Internet Filtering Requirements The Acts, Some Facts, and How It All Ties in with E-rate Laurie Taylor Michigan Information Network August 15, 2001

Internet Filtering Requirements

The Acts, Some Facts, and How It All Ties in with E-rate

Laurie Taylor

Michigan Information Network

August 15, 2001

August 15, 2001 Michigan Information Network 2

Forward

The information in this presentation is based on discussions regarding CIPA, N-CIPA, and COPPA held among state E-Rate coordinators and the Michigan Information Network (MIN) Work Group. Some of the information is also a result of conference calls between state E-rate coordinators and the FCC and SLD. MIN has made reasonable attempts to ensure the accuracy of this information as of the date of this presentation. However, the FCC and SLD are still working on the details of implementing CIPA and N-CIPA. Some of the information provided in this presentation may change as the result of further clarifications made by the FCC and SLD. Refer to the FCC and SLD web sites for “official” information.


Background on CIPA

• CIPA = Children’s Internet Protection Act

• Signed into law December 21, 2000 as part of a larger spending package– Consolidated Appropriations Act, 2001;

PL 106-554, Sections 1701-1741

• Went into effect July 1, 2001


Background on CIPA

• Establishes policy requirements for federal technology funding for K-12 schools and public libraries:– E-rate (Telecommunications Act of 1996)– Library Services & Technology Act (LSTA)– Title III of Elementary & Secondary Education

Act (ESEA)


Background on CIPA

• Special provisions for E-rate users:– Does NOT apply to telecom-only funding– Must meet additional Internet safety policy

requirements under Neighborhood Children’s Internet Protection Act (N-CIPA)

• CIPA addresses the filtering requirement and the need for an Internet Safety Policy

• N-CIPA focuses on what has to be included in a school or library Internet safety policy


Background on CIPA

• FCC rules went into effect April 20, 2001

• New Form 486 (July 2001) addresses CIPA compliance certification for E-rate purposes

• Internet Safety Policy (or Acceptable Use Policy) and Technology Protection Measures (e.g., “filters”) must be adopted within same timeframe


Background on PA 212

• PA 212 went into effect in Michigan on October 1, 2000

• It amended PA 37 that went into effect August 1, 1999

• PA 37 amended PA 7 that went into effect February 6, 1998

• PA 7 amended PA 455 (1982)


PA 455

• “An act to provide for the confidentiality of certain library records; and to provide for the selection and use of library materials.”


PA 7

• Amended section 2 of PA 455 (MCL 397.602)

• Basically, defines “library” and “library record”


PA 37

• Amended section 2 of MCL 397.602 as amended by PA 7 which provided definition for the following terms:– computer, computer network, computer

program, computer system, device, harmful to minors, Internet, library, library record, minor, obscene, sexually explicit matter, terminal


PA 37

• “Sexually explicit matter” defined as that definition provided in Act 33 of 1978 (MCL 722.673)– Means sexually explicit visual material, sexually

explicit verbal material, or sexually explicit performance

– Verbal material means a book, pamphlet, magazine, printed matter reproduced in any manner (i.e., “text”), or sound recording


PA 37

• Also added section 6 to MCL 397.602 which empowered the governing body of the library to authorize or require restricted access to minors to the Internet or computer systems in the following manner:


PA 37

• (a) By making available, to individuals of any age, 1 or more terminals that are restricted from receiving obscene matter or sexually explicit matter that is harmful to minors.


PA 37

• (b) By reserving, to individuals 18 years of age or older or minors who are accompanied by their parent or guardian, 1 or more terminals that are NOT restricted from receiving any material.


PA 212

• Focus is on minors only, not adults

• Amended section 6 of MCL 397.606 as added by PA 37 requiring the governing body of the library to adopt and require enforcement of a policy that restricts access to minors to the Internet or computer systems in 1 of the following ways:


PA 212

• (a) Both of the following:– (i) By making available, to individuals of any

age, 1 or more terminals that are restricted from receiving obscene matter or sexually explicit matter that is harmful to minors; AND

– (ii) By reserving, to individuals 18 years of age or older or minors who are accompanied by their parent or guardian, 1 or more terminals that are NOT restricted from receiving any material.


PA 212

OR

• (b) By utilizing a system or method that is designed to prevent a minor from viewing obscene matter or sexually explicit matter that is harmful to minors.– Possibilities:

• Internet filtering

• Monitoring


PA 212

• PA 212 also states that section 6 does NOT apply to a library established by a community college district, a college or university, or a private library open to the public.


PA 212

• So, that leaves libraries established by the state; a county, city, township, village, school district, or other local unit of government or authority or combination of local units of governments and authorities.


Background on COPPA

• COPPA = Children’s Online Privacy Protection Act

• Went into effect April 21, 2000– 15 U.S.C., Sections 6501-6506– Administered by the Federal Trade

Commission (FTC)


Background on COPPA

• Deals with the collection of information from children, NOT the restriction of content children can access over the Internet

• Applies to commercial web sites

• Does not apply to most non-profit or state/local government web sites


COPPA Requirements

• Operators of commercial web sites and online services that target or knowingly collect personal information from children under the age of 13 must:– 1. Notify parents of their information practices

(i.e., post a complete privacy policy);– 2. Obtain verifiable parental consent before

collecting a child’s personal information;


COPPA Requirments

– 3. Give parents a choice as to whether their child’s information will be disclosed to third parties;

– 4. Provide parents access to their child’s information;

– 5. Let parents prevent further use of collected information;


COPPA Requirements

– 6. Not require a child to provide more information than is reasonably necessary to participate in an activity;

– 7. Maintain the confidentiality, security, and integrity of the information.


CIPA Requirements

• Requires adoption and implementation of an “Internet Safety Policy”

• For all LSTA, ESEA, and E-rate fund applicants, means operation of a “technology protection measure” that blocks or filters Internet access to visual depictions that are:


CIPA Requirements

• Obscene• Child pornography• Harmful to minors

Minor = An individualwho has not attainedthe age of 17

Note: CIPA does allow adults to view visual depictionsconsidered harmful to minors, but not obscene or child pornography visual depictions


CIPA Requirements

• For E-rate fund applicants only, requires other safety and security measures for minors (as called for in N-CIPA) re:– E-mail

– Chat rooms

– Other direct electronic communications (e.g., Instant Messaging)

– “Hacking” and other unlawful online activities

– Unauthorized disclosure of personal ID info on minors


CIPA Requirements

• For schools applying for E-rate funds, also requires that the Internet Safety Policy include monitoring the online activities of minors– Note: 1) Libraries are not required to monitor

the activities of minors; 2) CIPA and N-CIPA do not require schools or libraries to track Internet use by identifiable users


CIPA Requirements

• Requires public hearing or meeting on the Internet Safety Policy– Must provide reasonable public notice for the

hearing or meeting – Local school districts must have their own

policy• They must sign Form 486 or Form 479 certifying

they have implemented such a policy


CIPA Requirements

• Disabling of filtering is allowed:– For authorized adult use for “bona fide

research or other lawful purposes”

• Federal funding for CIPA expenses:– ESEA and LSTA funds available– E-rate funds NOT available


But What About PA 212?

• In Michigan, you must comply with PA 212 whether or not you apply for E-rate funds.



• To comply with PA 212, you have to either– 1) make available to all age groups 1 or more

terminals that are restricted from receiving obscene/sexually explicit matter that is harmful to minors (OSEMHARTOM), AND make available to individuals 18 or older 1 or more terminals that are NOT restricted from receiving OSEMHARTOM; OR



– 2) implement a system or method designed to prevent a minor from viewing OSEMHARTOM (e.g., Internet filtering).

• To comply with PA 212 via alternative “1” above means that you will NOT be in compliance with CIPA.

• To comply with PA 212 and CIPA, you need to start with alternative “2” above.


CIPA and PA 212 Compliance

• To comply with both of these pieces of legislation, a school or library in Michigan must:– 1) adopt and implement an Internet Safety

Policy (including public hearing with reasonable public notice), AND



– 2) implement an Internet filtering system designed to protect a minor from viewing OSEMHARTOM, child pornography, and other material deemed locally to be inappropriate for minors (visual, verbal, and performance),



A few notes to remember on that last point: i) CIPA also requires that adults be protected

from viewing visual depictions that are obscene or child pornography;

ii) CIPA does not require that verbal or performance material be blocked from minors or adults;

iii) CIPA does not require restricting adults from viewing or accessing visual depictions that are harmful to minors;

iv) CIPA does require that minors not view or access visual depictions that may be harmful to them.



AND– 3) implement other safety measures for minors

with regards to E-mail, Chat rooms, Other e-coms, Hacking, and Unauthorized disclosure of personal ID info on minors, AND

The “N-CIPA” piece



– 4) if you are a school or school library, monitor the online activities of minors.

Note: A minor under CIPA is less than 17 years of age, while a minor under PA 212 is less than 18 years of age. In Michigan, libraries would need to filter the Internet for all individuals under the age of 18.


CIPA Impact on E-rate Year 4

• Must initially certify that an Internet Safety Policy is in effect or that the applicant is undertaking initial actions to do so

• Timing is important– Safest bet was to have taken some type of action

before funding Year 4 started on July 1, 2001 • For example - assigning a staff member or appointing

a committee to begin the process



– Document the actions you take• Letter or memo from responsible administrator

• Minutes from library or school committee/board meeting

• Record of attendance at meetings or workshops related to CIPA (including names of attendees and dates)

• Just reading an e-mail about filtering probably does NOT qualify as “taking action”



– If no action has been taken by the time the school or library starts or started to receive Year 4 E-rate services, those services will NOT be eligible for discounts until the school or library does begin the process of complying with the E-rate provisions of CIPA



• Libraries need only indicate that they are “evaluating their options”– Based on May 15, 2001 ruling by U.S. District

Court – The new Form 486 (July 2001) does not appear

to accommodate this stipulation• Safest bet is for libraries to select item 11b -

“undertaking such actions”

– Have until July 1, 2002 to comply


When Must I Certify?

• Certification of compliance must be made on or before October 28, 2001

• Taking steps to comply must be started on or before the start date for Year 4 E-rate services, but no later than October 28, 2001– For most, July 1, 2001 was the date by which

applicants must have taken initial steps to comply



• However...– Some Year 4 applicants may not get a Funding

Commitment Decision Letter (FCDL) by October 28, 2001

– Also, some Year 4 services may not start until after October 28, 2001



• Under such circumstances, the SLD will give applicants 120 days after receipt of the FCDL or start of services to file the Form 486, whichever is later– Note: If you did not start undertaking actions

by July 1 or the start of services, you can only qualify for Year 4 discounts back to the date at which you verify on Form 486 that your school or library started taking such actions



• Certification of full compliance must be made by the start of funding Year 5 (i.e., July 1, 2002)

• Exception: Unless applicant requests and receives a waiver because full compliance is prevented due to delays caused by local procurement procedures


How Do I Certify?

• Year 4– Schools and libraries applying for E-rate funds

certify via Form 486 (July 2001 version) on or before October 28, 2001 that

• a) they have the policies and technology protection measures related to CIPA in place;

• b) they are undertaking actions to put such policies and technology protection measures in place by the start of Year 5 (July 1, 2002); or


How Do I Certify?

• c) they are only applying for telecommunications services and not for Internet access or internal connections (therefore the E-rate CIPA provisions do not apply).

– Members of consortia certify on Form 479 (new form - July 2001)

• Consortia leaders will be required to certify that they have collected Forms 479 from all their members indicating that they are in compliance.


How Do I Certify?

• Year 5– Certification will be made on the new Form

486 (July 2001 version)– No specific filing dates announced yet– Must be fully in compliance by July 1, 2002 to

be eligible for funding (unless have obtained a waiver)


Things You Can Do to Get Started

• Hold staff meetings to discuss compliance issues (filtering software, AUP, etc.)

• Discuss the issue with your board

• Make inquiries for information from vendors on different technology protection measures



• Develop a draft RFP to obtain technology protection measures

• Develop a draft Internet Safety Policy for discussion at a public meeting– Should comport with the state’s Open Meetings

law• MCL 15.261 (March 31, 1977)



– Would be prudent to allow time at any such hearing or meeting for comments on the Internet policy from the general public (however, there is no specific language in the law requiring this)

– Be certain to document fully any such public meeting by keeping a copy of the notice, any minutes of the meeting, any actions taken, etc.



– Considering local variations in policies, it may not be feasible to have a single meeting representing more than one school district or library

– Consortium considering holding regional meetings representing more than one school district or library should consult with their attorney on this issue



• Whatever you do, you must undertake (and document) some sort of effort to implement CIPA by July 1, 2001 or the start of services if you expect to receive E-rate discounts on Internet access or internal connections for Year 4– However, you have until July 1, 2002 to

complete your efforts to fully implement CIPA



• Even after taking some initial action(s) to implement CIPA, schools and libraries have until October 28, 2001 to decide if they will or will not fully implement CIPA– Note: None of the "undertaking actions”

documentation has to be sent to the SLD nor is any of it appended to Form 486. It is simply retained by the school or library and may be requested by the SLD as part of any audit


What If I Choose NOT to Implement CIPA?

• Just don’t certify CIPA compliance on your Form 486

• You are still eligible to receive universal discounts on telecommunications services– Simply file a Form 486 for your

Telecommunications FRNs with the box for “CIPA does not apply” checked


What If I Choose NOT to Implement CIPA?

– If applicable, file a Form 500 cancelling the Internet Access and Internal Connections FRNs which you have received

• Be aware that such a decision may affect your ESEA Title III and LSTA funding


LSTA Funding Issues

• FY 2002 competitive grant program will not be subject to CIPA compliance

• In FY 2003, libraries will need to assure the IMLS* that LSTA funds will be used in accordance with CIPA requirements

*Institute of Museum and Library Services


LSTA Funding Issues

• LSTA funds may be used for CIPA compliance expenses (but request must meet all of the stated handbook criteria)


ESEA Title III Funding Issues

• TLCF* funds may be used for CIPA compliance expenses

• Cycle 4 funding not impacted by CIPA

• Cycle 5 funding appropriations will require that recipients be in compliance with CIPA

*Technology Literacy Challenge Fund


FCC Rules on CIPA

• Local authorities are best situated to choose which technology measures and Internet Safety Policies will be most appropriate for their relevant communities

• A school administrative authority must certify that its policy of Internet safety includes monitoring the online activities of minors


FCC Rules on CIPA

• Reimbursement for non-compliance shall be made directly by the school or library (not the service provider)

• All members of a consortium receiving discounts for Internet access and/or internal connections must submit signed certifications to the Billed Entity of the consortium on a new Form 479


FCC Rules on CIPA

• The Billed Entity must maintain a file of all Form 479 certifications

• The Billed Entity must certify on the Form 486 that it has received completed and signed certifications from all such members, and shall make such certifications available to the FCC or SLD upon request


FCC Rules on CIPA

• The Billed Entity is NOT responsible for verifying that members’ certifications are accurate

• The entire consortium will not be penalized due to the non-compliance of an individual member(s)

• CIPA makes no distinction between computers used only by staff vs. the public


What the FCC Rules Don’t Require

• E-rate applicants do not have to– certify the effectiveness of their filtering– track attempts to access prohibited material– further define prohibited material or actions– establish specific provisions to disable

protection measures for lawful research– post actual CIPA requirements– post text of their Internet safety policies


What the FCC Rules Don’t Require

• E-rate applicants do not have to– identify their technology protection vendors– post instructions on registering complaints


Court Actions

• ALA and ACLU lawsuits challenge the applicability of CIPA to libraries– May 15, 2001 ruling in U.S. District Court

requires libraries to indicate in PY4 that they are “evaluating their options”

– Full-blown trial tentatively scheduled for February 14, 2002


Court Actions

• Why no lawsuits from schools?– Perhaps because schools have much greater

flexibility restricting free speech under the concept of “educational suitability”


Advice

• Schools, school districts, libraries and library consortia should seek the advice of legal counsel in an attempt to ensure that their actions are in compliance with the letter of the law(s)


Resource Sites

• Refer to the following web sites for additional information on CIPA:– http://library.state.ak.us/usf/home.cfm

– http://www.merit.edu/usf/CIPAPA212Comparison.html

– http://www.ala.org/cipa

– http://www.aclu.org/issues/cyber/trial/ appeal.html

– http://www.safewiredschools.org/040601.html

– http://www.dpi.state.wi.us/dlcl/pld/cipafaq.html

– http://www.merit.edu/usf/CIPADocs.html


Resource Sites

• Refer to the following web sites for additional information on COPPA:– http://www.ftc.gov/privacy/coppafaqs.htm

– http://www.ftc.gov/ogc/coppa1.pdf

– http://www.ftc.gov/kidzprivacy


Concluding Remarks

Laurie Taylor

Manager, Planning and Funding

Michigan Information Network

517.241.0572

[email protected]

Documents

Internet Filtering Requirements The Acts, Some Facts, and How It All Ties in with E-rate Laurie Taylor Michigan Information Network August 15, 2001