I'm not contending that her silly contractual statement has any legal weight; in fact, I'd be stunned if it did. I'm just arguing that this doesn't prevent archive.org from being liable for copyright infringement if they copied her web site without permission.
Oops! Looks like somebody doesn't understand the internet.
Oops! Looks like someone doesn't understand the law or the Internet.
Robots.txt is the way to block web spiders from your site.
robots.txt is an optional protocol. It has no special standing in law, nor does it force spiders not to index or copy a site if they choose to ignore it.
When you have a blank or non-existant robots.txt, it's understood by billions of people on the internet that you don't mind if web spiders crawl your site and add it to their index, make cached copies, etc.
Oh, spare us your feeble attempt at hyperbole. I doubt that there are 1,000,000 people in the world who know about robots.txt, never mind 1,000,000,000s. The vast majority of Internet users today are not geeks, and have never heard of these obscure protocols, yet they still publish information on the web.
Also, every person who visits your site gets a complete copy of the pages they visit in their browser cache. Once your page is cached in my browser, I have that information forever. I can delete it, view it, save it to CD, make a PDF, etc.
If you can't appreciate the difference between a private copy of information made on a single computer during routine browsing and a public copy of information that is being republished without permission by a third party then I'm afraid you're woefully unqualified to be in this discussion. For all the bluster in your post, nothing in it has the slightest legal or ethical merit.
You know that in some places, recording someone in a dubious state of undress without their permission and then publishing the results would be illegal, right? Just because you can observe something right now, it doesn't mean you have the right to record it and give copies to others. This could be damaging in many different contexts, and that's why we have laws that restrict the freedom to do it.
Internet Archive took the site down per their opt-out policy when she requested it.
Perhaps, but they had no right to copy it in the first place. They do not have any legal authority to go around instigating "opt out" policies, and the fact that they removed the content when asked or that the complainant may otherwise be an unwholesome character do not change this.
People shouldn't put things online that might come back to bite them.
No, they shouldn't. But millions and millions of people do, and one can reasonably argue that the law should protect huge numbers of people making mistakes that are only human and can have potentially horrible consequences at the expense of supporting a small number of businesses (or public organisations) providing "services" with unproven benefits.
Wait, so ISP caches are ok because they'll probably be deleted fairly soon whereas Archive.org isn't because they hold on to it longer?
No. ISP caches are somewhat dubious anyway (for example, they damage web hosts by messing up server statistics) but more importantly here, they play a very different role to the original web server, while archive.org is in the same field.
Personally, I've never understood why there is so much hate for archive.org on Slashdot.
I don't hate archive.org, but (a) I just don't like the principle of taking others' work without permission, either ethically or legally, and (b) I have never yet seen them present an accurate copy of any web site I've maintained, while they have had numerous incomplete or poorly rendered versions that give a bad impression of the sites I carefully maintain.
I guess you do lose some ability to quickly retract all trace of your page from the internet (although even that is an illusion, unless your site was obscure chances are people have quoted from it and talked about it somewhere, and you can't erase other people's posts nearly as easily).
I've discussed the liabilities of permanent archive and argued that it isn't automatically a good thing elsewhere in this discussion.
Do you know how many protocols are in use, just during basic web surfing or e-mail use? Why should these conventions (and that's all they are; some of them are explicitly optional requests, even according to their own definitions) trump the law of the land, just because we're on the Internet?
I'm afraid I don't accept either your premise that these things should be opt-out, nor that archive.org really provides a "HUGE" net benefit. I commented on this elsewhere in this discussion.
Indexing the web as it currently stands (or at least, very recently stood) is nothing like the same as republishing entire web sites that are no longer publicly available. Nothing in my previous post implies that legitimate search engine activity would be barred, not least because the copies made for that purpose are likely to fall under fair use (or local near-equivalent) exemptions.
Er, yes, someone should sue you for starting a DoS attack like that, and they should win.
The fact that the site and its operator are engaged in dubious behaviour does not justify engaging in dubious behaviour yourself, nor encouraging others to do so as you are doing here.
And other than the distinction of digital vs physical media, this is different than a library storing old newspapers how?
Because the library paid for the original copy, and doesn't republish it in duplicate at a later date, for two things.
I think this is a case where copyright law is broken / not yet ready for this new digital world in which we live. Archive.org is a logical, (I would say obvious, but what do I know?) useful tool. It provides ways for anyone who wishes to to opt out, before OR after the fact. But by making it opt in, you would be negating it's usefulness.
I both agree and disagree. There is certainly a potentially useful service here, but also a potentially damaging one.
I wonder if, in a few years' time, we won't look back at the "liberal" information exchange of today's Internet and realise that we went too far. There is not automatically value in preserving everything that was ever published; people make mistakes, and a great many people have avoided suffering unreasonably from an innocent mistake or moment of madness in their youth because memories fade. Unless, of course, your personal details and intimate memories are preserved by archives of today's social networking sites, personal blogs, and so on.
I would rather we gave up on robots.txt as an obscure and backwards approach, and instead saw Internet standards bodies pushing for a widely-known opt-in convention that could make it clear to search engines, archives, caches and the like what content was intended to be available for these uses. I suspect many legitimate, informative sites would quickly adopt such a convention, and it would remove all risk from organisations like libraries and searching/caching services who are on shaky legal ground right now. At the same time, it wouldn't inadvertently preserve information that could be all too damaging later on, yet has little if any real value to society.
Her site shows up in Google, I wonder why she hasn't sued them? Could it be that she likes the exposure of the big search engine, but doesn't want any history of her site archived by the Internet Archive?
And that's her choice. No-one's forcing search engines to store her content, but what they do (distinguishing here between things like Google's search engine and Google Cache) is quite different to the Internet Archive's activity.
I'm wondering how many people here really read the article, or are thinking about the deeper issues. It seems to me that this woman's web site and her past actions are a bit messed up, and the court has rightly thrown out much of her case. That doesn't excuse any poor behaviour by archive.org earlier on, however.
No it's not an excuse. By placing her information on the internet, she must comply with the standards of the internet.
Says who? Much of the Internet -- both service providers and uses -- doesn't comply with those standards that are widely known and fundamental. robots.txt and its ilk are neither.
If you were to use a felt tip marker to put your copytight notice on a braille flyer, but didn't put the notice in braille, and someone who read the braille and was incapable of reading the marker then sent that notice to their friends, I suspect they would not be in violation of the copyright notice.
Your argument is a straw man. Copyright is opt-out, not opt-in. It is your hypothetical blind reader's responsibility to ensure that copying the notice does not violate copyright. The fact that he/she can't read any specific notice is entirely irrelevant.
OK, since we've got here already, let me preempt the next 500 factually incorrect "moral high ground" type posts.
Fallacy: By putting your content on the web, you're giving permission for archive sites to duplicate it.
Reality: By putting your content on the web, you're giving permission for visitors to read it. Under the law in many jurisdictions, they are also allowed to make personal copies of the work under "fair use" style legislation. However, nothing about this gives any permission to republish it in any jurisdiction I know of, and indeed it's hard to see how it could do for any nation that is a signatory to the major WIPO treaties. Even if this were the case, such permission would be implicit, and there was an explicit notice on the web site in this case making her wishes clear.
Fallacy: She should have just used robots.txt/<meta> tags/whatever instead.
Reality: This argument fails for several reasons. Firstly, these protocols are optional; they have no special legal weight. Secondly, not everyone is aware of these conventions, so while using them might count for something, failure to do so is unlikely to mean anything in law unless knowledge of them and ability to use them effectively is demonstrated. Thirdly, copyright is not opt-in, it is opt-out.
Fallacy: This isn't fair: software can't read arbitrary contracts!
Reality: This is not her problem. If someone wants to use software to copy stuff that isn't theirs, it is their responsibility to make sure that doing so is legal.
Fallacy: What archive.org is doing is just like keeping information in a browser or ISP cache.
Reality: Again, this analogy is flawed for several reasons. Browser caches are for personal use, and do not republish work to others. ISP caches are part of the Internet infrastructure, and their use is transient, while the use of archive.org is not necessary to normal web browsing. ISP caches will typically update or remove pages fairly quickly after the original is updated or removed from the web, while archive.org is intended to preserve sites in perpetuity and redisplay them to others.
Perhaps I'm misunderstanding your objection. I don't see a problem with lending out a copy of a work you have fairly bought for others to enjoy temporarily (regardless of media type). What I do see a problem with is lending works out so that others can then make copies for themselves to keep instead of buying originals. That collective act is no longer simple lending, it is duplication, and contrary to the very principle of copyright. Your earlier post -- at least, the part of it I quoted -- seemed to be saying that you thought this was OK too.
This means that when you lend a friend a CD, you probably have to rely on fair use, which is fine for ordinary lending, I'm sure, but probably no good if you're doing so for the purpose of having them make copies as a substitute for having to buy their own.
Additionally, a lot of jobs these days require commitment from employees that extends beyond the office, in the way of blackberries, VPN access, etc.
But do they, really? Or is it just easier to try the old "you're on salary, you work undefined hours" cop out rather than hiring enough people to actually provide the necessary cover at all times when it's required?
This is another trend that should be stomped on, hard, by workers. Being legitimately on call, and compensated fairly for it, is one thing. Indeed, it's a necessary part of certain jobs. But for most people, being connected with work 24/7, checking mail from home, getting calls on your spare time, is all just another abuse.
Some time pretty soon, I think the mainstream software industry is going to start fragmenting into much smaller, more dynamic businesses. The simple fact is that good people could write the same code for themselves or a small company that they part-owned as they write for a faceless megacorp, and it would be worth just as much to customers.
In other industries, with more physical products, there is a need for some centralisation of resources to produce products efficiently. However, this is not the case in a knowledge-based industry like software development.
Moreover, it used to be the case that working for a larger company provided some degree of security and relieved some of the burdens that the self-employed contractor would have to deal with. These days, large companies attempt to impose increasingly one-sided employment contracts that stretch well outside normal office hours, and fire people at the drop of a hat if a product isn't selling.
There simply isn't a compelling reason for good people to work for anyone but themselves, or a partnership with valued colleages, any more. In that environment, they don't get bossed around by ignorant managers, aren't subject to large company bureaucracy and overheads, get to do what they really think is the best thing, and most important of all, take home all of the profits instead of giving most of them to an employer that does precious little to justify that privilege.
Consider that other knowledge/skill-based industries have worked this way for a long time: think about lawyers and accountants. There isn't really much need for huge, monolithic software companies any more, and if you're going to get something bespoke done to improve your business, there's more benefit in getting a small, customer-friendly, and highly skilled team to do it for you than there is in buying some off-the-shelf ERP system or something and then wasting countless hours of employee time across your whole business because of the inefficiencies of using a generic product that isn't written very well, and comes complete with many bugs, little user friendliness, and often even less support from the vendor. In a more distributed, localised industry, everyone wins... except the big software companies who like to abuse good people and take most of the profits, whose free lunch is well and truly over.
The irony of your post, funny as it is, is that what you describe would pretty much be the result in real life if all these posters from Draco's School of System Administration took their arguments about regulation, liability, and the like to their logical conclusions.
You assume too much. There are, in fact, two possibilities here:
The GP poster is way too full of himself.
The GP poster really is that good, and is making a valid point.
Then again, I'm writing this as someone in a somewhat similar position to the GP poster, so presumably I'm way too full of myself as well, and the objectively measurable targets I've hit over the past year are less important than the fact that I take a break for a few minutes and read random web sites several times during the typical working day?
So who's to blame when your gmail account gets cracked and your company's IP gets stolen? Your sysadmins for "forcing" you to use gmail?
Well, since it sounds like they really did force the use of an outside service in order for someone to get their job done, despite requests being made through the appropriate channels for a "legitimate" alternative... Yes, the IT idiots in this case should carry 100% of the liability for the damage.
I always wonder at the idiocy of senior IT people in these discussions. Our lot are little better. The local IT guys are fine, but the senior, "worldwide" level guys are morons. They mandate aggressive e-mail blocking be used at a system level, and officially they ban all webmail services too. Those aggressive e-mail blocking policies are not documented in any way accessible to the mere code monkeys like me. As a direct result, we have lost everything from scripts going across the office (I work in a software development organisation, so we share these things with colleagues all the time) to urgent messages to paying customers.
There is simply no excuse for the IT group to impose such draconian measures. Before we were eaten by a US megacorp, we ran as a small, privately-owned UK company, with a level of security problems tending to 0%. Since the US morons got to run the show, we've had virus outbreaks, losses in connectivity to just about every system we depend on (even stuff that should be entirely local within our physical office building, because it's all routed through "centralised" IT systems outside), a huge rise in spam e-mail that makes it through the filters (which, trust me, has very little to do with the recent waves of increased spam activity, and much more to do with poorly configured filters), and so on. A cynic (or a realist) might reasonably conclude that the IT policies do not, in fact, increase the security of our office at all, yet they demonstrably do damage our legitimate business use of the IT systems.
You know what our local, sensible IT guys say?
Nothing, officially, of course, but unofficially, they just say use what works and make sure you take the appropriate precautions. So we circumvent the various "safety" features when they get in the way, and since the central IT morons are too stupid to understand why their own policies are messed up, they're also too stupid to even notice we're doing it. And if they did notice one day and moan about it, basically our entire office would quit, so perhaps that's for the best.
If it is not work related then you shouldn't be sending or receiving it while at work.
Hey, you could try banning personal phone calls at work, too. Let us know how that works out for you in a couple of years... if you're still in business.
Seriously, employees do not cease to become human when they walk through the office door. It is unreasonable (and indeed illegal, in some places) to expect them to work like machines, denied access to private communication with anyone outside the business during office hours, denied time off when they're sick or for medical check-ups, and so on.
Fortunately for all of us, it's rarely necessary to invoke such laws. Companies that abuse their staff (and that's exactly what this sort of thing is) will simply see all their staff walk, starting with the really good people, who find it easiest to find more pleasant conditions elsewhere. Meanwhile, companies with more enlightened, employee-friendly policies eat up good people for very modest costs and wonder what the problem is all about.
You are correct. However most EULAs have also got the weasel out clauses built into them.
You are correct. However, as you seem to have noticed yourself, there is this teensy weensy little issue of having no legal weight whatsoever. In many jurisdictions, you can't disclaim warranties of fitness for purpose etc. however many lawyerly weasel words you put into the "contract". Of course, whether EULAs can constitute valid contracts in the first place is a mostly untested question in many jurisdictions, too. In any case, if someone's text editor or video game, for which I paid good money, proceeded to hose my PC because of programmer negligence, I rather doubt any court in my country would side with the software vendor and uphold all the disclaimers, limits on damages to the original purchase price, and so on. But we won't know for sure until someone really does make that mistake, or the damage caused by crappy security and/or reliability in mainstream products results in a high profile case that gets (or doesn't get) a big damages award in a high-level court.
How about what the law decides? In most places, there is a legal requirement along the lines of "fitness for purpose" or similar. If the goods aren't, then their technical support needs to fix that, or they should expect the goods to be returned as unfit.
The problem is that too many executives don't care about the obvious, or even what their own good people tell them. Instead, they believe what they're told by expensive consultants and the studies those consultants produce.
This isn't to say that consultants can't be valuable. Some consultants really do bring broad experience of things that work, deep thinking about what else could help, and an aptitude for identifying how to match those things up with the company hiring them. Such experience is hard to find in a single place, no matter how good your people are. You just have to understand that these things are not the only things that matter, which is why good consultants often start by surveying the relevant parts of the company hiring them and talking to the people in the trenches a lot. (Unfortunately, the bad ones usually do the same thing, because it means they can search-and-replace in their canned forms and come up with something with little value but enough buzzwords to convince execs that hiring them was worthwhile.)
Slashdot Mirror
I'm not contending that her silly contractual statement has any legal weight; in fact, I'd be stunned if it did. I'm just arguing that this doesn't prevent archive.org from being liable for copyright infringement if they copied her web site without permission.
Oops! Looks like someone doesn't understand the law or the Internet.
robots.txt is an optional protocol. It has no special standing in law, nor does it force spiders not to index or copy a site if they choose to ignore it.
Oh, spare us your feeble attempt at hyperbole. I doubt that there are 1,000,000 people in the world who know about robots.txt, never mind 1,000,000,000s. The vast majority of Internet users today are not geeks, and have never heard of these obscure protocols, yet they still publish information on the web.
If you can't appreciate the difference between a private copy of information made on a single computer during routine browsing and a public copy of information that is being republished without permission by a third party then I'm afraid you're woefully unqualified to be in this discussion. For all the bluster in your post, nothing in it has the slightest legal or ethical merit.
You know that in some places, recording someone in a dubious state of undress without their permission and then publishing the results would be illegal, right? Just because you can observe something right now, it doesn't mean you have the right to record it and give copies to others. This could be damaging in many different contexts, and that's why we have laws that restrict the freedom to do it.
Perhaps, but they had no right to copy it in the first place. They do not have any legal authority to go around instigating "opt out" policies, and the fact that they removed the content when asked or that the complainant may otherwise be an unwholesome character do not change this.
No, they shouldn't. But millions and millions of people do, and one can reasonably argue that the law should protect huge numbers of people making mistakes that are only human and can have potentially horrible consequences at the expense of supporting a small number of businesses (or public organisations) providing "services" with unproven benefits.
No. ISP caches are somewhat dubious anyway (for example, they damage web hosts by messing up server statistics) but more importantly here, they play a very different role to the original web server, while archive.org is in the same field.
I don't hate archive.org, but (a) I just don't like the principle of taking others' work without permission, either ethically or legally, and (b) I have never yet seen them present an accurate copy of any web site I've maintained, while they have had numerous incomplete or poorly rendered versions that give a bad impression of the sites I carefully maintain.
I've discussed the liabilities of permanent archive and argued that it isn't automatically a good thing elsewhere in this discussion.
Do you know how many protocols are in use, just during basic web surfing or e-mail use? Why should these conventions (and that's all they are; some of them are explicitly optional requests, even according to their own definitions) trump the law of the land, just because we're on the Internet?
I'm afraid I don't accept either your premise that these things should be opt-out, nor that archive.org really provides a "HUGE" net benefit. I commented on this elsewhere in this discussion.
Indexing the web as it currently stands (or at least, very recently stood) is nothing like the same as republishing entire web sites that are no longer publicly available. Nothing in my previous post implies that legitimate search engine activity would be barred, not least because the copies made for that purpose are likely to fall under fair use (or local near-equivalent) exemptions.
Er, yes, someone should sue you for starting a DoS attack like that, and they should win.
The fact that the site and its operator are engaged in dubious behaviour does not justify engaging in dubious behaviour yourself, nor encouraging others to do so as you are doing here.
Because the library paid for the original copy, and doesn't republish it in duplicate at a later date, for two things.
I both agree and disagree. There is certainly a potentially useful service here, but also a potentially damaging one.
I wonder if, in a few years' time, we won't look back at the "liberal" information exchange of today's Internet and realise that we went too far. There is not automatically value in preserving everything that was ever published; people make mistakes, and a great many people have avoided suffering unreasonably from an innocent mistake or moment of madness in their youth because memories fade. Unless, of course, your personal details and intimate memories are preserved by archives of today's social networking sites, personal blogs, and so on.
I would rather we gave up on robots.txt as an obscure and backwards approach, and instead saw Internet standards bodies pushing for a widely-known opt-in convention that could make it clear to search engines, archives, caches and the like what content was intended to be available for these uses. I suspect many legitimate, informative sites would quickly adopt such a convention, and it would remove all risk from organisations like libraries and searching/caching services who are on shaky legal ground right now. At the same time, it wouldn't inadvertently preserve information that could be all too damaging later on, yet has little if any real value to society.
And that's her choice. No-one's forcing search engines to store her content, but what they do (distinguishing here between things like Google's search engine and Google Cache) is quite different to the Internet Archive's activity.
I'm wondering how many people here really read the article, or are thinking about the deeper issues. It seems to me that this woman's web site and her past actions are a bit messed up, and the court has rightly thrown out much of her case. That doesn't excuse any poor behaviour by archive.org earlier on, however.
Says who? Much of the Internet -- both service providers and uses -- doesn't comply with those standards that are widely known and fundamental. robots.txt and its ilk are neither.
Your argument is a straw man. Copyright is opt-out, not opt-in. It is your hypothetical blind reader's responsibility to ensure that copying the notice does not violate copyright. The fact that he/she can't read any specific notice is entirely irrelevant.
OK, since we've got here already, let me preempt the next 500 factually incorrect "moral high ground" type posts.
Fallacy: By putting your content on the web, you're giving permission for archive sites to duplicate it.
Reality: By putting your content on the web, you're giving permission for visitors to read it. Under the law in many jurisdictions, they are also allowed to make personal copies of the work under "fair use" style legislation. However, nothing about this gives any permission to republish it in any jurisdiction I know of, and indeed it's hard to see how it could do for any nation that is a signatory to the major WIPO treaties. Even if this were the case, such permission would be implicit, and there was an explicit notice on the web site in this case making her wishes clear.
Fallacy: She should have just used robots.txt/<meta> tags/whatever instead.
Reality: This argument fails for several reasons. Firstly, these protocols are optional; they have no special legal weight. Secondly, not everyone is aware of these conventions, so while using them might count for something, failure to do so is unlikely to mean anything in law unless knowledge of them and ability to use them effectively is demonstrated. Thirdly, copyright is not opt-in, it is opt-out.
Fallacy: This isn't fair: software can't read arbitrary contracts!
Reality: This is not her problem. If someone wants to use software to copy stuff that isn't theirs, it is their responsibility to make sure that doing so is legal.
Fallacy: What archive.org is doing is just like keeping information in a browser or ISP cache.
Reality: Again, this analogy is flawed for several reasons. Browser caches are for personal use, and do not republish work to others. ISP caches are part of the Internet infrastructure, and their use is transient, while the use of archive.org is not necessary to normal web browsing. ISP caches will typically update or remove pages fairly quickly after the original is updated or removed from the web, while archive.org is intended to preserve sites in perpetuity and redisplay them to others.
Perhaps I'm misunderstanding your objection. I don't see a problem with lending out a copy of a work you have fairly bought for others to enjoy temporarily (regardless of media type). What I do see a problem with is lending works out so that others can then make copies for themselves to keep instead of buying originals. That collective act is no longer simple lending, it is duplication, and contrary to the very principle of copyright. Your earlier post -- at least, the part of it I quoted -- seemed to be saying that you thought this was OK too.
<obligatory> RIAA Lawyer: I sue dead people. </obligatory>
And the problem with that is...?
But do they, really? Or is it just easier to try the old "you're on salary, you work undefined hours" cop out rather than hiring enough people to actually provide the necessary cover at all times when it's required?
This is another trend that should be stomped on, hard, by workers. Being legitimately on call, and compensated fairly for it, is one thing. Indeed, it's a necessary part of certain jobs. But for most people, being connected with work 24/7, checking mail from home, getting calls on your spare time, is all just another abuse.
Some time pretty soon, I think the mainstream software industry is going to start fragmenting into much smaller, more dynamic businesses. The simple fact is that good people could write the same code for themselves or a small company that they part-owned as they write for a faceless megacorp, and it would be worth just as much to customers.
In other industries, with more physical products, there is a need for some centralisation of resources to produce products efficiently. However, this is not the case in a knowledge-based industry like software development.
Moreover, it used to be the case that working for a larger company provided some degree of security and relieved some of the burdens that the self-employed contractor would have to deal with. These days, large companies attempt to impose increasingly one-sided employment contracts that stretch well outside normal office hours, and fire people at the drop of a hat if a product isn't selling.
There simply isn't a compelling reason for good people to work for anyone but themselves, or a partnership with valued colleages, any more. In that environment, they don't get bossed around by ignorant managers, aren't subject to large company bureaucracy and overheads, get to do what they really think is the best thing, and most important of all, take home all of the profits instead of giving most of them to an employer that does precious little to justify that privilege.
Consider that other knowledge/skill-based industries have worked this way for a long time: think about lawyers and accountants. There isn't really much need for huge, monolithic software companies any more, and if you're going to get something bespoke done to improve your business, there's more benefit in getting a small, customer-friendly, and highly skilled team to do it for you than there is in buying some off-the-shelf ERP system or something and then wasting countless hours of employee time across your whole business because of the inefficiencies of using a generic product that isn't written very well, and comes complete with many bugs, little user friendliness, and often even less support from the vendor. In a more distributed, localised industry, everyone wins... except the big software companies who like to abuse good people and take most of the profits, whose free lunch is well and truly over.
The irony of your post, funny as it is, is that what you describe would pretty much be the result in real life if all these posters from Draco's School of System Administration took their arguments about regulation, liability, and the like to their logical conclusions.
Oh, man. Working with VBS files is pretty bad, but you use notepad? Your life is teh sux0r. :-)
You assume too much. There are, in fact, two possibilities here:
Then again, I'm writing this as someone in a somewhat similar position to the GP poster, so presumably I'm way too full of myself as well, and the objectively measurable targets I've hit over the past year are less important than the fact that I take a break for a few minutes and read random web sites several times during the typical working day?
Well, since it sounds like they really did force the use of an outside service in order for someone to get their job done, despite requests being made through the appropriate channels for a "legitimate" alternative... Yes, the IT idiots in this case should carry 100% of the liability for the damage.
I always wonder at the idiocy of senior IT people in these discussions. Our lot are little better. The local IT guys are fine, but the senior, "worldwide" level guys are morons. They mandate aggressive e-mail blocking be used at a system level, and officially they ban all webmail services too. Those aggressive e-mail blocking policies are not documented in any way accessible to the mere code monkeys like me. As a direct result, we have lost everything from scripts going across the office (I work in a software development organisation, so we share these things with colleagues all the time) to urgent messages to paying customers.
There is simply no excuse for the IT group to impose such draconian measures. Before we were eaten by a US megacorp, we ran as a small, privately-owned UK company, with a level of security problems tending to 0%. Since the US morons got to run the show, we've had virus outbreaks, losses in connectivity to just about every system we depend on (even stuff that should be entirely local within our physical office building, because it's all routed through "centralised" IT systems outside), a huge rise in spam e-mail that makes it through the filters (which, trust me, has very little to do with the recent waves of increased spam activity, and much more to do with poorly configured filters), and so on. A cynic (or a realist) might reasonably conclude that the IT policies do not, in fact, increase the security of our office at all, yet they demonstrably do damage our legitimate business use of the IT systems.
You know what our local, sensible IT guys say?
Nothing, officially, of course, but unofficially, they just say use what works and make sure you take the appropriate precautions. So we circumvent the various "safety" features when they get in the way, and since the central IT morons are too stupid to understand why their own policies are messed up, they're also too stupid to even notice we're doing it. And if they did notice one day and moan about it, basically our entire office would quit, so perhaps that's for the best.
Hey, you could try banning personal phone calls at work, too. Let us know how that works out for you in a couple of years... if you're still in business.
Seriously, employees do not cease to become human when they walk through the office door. It is unreasonable (and indeed illegal, in some places) to expect them to work like machines, denied access to private communication with anyone outside the business during office hours, denied time off when they're sick or for medical check-ups, and so on.
Fortunately for all of us, it's rarely necessary to invoke such laws. Companies that abuse their staff (and that's exactly what this sort of thing is) will simply see all their staff walk, starting with the really good people, who find it easiest to find more pleasant conditions elsewhere. Meanwhile, companies with more enlightened, employee-friendly policies eat up good people for very modest costs and wonder what the problem is all about.
You are correct. However, as you seem to have noticed yourself, there is this teensy weensy little issue of having no legal weight whatsoever. In many jurisdictions, you can't disclaim warranties of fitness for purpose etc. however many lawyerly weasel words you put into the "contract". Of course, whether EULAs can constitute valid contracts in the first place is a mostly untested question in many jurisdictions, too. In any case, if someone's text editor or video game, for which I paid good money, proceeded to hose my PC because of programmer negligence, I rather doubt any court in my country would side with the software vendor and uphold all the disclaimers, limits on damages to the original purchase price, and so on. But we won't know for sure until someone really does make that mistake, or the damage caused by crappy security and/or reliability in mainstream products results in a high profile case that gets (or doesn't get) a big damages award in a high-level court.
How about what the law decides? In most places, there is a legal requirement along the lines of "fitness for purpose" or similar. If the goods aren't, then their technical support needs to fix that, or they should expect the goods to be returned as unfit.
The problem is that too many executives don't care about the obvious, or even what their own good people tell them. Instead, they believe what they're told by expensive consultants and the studies those consultants produce.
This isn't to say that consultants can't be valuable. Some consultants really do bring broad experience of things that work, deep thinking about what else could help, and an aptitude for identifying how to match those things up with the company hiring them. Such experience is hard to find in a single place, no matter how good your people are. You just have to understand that these things are not the only things that matter, which is why good consultants often start by surveying the relevant parts of the company hiring them and talking to the people in the trenches a lot. (Unfortunately, the bad ones usually do the same thing, because it means they can search-and-replace in their canned forms and come up with something with little value but enough buzzwords to convince execs that hiring them was worthwhile.)