prior probability

Chris McVeigh is the creator of these custom Lego sets. (Check out his website here to see more of his creations. Hat tip: @kottke.)

According to this report, Jelmer Eerkens (UC Davis) and Alex de Voogt (American Museum of Natural History) assembled and analyzed a set of 110 carefully dated, cube-shaped dice and made the following main findings (their full paper is available here):

• Dice made before 400, or in Roman times, are highly variable in shape, size, material and configuration of numbers.

• Dice are very rare between 400 and 1100, corresponding to the Dark Ages.

• When dice reappear around 1100 they are predominantly in the “primes” configuration, where opposite numbers tally to prime numbers (1-2; 3-4; 5-6), a numbering style that was also popular in ancient Mesopotamia and Egypt. Early medieval dice also tend to be quite small relative to their Roman predecessors.

• Around 1450 the numbering system quickly changed to “sevens” where opposite sides add up to seven (6-1; 5-2; 3-4). Dice also became highly standardized in shape, and also were made larger again.

We’ve shared many examples of “Lego Art” in previous blog posts (see here). This spring, 13 new works of LEGO art are on display at Leu Gardens in Orlando, Florida. These works are by Lego artist Sean Kenney. (Check out his website here.) The peacock pictured below contains 68,827 Lego bricks.

Image Credit: F. E. Guerra-Pujol

The Computer Fraud and Abuse Act (CFAA) is a federal law that imposes criminal and civil penalties on computer hackers. The original version of this law made it a federal crime to access government computers without authorization or in excess of authorization. The scope of the law has subsequently been expanded by Congress to include all “protected computers”, broadly defined as any computer connected to the Internet. Here are some relevant links:

1. Overview (via Wikipedia)
2. What is the CFAA? (via Wired)
3. List of the most controversial hacking cases (via Wired)
4. Overview of the CFAA and policy recommendations (via the Federalist Society)
5. Critique of the CFAA (via the Electronic Frontier Foundation)

According to the 2010 film “The Social Network” (see page 27 of the movie script), the Harvard Ad Board accused Zuckerberg of “violating copyrights” (among other things) when he created Facemash. Really? This allegation may sound plausible. After all, creators of original works (including photographs and even selfies!) own the exclusive legal rights to their works the moment those works are created. But before we can conclude that someone is engaged in copyright infringement, we must ask what copyrights did he infringe? In the case of Facemash, since Zuckerberg did not have the express or implied permission to use the I.D. photos of his fellow students, he may have committed copyright infringement when he took those pictures from Harvard’s databases and posted them up to Facemash, but that begs the question: who owns the legal rights–i.e. the copyright–to those pictures? Harvard or the students themselves? (Why is the question of ownership so crucial? Because it is the owner who retains the right to sue for damages for any copyright infringement.)

To keep this analysis simple, let’s say Harvard owns the rights to those student I.D. photos. (Perhaps students are required to assign their legal rights to Harvard when they submit their photos to the university.) The next question is: did Harvard at any time formally register those pictures with the U.S. Copyright Office? Without formal registration, a copyright owner’s enforcement rights are very limited, since federal copyright law preempts State law in this area. (See here, for example.) For the sake of argument, let’s say Harvard took the precaution of registering those student I.D. photos with the Copyright Office the moment it realized those photos were hacked. What next? In theory, Harvard could sue the hacker in federal court and request statutory damages under the Copyright Act, but in this case, the hacker was one of its own students! If Harvard is not going to expel him over this conduct, is it really going to incur the expense or risk of negative publicity by suing him?

Thus far, we have wondered whether Harvard sophomore Mark Zuckerberg may have committed a tort when he created Facemash back in ’03. Broadly speaking, whether an act or omission constitutes a civil tort depends on the common law of the place in which the alleged tort occurred. But remember: the United States is a federal system! There are two levels of government in the USA–the States and the feds–and each level has its own laws and operates its own separate legal system. As a result, in addition to local tort law, there are a number of federal laws that could have applied to Facemash. In particular, Facemash may have crossed the following three federal legal lines:

1. Copyright infringement under the Copyright Act of 1976.
2. Unauthorized access to a protected computer under the Computer Fraud and Abuse Act of 1986 (CFAA).
3. Breach of privacy rights under the Family Educational Rights and Privacy Act of 1974 (FERPA).

Frankly, we should just ignore FERPA because this toothless federal privacy law is all bark and no bite. In theory, the Secretary of the U.S. Department of Education could have brought a FERPA enforcement action against Harvard (perhaps on the theory that Harvard did not do enough to protect sensitive student information from hackers), but FERPA applies only to “educational records”, so a strong argument can be made that Facemash did not run afoul of FERPA. But even if student I.D. photos are considered “educational records”, the U.S. Supreme Court ruled in Gonzaga University v. Doe, a case decided in 2002, that private parties may not sue for damages under FERPA. (By the way, it’s also worth noting that the feds have never brought an enforcement action under FERPA!)

That still leaves copyright infringement and the CFAA, two federal laws that do allow private causes of action, i.e. private parties may sue for money damages under the Copyright Act and the CFAA if certain conditions are met. In addition, copyright law and the CFAA also establish severe criminal penalties (!) for copyright infringement and for unauthorized access to a protected computer, so we will take a closer look at these two laws in our next two blog posts.

Credit: Elaine Daniels

In my previous post, we considered Facemash from Harvard’s perspective, so we asked whether Mark Zuckerberg–the Harvard hacker and creator of Facemash–committed the tort of conversion or the tort of trespass to chattels when he hacked into the University’s computer network. In this post, let’s consider Facemash from the perspective of the “Facemash Girls”–the co-eds whose pictures were posted to the Facemash website without their consent. In particular, couldn’t some or all of the Facemash Girls have sued Zuckerberg for invading their privacy or for intentional infliction of emotional distress? (This is not a crazy question; a lot of the students at Harvard have powerful parents.)

Let’s consider the common law right to privacy first. In brief, there are four ways of proving that an unlawful “invasion of privacy” occurred: intrusion of solitude, public disclosure of private facts, false light, and appropriation of name or image. But however we slice and dice it, there are two big problems with all these privacy theories of liability in the case of Facemash: (1) what are the damages, and (2) is there a reasonable expectation of privacy in semi-public I.D. photos? To begin with, a tort plaintiff is required to allege and prove an injury or damages to win her case, but what damages did the Facemash Girls suffer when their pictures were posted to Facemash? Now, for the sake of argument, let’s suppose the Facemash Girls can prove damages. (After all, those pictures were posted to Facemash without the Facemash Girls’ consent. In other words, the injury here is that Zuckerberg did not ask for anyone’s permission first.) The plaintiff will also have to show that she had a reasonable expectation of privacy in her college I.D. photo. The problem, however, is that those I.D. photos are meant to be seen! How can one say that one has a reasonable expectation of privacy in something that is meant to be seen by your classmates?

What about the tort of intentional infliction of emotional distress or IIED? To recover under this theory of tort liability, a plaintiff will have to prove two things: (1) that the defendant acted in an “extreme and outrageous” way, and (2) that she, the victim, suffered “severe emotional distress” because of the defendant’s extreme and outrageous behavior. So, was Facemash really all that “extreme and outrageous”? It’s hard to say, especially given the fact that people judge each other based on their physical appearance all the time. Plus, even if Facemash was extreme and outrageous, how could it cause any severe emotional distress? Remember, the website was up only for a short period of time before the University shut it down.

This concludes our legal analysis of Facemash (and hacking generally) from a common law perspective. In our next two blog posts, we will consider two federal laws that might apply to Facemash.