1. Protection from Forced Disclosure. A commitment to establish and uphold rigorous procedural protections to ensure that the company only discloses user information to foreign governments when absolutely necessary under local law.
2. User Notification and Education. A commitment to providing general information about the
risks to the company’s users of using the company’s services on a worldwide basis, as well
as specific information about the risks of specific activities in certain settings where those risks
are particularly high.
3. Consciousness of Data Location. A commitment to locating servers in places that are
unlikely to result in the unethical, forced disclosure of user information. Server location will
be based, where possible, in countries with a demonstrated commitment to due process of
law and to reliable and consistent rule by legitimate governments. A company will disclose
to users the location of its servers hosting their personally identifiable information where
possible.
A critical part of such a voluntary code, regardless of its substantive terms, would be to develop an institution that would be charged with monitoring adherence to the code and enforcing violations. One way to accomplish this goal would be for states to adopt the code as law,
by passing ordinary legislation and then bringing to bear the full law enforcement capabilities
of the state to back it up. Another way could be to imagine an institution—perhaps not a new
institution, but a pre-existing entity charged with this duty—that would include among its participants representatives of NGOs or other stakeholders without a direct financial stake in the
outcome of the proceedings. This institution may or may not have state regulators involved as
partners to ensure compliance. The institution would play an essential role in ensuring that the
voluntary code of conduct not only has force over time, but also that it continues to address
the ethical issues as they change.
The development of the code itself solves only a small part of the problem; it is in the successful application of the code that a long-term solution lies. In the context of other instances
of corporate codes of ethics implicating human rights, such as the sweatshops issue, getting
to the code was the easy part.
Law
The legal system might provide one or more ways to resolve the ethical dilemmas facing corporations in the context of states that censor or carry out surveillance online. That said, classic
state-based regulation—of the second-order variety—is unlikely to be the most effective
means of addressing this particular problem over time. Individual states might require corporations chartered in their jurisdiction to refrain from certain activities when operating in other
states.
The analogy in the United States context runs to the Foreign Corrupt Practices Act, which
disallows corporations chartered in the United States from bribing foreign officials and other
business dealings that would violate U.S. law if carried out in the home market. A ‘‘handstying’’ regulation of this sort might be combined with other approaches—including the voluntary
Corporate Ethics on a Filtered Internet
117
2. User Notification and Education. A commitment to providing general information about the
risks to the company’s users of using the company’s services on a worldwide basis, as well
as specific information about the risks of specific activities in certain settings where those risks
are particularly high.
3. Consciousness of Data Location. A commitment to locating servers in places that are
unlikely to result in the unethical, forced disclosure of user information. Server location will
be based, where possible, in countries with a demonstrated commitment to due process of
law and to reliable and consistent rule by legitimate governments. A company will disclose
to users the location of its servers hosting their personally identifiable information where
possible.
A critical part of such a voluntary code, regardless of its substantive terms, would be to develop an institution that would be charged with monitoring adherence to the code and enforcing violations. One way to accomplish this goal would be for states to adopt the code as law,
by passing ordinary legislation and then bringing to bear the full law enforcement capabilities
of the state to back it up. Another way could be to imagine an institution—perhaps not a new
institution, but a pre-existing entity charged with this duty—that would include among its participants representatives of NGOs or other stakeholders without a direct financial stake in the
outcome of the proceedings. This institution may or may not have state regulators involved as
partners to ensure compliance. The institution would play an essential role in ensuring that the
voluntary code of conduct not only has force over time, but also that it continues to address
the ethical issues as they change.
The development of the code itself solves only a small part of the problem; it is in the successful application of the code that a long-term solution lies. In the context of other instances
of corporate codes of ethics implicating human rights, such as the sweatshops issue, getting
to the code was the easy part.
Law
The legal system might provide one or more ways to resolve the ethical dilemmas facing corporations in the context of states that censor or carry out surveillance online. That said, classic
state-based regulation—of the second-order variety—is unlikely to be the most effective
means of addressing this particular problem over time. Individual states might require corporations chartered in their jurisdiction to refrain from certain activities when operating in other
states.
The analogy in the United States context runs to the Foreign Corrupt Practices Act, which
disallows corporations chartered in the United States from bribing foreign officials and other
business dealings that would violate U.S. law if carried out in the home market. A ‘‘handstying’’ regulation of this sort might be combined with other approaches—including the voluntary
Corporate Ethics on a Filtered Internet
117