hold the aggregated data in proprietary databases, e.g., credit bureaus and credit card companies, then it may be possible to regulate them to protect the informational privacy of citizens. The existence of these regulatory chokepoints is unlikely to last, however, because modern search techniques make it increasingly attractive to keep data disaggregated, and continuously updated, while making it searchable over distributed networks akin to the Internet. If every data supplier to the network can also become a user of the network's data, the number of parties who would have to be regulated would grow considerably. When one considers that computerized data are highly mobile, and that data can be stored or searched overseas in "data havens," the regulatory possibilities begin to seem more limited. If indeed regulation is unavailing, or unavailable for other reasons, anonymous communications and anonymous commerce may be the primary tool available to most citizens to prevent their personal data from becoming part of profiles over which they have no control, and which may limit at least their economic options. Thus, it is conceivable that an otherwise legitimate regulation on anonymous digital cash may have such extreme effects on the ability of citizens to use the Internet to receive information without having their reading habits recorded as to call into question the regulation's constitutional propriety, not to mention the wisdom, of such regulation.
Given the importance of anonymity to free speech, electronic commerce, and privacy, it is only a small exaggeration to suggest that the debate about anonymity on the Internet is in effect a debate about the degree of political and economic freedom that will be fostered, or tolerated, in a modern society.{7} Part I therefore seeks to frame the issue by quickly sketching a few of the moral and social aspects of the debate over anonymity.
I. The Moral and Social Environment
II. Free Speech Now: The Anonymous Message in the Impregnable Bottle
IV. Data Collection and Profiling: Towards the Argus State?
© A. Michael Froomkin, 1996. All rights reserved. Send comments
to froomkin@law.miami.edu.
Links to author's official
homepage and unofficial
homepage.
Published at 15 Pitt. J. Law & Commerce 395 (1996).
This page has been accessed times.
There is no consensus, nor is there likely to be, as to whether, on balance, anonymity is a good. Anonymity has both valuable and harmful consequences, and different persons weigh these differently. Some, perhaps focussing on anonymity's contribution to many freedoms, argue that anonymity's benefits outweigh any likely harms it may cause, or that the harms (e.g., censorship) associated with trying to ban anonymity are not worth any benefits that could ensue. Others, perhaps focussing on the victims of harmful actions that can be accomplished anonymously, look at anonymity and often see dangerous license. Their conclusion is that at least some forms of anonymity should be banned.
Anonymous communication is a great tool for evading detection of illegal and immoral activity. Conspiracy, electronic hate-mail and hate-speech in general, electronic stalking, libel, general nastiness, disclosure of trade secrets and other valuable intellectual property, all become lower-risk activities if conducted via anonymous communications. These activities are merely low-risk rather than no-risk because it always remains possible to infer the identity of the author of some messages from clues intrinsic to the message itself. For example, by analyzing the manifesto issued by the "unabomber," the FBI concluded that he went to class or "hovered around" a major university in the late 1970's to mid-1980's, most probably Northwestern University, the Chicago Circle campus of the University of Illinois, the University of Utah, Brigham Young University or University of California at Berkeley.{8} Similarly, the leaker of proprietary or classified data can sometimes be identified if the circle of people who had access to the information was small.
An anonymous author suggests that the most serious argument against anonymous speech is that "disclosure advances the search for truth,"{9} because when propaganda is anonymous it "makes it more difficult to identify the self interest or bias underlying an argument."{10} The author notes, however, that this argument assumes the validity of the metaphor of the marketplace of ideas, and that whether the benefit of increased information from the ban on anonymous speech outweighs the loss of the ideas whose expression the anonymity ban discourages is an empirical question that is unanswerable.{11} Justice Black, the First Amendment absolutist, thought identity disclosure requirements might enhance the freedom of speech, and suggested Congress could require the disclosure of foreign agents "so that hearers and readers may not be deceived by the belief that the information comes from a disinterested source. Such legislation implements rather than detracts from the prized freedoms guaranteed by the First Amendment."{12}
To an economist who treats markets in ideas as more concrete than a metaphor, the desire to control information about oneself can be either a final or an intermediate good. Treating privacy as a final good, however, limits the power of economic analysis, since privacy is no more than one of many elements of consumer preferences that determine her purchases when faced with the purchases that the market has to offer.{13} Judge Posner has suggested that privacy can usefully be analyzed as an intermediate good.{14} Using this simplifying assumption, Posner concluded that personal privacy is generally inefficient, since it allows persons to conceal disreputable facts about themselves.{15} This failure to disclose disreputable facts shifts costs of information acquisition (or the cost of failing to acquire information) on to those who are not the least-cost avoiders. On the other hand, Posner argues that concealment by businesses is generally efficient, since allowing businesses to conceal trade secrets and other forms of intellectual property will tend to spur innovation.{16} Posner's formulation, however, has been criticized for neglecting the strategic aspects of the individual's desire to control the release of personal information that is not disreputable.{17}
Anonymous communication also poses particularly stark enforcement problems for libel law and intellectual property law. While it may be true that a signed defamatory message carries more credibility and thus is more damaging than an anonymous one, it does not necessarily follow that an unsigned message is harmless. Most people would probably be upset to discover a series of unsigned posters accusing them of pedophilia tacked to trees or lampposts in their neighborhood. Perhaps aware that some people believe that where there is smoke there must be fire, the victim of such a libel is unlikely to be soothed by the suggestion that anonymous attacks lack credibility.{18} An Internet libel can be spread world-wide, and may be effectively indelible since it may be reproduced, and stored, in countless and untraceable numbers of computers.{19} Anonymity can also be used to reveal a trade secret. For example, on September 9, 1994 an anonymous poster sent source code purporting to be RC4, a proprietary cryptographic algorithm of RSA Data Security, Inc., to the cypherpunks Internet mailing list.{20} In most cases, a public posting will tend to reduce the value of a trade secret.{21}
Sissela Bok has argued that a society in which "everyone can keep secrets impenetrable at will" be they "innocuous . . . [or] lethal plans," noble acts or hateful conspiracies, would be undesirable because "[i]t would force us to disregard the legitimate claims of those persons who might be injured, betrayed, or ignored as the result of secrets inappropriately kept."{22} Justice Scalia believes anonymity is generally dishonorable because it eliminates accountability.{23} This damage to society's ability to redress legitimate claims is, I believe, the strongest moral objection to the increase in anonymous interaction. It is also clearly an objection with popular resonance, as a recent Wall Street Journal column critiquing the growth of anonymous communication on the Internet illustrates.{24} Even a more moderate writer, while admitting that anonymity has its place, suggests that "[p]ermitting anonymity for the purpose of removing any vestige of accountability for abusive behavior . . . is not likely to be tolerated in the Networld."{25}
Anonymity has another serious consequence. Digital anonymity exacerbates the trends that are producing a society of strangers. Strangers are people who lack the mutual and continuous monitoring associated with life in a small town.{26} Another way of putting the same point is that strangers are people about whom one has little or no information; in effect strangers engage each other as if they had complete informational privacy. A society of strangers may be one in which trust may be more difficult. "He who stands by what he has allowed to be known about himself, whether consciously or unconsciously, is worthy of trust."{27} People about whom one knows little or nothing are harder to trust; they can be feared.
Anonymous communication can thus be viewed as one part of a more general debate over the extent to which individuals should control the dissemination of information about themselves. The problem is more complex than the loss of some imagined rural idyll. Urbanization itself does not necessarily breed mistrust. Georg Simmel suggested that in many cases "external facts" about people and goods suffice to create interpersonal confidence which therefore "no longer needs any properly personal knowledge."{28} Certainly, the prevalence of trust is valuable:{29} "Trust is not the sole foundation of the world; but a . . . fairly complex society . . . could not be established without trust."{30} Anonymity, like other forms of personal control over information, threatens to make access to those "external facts" on which people rely more difficult. Unwillingness to trust strangers leads to the growth of social institutions designed to compensate for, or eliminate, anonymity--walled and monitored communities, credit checks, lie detectors, drug tests and on-the-job monitoring.{31} "Surveillance is the cost of [] privacy."{32} The reinterpretation of Fourth Amendment privacy rights via so-called regulatory searches in recent decisions such as National Treasury Employees Union v. Von Raab,{33} and Vernonia School District 47J v. Acton,{34} may be in part a response to perceived social consequences of privacy.{35} A similar impulse may motivate legislative initiatives such as Megan's Law.{36}
The objection to communicative anonymity with the most popular resonance may blend all these concerns. The combination of communicative anonymity with a powerful, global, poorly understood new medium seems to threaten people because the Internet allows strangers to reach into the same homes that are being turned into fortresses against strangers, and to allow those strangers to interact with its inhabitants (especially its children) without any risk of being held accountable for their communications. It may be that the idea of the home as a secure fortress is an illusion,{37} but it is a powerful hope.
Ironically, the same anonymity that is blamed for undermining the accountability necessary for the security of the home/fortress may turn out to be the tool that the inhabitants of that home need to level the playing field against corporations and governments that might seek to use new data processing and data collection tools in ways that constrain the citizen's transactional or political freedom. Larger and faster database processing techniques combined with the ever-increasing quantity of personal data available on individuals makes it possible for both governments and private organizations to construct personal profiles based on transactions, demographics, and even reading habits of most citizens. Since most people lack the ability to contract for privacy on affordable terms, their main line of defense against being profiled is likely to be anonymous communication and anonymous transactions.{38}
Anonymous communication may be particularly deserving of protection for its own sake. Not everyone is so courageous as to wish to be known for everything they say,{39} and some timorous speech deserves encouragement. Corporate whistle-blowers, even junior professors, may fear losing their jobs. People criticizing a religious cult or other movement from which they might fear retaliation may fear losing their lives. In some countries, even this one in some times and places, it is unsafe to be heard to criticize the government. Persons who wish to criticize a repressive government{40} or foment a revolution against it may find anonymity invaluable. Indeed, given the ability to broadcast messages widely using the Internet, anonymous e-mail may become the modern replacement of the anonymous handbill.
Communicative anonymity encourages people to post requests for information to public bulletin boards about matters they may find too personal to discuss if there were any chance that the message might be traced back to its origin. In addition to the obvious psychological benefits to people who thus find themselves enabled to communicate, there may be external benefits to the entire community. To pick just one example, public health is enhanced by the provision of information regarding communicable diseases, but many people would feel uncomfortable asking signed questions about sexually transmitted diseases, and might be especially cautious about being identified as a potential sufferer of AIDS. This caution may be particularly reasonable as data-collection technology improves: any post to a public newsgroup or bulletin board is liable to be archived and searchable, perhaps for all eternity.
Anonymous communication, whether traceable or not, fosters the development of digital personae, which may be experienced as liberating by some.{41} The option of creating such personae is likely to increase and enhance the quantity, if not inevitably the quality, of speech. In addition to increasing the quantity of speech, anonymous communication may also enhance the quality of speech and debate.{42} Communications that give no hint of the age, sex, race, or national origin of the writer must be judged solely on their content as there is literally nothing else to go by. This makes bigotry and stereotyping very difficult, and also should tend to encourage discussions that concentrate on the merits of the speech rather than the presumed qualities of the speakers.{43}
In the U.S., anonymous speech may be guaranteed by the First Amendment or whatever right to privacy exists in the Constitution. In the U.S., anonymous speech also benefits from its association with well-remembered incidents in which political actors holding unpopular views that many now accept benefitted from the ability to hide their identity. The Federalist Papers, the nation's most influential political tracts, were published pseudonymously under the name "Publius." More recently, the Supreme Court held the guarantee of free speech in the Constitution protects a right of anonymous association and that a state therefore lacked the power to compel a local chapter of the NAACP to disclose the names of its members.{44} In so doing, the Court protected the NAACP members from danger at the hands of bigots who would have had access to their identities if the state had prevailed. Anonymity basks in the glow of association with good causes.
Dissenting in McIntyre v. Ohio Elections Commission,{45} Justice Scalia summed up the case against anonymity. Anonymity, he wrote, is generally dishonorable: "It facilitates wrong by eliminating accountability, which is ordinarily the very purpose of the anonymity."{46} To create legal protection for anonymous communication absent a reason to expect "threats, harassment, or reprisals," he argued, is "a distortion of the past that will lead to a coarsening of the future."{47}
The specter of a cheap and potentially ubiquitous means of avoiding accountability for one's speech or one's possibly illicit purchases is worrying to many, and seems to be leading to increasing attempts to regulate anonymous communication, and anonymous digital cash. Pennsylvania, for example, has just passed a statute making it a crime to possess, program, or use a device which can be used to "conceal or to assist another to conceal . . . the origin or destination of any telecommunication."{48} In other cultures with a more authoritarian tradition, anonymous speech may seem even more threatening to the established order; in some places the idea of anonymous communication may also conjure up unhappy images of secret informers and malicious denunciations.
In a legal culture that tends to glorify the First Amendment as the bedrock of our freedoms, it may seem odd to suggest the possibility of controls on information creation, dissemination, or storage. And in an age where the political rhetoric, if not always the policy, is increasingly that of laissez-fair capitalism it may seem strange to suggest that governments might impose curbs on technologies that increase transactional freedom. The instinct that says all such controls are bad may indeed be a healthy one, although it is not the instinct that animates all current U.S., much less foreign, law,{49} and definitely not the instinct that animates some notorious current policy proposals.{50} The instinct is complicated, although by no means invalidated, by the global reach of the information ocean now lapping at our doorstep.{51} Our ability to police ourselves is eroded by pools and rivers of foreign data outside our shores, and by our interconnection with networks in other countries that may operate by different rules. Similarly, foreign governments with repressive tendencies may find their restrictive information policies undercut by the extraterritorial consequences of our practices.
The Internet we have today is a tool for communication, one undergoing rapid growth.{52} At present the Internet is primarily an elite tool, but it seems reasonable to suppose that access to the Internet will become almost as ubiquitous as access to the telephone network within a few years.{53} Some of the transformative effects of this explosion in Internet connectivity, particularly within the United States, are already becoming visible.
Internet communication is capable of becoming a radically democratizing tool. The Internet offers rapid and (relatively) cheap one-to-one communication both nationally and internationally. It also provides means for citizens who have a common interest to find other like-minded persons to communicate with.{54} The autobiographical bildungsroman featuring an adolescent who believes he is the only sane, intelligent, or gay person (as the case may be) in a small town, and has no one to talk with, soon may be a thing of the past.
Perhaps more importantly, the Internet promises to democratize one-to-many communication. On the World Wide Web, to take the currently most popular example, everyone is a potential publisher, and the potential readership (and listenership and viewership, since the Internet increasingly transports audio and video) grows every day. The elite nature of the contemporary Internet makes it too soon to call it a truly democratic medium. Nevertheless, as Owen Fiss himself has noted, one can reasonably hope that his warning that radical critics of the status quo find it difficult to obtain access to mass media will soon seem passXe.{55} The Internet is already becoming a significant tool of political debate and political organization,{56} and has the potential to enhance representative democracy.{57} Indeed, as group formation on a national scale becomes easier and less costly, some positive critiques of pluralism may lose some (but not all) of their force.{58}
It is yet not evident whether the Internet will be a communicative tool that will be a net benefit to democratic government or society, or even one that is truly democratic.{59} The democratization of publishing means that much more will be published, which may lead to the ultimate in narrowcasting as readers try to keep their virtual heads above a rising tide of data.{60} Talking only to the like-minded has an anti-democratic, or at least anti-communitarian, component. If the Internet becomes the town square, or the shopping mall of the future, it may be one in which millions are shouting on the same street corner while passers-by are able to tune in or out at will. Many speakers may find themselves drowned out in the cacophony, although this will be due to a decision by the listener and not, as today, a function of the limited number of speakers with access to mass media.{61} It should be noted, however, that tools exist which tend to mitigate the drowning-out effect. For example, search tools on the World Wide Web may lead readers to materials they would otherwise never find. Similarly, Bob's decision to include a hypertext link to Alice's web page functions as free advertising for Alice, which may garner her readers she would not otherwise have. Such links may function as a primitive set of reputation credentials which would bring some speakers more listeners. Interestingly, both of these examples require some action on the part of the reader; the author/publisher need do nothing more than announce the existence of the resource to the appropriate indexing services.{62}
Any proposal to regulate Internet anonymity in the United States faces two large hurdles: the Constitution and the technological constraints imposed by the international nature of the Internet. At present, however, Internet anonymity relies on a small number of unpaid volunteers who operate the anonymous remailers that make Internet anonymity possible. If many governments impose regulations banning or restricting their activities, access to Internet anonymity could become much more difficult.
Thanks in large part to the easy availability of powerful cryptographic tools, the Internet provides the ability to send anonymous electronic messages at will. As described in more detail below, the anonymously remailed e-mail cannot, if properly implemented, be traced to its sender. In addition, two or more persons can communicate without knowing each other's identity, while preserving the 'untraceable' nature of their communications. As detailed below, the availability of strong cryptography vastly enhances communicative privacy and anonymity.
Currently the Internet makes it easy to send an anonymous message. Although no tangible goods can be exchanged, this communicative anonymity allows users to engage in political speech without fear of retribution, to engage in whistle-blowing while greatly reducing the risk of detection, and to seek advice about embarrassing personal problems without fear of discovery--things that are hard to do by telephone in this age of caller ID.{63}
The traditional anonymous leaflet required a printing and distribution strategy that avoided linking the leaflet with the author. If the leaflet risked attracting the attention of someone armed with modern forensic techniques, great pains were required to avoid identifying marks such as distinctive paper or fingerprints. In contrast, on the Internet communications are all digital; the only identifying marks they carry are information inserted by the sender, the sender's software, or by any intermediaries who may have relayed the message while it was in transit. Ordinarily, an e-mail message, for example, arrives with the sender's return address and routing information describing the path it took to get from sender to receiver; were it not for that information, or perhaps for internal clues in the message itself ("hi mom!"), there would be nothing about the message to disclose the sender's identity.
Enter the anonymous remailer. Remailers vary, but all serious{64} remailing programs share the common feature that they delete all the identifying information about incoming e-mails, substitute a predefined header identifying the remailer as the sender or using a cute tag such as nobody@nowhere.{65} By employing easily automated cryptographic precautions widely available on the Internet,{66} and routing a message through a series of remailers, a user can ensure three things conducive to high-security anonymity: (1) none of the remailer operators will be able to read the text of the message because it has been multiply encrypted in a fashion that requires the participation of each operator in turn before the message can be read;{67} (2) neither the recipient nor any remailer operators in the chain (other than the first in line) can identify the sender of the text without the cooperation of every prior remailer's operator; (3) therefore it is impossible for the recipient of the message to connect the sender to the text unless every single remailer in the chain both keeps a log of its message traffic and is willing to share this information with the recipient (or is compelled to do so by a court or other authority). Since some remailer operators refuse to keep logs as a matter of principle, there is a good chance that the necessary information does not exist. Even if logs exist, it could be prohibitively expensive to compel all the operators to divulge their logs when remailers are located in different countries.{68}
Any electronic communication, even live two-way 'chat' communication, can theoretically be made anonymous.{69} In current practice, anonymous remailer technology applies to e-mail, and hence is used for communication to individuals, mailing lists, and 'newsgroup' discussions. E-mail offers the simplest case, and although e-mail remailer technology may not yet be as user-friendly as it could be, it is available to anyone who knows where to look--and can even be found on an easy-to-use World Wide Web page.{70}
It is useful to distinguish between four types of communication in which the sender's physical (or "real") identity is at least partly hidden: (1) traceable anonymity, (2) untraceable anonymity, (3) untraceable pseudonymity, and (4) traceable pseudonymity. These categories allow one to disentangle concepts that are otherwise conflated: whether and how an author identifies herself as opposed to whether and how the real identity of the author can be determined by others.{71}
To make the examples that follow clearer, in each case Alice will be the person sending an e-mail message to Bob. Ted, Ursula, and Victor will be remailer operators, and Carol a judge with subpoena power.
Electronic anonymity can be "traceable" or "untraceable." Only the latter offers real security to the speaker.
A remailer that gives the recipient no clues as to the sender's identity, but leaves this information in the hands of a single intermediary, is a system of traceable anonymity. In the simplest example, Alice sends an unencrypted e-mail to a remailer operated by Ted, with instructions to forward the e-mail to Bob. Ted's remailer deletes Alice's identifying return address and sends the message on to Bob purporting to be from "nobody@remailer.com."
Alice has no way of knowing whether Ted has logged the message, keeping a record of Alice and Bob's e-mail addresses, or indeed the entire text of the message. If Ted has done this, then Bob can find out who sent him the message by persuading Ted to tell him--or, in some cases, if the message appears to violate a law, by enlisting the aid of Carol, a judge with subpoena power. Of course, if Ted lives in another country, outside Carol's jurisdiction, there may be little that Carol can do to assist Bob in his quest to persuade Ted to reveal Alice's identity. Many countries do have agreements for judicial assistance, but these can be costly, difficult, and in many cases require that the act complained of be illegal in both nations.{72}
Although traceable anonymity offers the lowest security, it suffices for many purposes. Some messages do not require any more security than a new header. There have been occasions when I have posted messages to newsgroups and received a great deal of unwanted e-mail in reply because my e-mail signature identifies me as a law professor. One way to avoid getting requests for free legal advice, or long and vicious notes attempting to re-educate me about gun control, is to delete the signature and route comments through a remailer. That simple expedient suffices because the consequences of my being discovered as the author of my posts on legal topics are not terribly severe.
In general, however, sending a message with sensitive information directly to a remailer for immediate forwarding to the intended recipient requires an inordinate amount of trust that the remailer operator will not read or copy the message or report the sender to the appropriate authorities. I have often thought that a nice novel could be written using a crooked remailer operator as its central character: imagine that Ted opens up for business, runs a fine remailer for a few years, collects many guilty secrets, and then retires on his blackmail profits.
Much greater security, and nearly iron-clad anonymity, can be achieved at the price of somewhat greater complexity through the use of "untraceable anonymity."
By "untraceable anonymity" I mean a communication for which the author is simply not identifiable at all. For example, if Alice drops an unsigned leaflet with no fingerprints on Bob's doorstep in the dead of night when no one is looking, her leaflet is "untraceably anonymous."
Current Internet technology allows this form of anonymity by the routing of messages through a series of anonymous remailers. This technique is called "chained remailing" and is about as anonymous as directed communication gets these days. Nothing is foolproof, however: as explained below, if Alice has the bad luck to use only compromised remailers whose operators are willing to club together to reveal her identity, she is just out of luck. If one member of the chain performs, however, Alice can ensure that no one can connect her to the message Bob receives so long as she uses both encryption and chaining. Even these two techniques together may not be enough to foil a determined eavesdropper who is able to track messages going in and out of multiple remailers over a period of time. To foil this level of surveillance, which has nothing to do with the bad faith of the remailer operators, requires even more exotic techniques including having the remailers alter the size of messages and ensuring that they are not remailed in the order they are received.{73}
At the simplest level, encryption ensures that the first remailer operator cannot read the message and effortlessly connect Alice to Bob and/or the contents of the message. But encryption also has a far more important and subtle role to play. Suppose that Alice decides to route her anonymous message via Ted, Ursula, and Victor, each of whom operates a remailer and each of whom has published a public key in a public-key encryption system{74} such as PGP.{75} Alice wants to ensure that no member of the chain knows the full path of the other remailers handling the message; anyone who knew the full path would be able to identify Alice from the message Bob will receive. On the other hand, each member of the chain will necessarily know the identity of the immediately previous remailer from which the message came, and of course the identity of the next remailer to which the message will be sent.
Alice thus wants Ted, the first member of the chain, to remove all the information linking her to the message; she is particularly anxious that Ted not be able to read her message since he is the one party in the chain who will know that Alice sent it. Alice also wants Ted to know only that the message should go to Ursula, and to remain ignorant of the message's route thereafter. Alice wants Ursula, the second member of the chain, to know only that the message came from Ted and should go to Victor; Victor should know only that it came from Ursula and should go to Bob, although by the time the message reaches Victor, Alice may not care as much whether Victor can read the message since her identity has been well camouflaged.
Alice achieves these objectives by multiply encrypting her message, in layers, using Ted, Ursula and Victor's public keys. As each remailer receives the message, it discards the headers identifying the e-mail's origins and then decrypts the message with its private key, revealing the next address, but no more. If one thinks of each layer of encryption as an envelope, with an unencrypted address on it, one can visualize the process as the successive opening of envelopes, as follows:
Chaining the message
through
Ted, Ursula, and Victor means that no remailer operator alone can connect
Alice to either the text of the message or Bob. Of course, if Ted, Ursula
and Victor are in a cabal, or all in Carol's jurisdiction and keep logs
that could be the subject of a subpoena, Alice may find that Bob is able
to learn her identity. All it takes to preserve Alice's anonymity, however,
is a single remailer in the chain that is both honest and either erases
her logs or is outside Carol's jurisdiction. In theory, there is no limit
to the number of remailers in the chain, and Alice can, if she wishes,
loop the message through some remailers more than once to throw off anyone
attempting traffic analysis.{76}
Suppose Alice is a repeat participant in a broadcast medium such as USENET or a mailing list. She may not wish to sign her name to her messages, but she desires to engage in discussion and debate with other list members and she wishes to do so under a continuous identity. Alice decides to sign her messages as "Andrea." Alice could, however, have chosen to sign her messages as "Frank," on the theory that this might allow her to avoid anti-female discrimination. Indeed, either sex can masquerade as the other; children as adults (and vice-versa). If nothing else, this creates some potential for embarrassment, and concerns some parents.{77}
Like fully anonymous messages, pseudonymous messages come in two varieties: traceable and untraceable. The advantage of traceable pseudonymity is that it gives the sender a consistent name that allows other parties to send replies far more easily than is possible with any untraceable system.
Traceable pseudonymity is communication with a nom de plume attached which can be traced back to the author (by someone), although not necessarily by the recipient. While a traceable pseudonymous system makes it much easier for someone to discover Alice's identity, it usually offers one large compensating advantage: the recipients of Alice's message can usually reply to it by sending e-mail directly to the pseudonymous e-mail address in the "From:" field of the message. The message will then either go to Ted, the remailer operator, who keeps an index of the addresses that link Andrea to Alice, or in the case of commercial service providers who allow subscribers to use pseudonymous IDs, directly to Alice's account.
Anon.penet.fi, probably the best-known "anonymous" remailer, is in fact merely a very user-friendly traceable pseudonymous remailer:
[Anon.penet.fi] provides a front for sending mail messages and posting news items anonymously. As you send your very first message to the server, it automatically allocates you an id of the form anNNN, and sends you a message containing the allocated id. This id is used in all your subsequent anon posts/mails. Any mail messages sent to your-id@anon.penet.fi gets redirected to your original, real address. Any reply is of course anonymized in the same way, so the server provides a double-blind. You will not know the true identity of any user, unless she chooses to reveal her identity explicitly.{78}
The anon.penet.fi system keeps a record of each user's e-mail address. The security of the approximately 8,000 messages that pass through anon.penet.fi daily{79} thus depends critically on the willingness of the operator, Johan Helsingius, a Finnish computer scientist, to refuse to disclose the contents of his index which maps each pseudonymous ID to an e-mail address. In February 1995, the Church of Scientology successfully enlisted the aid of the Finnish police, via Interpol, to demand the identity of a person who had, the Church of Scientology claimed, used anon.penet.fi to post the contents of a file allegedly stolen from a Scientology computer to a USENET group called "alt.religion.scientology." In compliance with Finnish law, Helsingius surrendered the information, believing that the only alternative would have been to have the entire database seized by the police.{80}
The social institution of traceable pseudonymity, which is permitted by a number of commercial Internet providers, is likely to generate some interesting lawsuits. Many commercial ISPs and on-line service providers, such as America OnLine for example, allow users to use any unique name they like as their "user ID," their on-line identifier. When my brother opened an account with an ISP, he used our family name for his account. As a result, when my parents set up an Internet account with the same service provider they were forced to select something different. Their ID is an amalgam of their first names. They could, however, have chosen any combination of letters and numbers they wanted so long as their ISP had not already assigned that name to someone else. Whether the ISP will release my parents' actual name to anyone who asks is primarily a question of contract law until a subpoena is involved. When people think they have been defamed or otherwise injured by the actions of a user who employs a pseudonym, the party claiming injury is likely to ask courts to require the ISPs to disclose the identity of the subscriber, at least when the ISP is in an accessible jurisdiction.
Untraceable pseudonymity works just like untraceable anonymity, except that Alice chooses to sign her message as Andrea, a pseudonym. If Alice is worried that someone else may try to masquerade as Andrea, she can sign her message with a digital signature{81} generated specially for "Andrea," which will uniquely and unforgeably distinguish an authentic signed message from any counterfeit. By participating in discussions under a consistent pseudonym (often abbreviated to "nym" on the Internet) Alice can establish Andrea as a digital persona:
[N]yms allow for continuity of identity to be maintained over a period of time. A person posting under a nym can develop an image and a reputation just like any other online personality. Most people we interact with online are just a name and an e-mail address, plus whatever impression we have formed of them by what they say. The same thing can be true of nyms. Cryptography can also help maintain the continuity of the nym, by allowing the user to digitally sign messages under the name of the nym. The digital signature cannot be forged, nor can it be linked to the True Name of the user. But it makes sure that nobody can send a message pretending to be another person's nym.{82}
Strictly speaking, a digital persona does not require untraceable anonymity: it is sufficient to have a system that allows one to communicate under a "nym" and to digitally sign one's messages in order to prevent anyone else from masquerading as the nym.{83} "Publius," the author of the Federalist Papers, was known to "his" publisher, and a digital persona can exist even if the persona's ISP knows the persona's real identity. Nevertheless, a nym may have more value, or at least may be experienced as more liberating, if the identity of the person(s) behind the persona is untraceable.{84}
While the technological alternatives described above have their own interest, the most important point for present purposes is that very effective Internet anonymity requires only two things: cryptographic tools, and willing remailer operators. The cryptographic tools are in ready supply.{85} If the user deploys the cryptographic tools properly, the remailer operators need not be known to be trustworthy; since the message is untraceably anonymous if any single operator in a chain is honest, it will ordinarily suffice to route the message through several remailers. The more remailers in the chain, however, the longer it may take the message to get to its destination,{86} and the greater the chance that an operator in the chain will fail to pass the message on down the line.{87}
The supply of remailer operators is the major potential constraint on Internet anonymity.{88} Remailer programs are currently operated by a relatively small number of volunteers located in a few countries; at present they receive no compensation for this service, and in the absence of anonymous electronic cash or the equivalent{89} it is difficult to see how an electronic payment system could be constructed that would not risk undermining the very anonymity the remailers are designed to protect.
The remailer operator's problem is a simple one. No remailer operator can control the content of the messages that flow through the remailer. Furthermore, the last remailer operator in a chain has no reliable way of concealing the identity of the sending machine from the message's ultimate recipient. Suppose, to return to the example above,{90} Alice wants to send an anonymous death threat to Bob via remailers operated by Ted, Ursula, and Victor. If Victor does nothing to mask his e-mail address, Bob will know he was the last to remail the message. Victor can make any attempt to identify him more difficult by forging his e-mail address in the message to Bob, but Victor cannot be certain that this will work. Indeed, he can be almost certain that over time it will fail.{91}
The last remailer in a chain thus risks being identified by an unhappy recipient. An identifiable person is a potential target for regulation. If the remailer operators were made strictly liable for the content of messages that passed through their hands, even though they were unable to learn the content of those encrypted messages, most reasonable people probably would find running a remailer to be an unacceptable risk if they resided in a jurisdiction capable of enforcing such a rule.
Remailer operators already have come under various forms of attack, most recently lawsuits or subpoenas instigated by officials of the Church of Scientology who sought to identify the person they allege used remailers to disseminate copyrighted and secret Church teachings.{92} As a result, operating a remailer is not a risk-free activity today. Indeed, one can imagine a number of creative lawsuits that might reasonably be launched at the operator of a remailer. Examples include a new tort of concealment of identity, a claim of conspiracy with the wrong-doer, and a RICO claim. A remailer operator whose remailer was used to harass someone might face a common law tort claim of harassment. A conspiracy charge would be difficult since it would difficult the prove the element of agreement that is a necessary part of a conspiracy. It is difficult to say that Bob conspires with a stranger, even if he leaves a tool lying in plain sight, knowing that criminals are likely but not certain to come by and use it. If Bob is really ignorant of the identity, content, and purposes of the messages he retransmits, he can plausibly say that there is no agreement between him and the conspirator, and that he should no more be liable for the misuse of his remailer than the rental car company that leases a car to a terrorist. A RICO claim against a remailer could also founder on the lack of agreement.{93} Although it is far from obvious that any of these legal theories would or should succeed, some raise non-frivolous issues and thus would be expensive to defend.
At some point, if the number of remailers becomes small, it becomes technically (if not necessarily politically or legally) feasible for the authorities to conduct traffic analysis{94} on all the remailers and make deductions about who sent what to whom. In the absence of a compensation mechanism, or a jurisdiction capable of offering a safe haven for remailers, the cornerstone of Internet anonymity currently relies entirely on the kindness of strangers.
The ease with which anonymous electronic communication lends itself to unaccountable libel, conspiracy, and other harms has led to some calls for regulation;{95} as use of the Internet grows and more users learn about cryptography and remailers, one can reasonably expect calls for regulation to increase. It seems reasonable to ask if such regulations would be constitutional.
The United States Constitution does not guarantee a right to be anonymous in so many words. The First Amendment's guarantees of free speech and freedom of assembly have, however, been understood for many years to provide protections for at least some, and possibly a great deal of, anonymous speech and secret association. As already noted, the Federalist Papers were written pseudonymously.{96} In 1958, the Supreme Court upheld the right of members of the NAACP to refuse to disclose their membership lists to a racist and surely vengeful state government,{97} a decision that I imagine almost every lawyer in the US would endorse today--at least on its facts. Simultaneously, however, the United States has nurtured a deep-seated fear of conspirators and conspiracy,{98} with the McCarthyite witch-hunts of the 1950's being only one of the more lurid examples.
Doctrinal discussions of permissible restrictions on the freedom of speech commonly divide the discussion into "political" and "non-political" speech, and the sketch which follows adopts this convention. The division into two categories tends, however, to obscure alternate and perhaps more valid ways of describing the extent of the government's power to impose restrictions on speech. In particular, the standard doctrinal approach tends to reify a debatable distinction between purportedly high value and lower value speech. The categories "political" and "non-political" themselves may be overlapping and ultimately unhelpful. For example, outrageous, even obscene, speech can be political.{99} And if the personal is indeed the political all categories collapse into one.
Political speech receives the highest constitutional protection because it "occupies the core of the protection afforded by the First Amendment;"{100} other types of speech, notably "commercial speech," sometimes receive a reduced level of First Amendment protection. Core political speech need not center on a candidate for office, but can affect any matter of public interest--especially if it is an issue in an election.{101}
The Supreme Court has repeatedly noted the existence of a "profound national commitment to the principle that debate on public issues should be uninhibited, robust, and wide-open,"{102} which would presumably include protections for anonymous speech. Indeed, McIntyre v. Ohio Elections Commission, the Supreme Court's most recent opinion on the right to anonymous speech, states that "an author's decision to remain anonymous, like other decisions concerning omissions or additions to the content of a publication, is an aspect of the freedom of speech protected by the First Amendment" and "the anonymity of an author is not ordinarily a sufficient reason to exclude her work product from the protections of the First Amendment."{103} Despite these ringing words, whether there is a right to be anonymous in the US remains unclear as a general matter, since difficult cases are precisely those in which exceptions are made to fit facts that sit uncomfortably within the rules that apply "ordinarily."{104}
Broad prohibitions of anonymous political speech, such as ordinances prohibiting all anonymous leafletting, are an unconstitutional abridgment of free speech.{105} The Supreme Court has also tended to be highly solicitous of the need of dissidents and others to speak anonymously when they have a credible fear of retaliation for what they say. Thus, the Supreme Court has struck down several statutes requiring public disclosure of the names of members of dissident groups.{106} Nevertheless, the right to privacy in one's political associations and beliefs can be overcome by a compelling state interest. The state interest in forbidding discrimination in places of public accommodation has been held to be sufficiently compelling to meet this test, at least when the objectives and remedies were sufficiently narrowly tailored to achieve the result when examined with strict scrutiny.{107} In contrast, the recent McIntyre decision found that the state's "interest in preventing fraudulent and libelous statements and its interest in providing the electorate with relevant information" was insufficiently compelling to justify a ban on anonymous speech that was not narrowly tailored.{108}
Not even political speech is immune from regulation. Despite its privileged position, political speech can be regulated given sufficient cause, especially if the regulation is content-neutral, as a regulation on anonymous speech would likely be. An example of sufficient cause is the state interest in ensuring compliance with campaign finance contribution limits. For example, in Buckley v. Valeo,{109} the Supreme Court upheld a statute forbidding donations of more than $1,000 to a candidate for federal office, and compelling disclosure to the Federal Election Commission of the names of those making virtually all cash donations.{110} Since the Court in the same decision essentially equated the expenditure of money in campaigns with the ability to amplify political speech,{111} the decision appears to say that given a sufficiently weighty objective, and a statute carefully written to minimize the chilling or otherwise harmful effects on speech, even political speech can be regulated.{112}
Similarly, in First Nat. Bank of Boston v. Bellotti,{113} the Supreme Court struck down a state requirement forbidding corporations from making political contributions except for ballot measures directly affecting its business, but it contrasted the unconstitutional state law with others that it suggested would surely be acceptable: "Identification of the source of advertising may be required as a means of disclosure, so that the people will be able to evaluate the arguments to which they are being subjected."{114} Indeed, the Communications Act requires licensed television and radio stations to identify the sponsors of paid political advertisements at the time the ad is broadcast.{115} Indeed, the licensee has a duty to "exercise reasonable diligence" in identifying the true sponsor of political advertisements.{116}
The implications for the regulation of anonymity--even in the context of political speech--are obvious, and were not lost on the Supreme Court of California, which in Griset v. Fair Political Practices Comm'n recently upheld a state statute forbidding anonymous mass political mailings by political candidates.{117} The facts involved a political dirty trick: Griset had sent a mass mailing attacking his opponent and pseudonymously purporting to be from a neighborhood association. The court concluded that prospective voters could have been deceived into thinking that Griset had "grass roots" support.{118} The California court reasoned that this sort of deception was the evil that the statute was designed to cure, and that the ban was necessary to further the state's interest in "well-informed electorate" at election time and was "narrowly drawn to meet that goal."{119} The Court therefore distinguished Griset from federal Supreme Court decisions, such as Talley, supra, Bates v. City of Little Rock,{120} and NAACP v. Alabama,{121} which held that the First Amendment freedom of association limited the state's ability to pierce an organization's anonymity. One could perhaps read Griset as concerning the mis-use of pseudonymity rather than anonymity. The argument would be that there is a greater harm to the political process from a false statement of support by a non-existent "citizen's group" than from an anonymous source, since the latter's secrecy puts readers on notice that the author could be anyone. While this approach is attractive, and probably constitutional, neither the opinion nor the statute makes a distinction between a false statement and one that fails to identify the author.
Quite possibly the Supreme Court would uphold a narrowly tailored statute prohibiting anonymity even in the context of political speech if the statute had clear and palatable objectives. This possibility seems all the more real when one considers the contexts in which the Supreme Court has already sustained limitations on the privacy of individuals engaged in the political process, particularly the Buckley decision.{122} Indeed, the D.C. Circuit upheld the constitutionality of the Communications Act requirement that paid political radio and television broadcasts include the name of the sponsor, and the Court denied certiorari.{123}
Once down this slippery slope of regulation it is notoriously difficult to find a logical place to stop.{124} A particularly difficult case might be a statute that sought to ban all anonymity in political campaigns on the theory that if the message is not signed with the actual name of the author, it is impossible to know whether it originated in a political campaign, and thus constitutes actionable lies about an opponent, or potentially violates campaign finance expenditure limits. This would juxtapose the Talley-McIntyre line of cases with the Buckley-Griset line of cases. Without forcing everyone to sign their messages there may, it could be argued, be no way to monitor what campaigns spend, and thus no way to ensure they do not seek to get an edge by spending beyond the legal limits.
In the glow of McIntyre's rhetoric about the importance of anonymity to the political and literary tradition, it is all too easy to think that anonymity in cyberspace would surely triumph. Yet there is reason to doubt, especially because in McIntyre Justice Stevens himself carefully distinguished earlier cases upholding statutes that sought to preserve the integrity of the voting process, e.g., Burson v. Takushi.{125} Additionally, statutes designed to attack the enforcement problems caused by anonymous libelous or electronic violations of intellectual property rights might be in a particularly good position to survive judicial review. As a constitutional matter, the issue is far from resolved.{126}
As ringing a defense of the First Amendment as the Talley and McIntyre decisions may be, they involved political speech. At most, therefore, they merely suggest the outcome for cases involving anonymous speech that is not "political speech" and also not one of the areas of general public concern such as religion, art, or literature, that commentators usually include within the rubric of so-called "core" First Amendment speech.{127} It is also important to understand that the anonymity cases decided by the Supreme Court involved very broadly drafted statutes aimed at political speech, and that the Supreme Court has carefully left open the question whether a statute regulating (or prohibiting) anonymous speech would survive review if the statute were narrowly tailored, e.g., to "provid[e] a way to identify those responsible for fraud, false advertising and libel."{128}
Restrictions on anonymity are more likely to be sustained if they focus on types of non-political speech that have tended to receive the lowest protection. Although in McIntyre the Court found that the state's "interest in preventing fraudulent and libelous statements and its interest in providing the electorate with relevant information" was insufficiently compelling to justify a ban on anonymous speech, the weighing might produce a different result if there were some way to tailor it to types of speech that ordinarily receive less protection, such as commercial speech.{129}
Despite some scholarly suggestions that the First Amendment should apply with undiluted force,{130} "commercial speech" tends to be subject to greater regulation.{131} Restrictions are more likely to be upheld if they appear plausibly tailored to strike at illegal non-political non-speech "conduct"{132} particularly when the speech "incidentally" burdened is non-political. And restrictions are most likely to be upheld when the speech burdened falls into the ill-defined, and predominately salacious, category of speech that is for all practical purposes disfavored.
An example of the latter is the stringent anti-anonymity provisions that appear in the Child Protection and Obscenity Enforcement Act of 1988,{133} as amended by the Child Protection Restoration and Penalties Enhancement Act of 1990{134} (collectively, "the Act"). The workings of the Act are worth examining in some detail because the Act has been upheld by the D.C. Circuit,{135} and risks setting a precedent for future legislative attempts to restrict anonymous non-political speech. The Act attacks anonymity by requiring that producers of certain kinds of speech ascertain and record information about performers' identities (the "ascertainment requirement"), and that producers affix a notice disclosing their own identity and address (the "disclosure requirement").
The Act's ascertainment requirement is far-reaching. All producers of visual depictions of certain types of "actual sexually explicit conduct"{136} have a duty to "ascertain"{137} the legal name and age of every performer so depicted by examining the performer's photographic{138} "identification document."{139} The Act defines "producer" broadly to include everyone "from photographers to printers to page layout artists."{140} It includes all those involved in the production process of "any book, magazine, periodical, film, video tape or other similar matter" and all those involved in their creation, duplication, reproduction, or reissuance after November 1, 1990.{141} However, the definition of "producer" excludes "mere distribution or any other activity which does not involve hiring, contracting for managing, or otherwise arranging for the participation of the performers depicted."{142} (Whether, given this limitation, the Act applies to a person who posts "visual depictions" made after November 1, 1990 of "actual sexually explicit conduct" to a World Wide Web site is an interesting question, one that may turn on whether the act of posting a picture or movie on the Web is exempt "distributing" or covered "duplication, reproduction, or reissuance.")
In addition to ascertaining the performer's real name and age, the producer must also ascertain all aliases "ever used" by the performer including "maiden name, alias, nickname, stage, or professional name," and maintain records of all affected performers cross-indexed by their aliases.{143} A producer who knowingly fails to maintain these records, or knowingly includes inaccurate information, can be punished by a fine and up to two years imprisonment; second and subsequent offenses can result in up to five years imprisonment.{144}
Although the Act does not create penalties for performers who mislead an unwitting producer,{145} one practical effect of the ascertainment requirement is to make it difficult, perhaps impossible, for effected performers to perform anonymously. The District Court accepted that the Act "is overly burdensome because it will invade the privacy of adult models and discourage them from engaging in protected expression. . . . Many of the artists and adult models engaged in sexually explicit visual imagery have an interest in maintaining their anonymity. Exposure of their true names, aliases, and addresses could subject them to stigmatization, harassment and ridicule from others."{146} On appeal, however, the D.C. Circuit dismissed this argument on the grounds that producer's records are disclosed only to the Attorney General or her delegate, and to producers and publishers further along the chain of production. Judge Buckley asserted, without apparent support in the record, that "we may safely assume that the performers are not concerned over the prospect of being stigmatized, harassed, or ridiculed by the producers they help enrich."{147}
Another practical effect of the Act's ascertainment requirement is to make it impossible for (re)producers to use affected images unless the (re)producer is in direct contact with a producer earlier in the chain of production who had direct contact with the performer, because producers later in the chain of production can discharge their record-keeping obligation only by contact with the performer or with a "primary" producer who was in direct contact with the performer.{148} As a result, it is now potentially a criminal violation to use affected images when the model is unknown or anonymous, regardless of the model's age.{149}
The Act's second attack on anonymity is its disclosure requirement. Affected producers must affix to "every copy" of the covered materials a statement identifying the producer's business premises or other location where the producer can be found, and must maintain the ascertained records at that location.{150} It is a felony for the producer to fail to affix this information, and a felony for any person, whether or not they are a producer, to sell, give, or offer to sell or give{151} any visual depictions of the relevant "actual sexually explicit conduct" which does not have an affixed statement describing where the required records may be located.{152}
Under the Act, therefore, neither performers nor primary producers of affected materials can be anonymous. The D.C. Circuit held that the Act is nonetheless consistent with the First Amendment because it imposes content-neutral burdens on speech, and those burdens are designed to achieve a significant legislative goal.{153} Writing for the panel majority, Judge Buckley suggested that the record-keeping requirement was no more a content-based burden on speech than were the zoning ordinances restricting the location of "adult" theaters that the Supreme Court upheld in City of Renton v. Playtime Theaters.{154} In Renton the Supreme Court stated that intermediate scrutiny sufficed when a statute burdens speech because of its subject matter rather than its viewpoint. As a result of Renton, "an otherwise content-based restriction on speech can be recast as 'content neutral' if the restriction 'aims' at 'secondary effects' of the speech."{155} The distinction between viewpoint and content neutrality is extremely significant, because the Supreme Court has repeatedly held that "viewpoint neutrality" (in which all speakers on a given subject are discriminated against equally) does not equal content-neutrality,{156} and only content-neutrality is entitled to be judged by the more lenient standard of "intermediate scrutiny" rather than the most exacting standard, strict scrutiny.
Judge Buckley used Renton in ALA v. Reno to suggest that the Child Protection Act was content-neutral because it aimed at one of the secondary effects of visual depictions of actual sexually explicit conduct (i.e., child pornography) rather than the speech itself.{157} Buckley argued that the Act was no less content-neutral than the zoning restrictions on adult theaters upheld in Renton. If subjecting theaters to more stringent zoning because they show blue movies was not a case of viewpoint neutrality deserving strict scrutiny but only a case of content-neutrality deserving intermediate scrutiny,{158} why, Buckley essentially asked, should the Act be any different? The panel majority further relied on the Supreme Court's earlier statement that when speech and non-speech elements are combined in a single course of conduct, "a sufficiently important government interest in regulating the nonspeech element can justify incidental limitations on First Amendment freedoms."{159}
Having found that the Act was a content-neutral regulation that had only an incidental effect on First Amendment rights, Judge Buckley applied intermediate scrutiny and concluded that the Act was constitutional because it furthered the compelling governmental interest of combating child pornography.{160} The dissent countered that the statute was overbroad and would in any case have at most a negligible effect on child pornography because underage actors would get phoney IDs, and because the Act in its own terms{161} precludes the use of the producers' records directly or indirectly in a child pornography prosecution,{162} a limitation presumably designed to address Fifth Amendment concerns.{163} The Supreme Court denied certiorari.{164}
The D.C. Circuit's ruling in American Library Ass'n is significant because it permits an anonymity ban to extend to non-commercial, non-political speech on the grounds that the regulation seeks to combat a social harm and only incidentally burdens speech.{165} In theory, if the government's interest in combatting the effects of child pornography is sufficient to justify the Act's effects on adult performers and those who produce materials containing their visual images, it might be equally constitutional to require that at least non-political messages on the Internet include information sufficient to allow a libel victim to trace the source of the defamation.{166} Nor is it difficult to imagine how one might make similar arguments to defend the prohibition on anonymous faxes that Congress passed in 1991 in order to protect consumers from junk faxes.{167}
The Supreme Court has yet to go so far. The District Court in ALA v. Reno found it easy to distinguish the Act from the facts of Renton; Judge Buckley held that Renton controlled. If Judge Buckley was right, which is itself debatable,{168} the problem is Renton: as many commentators have noted, Renton's conclusion that distinctions aimed at controlling the "secondary effects" of speech are content-neutral and thus require only intermediate scrutiny is at best manipulable and at worst ridiculous.{169} Nevertheless, unless eroticized speech is a very special form of "low-value speech"{170} an attempt to control anonymous non-political speech might fall within the Renton rule, and thus withstand intermediate scrutiny if the measure were backed by a sufficiently weighty governmental purpose. In this context, Professor Tribe's suggestion that the Supreme Court "is beginning to construct a multi-level edifice with . . . categories of less-than-complete constitutional protection" for expression characterizable as "commercial speech . . . offensive speech . . . defamation and possibly the speech of public employees" seems particularly accurate--and ominous.{171}
Despite suggestions to the contrary, the Internet carries a high volume of non-eroticized, and indeed political, speech.{172} As a practical matter, therefore, it would be exceedingly difficult, and probably impossible, to craft a ban on anonymous speech on the Internet that distinguished between political and non-political speech and yet was enforceable. Since remailer operators will ordinarily be unable to decrypt the messages that they are forwarding, the operators themselves will be unable to tell whether the message is core First Amendment speech or unprotected obscenities.{173} A ban on anonymous speech cannot therefore meaningfully distinguish by subject matter, nor can it necessarily even distinguish between visual depictions and mere words.
Any meaningful attempt to ban anonymous Internet speech must therefore either attempt to ban it all, or craft some more limited rule that has the same result.{174} A straightforward banning of all anonymous speech is so far from being narrowly tailored to achieve the public purposes (preventing harmful messages from being forwarded or frustrating legitimate law enforcement attempts to trace threatening messages or the plans of conspiracies) that it does not seem likely to survive even cursory review. On the other hand, Renton might provide a model for achieving the same end in a different way. If, for example, remailer operators were made strictly liable for carrying messages that are used to conduct terrorist operations, perhaps on a Renton theory that some categories of speech have harmful secondary effects, the result would be to force all remailers in the jurisdiction to close since the operators would have no other way to protect themselves from the liability. This hypothetical strict liability statute would be vulnerable to the accusation that it discriminated against points of view that dare not speak openly, and its constitutionality is far from certain, but it is certainly more likely to be found constitutional than a straight ban on anonymous messages.{175}
Given the international nature of the Internet, however, even a clever attempt to ban anonymous remailers one jurisdiction at a time may be ineffectual. Even if every remailer in the U.S. stops operating, there is nothing to stop U.S. citizens from sending and receiving messages via foreign-based remailers--at least not yet. The continuous and conspicuous use of remailers and the equivalent might even be seen to create a reasonable expectation of privacy for Fourth Amendment purposes, thus reinvigorating a part of the Constitution which otherwise appears to be heading towards desuetude.
The Internet is an increasingly multi-national phenomenon. Other countries that lack a First Amendment may desire solutions to the perceived dangers of anonymous communication that are more or less restrictive than those suggested by U.S. law, which itself remains unclear in important respects. Remarkably, however, the reality of the Internet is that the technology for sending e-mail messages anonymously is already in use both here and abroad: the whole world can now enjoy (or suffer) the fruits of anonymous remailers located anywhere. The Constitutional status of anonymous electronic speech remains important: if the U.S. will not or constitutionally cannot ban anonymous remailers, then they will be available for the entire Internet to use. Even if the U.S. attempts to ban anonymous remailers, and even if the Constitution allows this, U.S. law may not be determinative because, as it now stands, the Internet as a whole is not easily amenable to any nation's control. While it is probably within the physical power of the U.S. government to prosecute Internet remailers based in U.S. territory, the government appears to lack the power to deny U.S. residents the benefit of remailers located abroad, although it can certainly raise the costs of getting caught.{176}
The Internet is an international packet switching network and its messages are carried over telephone lines.{177} Short of cutting off one's own international telephone service or concluding an international agreement with all industrialized countries to discontinue telephone service to foreign countries that harbor remailers there is little that one can do to keep out messages from any other country, or indeed to keep citizens from sending messages wherever they like.{178} If the government of Ruritania is intent on preventing communication with Great Britain, Ruritania might attempt to require that Ruritanian ISPs refuse to accept messages from computers whose domain name identified them as British. British domain names frequently end with the characters ".uk" and Ruritanian routers might be required to return all messages from those domains. Even if this is technically feasible, such a strategy is unlikely to succeed. First, there are generic domain names such as ".com," ".org," and ".net" that do not identify the country of origin. Second, unless Ruritania has currency and other controls, there is nothing to stop Ruritanian users establishing an account in the U.S. and telnetting to it to access British data.{179} Third, short of a robust international convention, there is no way that Ruritania can prevent people outside Britain from running remailers that "launder" messages from Britain and present Ruritanian computers with acceptable domain names. In short, any effort to censor the Internet organized at the national level (or below) is likely to fail.{180} As John Gilmore put it, "the Net interprets censorship as damage and routes around it."{181}
U.S. law currently imposes few if any legal restrictions on anonymous remailing.{182} U.S. rules can thus be viewed as a baseline; any country with a more restrictive approach to anonymity can expect to see it undermined by the U.S. rules unless it is willing and able to cut itself off from the Internet entirely.{183} Similarly, should the United States's rules change to restrict anonymity, as they might some day, these new rules will themselves be undermined by persons in any another country with adequate connectivity and a legal regime more congenial to anonymous communication.{184} The proponents of measures to eliminate Internet anonymity are thus likely to find themselves in the position of the counselors to King Canute.{185} Indeed, to the extent that foreign countries with good Internet connectivity such as the Netherlands and Finland already have more permissive rules, those rules effectively undercut the United States' ability to enforce what rules it has.
The difficulty that governments have in reigning in free speech on the Internet or in living with its consequences is particularly visible in the uneasy relationship that several Asian governments have with the Internet. Only North Korea and Myanmar have chosen to remain completely aloof from it.{186} The Vietnamese government overcame its concerns about free movement of information and allowed a small academic and scientific network, "NetNam," to operate, because the government saw the Internet as the "fastest, cheapest way" to improve communications with the rest of the world.{187} The Vietnamese government then apparently had second thoughts about unregulated communications, and decided to set up its own system, using hardware purchased from a US telecommunications company, Sprint. The new system, which is likely to displace NetNam, will have a greater capacity but the government hopes that it will also be controlled more tightly "for technical and security reasons [and] from the cultural aspect."{188} The government intends to keep out foreign pornography and other harmful information sent by foreign organizations.{189} A government spokesman admitted, however, that the government was uncertain as to how it would achieve these goals, but he promised that the government intended to "think about it."{190}
Meanwhile, in Singapore, the government has promised penalties for anyone caught transmitting pornographic or seditious matter.{191} It has also ensured that its point of view will be represented in a Usenet discussion group, soc.culture.singapore, frequented by its critics. Government spokespersons routinely post messages giving the government's side of issues.{192} Overall, however, the government has chosen to control Internet access since, despite its best efforts, it cannot figure out how to control content:
The Singapore government knows that it cannot do much to censor the Internet. But it refuses to give up without a fight.
The main control is to limit access--the rationale being that only the determined would get at the materials and not the casual users.
. . . .
Singapore's case is instructive in that it is trying to both control information and yet benefit from the Information Age. Current thinking suggests that it is difficult, if not impossible, to achieve both aims. Nevertheless, Singapore is trying.{193}
As part of its campaign against Internet pornography, the Singaporean government searched the files of users of Technet, one of Singapore's major Internet providers. A scan of 80,000 files with a ".GIF" extension found five pornographic files, resulting in warnings to their owners.{194} Foreign companies with offices in Singapore worried that the Singaporean government would search their data too in the hopes of finding confidential corporate e-mails, and the government had to promise them that it would not do it again.{195}
Just as nations are unable to control the content of Internet speech, so too will they be unable to prevent anonymous communication. This inability to enforce a ban on anonymous Internet communication is not an unmitigated disaster, Justice Scalia's warnings notwithstanding.{196} Although it will impose real costs in untraceable libel, hate speech, and (perhaps) theft of intellectual property,{197} easily available anonymous communication also spells the end of restrictive national policies regarding information. Any government that allows its citizens to become a part of the global electronic network will be forced to live with a freedom of speech even greater than that contemplated by the authors of the First Amendment. The Singaporean example suggests that the ability of even a very authoritarian government to restrict access to the global information network is limited because businesses believe that the value of unrestricted access to these communications is very high.
Even so, governments are not yet powerless. Governments have it within their power to impose some costs, at least in ease of use, on those who wish to communicate anonymously. If banned in one country, anonymous remailers can be found abroad. A country that wishes to ban mail to or from foreign anonymous remailers will find it hard to detect unless it expends great resources monitoring all national traffic. The expenditure will need to be great because it is difficult to distinguish between ordinary mail and mail to anonymous remailers unless the government either bans encryption or maintains a very up-to-date list of foreign remailers. Even an encryption ban is difficult to enforce since some forms of encrypted text are hard to distinguish from other common file formats.{198} Governments have demonstrated that they are capable of acting in concert to seek to control activities such as money laundering which they perceive as a common threat, although the effectiveness of these measures is debated.{199} International actions in this domain include the Vienna Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances{200} regional agreements,{201} a number of mutual legal assistance treaties between the U.S. and other nations,{202} and the creation of a Financial Action Task Force including most of the world's major economies.{203} As yet, there appears to be no equivalent movement to control anonymous remailers, but it is not inconceivable.
The prime effect of a single government's attempt to ban anonymous messages will be to make anonymous communication far less easy to use if one is concerned about getting caught. Loss of ease of use is a significant factor, because the harder a computer technique is to use, the fewer people will use it. Furthermore, the more difficult a computer technique, the more users will make sloppy mistakes that could lead to their being detected.{204} Criminalization drives use at least partly underground, much like the attempt to control drugs has no doubt reduced, but in no way eliminated, the use of marijuana and narcotics in the U.S. and other countries.{205}
Widespread access to anonymous communication, even if the communication carries some risk, means that citizens armed with computers will be able to criticize their government--and their neighbors--with less fear of retribution, and will have increased access to messages from around the world giving alternative points of view. Meanwhile, at this writing there is little or no risk involved in using a chain of anonymous remailers, and only a little technical skill is required. As a result, rules seeking to control the export of information such as the International Traffic in Arms Regulations (ITAR) will become even more difficult to enforce.{206} So long as anonymous remailers exist, rules seeking to limit the importation of "subversive" or "obscene" speech become impossible to enforce consistently while the recipient country remains connected to the Internet. Like it or not, we live now in an age of completely free speech, of one limited and anonymous type, for everyone with access to a computer.{207}
A great number and variety of businesses have announced plans for or prototypes of Internet-based commercial activities. As many as fifteen percent of consumer purchases may be electronic by the turn of the century.{208} Internet commerce seems poised to evolve in two complementary directions, which one might call ordinary commerce in tangible things and information commerce.
In the case of ordinary commerce in tangible things, many transactions that are currently carried out by telephone, ordinary mail (e.g., catalog sales), and even in person, may shift to the net. The shopping mall of the future may be on line, and offer everything from video product demonstrations and recorded customer testimonials to technical specifications for the product. Interactive sales may allow merchants to question customers as to their needs and budgets and then guide them to particular products;{209} the products could be manufactured to the customer's size, color, and other specifications based on the customer's specifications. It may even be possible to haggle with the merchant's computer about the price.{210}
>From the most practical standpoint, the challenge of Internet commerce is of conducting business via a medium that excels at moving information, but provides a very insecure means of communication. It is not always possible to be certain that persons are who they claim to be, nor is it certain that no one is eavesdropping. Digital cash promises to solve the problem of moving value, but it is too early to say which if any type of digital cash is likely to find wide acceptance in the marketplace. In the mean time, consumer transactions are being conducted by credit/debit card.
In the short run, credit and debit cards provide the simplest, if not necessarily the ideal, means of transferring value over the Internet. These Internet credit card{211} transactions can usefully be divided into three categories:
(1) The customer e-mails the merchant her credit card details (or fills out a form on a World Wide Web page), much as a person currently sends such information through the ordinary mail. Although there is some risk that this information might be copied en route, particularly if the message originates on Ethernet systems that are vulnerable to in-house packet sniffing, to date such theft of credit card details seems rare at most. The customer's liability for fraudulent use in such cases is subject to the same $50 limit as with any other credit card transaction.{212}
(2) The customer encrypts the credit card data before sending it, e.g., with PGP or with Netscape's Secure Sockets Layer (SSL) protocol. Subject to the constraint that a determined attacker armed with enough computers and time can always break some of the shorter codes in use, this reduces the risk that the credit card details will be copied by a third party. (Other risks include the danger that the cryptographic system is flawed, badly implemented, or used on an insecure platform, e.g., one which stores the data in an insecure manner.)
(3) The customer enters into an agreement with a third party such as First Virtual Holdings, in which the credit card data is transmitted to the third party by some other means. In the case of First Virtual, an early entrant to this market, each transaction is also confirmed by e-mail;{213} in other cases, the customer may be issued some identifying data, such as a PIN or a public-private key pair{214} with which to digitally sign messages. In both cases participating merchants clear transactions through the third party before the charge is posted to the customer's credit card.
In all three categories, the customer needs to have a valid debit/credit card, e.g., Visa, or MasterCard, to make the transaction work. The charges are sent to the bank, or appear on the credit card, and are settled between the buyer, the seller (or the third party) and the card issuer as if the customer had used the card to buy something in an ordinary transaction.
Despite the variety of options, however, the transfer of ordinary commerce in tangible things from existing retail channels to distributed network sales is likely to raise relatively few new legal problems, although there is no reason to expect any of the existing problems associated with retail sales to disappear.{215} Indeed, ordinary Internet commerce in tangible things may remain well suited to credit card sales, particularly if the customer's potential liability for fraud remains fixed at $50.{216}
In contrast to ordinary commerce in tangible things that simply moves to the Internet, the sale of information is likely to be transformed. This transformation will bring new legal and social problems in its wake, or at the very least amplify old ones.{217} Although today access to most World Wide Web pages is free and open to anyone with a browser, this may change once the pioneers on the information ocean begin creating exclusive economic zones in their virtual real estate and limiting access to users who have either purchased a password for access or have browsers that are pre-configured to pay charges, perhaps up to a pre-defined limit, for access to World Wide Web pages. Web pages are ideally suited to micro-transactions, in which the reader is charged a trifling fee--a penny or less--for each access,{218} so long as the process of payment can be seamlessly integrated into browsing tools. At present, minute charges such as a tenth of a cent cannot economically be processed through existing credit card systems{219} and this seems unlikely to change in the near future. Thus, a digital means to transfer value, preferably one that does not require the participation of a third party such as a credit bureau or credit card issuer, will be required before micro-charges can become part of the new information economy.{220} It is clear that the potential for growth of Internet information commerce is enormous, and that the high fixed costs of credit cards transactions makes them particularly unsuited for high-volume low-value transactions.
Cryptologists have worked out methods for creating and transmitting tokens of value--the digital equivalent of cash and checks--over a network like the Internet. This "digital cash," also known as "electronic cash," "E$," or "e-cash," will allow buying and selling goods or services over the Internet. Any digital cash system vastly expands the commercial possibilities of the Internet, particularly if the system has low transaction costs. With low transaction costs, pay-per-view/pay-per-byte systems in which pennies or less are charged to view an article or picture on the World Wide Web become a real possibility.
Depending on which protocol is adopted, the transaction may or may not result in a record of the buyer's participation in the transaction being maintained by either the seller or the bank. Digital cash can leave the audit trail of a credit card purchase, or can provide greater anonymity than paper currency. Without some form of anonymity built into digital cash, however, each payment creates the possibility of a record which, when combined with other similar records, becomes a detailed consumer profile. If digital cash replaces credit cards for ordinary commerce in tangible things, the consequences of this profiling may be no more severe than those caused by the use of credit cards today. If, however, the availability and ease of use of Internet commerce causes consumers to shift cash sales to Internet credit card sales or traceable digital cash, the effect will be to increase the amount of information available on the consumer's buying habits.
If consumers use a traceable payments mechanism for the purchase of information as well as goods, the potential for consumer profiles grows larger still. If Internet tools such as the World Wide Web become a major national and international communications medium with an embedded micro-charging mechanism, every newspaper article accessed, every online catalog perused, every political debate sampled, will leave an information residue. These data can be collected to form a highly detailed profile of the consumer-citizen. The existence of such detailed dossiers on spending and intellectual preferences would be unprecedented.{221}
We are at a very early stage in the development of Internet commerce. Most payment products and protocols are somewhere between the drawing board and the street; few are beyond their field tests. No standards have emerged, but many large financial corporations and banks are preparing to provide consumer electronic financial exchange products.{222} Each of these implementations requires that decisions be made about inevitable tradeoffs between security, anonymity, cost, and ease of use.
Let us assume that the digital cash is to be provided by a bank,{223} and used in a real-time transaction between Alice, a customer, and Bob, a merchant.{224} In a real-time transaction Alice buys information (software, news, art, the right to view a Web page) on-line. There may be only seconds between Alice's proffer of payment and her expectation that Bob will deliver the goods; Bob must confirm the validity of Alice's payment immediately, or run the risk that there will be little he can do if Alice has cheated him. An Internet transaction might of course take many other forms, and these too receive occasional mention in what follows. The transaction could, for example, be a catalog sale transaction in which Alice places an order, makes a payment, and Bob waits until payment clears before shipping the goods. In this model, Bob's risk that the payment will be bad is relatively low since he need only fail to ship the goods.
Because the digital cash is represented by a series of bits, and there are few things in this life easier to copy than bits, the bank is going to be very anxious to ensure that any copies of the digital cash created by Alice or by Mallet, a hostile third party,{225} will be unspendable, or at least very easy to detect. The bank wishes to prevent, or at very least detect, attempted double-spending of digital cash in order to avoid having to pay twice, and ideally it also wants to be able to figure out who the double-spenders are in order to have them prosecuted for fraud. For example, if the bank's communication with Alice is not encrypted, Mallet might eavesdrop on Alice's telephone line and record the digital cash as it is transmitted and then try to spend it before Alice does. And even if the communication with Alice is secure, the bank wishes to make sure that Alice herself cannot spend a coin more than once.
Bob, the merchant, wishes to be able prove that Alice authorized the transaction, in order to ensure that Alice will not attempt to deny it later ("non-repudiation"). Bob also wants an assurance that Alice has the funds to pay for the transaction, and that the bank will transfer them to him.{226} In some circumstances Bob may also wish to avoid revealing the fact of the transaction. Meanwhile, Alice wishes to ensure that unauthorized payments are impossible, that Bob cannot deny having received her payment, that the fact of transaction is private, and that there is some redress available if Bob defaults or delivers shoddy goods. In some cases, Alice wants the transaction to be fully anonymous--not even Bob should know Alice's identity; in such cases, however, Bob will want to ensure that Alice remains unable to disavow the obligation to pay.{227}
If the transaction is entirely electronic, each of the parties will need a mechanism to ensure the other parties will pay what is required. In a world where fraud is possible, or the transaction has any non-instantaneous aspects (e.g., a warranty, the possibility of product liability suits, the possibility that a party might attempt to repudiate the payment) the parties will want some assurance that the other parties are who they claim to be: bank, Bob, and Alice (the owner of the digital currency). Identity authentication, however, is by far the easiest aspect of the electronic transaction, as it can easily be achieved with digital signatures.{228}
Digital cash can be stored in any one of a number of places: in the financial institution's computer, in Alice's and Bob's computers, or on smart cards carried by the customer and the merchant.{229} The digital cash may be backed by actual funds, or it may not. Depending on the system used, if Alice and Bob hold the digital cash, the bank may issue it in the form of digital "coins" which must be aggregated to reach the total amount of the purchase, or Alice and Bob may hold it in a digital account on a smart card which is debited and credited as needed. The system may require that all transactions are cleared by the issuer, or it may allow funds to circulate freely between customers and merchants.
What follows attempts to be a representative sample of the types of digital cash currently being developed. Few of the digital payment systems discussed below allow unlimited direct transferability between holders of electronic funds: with the single exception of the Mondex digital purse model, in all of the digital coin models the recipient of an electronic payment must always return to the bank for a new coin before being able to spend it, although it is theoretically possible for users to modify at least one digital coin payment scheme to allow the coins to be transferred among third party without returning to the bank.{230}
One simple, albeit costly, electronic payment strategy that meets the bank's security needs, but not necessarily all of Alice and Bob's, is to require that every transaction between them be cleared through the bank at the time of the transaction. The highest-security version of this model is not really digital cash at all, and is modeled on debit cards: the bank requires Bob, the merchant, to contact the bank on-line at the time of payment in order to transfer the funds from Alice's account to Bob's account. If Alice has insufficient funds, the bank refuses to allow the transaction. If the client has the funds, they are transferred from the client's account to the merchant's account at time of sale. An alternative form of this model has the "bank" replaced by a clearing service that forwards the payment instructions to the ordinary banks previously selected by members of the scheme.{231}
Alice's and Bob's identity can be verified using unforgeable digital signatures, making the chances of a fraudulent or repudiable transaction remote so long as both parties carefully protect the passphrases (longer, alphanumeric, versions of bankcard PIN numbers) that access their accounts. There is no danger of double-payment or duplication of digital currency because no digital currency ever leaves the banking system.
One disadvantage of this approach is that on-line verification introduces both delay and expense into the transaction akin to that of ordinary credit cards. The transaction costs associated with the debit-card paradigm make it unsuited for low-value/very-high-volume transactions.