Home | Databases | WorldLII | Search | Feedback New Zealand Yearbook of New Zealand Jurisprudence

Svantesson, Dr Dan Jerker B --- "The legal implications of geo-identification" [2006] NZYbkNZJur 18; (2006) 9 Yearbook of New Zealand Jurisprudence 277

Last Updated: 24 April 2015

The Legal Implications of Geo-identification*

Dr Dan Jerker B. Svantesson^#

i. intrOdUctiOn

Location may determine whether a person falls within the jurisdiction of a particular state, it may determine which law is applicable to a person’s conduct, and it may determine whether or not a judgment can be successfully enforced. Indeed, it could be said that, as far as private international law is concerned, location almost always matters. However, until recently it was often said to be impossible to link those active on the Internet to a geographical location (“geo-identification”). This is all changing. A recent survey revealed that a large number of companies, particularly in the US, seek to identify the geographical location of those who visit their websites. Further, the courts’ perception of the possibility (in some cases) or impossibility (in other cases) of geo-identification has been determinative in several court cases.

This article aims at providing a basic overview of so-called geo-location technologies, their technical structure and their legal and regulatory implications.

ii. the cOntext

While geo-location technologies can be used for a wide range of purposes, such as fraud detection, authentication, content targeting, security and network efficiency, this article focuses on their use for regulation compliance and for risk-exposure limitation. It is not rare for website operators to be forced to defend themselves in foreign courts under foreign laws. The reason for this is that currently many, not to say most, countries’ rules of private international law are focused on the location of the effect of conduct, rather than on the location of the conduct. For example, The High Court of Australia ruled that a resident of the Australian state Victoria was allowed to sue a US based

* This article is based on Dan Svantesson, ‘Geo-location technologies and other means of placing borders on the ‘borderless’ Internet’ (2004) Vol XXIII John Marshall Journal of Computer & Information Law 101-39.

# Assistant Professor, Faculty of Law Bond University, Queensland, Australia. Research Associate, Cyberspace Law and Policy Centre - Contributing Editor, World Legal Information Institute (www.worldlii.org) - National Rapporteur (Australia), Data Protection Research and Policy Group (The British Institute of International and Comparative Law).

publisher in Victoria and have Victorian law decide the dispute, based on the fact that allegedly defamatory material, on the publisher’s website, was available to people in Victoria.¹

As the geographical reach of a website operator’s legal risk exposure ordinarily is, at least, equal to the geographical reach of the website itself, it is obviously valuable for website operators to be aware of the geographical location of the people who access their website. If a website operator can know the location of those who access the website, he/she can, due to the reactive nature² of a webserver, control what material is presented, and indeed, accessible to each access-seeker. In addition to business advantages, such as targeted advertisement, a structure allowing for geo-identification has the advantage of providing the website operator with the means to comply with local regulations. Indeed, as the provided content can be adjusted depending on the access-seekers geographical location, geo-identification has the advantage of providing the website operator with the means to comply with multiple, varying, and even contradictory, local regulations. The value of this cannot be emphasised enough in a world where substantive laws vary considerably from state to state, but material may be accessible from every state where Internet connection is possible.

1 Similar reasoning, in the context of online defamation, can, for example, be found in the British Harrods case (Harrods Ltd. V Dow Jones & Company Inc. [2003] EWHC 1162 (QB)), the Canadian Bangoura case (Bangoura v Washington Post (January 27, 2004), OSCJ

03-CV-247461CM1) and the Investasia case (Investasia Ltd and Another v Kodansha Co

Ltd and another HKCFI 499 (18 May 1999)) from Hong Kong SAR.

2 A web server’s function is most accurately described as reactive (A term, to my knowledge, first used by Roger Clarke in Clarke, R., ‘Defamation on the Web: Gutnick v. Dow Jones’ at http://www.anu.edu.au/people/Roger.Clarke/II/Gutnick.html (last visited May 25, 2004). The content of a website is not constantly broadcasted, or even available in any humanly comprehensible format, but at the moment the server receives an access-request, the content becomes available – the server reacts to the browser’s request/action. Describing the web servers’ role as reactive is, further, preferable as it indicates active steps of both the one imparting the information and the one receiving the information (i.e. the receiver acts and the sender reacts).

iii. the technOLOgy

Currently, the most relevant form of geo-location technology is based on the translation of IP addresses³ into geographical locations, by the use of information stored by the provider of the geo-location service. The figure below illustrates a common model of how this form of geo-location technology is applied:

3 There is currently approximately 1.3 – 1.6 billion IP addresses in use, out of the 4.25 billion possible addresses that can be issued under the four block range from 0 to 255. See further: van Leeuwen, A., ‘Geo-targeting on IP Address: Pinpointing Geolocation of Internet Users’ Geo Informatics (July/August, 2001); Olsen, S., ‘Geographic tracking raises opportunities, fears’ CNET News.com, Nov. 8, 2000; and Spangler, T., ‘They Know – Roughly – Where You Live’ eWEEK, Aug. 20, 2001.

As the access-seeker enters the appropriate Uniform Resource Locator (“URL”)⁴ into his/her browser, or clicks on the appropriate hyperlink, an access-request is sent to the server operating the requested website. As the server receives the access-request, it, in turn, sends a location request (e.g. forwards the access-seeker’s Internet Protocol (“IP”) address)⁵ to the provider of the geo-location service. The provider of the geo-location service has gathered information about the IP addresses in use, and built up a database of geo-location information.⁶ Based on the information in this database, the provider of the geo-location service gives the website server an educated guess as to the access-seeker’s location. Armed with this information, the web server can provide the access-seeker with the information deemed suitable (e.g. a message along the lines of: “Sorry. This website is intended for the people of Sweden only,”⁷ or perhaps provide advertisement specifically targeted at people from the access-seeker’s particular location). There are currently several products on the market utilising this type of systems.⁸ This technology is not necessarily prohibitively expensive for larger website operators, nor does it appear particularly difficult to operate.⁹

4 “[URL], Abbreviation of Uniform Resource Locator, the global address of documents and other resources on the World Wide Web. The first part of the address indicates what protocol to use, and the second part specifies the IP address or the domain name where the resource is located.” http://www.webopedia.com/TERM/U/URL.html (last visited May 25, 2004). For more details, see, e.g., Chappell, Laura A. & Tittel, Ed Guide to TCP/IP (2002) 271.

5 See further http://searchwebservices.techtarget.com/sDefinition/0,,sid26_gci212381,00.

html (last visited May 25, 2004).

6 The methods of collecting this information are discussed below.

7 For example, when using a computer at University of New South Wales (Australia), to access Showtime’s website, http://www.sho.com (last visited May 25, 2004), I received the following message: “We at Showtime Online express our apologies; however, these pages are intended for access only from within the United States.”

8 See, e.g., http://www.quova.com/ (last visited May 25, 2004), http://www.akamai.com/ (last visited May 25, 2004), http://www.caida.org/tools/utilities/netgeo/ (last visited May 25,

2004) and http://www.digitalenvoy.net/ (last visited May 25, 2004). See also the following geo-location products that can be tested for free online:

http://www.perl-studio.com/iptocountry/index.php (last visited May 25, 2004), http://www. activetarget.com/livedemo.asp (last visited May 25, 2004), http://www.ip2location.com/free. asp (last visited May 25, 2004) and http://www.geobytes.com/IpLocator.htm (last visited May 25, 2004).

9 The author does not have sufficient information, and is anyhow not qualified, to independently

assess the accuracy of these products. But, for example, Geobytes’ product is available from

$500 US per annum, appears easy to operate (see demo: http://www.geobytes.com/demo. htm (last visited May 25, 2004)), and the producers argue that the product is accurate to

97% on country-level and 75-80% on city-level. See further: http://www.geobytes.com/

(last visited May 25, 2004).

The accuracy of these products is, however, difficult to gauge. While the providers indicate the potential accuracy to be very high, “over 99% at a country level and approximately 92% at a city-level,”¹⁰ it should be remembered that they are after all trying to sell a product, and these impressive figures have been criticised.¹¹ There is a range of factors affecting the accuracy of geo-location technologies. Due to the dual nature of the geo-location process, these factors can be divided into two categories: ‘source problems’ and ‘circumvention problems’.

The source problems are the problems associated with building up and/or collecting accurate geo-location data. In relation to IP addresses, there is no real equivalent to the address registers listing physical addresses, or the phone registers listing phone numbers, at least not currently. Consequently the ones creating databases of geo-location information must rely on other, less straightforward, methods. Obviously, the accuracy of the material in the geo-location databases depend on, and can never be better than, the accuracy of the collection of that data. Common methods of collecting relevant material include, for example, gathering data from registration databases,¹² network routing information, DNS systems, host name translations, ISP information and Web content.¹³ As discussed in detail by Edelman, all of these sources may provide inaccurate information.¹⁴

Turning to circumvention problems, it can be noted that, while some circumvention techniques are technologically advanced (e.g. deep linking to streaming video content without accessing the HTTP server),¹⁵ others are easy enough to be used by virtually anyone (e.g. ‘anonymising’ techniques)¹⁶

10 Digital Envoy product sheet (on file with the author).

11 Information Technology Association of America, ECommerce Taxation and the Limitations of Geolocation Tools, at http://www.itaa.org/taxfinance/docs/geolocationpaper.pdf (last visited May 25, 2004), 6.

12 I.e. Réseaux IP Européens Network Coordination Centre (http://www.ripe.net (last visited May 25, 2004)), American Registry for Internet Numbers (http://www.arin.net (last visited May 25, 2004)), Asia Pacific Network Information Centre (http://www.apnic.net (last visited May 25, 2004)) and Latin American and Caribbean IP address Regional Registry (http://lacnic.net (last visited May 25, 2004)).

13 See, e.g., ‘Internet Geography Guide – A NetGeo White Paper’ (can be requested from:

http://www.netgeo.com/ (last visited May 25, 2004)).

14 Edelman, Benjamin ‘Shortcomings and Challenges in the Restriction of Internet Retransmissions of Over-the-air Television Content to Canadian Internet Users’ at: http:// cyber.law.harvard.edu/people/edelman/pubs/jump-091701.pdf (last visited May 25, 2004)

3-7.

15 Ibid, 10.

16 Ibid, 8. For some examples of anonymising services, see e.g.: EPIC Online Guide to Practical

Privacy Tools (http://www.epic.org/privacy/tools.html (last visited May 25, 2004)).

or even inherent in the system-structure (“tunnelling methods”).¹⁷ With this in mind, it will presumably always be possible to circumvent geo-location technologies. Having said that, it should also be noted that for most uses, these technologies do not need to be hundred percent accurate and it consequently does not always matter that they can be circumvented by a limited group of people motivated to do so. Furthermore, the accuracy is high enough to interest website operators to use geo-location technologies, and high enough for the courts to start taking notice of geo-location technologies.

iv. geO-identiFicatiOn in the cOUrtS

The courts have started to take notice of geo-identification. In this context, it is interesting to note the difference in approach between the the Australian Internet defamation case, Macquarie Bank Limited & Anor v Berg,¹⁸ on the one hand, and the French Court’s 2000 decision in International League Against Racism & Anti-Semitism (LICRA) and the Union of French Jewish Students (UEJF) v. Yahoo! Inc.¹⁹ on the other. In Macquarie Bank Limited & Anor v Berg, the plaintiffs were seeking an injunction restraining the defendant from publishing allegedly defamatory material on a particular website, and Simpson J stated that:

The limitation [to publication occurring in NSW only] is ineffective. Senior council [for the plaintiffs] acknowledged that he was aware of no means by which material, once published on the Internet, could be excluded from transmission to or receipt in any geographical area. Once published on the Internet material can be received anywhere, and it does not lie within the competence of the publisher to restrict the reach of the publication.²⁰

There can be no doubt that the technical features of the Internet played a central role in the judge’s decision not to give injunctive relief in Macquarie Bank Limited & Anor v Berg. In contrast, based on the expert evidence provided, Justice Gomez in the Yahoo! case, concluded that geo-location technologies are sufficiently effective to allow the defendant to implement them to prevent

17 Edelman, supra n 13 at 9.

18 Macquarie Bank Limited & Anor v Berg [1999] NSWSC 526.

19 International League Against Racism & Anti-Semitism (LICRA) and the Union of French Jewish Students (UEJF) v. Yahoo! Inc. County Court of Paris, interim court order of 20^th of November 2000 (English translation available at http://www.cdt.org/speech/international/

001120yahoofrance.pdf (last visit May 25, 2005)).

20 Macquarie Bank Limited & Anor v Berg, supra n 18 at para 12.

access-seekers located in France from accessing the Nazi memorabilia/junk in dispute.²¹ Here, the perceived existence of feasible technical solutions was determinative.

The fact that courts have started to take account of geo-location technologies is a huge incentive for continued technical developments This, in turn, is likely to lead to improved accuracy, and this improved accuracy can motivate courts to place an even heavier emphasis on these technologies. To be a bit poetic, the wheels of geo-location technologies are in motion, and the consequences for Internet website operators are significant.

v. LegaL and regULatOry impLicatiOn OF geO-identiFicatiOn

As long as the rules of private international law focus on the location of the effect rather than on the location of the acting party, there is a huge incentive for website operators to know the location of those who access their content. Having obtained the means for identifying the geographical location of the access-seekers, a website operator has the possibility of deciding what parts of his/her content is available at which locations. Once it becomes common for website operators to make access conditioned on location, the nearly global Internet of today will be replaced by an Internet taking account of geographical borders. However, it has been pointed out that reliable technology simply is not enough.²² Even if geo-location technologies were widely utilised and worked to a satisfactory degree, not all problems associated with the special characteristics of the Internet would necessarily be solved. For example, the simple fact that a website operator is aware of the access-seeker’s physical location does not mean that he/she can make an informed decision as to whether imparting information to that individual might mean that he/she is at risk of being sued, for example, for defamation in the access-seeker’s forum. Bearing in mind the structure of current private international law rules, the website operator would need to know both the substantive defamation laws of the location from which the access-seeker is located and that country’s private international law rules to make such a decision. Further, since access-seekers may be geographically located virtually anywhere in the world, the website

21 International League Against Racism & Anti-Semitism (LICRA) and the Union of French

Jewish Students (UEJF) v. Yahoo! Inc., supra n 19.

22 See, e.g., Corn-Revere, Robert “Caught in the Seamless Webb: Does the Internet’s Global

Reach Justify Less Freedom of Speech?” Cato Institute, Briefing paper N0. 71 (July 24,

2002 6 and Clarke, Roger ‘Defamation on the Web: Gutnick v. Dow Jones’ at:

http://www.anu.edu.au/people/Roger.Clarke/II/Gutnick.html (last visited May 25, 2004).

operator would arguably have to know all substantial and procedural laws of all the countries on earth – an unrealistic task. This has led some commentators to conclude that “[g]eographic location technology is a red herring.”²³

On the other hand, this line of reasoning appears to be based on the notion that the ‘right’ or ‘ordinary’ thing to do, is to use technology to its full potential. Maybe we must depart from such ideas? The publisher of a newspaper, for example, would ordinarily be publishing within a local area, or a country or, if very large, a region. The technology of newspaper publications is such that a newspaper will only be available at those places the publisher has targeted. It could be said that the starting point is zero percent publication-coverage, and for that number to increase the publisher must target a community, country or region with its newspaper. Web publication, on the other hand, works in exactly the opposite way. Once the material is made available on the web, it has virtually one hundred percent publication-coverage, and for that percentage to decrease, the publisher must take action by ‘dis-targeting’ undesirable forums.²⁴ As the appropriate technology becomes available, and economically and practically feasible to use, web publishers may need to change their way of thinking.²⁵ Maybe also web publishers will have to, through the use of technology, take the zero percent publication-coverage as their starting point, instead of the one hundred percent publication-coverage (which could be said to represent full utilisation of the technology)? Maybe web-publishers will need to choose the market where they feel safe, to the exclusion of all other markets?

vi. cOncLUSiOn

SOme thOUghtS aBOUt the FUtUre OF geO-identiFicatiOn

It seems possible, or even likely, that geo-location technologies will contribute to transforming the Internet, as we know it, into something that more closely resembles our world, so divided by borders of different kinds. In evaluating the value of geo-location technologies, we must recognise that “the use of such technologies entail a cost – a financial cost to content providers and the social cost of a network that is no longer open and neutral.”²⁶ While such a development is far from ideal, it may nevertheless be unavoidable, and

23 Eunjung Cha, Ariana ‘Rise of Internet ‘Borders’ Prompts Fears for Web’s Future’ Washington

Post, Jan. 4, 2002.

24 Any proposition to the effect that Internet activities are functionally identical to offline activities fits uneasily with this observation.

25 Indeed, maybe such a change in approach is justified already today with the available technology? Perhaps even the alternatives of ‘soft protection’, discussed above, justify such a change in approach?

26 Fagin, Matthew Regulating Speech Across Borders: Technology vs. Values, 9

MichTelecomm&TechLR 395, 421 (2003).

perhaps even the best option. The reality that different states have different substantive laws simply cannot be ignored, and the regulation of activities on the Internet must in one way or another take account of this reality. As long as the rules of private international law focus on the location of the effect rather than on the location of the acting party, there is a huge incentive for website operators to know the location of those who access their content, and currently the most effective way of gaining such knowledge is arguably through the application of some form of geo-location technology. Thus, the Internet will inevitably transform from a relatively borderless dimension into a medium that takes account of geographical and legal borders. Furthermore, in light of such a development, current “effect-focused” private international law rules may make sense. In other words, from the perspective of Internet regulation, geo-location technologies may, to a large extent, eliminate the regulatory difficulties associated with the Internet’s “borderlessness”. If it can be assumed that web content being available in a particular state is an indication of the web publisher’s intention to make the content available in that particular state, the application of effect-focused private international law rules make sense. While we must remain alert to their less than perfect accuracy, geo-location technologies have the potential of making such assumptions valid prima facie. It would thus seem that discussions of Internet regulation necessarily must take account of these emerging technological solutions. Considering the above, it is submitted that the courts now have a great responsibility in ensuring that the potential of geo-identification is recognised and appreciated.

I would like to conclude this article with a quote from Mark I. Wilson and his colleagues: “[w]hile the power of distance has been eroded, it should not be confused with the diminishing meaning of place.”²⁷ Geo-location technologies

‘merely’ make it possible and practical to consider location, or place, also in the Internet context.

27 Wilson, Mark I., et al., ‘Death of Distance/Rise of Place: The Impact of the Internet on Locality and Spatial Organization’(Paper prepared for Presentation at INET 2001, The 11^th Annual Internet Society Conference (Stockholm, 5-8 June 2001).