The techie blogosphere is abuzz with the news that Michigan amended its private investigator licensing laws in May to add “computer forensics” to the list of activities that require a P.I. license in Michigan. This may not sound like big news, but it raises the possibility that MediaSentry, a company that gathers information on peer-to-peer filesharers for use in the RIAA’s lawsuits against online infringers, may be violating the law in several states. Given the general antipathy to the RIAA among the technorati, suddenly a large number of bloggers are interested in the arcane details of P.I. licensing requirements.
But the issues raised by the law go well beyond the RIAA lawsuits, and potentially affect any investigation of online misbehavior. Any lawsuit against an anonymous online individual begins with an attempt to identify that person. Furthermore, the definition of “computer forensics” in the Act is so broad that it includes printing out a web page for use in a lawsuit. Attorneys need to pay attention here too: the Michigan law exempts attorneys, but only if they are “admitted to practice in this state.” And other states have similar laws. So do you need a P.I. license or a bar admission in all 50 states before you can sue that defamatory blog poster?
I think the answer is no, but we’ll see what position the state regulatory authorities take. The issue raised here is one that comes up in a lot of different contexts in Internet law: where in real space does activity on the Internet occur? The position of the General Counsel of Central Michigan University, who has filed a complaint against MediaSentry, appears to be that private investigation services occur at the site of the computer holding the file or website that is being investigated.
There’s no single answer to the question of where activity occurs on the Internet; rather, in each context, the question is which of the many possible locations at issue (the server, the client, or each jurisdiction the communication passes through) has the better claim to exercise regulatory authority. In the specific context of business licenses, I think it’s a mistake to say that Internet information-gathering services are properly regulated in each forum with a server holding some of the information.
The statute at issue governs, not activities in Michigan per se, but rather the business of being a professional investigator. (“A person, firm, [etc.] shall not engage in the business of professional investigator for hire, fee, or reward, and shall not advertise his or her business to be that of professional investigator or of a professional investigator agency without first obtaining a license from the department.”) That’s wise, because a statute requiring a license to gather any information at all would likely violate the First Amendment. But is a person who gathers information off of an AOL server in Virginia really conducting business in Virginia? Certainly not for personal jurisdiction purposes; even the sale and shipment of a physical automobile on eBay to a California consumer was recently held not to be “doing business” in California. And for sales tax purposes, gathering information off of a server in the forum also wouldn’t be enough to subject the sale of that information elsewhere to sales tax in the forum.
Gathering information available on the Internet from a server in the forum seems too tenuous a connection to make that business (or lawyer) subject to licensing requirements or other business regulations in that forum. MediaSentry is located in Maryland; if Maryland decides MediaSentry needs a license, it would have every right to insist upon it. But until MediaSentry starts sending investigators into Michigan, or directly interacting with Michigan residents somehow, I don’t think the Michigan license requirements apply to it.
If Michigan takes the opposite view, that could well be subject to a dormant commerce clause challenge, as an attempt to effectively regulate behavior taking place wholly outside its borders, and as a local regulation that would have disproportionate negative impact on interstate commerce. Anyone investigating any website where the location of the server was not known would, essentially, need to be licensed everywhere the server could be, which would make garden-variety investigation of websites or emails needlessly cumbersome. And the local benefit from requiring a P.I. license for the gathering of information easily accessible on the Internet is extremely slim. So an attempt by a state to regulate ordinary out-of-state Internet data-gathering activities, carried on in preparation for a yet-to-be-filed lawsuit, should fall afoul of the commerce clause.