With the borderless nature of the internet  , the ambit of state interference regarding individuals and their actions has become ever more relevant, as technology has brought about challenges in respect to jurisdiction and enforcement of domestic legislation and human rights obligations. Actions that in the offline context are clear in a legal and societal sense have proven to be challenging in the online sphere. This poses questions concerning whether human rights obligations of states are being upheld in the online sphere, or if going online enacts a different standard for states to measure up to.
With respect to human rights, the role of states has been described as threefold: the obligation to respect, to protect and to fulfil human rights. The obligation to protect necessitates that individuals within the jurisdiction of a state should enjoy the protection of their rights. When, due to internet architecture a state cannot uphold its role as guarantor of human rights in the online sphere, what is the acceptable outcome from a legal perspective? Does the domestic legislation have to be put aside for the greater good of a free internet, or does the situation undermine human rights protection on a domestic level? The answers to these questions can vary, but this paper will examine the case of online revenge porn.
With the enhanced distribution possibilities the internet brings, online revenge porn has gained more attention as reports show that the act can cause serious consequences for victims. Research and reported cases have led to criticism of states and their lack of legal and executive means to protect victims, not least due to jurisdictional issues.  Domestic calls for criminalization of the posting of revenge porn have been responded to with arguments for freedom of expression, worries that such means will contribute to a fragmented internet, and of a slippery slope of state interference online. Further, as revenge porn touches upon the balancing between competing human rights, the outsourcing of human rights assessment to private entities could become a point of discussion.
In order to address this issue, I will first introduce and define the term revenge porn, draw out the main aspects, and summarize a trend for criminalization of such acts. Next I will address aspects of the international human rights framework highlighting the current legal obligations for states bound by the European Convention on Human Rights.  Thereafter I will look at jurisdictional issues that arise in cases of cross jurisdictional nature. Then I will briefly address the role of private entities such as social media platforms and hosting services before summarizing the main issues.
The term revenge porn already poses a problem in terms of definition. Since introduced, the term has been used in public discourse as an acronym for unconsented distribution of sexual or intimate material, often with personal information attached, and intent to inflict harm or damage to the person depicted.  The material can have been produced with or without the consent or knowledge of the person depicted, it´s sharing intended for personal use and not wider distribution, and with or without malicious intent of the distributor. This wide variation in circumstances has led to criticism of the term claiming it to be misleading,  resulting in calls for a different terminology such as, “non-consensual pornography” (NCP).  The Oxford dictionaries definition: “revealing or images or of a person posted on the Internet, typically by a former sexual partner, without the of the subject and in order to cause them or ”,  shows that revenge is not always a key component of the act. However, cases show that the underlying intent to harm sometimes comes from an ex-lover scorned by the end of an intimate relationship with the person depicted.  The definition also refers to revenge porn as a phenomenon of the internet. It could be argued that this is unprecise terminology. Most of the acts and expressions that the internet provides us access to have been a part of human society for a long time. They just took place in a narrower frame with a more limited geographical and mass distribution compared to the internet. In the 1970s, the US magazine Hustler dedicated a specific section in their publications to the publishing of photos sent in by its readers and depicted naked women along with personal information such as their names and addresses, and as cases showed, sometimes without the consent of the women depicted. The publishing of such photos in the magazine ceased in the 1980s after one of the women featured sued the magazine as she had not given her consent for publishing.  This differs only from online revenge porn in terms of the platform the material is shared on, not the nature of the act, highlighting that not all components of the dictionary definition are precise.
Although the internet did not alter the concept, it has effected the amount. Material that could become revenge porn is increasingly digitally captured and stored on smartphones, now ubiquitous amongst teenagers,  such devices have made video recording and photographing ourselves and others, with or without their knowledge, an everyday event. Young people only know a connected world where the internet serves as a general platform for information, entertainment and social interaction, and generally embrace evolving dynamics in social media platforms even before their parents or carers have heard of them. Today’s young will also become of age in a connected world, something that differs from today’s professionals, researchers and policymakers. Mistakes and misbehavior that have been a part of teenagers’ and young people’s growth from the dawn of time are no longer left as a memory of younger times. Today, the memories of teenagers are stored on computer clouds, on hard drives and uploaded to social media platforms accessible to everyone, anywhere, at any time.  A recent study from the Internet Watch Foundation found that young people make and share self-generated sexual material  from an even younger age than previous research showed. During the three month period of the study, 269 cases of material depicted children deemed in the age-group of 7-10.  Almost 90% of the cases examined in the report detailed that the content had been forwarded or re-disseminated in cases where the child had shared the material with someone they trusted.  Such dissemination entails the risk of the material becoming revenge porn.
The common denominator distinguishing revenge porn from other sexual material online is that the dissemination is not consented to by the person depicted. Due to the lack of consent, the material can be used to pressure the individuals depicted or cause them harm, as the publishing of revenge porn can have serious reputational and academic/professional consequences for those portrayed.  Even if the material may have been shared with a partner as part of an intimate relationship, that does not mean that the material has been made available to the general public, nor does it imply consent that the material can be posted online.  Another common denominator is that due to the borderless nature of internet, domestic legislation and enforcement has struggled to fully grasp the phenomenon leaving those who fall victim to such acts feeling unprotected and let down by their domestic justice system. Indications suggest that revenge porn affects women disproportionately - or in 90% of the cases.  In her 2014 book, Hate Crimes in Cyberspace, Citron compares views towards revenge porn and online harassment of women to dominant views on domestic violence and sexual harassment in the work place being a private matter that could not be regulated which existed up until the mid- to late 1970s.  Her claim that online harassment of women, including revenge porn, must be criminalized has gained traction on both sides of the Atlantic. 
On 14 October 2014, the UK Crown Prosecution Service issued guidelines on how to prosecute cases of revenge porn. It stipulated that such acts could fall within the scope of existing legislation even if there was not a specific act criminalizing revenge porn.  The same applied in many European countries, where the posting of revenge porn could constitute a breach of civil law, and in certain cases lead to criminal charges such as, harassment, decency and defamation, without specific reference to revenge porn. Out of 149 cases on file from eight police precincts in England and Wales during the time of the issuance of the guidelines until April 2015 when revenge porn was criminalized in the UK, six cases resulted in charges or police caution. 
In March 2015 a District Court in Iceland convicted the 18 year old ex-boyfriend of a 17 year old girl for publishing naked photos of the girl on his Facebook page for a few minutes before deleting them from the social media platform. The girl had taken the photos in question herself and sent them to the defendant during their relationship. He confessed to the act and was sentenced to 60 days suspended imprisonment, for a violation of the decency and defamation clauses of the General Penal Code,  causing her harm and distress under the Tort Act,  and found in violation of the Child Protection Act.  He was ordered to pay the victim damages and to bear all costs for the court proceedings.  On 10 December 2015, the Icelandic Supreme Court upheld the judgement.  A month later, in January 2016, a bill was re-introduced to the Icelandic parliament proposing a legal amendment to the General Penal Code criminalizing revenge porn. The commentary to the draft bill states that it draws on the UK Criminal Justice and Courts Law enacted in April 2015.  As laid out in the commentary to the draft bill, it’s presentation to parliament is rooted in the notion that such serious attacks on a person’s personal integrity, protected under human rights, could not be overlooked by the criminal legislation, and despite the current legislation being applicable, further legislative actions were needed in order to provide victims of revenge porn sufficient protection to personal integrity and privacy as enshrined in the ECHR. 
This view corresponds with the picture Citron unveils concerning the application of a legal framework and remedies for victims of revenge porn in the United States of America.  The author claims that the current civil law remedies under tort and the copyright framework do not provide sufficient protection for individuals, as the financial cost of civil suits makes them an unrealistic choice for some.  Citron additionally claims that current criminal legal remedies will not protect victims of revenge porn sufficiently, as even in cases where criminal charges could be pursued against the distributor of the material, the lack of police capacity and outdated views towards online activity resulted in cases not being processed properly through the US justice system.  She argues that in order for states to protect victims of revenge porn, civil rights law should be amended to penalize online harassers.  Citron, alongside Professor Mary Ann Franks, has also drawn on social condemnation arguments in favor of criminalization of revenge porn  and has emphasized that invasion of privacy amounting to criminal liability is not a new notion. In their article Revenge Porn Should be Criminalized, Citron and Franks draw on Warren and Brandeis argument published in 1890 stating “[i]t would doubtless be desirable that the privacy of the individual should receive the added protection of the criminal law.” 
A critique on the legal and executive frameworks in respect to revenge porn has gained global media attention with a string of high profile cases,  reports of justice systems failing to protect victims of revenge porn, and the formation of advocacy groups and Non-Governmental Organizations (NGOs) that have pushed for the criminalization of revenge porn both in the US and in European countries.  These efforts have been somewhat successful, resulting in legal amendments in 26 US states, Israel  and a number of European countries, notably England and Wales in April 2015.  Draft bills have been presented recently to the Scottish  and Icelandic  parliaments respectively to criminalize the posting of revenge porn, and preparatory research work has taken place in Sweden  .
The first specific criminal legislation on revenge porn was passed in the US State of New Jersey in 2003.  Since then, 25 more States in the US have enacted legal reforms criminalizing the publishing of revenge porn. In most cases the perpetrator has to have had an intent to inflict harm and should have known that publishing the material was non-consensual.  This is the case in California, which is a relevant judicial precinct as many of social media sharing platforms operate under California law.  The legal amendments made to the UK Criminal Justice and Courts Law enacted in April 2015 are similar as the provision demands that the person was acting in bad faith and had the intention to inflict harm to the individual exposed.  Following the amendment  in April 2015, UK police authorities saw 200 cases of revenge porn reported from England and Wales. 
The NGO ‘End Revenge Porn’ states that the revenge porn legislation put in place in the U.S. state of Illinois provides the best protection for individuals harmed by revenge porn and at the same time provides a balanced approach to the freedom of expression protected by the First Amendment to the US Constitution.  In particular it is emphasized that the legislation not only applies to the person that posts the material initially, but also to subsequent distributors that should have known the material was not posted with the consent of the individual portrayed. The aim is to try and limit the distribution of the harmful material.
The international framework for the promotion and protection of human rights takes place in many contexts. The overarching role of the United Nations (UN) has a global effect, with what has been described as the international bill of rights  and a system of promotion and protection of human rights under the ambit of the UN Human Rights Council while stretching to every aspect of the UN system.  Further, regional cooperation in the field of human rights has become a strong part of the drive towards strengthening of human rights in domestic legal contexts. In wider Europe, the cooperation within the Council of Europe and the development of the Convention system  following the disastrous events of the World War in the mid-20th Century. Similar systems were set up on a regional basis in other parts of the world. 
It is generally undisputed that states are the main guarantors of human rights within their borders.  Their obligations have been described as threefold: the obligations to respect; to protect; and to fulfil human rights.  The responsibility to protect  has been described as a duty to protect individuals from human rights violations, entailing a responsibility to proactively prevent individuals from within their jurisdiction to not suffer human rights violations by third parties, be that individuals, groups or legal persons.  This includes ensuring preventive measures in place in order for threats of violation of rights of individuals not to materialize. An example of this is providing for a functioning police force that has balanced investigative powers. Under the classification, state responsibility also extends to situations where safeguards fail, and violations are caused by non-state actors, effectively necessitating that states shall ensure effective remedies for those who are violated against.  This is further stipulated through various regional  human rights instruments.
In the Council of Europe’s 2014 Recommendation Guide to human rights for internet users,  it is emphasized that states have to ensure that individuals can enjoy their rights effectively and that the obligations of states to respect, protect and promote human rights “include the oversight of private companies.”  The Council of Europe’s 2001 Cybercrime Convention  and recent human rights instruments, such as the Lanzarote Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse  explicitly address State obligations to tackle online activity through legislation and “other effective means”.
In the case of K.U. v. Finland of 2 December 2009 (Application No.), the European Court of Human Rights was presented with the case of a child whose information was posted by an anonymous person to a dating website insinuating that the child was interested in sexual relations with a grown man. No effective means were in place in order for the police to obtain information from relevant Internet Service Providers as to who posted the information, resulting in no one being found responsible for the harm caused to the child. In its findings the Court stated (Para. 42) that:
“…although the object of Article 8 is essentially to protect the individual against arbitrary interference by the public authorities, it does not merely compel the State to abstain from such interference: in addition to this primarily negative undertaking, there may be positive obligations inherent in an effective respect for private or family life…” and that “…these obligations may involve the adoption of measures designed to secure respect for private life even in the sphere of the relations of individuals between themselves…”(Para. 43).
The Court further noted that there were “difficulties involved in policing modern societies”, but a positive burden on the state to take measures in order to protect the applicants rights to privacy under Article 8 must be “interpreted in a way which does not impose an impossible or disproportionate burden on the authorities or, as in this case, the legislator…” while at the same time ensuring that “powers to control, prevent and investigate crime are exercised in a manner which fully respects the due process and other guarantees which legitimately place restraints on criminal investigations and bringing offenders to justice […]” 
Before ruling in favor of the applicant in the case, the Court noted a general principle (Para. 49) stating that:
“Although freedom of expression and confidentiality of communications are primary considerations and users of telecommunications and Internet services must have a guarantee that their own privacy and freedom of expression will be respected, such guarantee cannot be absolute and must yield on occasion to other legitimate imperatives, such as the prevention of disorder or crime or the protection of the rights and freedoms of others. […] [I]t is nonetheless the task of the legislator to provide the framework for reconciling the various claims which compete for protection in this context …”
The Court’s findings in the case highlight the competing rights that come into play when examining revenge porn in the context of human rights – the freedom of expression on one hand, and the rights to privacy and personal integrity on the other.
Freedom of expression is closely linked to the fundamental elements of democracy and democratic principles.  The scope of state interferences on actions of individuals and legal persons on the internet has revolved around the core issue of freedom of expression. One of the main arguments against states setting up legal safeguards as described in Section A.II., is that categorical restrictions on the freedom of expression will undermine the free nature of the internet leading to its fragmentation and, subsequently, collapse. The general argument goes that, although well intentioned, it could prove to be a slippery slope towards censorship on the internet.  Some governments have tried means such as internet censorship to create “national” intranets in line with national borders to maintain their legal and sovereign powers online as well as offline.  This has proved challenging in practice but has not dissuaded states from pursuing such initiatives on a domestic and international level.  That does not alter the scope of obligation of states, as the UN Human Rights Council and the Council of Europe´s Committee of Ministers  have both specifically declared that human rights shall apply equally online and offline. 
The core human rights document of the United Nations is the Universal Declaration of Human Rights adopted in 1948.  Article 19 of the declaration stipulates that the freedom of opinion and expression applies regardless of the medium used and irrespective of frontiers. The importance of the right is further stated in Article 19 of the subsequent International Covenant on Civil and Political Rights where conditions for interference with the freedom of expression are laid out.  Furthermore, according to Article 20, states are obliged to restrict expression that can threaten peace and security. 
Regional cooperation and conventions in the field provide additional stakes in the safeguards of the competing rights. States that are subject to the European Convention System can rely on the Convention text  but also extensive case law from the Strasbourg Court for guidance in the balancing act between freedom of expression and the factors that can be limiting to it, such as the rights of others and societal interests.  The Court has established that the protection provided to the freedom of expression under Article 10 does not apply to all expression as the Court has found that expressions that go against the fundamental values of the Convention will not be tested before the Court and will be deemed under the scope of Article 17, prohibiting the misuse of the Convention.  Nevertheless the Court has stated that Article 10 protects not only “‘information’ or ‘ideas’ that are favorably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb the State or any sector of the population.”  Thus, offensive expression can enjoy the protection of the Convention under Article 10, although it may be subject to limitations under paragraph 2, such as in the interests of the rights of others. Rights of others includes among other things the rights protected under Article 8. The borders between these rights have been tested in a number of cases regarding defamation and media freedom of expression. In the case RUSU v. Romania of 8 March 2016 (Application No. 25721/04) the Court stated:
“[…] Lastly, in cases which require the right to respect for private life to be balanced against the right to freedom of expression, the Court considers that the outcome of the application should not, in theory, vary according to whether it has been lodged with the Court under Article 8 of the Convention by the person who was the subject of the news report, or under Article 10 by the publisher. Indeed, as a matter of principle these rights deserve equal respect […]” (Para. 24).
From the above it could be established that in states bound by the ECHR, freedom of expression does not exist without limitations neither online nor offline. This indicates that there exists no such right as to exercise freedom of expression without any regard to a wider context such as the rights of others. John Stuart Mill argued: “[…] even opinions lose their immunity, when the circumstances in which they are expressed are such as to constitute […] a positive instigation to some mischievous act.”  Although written in another time, the principle seems to still apply. The dissemination of expression such as a photo depicting a naked person can be a perfectly valid action that deserves the full protection of the freedom of expression. But the context that such dissemination takes place in is of utmost importance when examined from a human rights perspective. In the context of revenge porn, the rights of others (the person depicted) weighs heavily against the disseminator’s freedom of expression.
The role of the state in a democratic society is a topic of endless discussion and the subject of many more disciplines than law. The digital dimension does not simplify the matter. Law provides only a part of the picture. Framed in national constitutions and described in international and domestic legislation, the solutions legislation provides is bound by the notion of the nation state and both its application and enforcement limited to state jurisdictions. Human rights obligations provide principles for the states, but their application depends on various factors such as political stability and culture. States’ varied compliance of fundamental values further add to the lack of coherence. This colorful palette framed within the human rights framework raises the question of how much is enough for states to do in order to uphold their responsibility to protect?
The measurement for success in terms of effective human rights protection has usually ensued in application or enforcement of legislation. As discussed above, reports indicate that very few cases have been decided on the basis of the recent revenge porn legislation in the UK, so the effectiveness of the legislation is yet to be determined. Experience from the US shows that although some legal safeguards are in place, they may not be effective.  In 74% of Web Index countries, the Web Foundation found that domestic justice systems are failing to take appropriate actions for violence against women online - revenge porn being listed as an example of such violence.  A recent study on crimes committed via the internet by The Swedish National Council for Crime Prevention states that 96% of cases reported to the police will not go further within the justice system.  Out of the cases that the police examined but were found to have insufficient evidence to proceed, the main reason was that technical information was lacking to establish who the perpetrator was. According to the police, the main reason was that the social media and ISPs holding the information were not willing to provide the police with the information despite such evidence being a necessary component of the investigation. Police expressed that the biggest problem was when dealing with companies outside of Swedish jurisdiction; in particular companies that were under US jurisdiction.  The Icelandic police claims that it faces the same problem in dealing with sites set up to share naked photos of women and girls, and despite using the international legal assistance scheme, they have run into the same barriers as their Swedish counterparts. An Icelandic Police officer summed up the situation stating: “cases like these are difficult for the police, in particular when the websites are foreign. We cannot control the internet.” 
The global nature of the internet does not abide to the same borders as states, adding a new dimension to the jurisdiction of states.  The internet is not wholly bound by nations, cultures, or geo-borders, but is in no way unaffected by those factors. The physical and wireless infrastructure in the transport layer of the internet is connected within and across borders of nation states, running on components that have been referred to as “code”.  Code is such an important factor in the running of the internet, that it has famously been stated that code is law.  A fundamental difference between the two is that law applies only within a prescribed and clearly authorized jurisdiction, while code applies wherever it works. In light of the fact that the internet serves everyone that can access it, the application of law that is bound by the jurisdiction of nation states will barely be uniform – even if it has its basis in human rights that are intended to apply universally.
Scholars have argued that human rights and sovereignty cannot be fully compatible, as the international order of human rights challenges the principle of sovereignty.  Globalization poses challenges to the independent function of the state, and presents challenges to traditional legal theory, for instance “black box theories”, that treat nation states, societies, legal systems, and legal orders as closed, impervious entities that can be studied in isolation.  The same theory could be applied to the internet, which is an advanced example of globalization of information as well as services.  This has resulted in challenges to the universal application of human rights that are not least bound to the issue of state sovereignty, posing the question: can states uphold their human rights obligations in the same capacity online and offline?  Furthermore, in light of the aforementioned principle of the responsibility to protect; to what extent can an individual expect that the state will fulfil and enforce a legal framework that abides by tighter boundaries than in cyberspace?
The scope of application is a key component of human rights instruments, just as in most conventions and contracts intended to have a bearing for the contracting parties. Most treaties specify that they apply within the scope of the contracting parties’ jurisdiction.  Article 1 of the ECHR states that: “The High Contracting Parties shall secure to everyone within their jurisdiction the rights and freedoms defined in Section I of this Convention”. By case law the Court has established that jurisdiction does not only mean within the physical or geographical borders of a state,  although it has been claimed that the Court has been inconsistent in the application of the article. 
The UN International Covenant on Civil and Political Rights refers to its application as “within its territory” as well as “subject to its jurisdiction”. In the Lopez Burgos v. Uruguay case the Human Rights Committee formed a view stating that “it would be unconscionable to so interpret the responsibility under the Article 2 of the Covenant as to permit a State party to perpetrate violations of the Covenant on the territory of another State, which violations it could not perpetrate on its own territory.”  The same views are expressed in the International Court of Justice advisory opinion on the Palestinian Wall, noting that although jurisdiction is “primarily territorial, it may sometimes be exercised outside the national territory”. 
Within the limits of the sovereignty principle, a state carries the trias politica powers  entailing a multifaceted role of states online as well as offline. It is generally undisputed that states have a legitimate claim to a role on the internet. The extent and essence of this role on the other hand is still subject to ongoing discourse. 
Parts of the internet are regulated in different capacities but no holistic regulation is in place. Parts of the infrastructure, the information highway, are regulated under telecommunications legislation while companies and entities whose operation is essential to the functioning of the internet are regulated through general legislation on companies and competition on a domestic and regional level. With the single market, the EU has taken steps towards a harmonized European regulation affecting both infrastructure, business and content, and recent judicial development indicates a more direct application of current legal frameworks to influence online services.  Recent efforts signal an increase in the role of companies such as media outlets and social media platforms in the online context.  In light of the essential part such companies play in order for states to be able to live up to their human rights obligations as described earlier, does the internet infrastructure entail that in cases as sensitive as revenge porn, that human rights protection of individuals in European countries lie in the hands of US technology companies?
Private entities are of significant importance for the functioning of the internet. Internet service providers, the backbone of the internet, are entities that are largely privately owned on both sides of the Atlantic, although internet infrastructure, such as broadband deployment has across the ‘OECD’ membership been at least partly funded by public means. States have a multifaceted interest in the internet functioning at its best, and wear many hats to this end. One is legislative, another regulatory, but also another facilitating an environment for incentive, innovation and economic growth. However, states also have a hat branded with providing a functioning and fair justice system for their citizens. The trick is to fit this with the other – and maintain a balance so that they all stay put.
5.1. Intermediary  liability
Following legal uncertainties with respect to liability and responsibilities of intermediaries, legislative means were taken on both sides of the Atlantic. In the US a legal framework established with the Communications Decency Act and the Digital Millennium Copyright Act, describes that intermediaries will not be held accountable for user generated material on their sites unless they were notified of the material being a copyright infringement or a criminal act and did not have in place an effective notice and takedown system to relieve an infringement.  With respect to defamatory content, the same does not apply as section 230 of the Communications Decency Act states: “The Act provides that no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider. No cause of action may be brought and no liability may be imposed under any State or local law.”  Similarly, the EU adopted the e-Commerce directive  that has been transposed in domestic legislation within the Single Market in a fairly uniform manner making intermediaries who run a merely technical operation not liable for third party content and describes a notice and takedown system to be in place regarding “illegal activities” but in line with freedom of expression as protected under Article 10 in the ECHR. While the directive prohibits member states from imposing a monitoring obligation of a general nature on intermediaries, the ECJ has found that the liability exemptions under the directive do not preclude states from enacting legislation entailing civil liability for defamation for online news outlets. The Court stated that:
“The limitations of civil liability specified in Articles 12 to 14 of Directive 2000/31 do not apply to the case of a newspaper publishing company which operates a website on which the online version of a newspaper is posted, that company being, moreover, remunerated by income generated by commercial advertisements posted on that website, since it has knowledge of the information posted and exercises control over that information, whether or not access to that website is free of charge.” 
These findings were cited in a recent judgement from the ECHR in the Delfi vs. Estonia case, when the Grand Chamber of the Court upheld the findings of the Estonian Supreme Court, stating that the internet news outlet Delfi could be held liable on civil grounds for a defamatory comment posted on the site by a third party. The Court did not base the findings on the e-Commerce directive, as the Estonian Supreme Courts found the relevant domestic legislation transposing the E-Commerce directive inapplicable and based its findings on the company’s breach of the Obligations Act. 
Both the cases concerned the civil liability of a private entity operating in a wider capacity than merely technical, meaning that they could be held liable for defamatory material generated by third party. Up until recently most states applied defamation clauses in cases of revenge porn. In light of the findings of the above mentioned cases from the ECJ and ECHR it is interesting that case law from European countries does not indicate that service providers have been challenged to bear liability in revenge porn cases. That may also suggest that most of the providers in question do not operate under the jurisdiction of European states, but rather US states, freeing them from possible liability for third party content that may be in breach of defamation clauses. Further, it remains to be seen what effect the criminalization of revenge porn will have with respect to possible liability of intermediaries in such cases.
Online anonymity and the use of pseudonyms can be immensely valuable for individuals and underlying societal, democratic, or economic interests. This can be the case for people that disseminate information with an intent to expose corruption or violations. The posting of revenge porn has no such grander goals.
The acquisition of essential information in order to establish responsibility in revenge porn cases is reliant on cooperation with private entities that control the information in connection with their operations. Swedish police report that they have found an effective way to cooperate with some major social media platforms, while others are not as willing to cooperate.  Requests from European police forces in cases of revenge porn are both based on criminal charges and breach of civil code within their jurisdiction. This entails that the charges are based on a legal framework formed and enactment under legal and societal orders that in general are democratic and are a part of the European Convention System. It is somewhat paradoxical to claim that states that are subject to an effective human rights monitoring system would demand that the companies interfere with information contrary to human rights. Yet cases show that the companies are often faced with a complex situation as not all states are based on a democratic order, and democratic states have put forth unbalanced requests for information about individuals to companies.  Recent revelations show that some states engage in invasive practices in cyberspace in the interest of anti-terrorism without what seems to be a proper balance to human rights.  Further, the companies that hold information due to their operations that are based within US jurisdiction are not altogether bound by the same legal framework, even though some also operate partly under EU legislation.
It has proven problematic to have revenge porn content removed from the internet.  In cases where the victim is the author of the material, such as in the cases of nude “selfies”,  the victim could claim copyright over the content and thus oblige website operators to delete the content on those grounds. Such action will only apply to the website in question so the content might still be accessible on other platforms. Cases also show that victims can seek redress from those responsible for the publishing and dissemination of the content on tort grounds such as defamation and distress. 
Some companies have built efforts against revenge porn into their terms and conditions. Google issues and updates its Transparency Report  with information on requests the company receives from governments, copyright owners, and individuals that want their information removed from Google’s search results.  In June 2015 Google revealed that revenge porn will also be removed from search results upon request stating that:
“[…] revenge porn images are intensely personal and emotionally damaging, and serve only to degrade the victims—predominantly women. So going forward, we’ll honor requests from people to remove nude or sexually explicit images shared without their consent from Google Search results. This is a narrow and limited policy, similar to how we treat removal requests for other highly sensitive personal information, such as bank account numbers and signatures, that may surface in our search results.” 
The efforts by Google are likely to limit the harm caused by revenge porn, but they will not remove the content from the relevant websites, social media platforms or forums where originally posted and thus they would be subject to further distribution online.
The legal framework on revenge porn has developed fast in the last years. Despite states claiming that revenge porn was regulated under the general legislation, amendments have been made to penal codes in a number of nation states and US States specifically criminalizing what is described as revenge porn. The legal framework up until now has proven very complex to enforce, with the recent regional criminalization still to be put to the efficiency test. Information from European police forces highlight that challenges of efficiency remain in order for the justice system to sufficiently protect victims of revenge porn.
Private entities play a crucial role in the functioning of the internet. With the leverage provided for intermediaries with the current legal framework on both sides of the Atlantic, terms and conditions and internal rules of private entities seem to trump legal orders of sovereign states that are formed within a democratic system framed by human rights. This poses a challenge to the state obligations under the ECHR in light of the theory of the responsibility of states to protect. With the notice and takedown procedures already awarded to copyright protected material under US and EU legislation, the technical procedures for companies to take down revenge porn material are available. In the current regime it can be claimed that the protection of the human rights of victims of revenge porn remains a challenge with respect to states’ responsibilities due to jurisdictional challenges posed by the borderless nature of the internet. In order to uphold their duties, a cross jurisdictional effort of states in cooperation with private entities would have to take place. Otherwise there will continue to be two different streams of legislation and technology with victims of revenge porn stuck in the middle without any chance of crossing either. That is a situation that does not align with the human rights obligations of states.
* María Rún Bjarnadóttir is a doctoral researcher at the University of Sussex.
 Johnson, David R. and Post, David G. Law and Borders: The Rise of Law in Cyberspace. 48 Stanford Law Review 1367. 1996.
 Citron, D.K. Hate Crimes in Cyberspace. 2014. Harvard University Press and Hill, R. “Cyber-misogyny. Should revenge porn be regulated in Scotland and if so, how?” SCRIPTed, 2:12. 2015.
 European Convention for the Protection of Human Rights and Fundamental Freedoms, as amended by Protocols Nos. 11 and 14. CETS No. 5. Entry into force 3. September 1953. (ECHR).
 Citron, D.K. Hate Crimes in Cyberspace. 2014. Harvard University Press. P. 17.
 The Independent. Proudman, C.R. “Revenge porn: enough still isn’t being done to stop it” 2. July 2014.
 Hill, R. “Cyber-misogyny. Should revenge porn be regulated in Scotland and if so, how?” SCRIPTed, 2:12. 2015. P. 118.
 Hill, R. “Cyber-misogyny. Should revenge porn be regulated in Scotland and if so, how?” SCRIPTed, 2:12. 2015. P. 118.
 Lajuan and Billy Wood vs. Hustler Magazine. 736 F 2d 1084 (5th Cir.1984).
 73% of teenagers (13-17 year old) in the United States of America have access to a smartphone according to the findings of Pew Research Center published in April. Accessible at: .
 See Mayer-Schönberger, V. delete. The virtue of Forgetting in the Digital Age. Princeton University Press. Princeton and Oxford. 2011. P. 85.
 The IWF suggests that the term will be renewed and addressed as: “Nude or semi-nude images or videos produced by a young person of themselves engaging in erotic or sexual activity and intentionally shared by any electronic means”. Internet Watch Foundation in partnership with Microsoft. Emerging Patterns and Trends Report #1 Online-Produced Sexual Content. 10 March 2015. P. 1.
 Ibid P. 12.
 Ibid P. 3.
 Keats Citron, D. Hate Crimes in Cyberspace. 2014. Harvard University Press. Cambridge, Massachusetts. P. 1-17.
 Hill, R. “Cyber-misogyny. Should revenge porn be regulated in Scotland and if so, how?” SCRIPTed, 2:12. 2015. P. 123.
 Ibid. P. 119. See also Keats Citron, D. Hate Crimes in Cyberspace. 2014. Harvard University Press. Cambridge, Massachusetts. P.17.
 Citron, D.K. Hate Crimes in Cyberspace. P. 95.
 Ibid. P. 142 – 143.
 The guidelines were published 14 October 2014 and are accessible at: Crown Prosecution Service (2015)
 The Daily Mail. Revenge porn laws come to force. 13. April 2015.
 The defendant was found in breach of Articles 209. And 233.b. of the General Penal Code No. 19/2940. Article 209 reads: “Any person who, through lewd conduct, offends people’s sense of decency or causes a public scandal, shall be imprisoned for up to 4 years, or [up to 6 months]1) or fined if the offence is minor.” Article 233.b. reads: “Anyone who insults or denigrates his or her spouse or ex-spouse, child or other closely-related person, the offence being considered as constituting serious defamation, shall be imprisoned for up to two years.”
 Article 26, paragraph 1of the Tort Act No. 50/1993 reads: “A party who a) by intention or by gross negligence, causes personal injury, or b) is responsible for an unlawful, malicious action directed against the freedom, peace, honour or person of another individual may be ordered to pay the injured party damages for loss of amenities of life.”
 Article 99, paragraph 3 of the Child Protection Act No. 80/2002 reads: “Any person who subjects a child to aggressive, abusive or indecent behaviour or hurts or insults him/her is liable to fines or imprisonment for up to two years.”
 The Eastland District Court. Case No. S-36/2014. 27 March 2015.
 The Icelandic Supreme Court. Case No. 312/2015. 10. December 2015.
 The draft bill is accessible only in Icelandic at the website of the Icelandic Parliament: .
 Keats Citron, D. Hate Crimes in Cyberspace. 2014. Harvard University Press. Cambridge, Massachusetts. P. 122.
 Ibid. P. 123.
 Ibid. P. 142.
 Citron, D.K. and Franks, M.A. Criminalizing Revenge Porn. 2014. 49 Wake Forest Law Review 349.
 Ibid. P. 346.
 See for example the case of Tulisa Contostavlos: The Telegraph. Radhika Sanghani, R. “Tulisa sex tape hell. Trolls aren´t usually to blame for revenge porn, our loved ones are.” 29. July 2014, and the case of Jennifer Lawrence Vanity Fair. “Jennifer Lawrence calls Photo Hacking a Sex Crime.” November 2014.
 To name some: End Revenge Porn , Civil Rights Initiative and Stop Revenge Porn Scotland
 Posting revenge porn constitutes to a breach of the Prevention of Sexual Harassment Act as amended in 2015. It classifies posting of revenge porn as sexual harassment and entails that the offender will be registered as a sex offender. See further analysis in Hill, R. “Cyber-misogyny. Should revenge porn be regulated in Scotland and if so, how?” SCRIPTed, 2:12. 2015. P. 136=137.
 Article 33 of the Criminal Justice and Courts Act as amended of April 2015 states the disclosure of a private sexual photograph or film is an offence if the disclosure is made without the consent of an individual who appears in the photograph or film, and with the intention of causing that individual distress. The act is punishable with up to two years imprisonment. .
 The Abusive Behaviour and Sexual Harm (Scotland) Bill was introduced in the Parliament on 8 October 2015. - See more at: .
 An amendment bill to the General Penal Code making the posting of revenge porn criminal was re-introduced to the Parliament on 10 September 2015. Available in Icelandic at: .
 Statens Offentliga Utredningar. Integritet och straffskydd. Stockholm. SOU 2016:7. (In Swedish).
 Keats Citron, D. Hate Crimes in Cyberspace. 2014. Harvard University Press. Cambridge, Massachusetts. The legal text is accessible at: .
 Overview of revenge porn legal acts from the US is available at the website of the NGO End Revenge Porn accessible at: . Similar conditions are put up in a draft legislation currently discussed in the Icelandic parliament accessible here only in Icelandic:
 Section 647, Article 4(a) of the California Penal Code states: “Any person who intentionally distributes the image of the intimate body part or parts of another identifiable person, or an image of the person depicted engaged in an act of sexual intercourse, sodomy, oral copulation, sexual penetration, or an image of masturbation by the person depicted or in which the person depicted participates, under circumstances in which the persons agree or understand that the image shall remain private, the person distributing the image knows or should know that distribution of the image will cause serious emotional distress, and the person depicted suffers that distress.” The legislation is accessible at: .
 An updated list of states with such legislation in the US as of 1. October 2015 is accessible at: .
 Article 33 of the Criminal Justice and Courts Act states the disclosure of a private sexual photograph or film is an offence if the disclosure is made without the consent of an individual who appears in the photograph or film, and with the intention of causing that individual distress. The act is punishable with up to two years imprisonment. .
 The Guardian. Revenge porn cases increase considerably, police figures reveal. 16 July 2015.
 A graphic description of the legislation is accessible at the NGO´s website: http://www.endrevengeporn.org/anatomy-effective-revenge-porn-law/.
 The term refers to three core documents: the Universal Declaration of Human Rights, adopted by General Assembly resolution 217 A (III) of 10 December 1948, The International Covenant on Economic, Social and Cultural Rights and the International Covenant on Civil and Political Rights were adopted by the General Assembly by its resolution 2200 A (XXI) of 16 December 1966 and the International Covenant on Economic, Social and Cultural Rights adopted by General Assembly resolution 2200A (XXI) of 16 December 1966.
 Extensive literature exists on the UN Human Rights system. See the official webpage for the Office of the High Commissioner for Human Rights: .
 Extensive literature exists on the European Convention System. See the official webpage for the Convention at: .
 See for example Nmehielle, V.O. The African Human Rights System: Its Laws, Practice, and Institutions. 2001. Martinus Nijhoff. The Hague/London/New York.
 Doswald-Beck, L. Human Rights in Times of Conflict and Terrorism. 2011. Oxford University Press. Oxford. P. 30. Steiner, H.J., Alston, P, Goodman, R. International Human Rights in Context. Law, Politics, Moral. Text and Materials. 3rd Edition. 2008. Oxford University Press. Oxford. P. 1087.
 De Schutter, O. International Human Rights Law. Cases, Materials, Commentary. 2nd edition. 2014. Cambridge University Press. Cambridge. P. 280 – 281.
 This does not refer to the idea of ‘Responsibility to Protect’ that deals with state and international community responsibility to avert atrocities, but to the doctrinal meaning of the obligation to protect under human rights obligations of states. See further: Mégret, F. Nature of obligations. International Human Rights Law. Second Edition. Edited by Daniel Moeckli, Sangeeta Shah and Sandesh Sivakumaran. 2014. Oxford University Press. Oxford. P. 102.
 De Schutter, O. International Human Rights Law. Cases, Materials, Commentary. 2nd edition. 2014. Cambridge University Press. Cambridge. P. 427.
 See European Convention for the Protection of Human Rights and Fundamental Freedoms, as amended by Protocols Nos. 11 and 14. CETS No. 5. Entry into force 3. September 1953. Article 13 Right to an effective remedy “Everyone whose rights and freedoms as set forth in this Convention are violated shall have an effective remedy before a national authority notwithstanding that the violation has been committed by persons acting in an official capacity.”
 Recommendation CM/Rec(2014)6 of the Committee of Ministers to member States adopted on 16. April 2014.
 Ibid. Article 2.
 Cybercrime Convention. CETS No.185. Entry into force 1 July 2004. Also referred to as the Budapest Convention. The Convention was the first international treaty on crimes committed via the Internet and other computer networks, dealing particularly with infringements of copyright, computer-related fraud, child pornography and violations of network security. It also contains a series of powers and procedures such as the search of computer networks and interception.
 Council of Europe Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse. CETS No. 201. Entry into force 1 July 2010. Also referred to as the Lanzarote Convention.
 K.U. v. Finland of 2 December 2009 (Application No. ). Excerpts from Para. 47 and 48.
 Ovey, C., and White, R.C.A. Jacobs and White European Convention on Human Rights. 3rd Edition. 2002. Oxford University Press. Oxford. P. 279.
 See for example the Internet Governance Principles accepted at the Netmundial Conference in Brazil 2014 accessible at: .
 This includes restrictive means such as filtering and blocking. Noteworthy cases from the European Court on Human Rights such as Ahmet Yıldırım v. Turkey of 18. December 2012 (Application No. 3111/10) where a governmental restriction on internet access due to content that the applicant had uploaded to the internet was unlawful and therefor did not meet the standards of protection awarded by article 10 of the Convention.
 The International Telecommunications Union met in Cairo in 2012 with the intention to update several of its treaties. A draft treaty intended to ensure stronger governmental influence in the regulation of internet infrastructure in the name of better upholding national legislation was not approved. The Guardian. Arthur, C. “Internet remains unregulated after UN Treaty Block.” 14. December 2012.
 Recommendation CM/Rec(2014)6 of the Committee of Ministers to member States adopted on 16. April 2014.
 The promotion, protection and enjoyment of human rights on the Internet. A/HRC/20/L.13.
 Adopted by the United Nations General Assembly in Paris on 10 December 1948. Res. 217 A.
 Article 19 of the ICCPR reads: 1) Everyone shall have the right to hold opinions without interference. 2) Everyone shall have the right to freedom of expression: this right shall include freedom to seek, receive and impart information and ideas of all kids, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice. 3) The exercise of the rights provided for in paragraph 2 of this article carries with it special duties and responsibilities. It may therefore be subject to certain restrictions, but these shall only be such as provided by law or necessary: a) For respect of the rights or reputation of others: b) For the protection of national security or of public order (ordre public), or of public health or morals.
 Article 20 of the ICCPR reads: 1) Any propaganda for war shall be prohibited by law. 2) Any advocacy of national, racial or religious violence shall be prohibited by law.
 Article10 of the ECHR provides: (1) Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. (2) The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.
 An overview of relevant case law regarding hate speech is accessible at: .
 “[T]here is no doubt that any remark directed against the Convention’s underlying values would be removed from the protection of Article 10 [freedom of expression] by Article 17 [prohibition of abuse of rights]” Seurot v. France. Decision on the admissibility of 18 May 2004. (Application No. 57383/00).
 In the Case Handyside v. United Kingdom of 7 December 1976 (Application no. 5493/72) the ECHR set out ground principles for the scope of Article 10 of the European Convention on Human Rights stating that: “Freedom of expression constitutes one of the essential foundations of [a democratic] society, one of the basic conditions for its progress and for the development of every man. Subject to paragraph 2 of Article 10 [of the European Convention on Human Rights], it is applicable not only to ‘information’ or ‘ideas’ that are favourably received or regarded as inoffensive or as a matter of indifference, but also to those that offend, shock or disturb the State or any sector of the population.”
 Mill, J.S. On liberty and Other Essays. 1991. Oxford University Press. Oxford. P. 56.
 Citron, D.K. Hate Crimes in Cyberspace. 2014. Harvard University Press. Cambridge, Massachusetts. P. 105 and 141.
 The Broadband Commission for Digital Development. Cyber Violence against Women and Girls. A World-Wide Wake up call. 2015. P. 39.
 Polisanmälda brott hot och kränkningar mot enskilda personer via internet. Rapport 2015:6. The study is accessible in Swedish with an English summary via the Council´s website at:
 Ibid. P. 90.
 Visir.is. “Lögreglan máttlaus gagnvart nektarmyndum á netinu” (“Police powerless facing naked photos online”). 8. September 2014. Friðrik Smári Björgvinsson, Police Officer. The original statement is in Icelandic „Svona mál eru erfið fyrir lögregluna, sérstaklega þegar um erlendar síður er að ræða. Við getum ekki stjórnað internetinu”.
 Schultz, T, “Carving up the internet”, The European Journal of International Law, vol. 19, no. 4, 2008, pp. 799–839.
 Brown, I. and Marsden, C. Regulating Code. Good governance and better regulation in the information age. 2013. MIT Press. London, England and Cambridge, Massachusetts.
 Lessig, L. Code 2.0. 2006. Basic Books. New York. P. 5.
 Duzinas, C. The End of Human Rights: Critical Legal Thought at the Turn of the Century. 2000. Hart Publishing. Oxford. P. 374 and Dickinson, R. Universal human rights: a challenge too far. Examining Critical Perspectives on Human Rights. Edited by Dickinson, R., Katselli, E., Murray, C., and Pedersen, O.W. 2012. Cambridge University Press. New York. P. 175.
 Ibid. P. 177 and Twining, W. Globalisation and Legal Theory. 2000. London. Butterworths. P. 252.
 Marsden, C.T. Information and communications technologies, globalisation, and regulation. In: Regulating the Global Information Society. Edited by Marsden, C.T. 2000. Routledge. London/New York. P. 2.
 The question does not entail that states uphold their human rights obligations to the full extent offline.
 This is not without exemption. The UN Covenant on Economic, Social and Cultural Rights does not contain a clause on jurisdiction.
 See the ECHR factsheet on extra-territorial jurisdiction accessible at: .
 Milanovic, M. Applicability of the ECHR to British soldiers in Iraq. Cambridge Law Journal. Volume 70. Issue 1. 2011. P. 7-11.
 HRCte, Lopez Burgos v. Uruguay Com 52/1979, Views, 29 July 1981, paragraph 12.3.
 Doswald-Beck, L. Human Rights in Times of Conflict and Terrorism. 2011. Oxford University Press. Oxford. P. 11.
 The three branches of government; , , and .
 Brown, I. and Marsden, C. Regulating Code. Good governance and better regulation in the information age. 2013. MIT Press. London, England and Cambridge, Massachusetts. P. 2-4.
 The European Court of Justice is a key player in this development with its decision in the Google vs. Spain (Case C-131/12) verdict entailing the right to be forgotten and the recent advisory opinion in the so called Safe Harbour case (Case C-362/14) effectively stating that the data sharing practices current online operations are based on are not compliant with the EU Charter on Fundamental Rights and need to be revised.
 Intermediaries are key players in a functioning internet. They are internet service providers (ISPs), service providers (such as mailbox service, website hosting, cloud services) and transit providers.
 World Intermediary Liability Map. The Center for Internet and Society. Stanford University.
 Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market ('Directive on electronic commerce') OJ L 178, 17.7.2000, p. 1–16.
 C-291/13. Papasavvas. ECJ. 11. September 2014.
 Delfi v. Estonia. GC of 16 June 2015. (Application no. 64569/09).
 The report states also that recently the National Police Commissioner has following consultation with Facebook and Instagram gained access to the essential information. Brottsforebyggande Radet. Polisanmälda brott hot och kränkningar mot enskilda personer via internet. Rapport 2015:6. 2015. P. 90.
 The Case of the Icelandic PM Birgitta Jonsdottir is summarized in a resolution of the International Parliamentary Union PU Governing Council. 189th session. Bern, 19 October 2011. .
 The Snowden revelations. See for example: .
 See Chapter 5 in Citron, D.K. Hate Crimes in Cyberspace. 2014. Harvard University Press. Cambridge, Massachusetts. P. 120 – 141.
 A photograph that one has taken of oneself, typically one taken with a or and shared via . .
 Citron, D.K. Hate Crimes in Cyberspace. 2014. Harvard University Press. Cambridge, Massachusetts. P. 121 – 122.
 Accessible at: .
 Accessible at:
 19. June 2015. Revenge Porn and Search. .
Fulltext as PDF. ( Size 344.7 kB )
Any party may pass on this Work by electronic means and make it available for download under the terms and conditions of the Digital Peer Publishing License. The text of the license may be accessed and retrieved at http://www.dipp.nrw.de/lizenzen/dppl/dppl/DPPL_v2_en_06-2004.html.