doteduguru

Wednesday we received information that was both surprising and almost unbelievable from a friend and reader of ours over in Colorado. After some digging and communication with other contacts we have confirmed with other schools and the CO State Controller that it appears that the state of Colorado has advised state agencies, including higher ed, to halt the use of Facebook indefinitely. Yes, you read that correctly.

Here’s the issue, as we understand it. Recently, section 15 part 2 of the Facebook Terms of Service was brought to the attention of the state attorney general. That section reads:

15. Disputes
2: If anyone brings a claim against us related to your actions, content or information on Facebook, you will indemnify and hold us harmless from and against all damages, losses, and expenses of any kind (including reasonable legal fees and costs) related to such claim.

The apparent problem is that the CO state constitution forbids such an agreement. Indemnity is the paying of damages or a sum of money paid in compensation for loss or injury, in this case if you were to do something that got Facebook sued, you agree to pay them back. The issue in point seems to be , which states that the state controller has to approve any “contract,” in this case including the Facebook TOS, with regard to the agreement of paying any money out. As a result, they determined the best course of action (legally speaking) was to advise state agencies to suspend the use of Facebook while they work to negotiate around the issue of indemnity. The state attorney general had no comment about the specific instructions or advice given to the organizations, nor about what actions are currently being pursued with Facebook.

So, here’s the thing. It’s not that Colorado is going all “we hate Facebook” on everyone. It’s nothing like that at all. It’s a case where the wild world of web site terms of service is coming into conflict with the realm of state contract law, and people weren’t sure how to respond. As we understand it, the state is or will be negotiating with Facebook to find a resolution to this issue, at which point we can assume agencies will be allowed to resume their use of Facebook (hopefully) normally. But how long that takes, and how successful they are will be variables that we’ll have to wait to find out about. Facebook has never, and reasonably would never actively use indemnity as a weapon to go after users - imagine the PR storm that would follow. More likely, it’s boilerplate legalese that is there just for general protection in cases of serious abuses.

What’s more, this issue isn’t just about Facebook, it’s just what started it. Here’s MySpace’s (it’s actually even worse):

17. Indemnity. You agree to indemnify and hold MySpace, its subsidiaries, and affiliates, subcontractors and other partners, and their respective officers, agents, partners and employees, harmless from any loss, liability, claim, or demand, including, but not limited to, reasonable attorneys’ fees, made by any third party due to or arising out of your use of the MySpace Services in violation of this Agreement and/or arising from a breach of this Agreement and/or any breach of your representations and warranties set forth in this Agreement and/or any Content that you post on, through or in connection with the MySpace Services.

And YouTube:

5. Your Use of Content on the Site
G. You understand that when using the YouTube Website, you will be exposed to User Submissions from a variety of sources, and that YouTube is not responsible for the accuracy, usefulness, safety, or intellectual property rights of or relating to such User Submissions. You further understand and acknowledge that you may be exposed to User Submissions that are inaccurate, offensive, indecent, or objectionable, and you agree to waive, and hereby do waive, any legal or equitable rights or remedies you have or may have against YouTube with respect theretoand agree to indemnify and hold YouTube, its Owners/Operators, affiliates, and/or licensors, harmless to the fullest extent allowed by law regarding all matters related to your use of the site.

And probably one of the scariest ones, Ning:

22. Indemnity

You agree to indemnify, defend, and hold harmless Ning, and its successors, subsidiaries, affiliates, co-branders, contractors, employees, all third-party advertisers, technology providers, service providers or other partners, and each of their respective officers, directors, agents, shareholders, employees and representatives, from and against any third party claim, demand, loss, damage, cost, or liability (including, reasonable attorneys’ fees) arising out of or relating to:

* Your Code, Your Content or Your Social Network;
* Your use of any Non-Ning Code or Third Party Applications;
* Your use or misuse of, or connection to, the Ning Platform;
* Your breach or alleged breach of this Agreement;
* Your violation of any rights (including intellectual property rights) of a third party;
* Your use or misuse of any User data (including Ning Member Data and Network Member Data), including, in violation of the Ning Privacy Policy and
* Your breach or alleged breach of any agreement or policy between you and other Users.

Ning reserves the right, at your expense, to assume the exclusive defense and control of any matter for which you are required to indemnify us and you agree to cooperate with our defense of these claims. You agree not to settle any matter without the prior written consent of Ning. Ning will use reasonable efforts to notify you of any such claim, action or proceeding upon becoming aware of it.

Anyway, I think you get the idea (note that I couldn’t find anything in Twitter’s TOS about indemnity or holding harmless). It’s not that these companies are all “RAWR, WE’RE GONNA TAKE ALL YOU’S MONIESSS!“, it’s just that this is extremely common, protectionary contract verbiage. But, regardless of how innocuous it is, it clearly can have a real world impact on those of us in the public sector, where we have higher rules and laws dictating some of our activities. In Colorado’s case, it’s not that they are responding to a problem that arose, they just want to prevent any issues from happening in the first place. Even if we all know that the threat of any liability here isn’t worth breaking a sweat over, the laws are the laws. Welcome to the world of state employment.

Here’s the advise I can give you: inform yourself. Know what your state’s position is on indemnity clauses in web site terms of service. Ask your legislative liaisons and campus lawyers questions. Once this information gets out very far, you can bet Colorado won’t be the last one to go through this situation, so be sure you are prepared and know your state’s legal traps. And in the same breathREAD TOSs! I know the minute I say that everyone goes “Yeah! We should!“, and then immediately goes back to checking boxes and clicking agree to everything. But the reality is, in private there’s not much risk, but in our day job the rules change. Make sure you understand where these conflicts can happen.

I’ll keep this post updated as we get more information and as news develops. If you’ve been through similar experiences in your state or school, be sure to share them in the comments below.

UPDATE 10.04.08 3:44PM CDT: @brucefloyd tells us “Was just told by someone at @uflorida legal that this is a problem for almost all states, inc Florida…” Additionally, Texas appears to have restrictions preventing indemnification in it’s constitution in article III §50-52 and article XI §3.

UPDATE 10.04.08 4:03PM CDT: I offer up an interesting position on the issue of indemnity clauses in web site TOSs. As I am researching my own state laws, one phrase jumped out at me - ” Any litigation, arbitration or other dispute resolution arising from such contracts would be conducted in the state and any contract provision, covenant or clause that conflicts with these provisions would be void and unenforceable.” So my wondering is does it matter whether or not a TOS has an indemnity clause in a state that doesn’t allow for it to provide indemnification? If it were to go to court, would the court not just say “This clause is not enforceable in this state because it is in violation of state statutes, try again next time.” Sadly, IANAL, so I can only speculate on that. Can anyone provide clarification on that thinking?

UPDATE 10.04.08 4:08PM CDT: Yes, Flickr and Google Custom Search both also have indemnification clauses in their TOSs, as does Amazon Web Services (covering things like S3 and EC2).

UPDATE 10.04.13 11:49AM EDT: In Colorado, the state AG is coordinating with other state agencies to negotiate with Facebook to get a customized TOS. In the mean time, they have apparently ordered users that the course of action currently is to take down any existing pages, as previously mentioned. This is bothersome for me, though, because they will no doubt get a custom TOS, yet they want to completely scuttle all the hard work organizations have done thus far and destroy the communities. There is a cost in social capital here that is extremely high. You don’t cut the arm off before attempting to cure the infection. Some groups are looking in to whether or not alumni or foundation organizations could temporarily take over their pages and be stewards until the issue is resolved.

UPDATE 10.04.15 11:33AM EDT: It appears that the state AG in Colorado is now granting permission, at least to universities, to resume and/or continue using Facebook at this time. Though negotiations with Facebook are apparently continuing, this signals they are likely nearing or confident in the solution to the TOS.