Oportun

Bryan Hendricks, Director of Security Architecture, Oportun

I watched in horror last week as Judge Martin Glen interpreted Celsius's terms of use to mean that investor assets became Celsius property. The implication was that five hundred thousand crypto investors no longer owned the money they placed in Celsius accounts. I was also uncomfortable a couple of months earlier when someone noticed language in the PayPal terms of the agreement allowing PayPal to levy fines against users for promoting misinformation in a political climate where misinformation is a label that might mean opposing views. People are still arguing whether either of these problems with terms and conditions was deliberate. Whether or not these conditions were deliberate might be less significant than the reality that terms and conditions, terms of service, EULAs, and similar contracts can be used for nearly anything someone dares put in print.

I remember a time when it was fashionable within the technology industry to poke fun at these agreements. AWS included a zombie apocalypse clause in their Lumberyard gaming engine. A UK video game store included language which granted control over users' immortal souls (an April Fool's prank). PC Pitstop offered money to a limited number of people who read the terms and followed the process to claim the money.

At some point along the way, people stopped laughing, and the purpose of terms and conditions expanded from protecting the company from litigious customers and expanded into claiming ownership and control of customer data. I have personal privacy reservations regarding that change, but I must also acknowledge the corresponding explosion in free and inexpensive services because companies were able to monetize our personal information.

Meanwhile, Senator Elizabeth Warren is steamrolling the Zelle platform's terms and conditions by asking the Consumer Fraud Protection Bureau to expand and clarify their regulations. On the one hand, I agree with Senator Warren. When fraudsters victimize Zelle customers without any involvement or participation on the part of the customer, she might be correct in requiring customers to be reimbursed. However, Senator Warren also seems to expect Zelle to reimburse customers who fall victim to scams and actively participate in sending money to the scammers via the Zelle platform. I am not impressed by that argument, but my opinion is not the one that matters. If Senator Warren prevails, the new regulations will not just impact Zelle. They will impact the whole industry.

"We are witnessing a slow-motion collision. the wild west nature of legacy terms and conditions is colliding with politic"

Is the current wild west nature of software terms and conditions bad enough that an intervention is required? Senator Warren firmly believes that an intervention is required. I would agree if I had a better alternative. I recently imagined a time when attorneys would pipeline their work to include peer reviews and static analysis of certain classes of legal documents like peer reviews, threat modeling, and software analysis which is now common in the software development life cycle. I even noticed code for a EULA scanner on GitHub. I doubt we have enough consensus regarding what language in a EULA is risky in order to make such a pipeline or tool meaningful. I wouldn't be surprised if regulation emerged faster than consensus.

We are witnessing a slow-motion collision. The Wild West nature of legacy terms and conditions is colliding with politics. I am skeptical that the industry will be able to agree on a standard set of principles in a timely manner. The net effect is likely to be an externally imposed set of standard principles in the form of government regulation. Of course, we will probably continue to have wonderfully complex individual terms and conditions to govern everything else.