February 28, 2012

How Internet Companies Would Be Forced to Spy on You Under H.R. 1981

February 23, 2012 | By Rainey Reitman

Online commentators are pointing to the Internet backlash against H.R. 1981 as the new anti-SOPA movement. While this bill is strikingly different from the Stop Online Piracy Act, it does have one thing in common: it’s a poorly-considered legislative attempt to regulate the Internet in a way experts in the field know will have serious civil liberties consequences. This bill specifically targets companies that provide commercial Internet access – like your ISP – and would force them to collect and maintain data on all of their customers, even if those customers have never been suspected of committing a crime.

Under H.R. 1981, which has the misleading title of Protecting Children From Internet Pornographers Act of 2011, Congress would force commercial Internet access providers to keep for one year a “log of the temporarily assigned network addresses the provider assigns to a subscriber to or customer of such service that enables the identification of the corresponding customer or subscriber information under subsection (c)(2) of this section.”  Let’s break that down into simple terms.

Temporarily Assigned Network Addresses: More than IP Addresses

Under this proposal, ISPs would have to maintain “temporarily assigned network addresses” to enable the identification of a subscriber. At a minimum, this refers to the IP addresses assigned by ISPs, including the Internet services associated with mobile phones.  It could also potentially include mobile phone numbers or other forms of cell phone identification, such as the three major mobile device identifiers: IMEI, IMSI, TMSI. These are the tracking IDs for your mobile devices, the unique identifiers that mobile phone companies use to track handsets and the accounts associated with them.

IP Addresses Aren't a Perfect Identifier

An IP address is like a street address or a phone number; it's the arrow that points packets of information your way when people send you things over the Internet. But it cannot tell you who is actually sitting behind a computer screen, typing at a computer.

Currently IP addresses by themselves aren’t a perfect way to identify individuals. One reason is because there are only a limited number of IPv4 addresses (the current schema most ISPs use to allocate IP addresses), and so there are many situations in which a bunch of Internet users are sharing a single IP address. This strategy, called Network Address Translation (NAT), is a creative way to deal with the shortage of IP addresses while we are still in the protracted process of transitioning to IPv6. All of which is to say: H.R. 1981 mandates that companies keep a log of assigned network addresses in order to identify customers, but IP addresses are only one clue in figuring out a user's identity.

IP Addresses: Useful for Location Tracking

But there’s another element many commentators are forgetting: even if a single IP address isn’t a perfect identifier, a collection of IP addresses assigned to a user can be combined with other data elements to create a frighteningly detailed map of a person’s location over time. For example, law enforcement could review the IP addressses an individual used to log onto her email account over the period of several months to create a detailed picture of when she was at home, when she went to work, when she was in transit, and when she went to sleep – and whether there were certain days she deviated from her typical schedule.

IP addresses can also indicate information about a user's physical proximity to other users. For example, if two people are using the same IP address at the same time, they are likely at the same location. Law enforcement might be very interested in how IP addresses can indicate one's associations in this way.

Law enforcement could also demand that a social network hand over the IP addresses and logged-in times of an individual using its service. Law enforcement could then combine this information with data from an ISP or mobile carrier to figure who was assigned to each of those IP addresses. For mobile providers, each entry could be combined with data about one’s GPS location. So a law enforcement agent could know when an individual was posting to a social network as well as her location. ISPs will be slightly less exact but still provide a detailed portrait of an individual’s physical location each time she logged in. 

This is no nightmare scenario. This is exactly what the U.S. government attempted when it pressured Twitter to hand over Icelandic parliamentarian Birgitta Jónsdóttir’s data as part of the WikiLeaks investigation. And we’ve seen numerous other occasions where law enforcement pressured Internet companies to hand over the IP addresses and times of individuals using their services.

Law enforcement is coming to understand that IP addresses are a powerful key to location data and to tracking people's movements over time. But in order for this data to be most useful to them, they need ISPs and mobile carriers to keep records of who is assigned to which IP addresses, and when.

The Supreme Court has already decided that tracking an individual’s car with a GPS device for months at a time without a search warrant is blatantly unconstitutional.  But by passing H.R. 1981, law enforcement hopes to create a mountain of data that will facilitate the location tracking of anyone who uses the Internet, if that person is under suspicion for any reason in the coming year.

Detailed Banking Information

Because the actual language of the bill is somewhat vague, activists at Demand Progress have correctly noted that this legislation might force Internet companies to retain even more data just to be on the safe side. The proposed bill is an amendment to 18 USC § 2703, the law currently defining the circumstances under which companies that store electronic data on customers must disclose it to the government. H.R. 1981 is attempting to amend and expand this law in a way that “enables the identification of the corresponding customer or subscriber information under subsection (c)(2) of this section.”

So what is subsection (c)(2)?  It requires a provider to turn over to the government without a warrant:

  • Name
  • Address
  • Records of session times and durations
  • Length of service (including start date) and types of service utilized
  • Credit card or bank account number

The language of H.R. 1981 is dangerously unclear – it would definitely require a network to maintain an historical log of IP addresses, but will ISPs believe it also requires them to maintain detailed records on customers’ addresses, credit card, and bank information? Such an interpretation would create a honeypot of sensitive data ripe for overly ambitious law enforcement agents, malicious hackers, or even accidental disclosures.

This Attack on the Internet Has Nothing to Do With Child Pornography

H.R. 1981 is touted as a way to crack down on child pornography, but the data retention mandates of this bill will affect every Internet user who uses a U.S. ISP.  It’s sad to see our legislators using the mantle of child pornography to order Internet companies to spy on users, forcing ISPs to keep mountains of unnecessary data about innocent Internet subscribers in the hopes that it might one day be useful to law enforcement.  That’s exactly why Representative Zoe Lofgren proposed an amendment to rename the bill the 'Keep Every American's Digital Data for Submission to the Federal Government Without a Warrant Act of 2011.'

This type of legislation goes against the fundamental values of our country where individuals are treated as innocent until proven guilty. H.R. 1981 would uproot this core American principle, forcing ISPs to treat everyone like a potential criminal. 

Help us defeat the Internet spying bill. Contact Congress today.

Permalink • Print • Comment

May 23, 2011

Mass Copyright Litigation Roundup: Positive Trend for Due Process?

Judicial decisions are starting to come fast and furious in the movie copyright troll cases – and the trend is mixed but promising for those of us who care about protecting due process.

The good news is that judges continue to recognize the fundamental flaws in these cases. In the Northern District of Illinois, for example, Judge Blanche Manning recently severed Millennium v. Does 1-800, effectively dismissing the case against almost every Doe defendant. The court also suggested that the suit had been brought in the wrong place:

The plaintiff is a Hawaii corporation with its principal place of business in California. As far as the plaintiff knows, none of the defendants are located in Illinois and it merely alleged, without any basis the court can discern, that “on information and belief each Defendant may be found in this district and/or a substantial part of the acts of infringement complained of herein occurred in this District.” Amended Comp. at ¶7. Indeed, apparently none of the Doe defendants who have filed motions to quash are located in Illinois and it appears that easily accessible tools exist to verify the locations of the IP addresses of the other named Doe defendants, see, e.g.,http://whois.arin.net/ui/, many (if not all) of which are not located in Illinois.

Judge Manning has also ordered severance in Lightspeed v. Does 1-1000, on similar grounds.

Another Illinois federal judge has expressed not just skepticism but outrage at the tactics of one copyright troll. Calling the case of CP Productions v. 1-300 both “ill-fated’ and “ill-considered” he not only dismissed the case but read the riot act to the plaintiff’s attorney in open court, demanding to know why, if the case was properly filed in Illinois, he was getting motions to quash from defendants all over the country.

And, as we reported last week the judge in one mass copyright “reverse class action” in the Southern District of Illinois has stayed discovery while it considered whether the plaintiff should be allowed to subpoena the Does’ identities given the fundamental flaws in its case. A hearing on the issue is scheduled for Monday.

These views are not yet universal, however. In late March, Judge Beryl Howell issued an unfortunate decision on motions to quash discovery in three cases filed in the District of Columbia (the plaintiffs are all represented by the US Copyright Group). EFF participated as amicus in one of the cases, Call of the Wild Movie v. Does 1,062. The judge denied the motions, concluding, in essence, that it was too early in the litigation to address deep the procedural flaws in the plaintiffs’ cases. We are particularly disappointed that Judge Howell (1) accepted the idea that using BitTorrent to download the same movie was enough to establish a logical relationship between defendants; and (2) suggested that the Doe defendants are not harmed until they are actually named in a lawsuit, not withstanding the efforts of plaintiffs to extract settlements based, in part, on the coercive effect of being sued far from home with the threat of statutory damages of up to $150,000.

Since then, however, Judge Howell has indicated that she is keeping a close eye on USCG. For example, in one of the cases, Maverick v. Does 1-4350, Judge Howell has ordered the plaintiff to dismiss hundreds of Does where the plaintiff either does not intend to name and sue the Does in D.C. and/or the information for those Does is no longer available. The court noted that “since plaintiff filed its Complaint, it has not named a single defendant in this action” and that while plaintiff had stated it would dismiss numerous Does, it had not bothered to submit a proposed order to that effect, leaving those Does in limbo.

We'll continue to monitor these cases, and to get involved directly where we can.

Attachment Size

Related Issues: Copyright Trolls

Permalink • Print • Comment

Lawsuit Against YouTube Threatens Global Growth of Political Speech

April 7th, 2011

Legal Attack on Online Video Site Could Throttle Innovation with Fears of Litigation

San Francisco – The Electronic Frontier Foundation (EFF) and a coalition of advocacy groups have asked a federal appeals court to reject attempts to thwart federal copyright law and saddle online communities with new litigation fears in the appeal of Viacom v. YouTube.

In an amicus brief filed Thursday, EFF argues that the infringement claims made by Viacom and the other plaintiffs threaten to undermine the "safe harbor" provisions of the Digital Millennium Copyright Act (DMCA) — safe harbors that have fostered free speech and innovation around the globe. Without the clear legal structure of the DMCA process, companies that host user-generated expression could be hit with potentially massive damage awards, which would encourage over-blocking of content or even the shutdown of services altogether.

"If the DMCA safe harbors are undermined in the way Viacom and the other content companies would like, the free flow of information will be seriously threatened," said EFF Senior Staff Attorney Abigail Phillips. "Communications platforms like YouTube have enabled political and other speech to flourish online. We've all seen the critical role digital communications have been playing in protests across the Middle East. The safe harbors make posting of user-generated content like this possible."

At issue in this case is copyright infringement on YouTube before the online video service voluntarily implemented content filtering technologies in May of 2008. The district court correctly found that YouTube was shielded by the DMCA safe harbors, and Viacom and others appealed the ruling to the 2nd U.S. Circuit Court of Appeals.

"All the online services you use every day — Facebook, Twitter, Amazon, eBay — depend on the DMCA safe harbors in order to allow user-generated content on their sites," said EFF Intellectual Property Director Corynne McSherry. "That's why Congress designed the safe harbors — to allow innovators to manage legal risk and develop new services without fear of devastating litigation, while offering copyright owners an expedited process for taking down infringing content. Viacom's arguments here misinterpret the law, with potentially disastrous results."

Also joining EFF's brief are the International Federation of Library Associations and Institutions, the American Library Association, the Association of College and Research Libraries, the Association of Research Libraries, and the Center for Democracy and Technology.

For the full amicus brief:
https://www.eff.org/files/filenode/viacom_v_youtube/ViacomvGoogleAmicus….

For more on this case:
http://www.eff.org/cases/viacom-v-youtube

Contacts:

Corynne McSherry
Intellectual Property Director
Electronic Frontier Foundation
corynne@eff.org

Abigail Phillips
Senior Staff Attorney
Electronic Frontier Foundation
abigail@eff.org

Related Issues: DMCAIntellectual Property

Related Cases: Viacom v. YouTube

Permalink • Print • Comment

May 22, 2011

Who’s Screwing You Over on Privacy Issues? Pretty Much Everybody.

Dropbox–flamed this week for revealing that it will hand over your stored files to the feds if requested–is not alone in its willingness to throw users' privacy under the proverbial bus.

Nor is Apple, under the gun today after a revelation by O'Reilly Radar that 3G iPads and iPhones keep track of users' locations in unencrypted files.

The Electronic Frontier Foundation recently released its annual Privacy and Protection Report Card, rating the largest online players' performance in four categories:

  • Telling users about data demands
  • Being transparent about government requests for information
  • Fighting for user privacy in the courts
  • Advocating for privacy before Congress

EFF asks the provocative question, "When the government comes knocking, who has your back?" The discouraging but unsurprising answer appears to be, "You better have your own," because almost everybody failed.

As ZDNet's Violet Blue said, "They've either got your back in a pinch, or they'll sing like yellow canaries when the chips are down and sacrifice you without a second glance."

How the Big Boys Did

Among the tech firms whose performance on privacy issues can best be described as "not terrible:" Google (two stars plus two half-stars), Amazon (two stars) and Twitter (one star and two half-stars).

Google was the only surveyed company to rate something in all four categories, giving it a solid grade of C. Google got props from the EFF for citing user privacy as it pushed back in court against a request for search records, and for regular reporting about how and when they provide data to governments around the world.

Amazon and Twitter received props for their handling of requests for individuals' data, and Yahoo earned a star for resisting subpoenas of a user's email records.

Microsoft, Facebook and AT&T earned one star each for lobbying Congress on privacy concerns.

Coming up completely empty: Apple, Comcast, MySpace, Skype, and Verizon.

Privacy-minded users have already kicked themselves off Facebook and sworn off FourSquare and cloud-based anything. They won't get much additional benefit from a privacy bill rolling out on Capitol Hill.

The Commercial Privacy Bill of Rights, introduced in the Senate last week by strange bedfellows John McCain and John Kerry, got a lukewarm review from EFF's Rainey Reitman: "The bill's most glaring defect is its emphasis on regulation of information use and sharing, rather than on the collection of data in the first place. For example, the bill would allow a user to opt out of third-party ad targeting based on tracking–but not third-party tracking."

Moreover, Reitman adds, a loophole in the legislation allows sites like Facebook to step neatly around privacy protections: "A user would surrender any right to opt out of being tracked by Facebook or Google simply by having an account with them."

You are warned…

Permalink • Print • Comment

Mass Copyright Litigation: New Challenge for the Federal Courts

The below originally appeared in the Daily Journal.

The past year has seen the emergence of a new litigation strategy that poses particular challenges for the federal courts: mass copyright litigation. Over 130 mass copyright cases – i.e., copyright infringement cases joining together hundreds and often thousands of Doe defendants at once – have been filed in just the last 15 months in federal district courts across the country, targeting over 135,000 people. These cases involve significant and substantive early, ex parte activity before the individual defendants are even aware of the litigation, much less in a position to respond. Yet even at this early stage, these cases raise fundamental due process concerns. While there has yet to develop a body of published case law about the novel issues raised by the mass copyright cases, a growing body of largely unpublished judicial decisions can help both courts and attorneys handling them, whether on behalf of an ISP (Internet service provider) or on behalf of a defendant.

The cases generally follow the same path. A complaint is filed against hundreds or thousands of unnamed “John Does,” usually involving a single claim of copyright infringement over a single copyrighted work. The cases are brought in the jurisdiction where the plaintiff’s attorney is located, while the defendants are ordinary Internet users scattered across the country. The copyrighted works are usually “independent” movies or pornographic films. One title, for instance, is “Nude Nuns with Big Guns”; others have titles even less safe for work. Immediately after filing, the plaintiff moves for leave to issue early subpoenas to the ISPs of the defendants in order to obtain their identifying information .

If leave is granted and the information obtained, plaintiffs’ attorneys send demand letters to the now-identified individuals sued, giving them a stark choice: They can attempt to defend a suit in a far away court, risking liability up to $150,000 in copyright statutory damages plus attorney fees and costs. Or, they can pay a settlement in the $2,000-$5,000 range. Because the settlement amount is less than the cost of even a pro forma defense, and the downside risk of litigation is so great under copyright’s lopsided damages scheme, the pressure to settle rather than raise legitimate defenses is high. For those accused of infringing pornographic movies, many with gay themes, the prospect of being publicly named in a lawsuit is a further reason to settle quickly. Thus, a court’s decision granting leave to issue discovery often gives the plaintiffs in these cases the only remedy they really want: the ability to demand settlements from the Doe defendants.

So what does this mean for the courts and ISPs receiving the subpoenas? It means that judicial supervision over the early, ex parte stages of these mass copyright cases is critical.

Luckily, several district courts have taken the time to review the questions raised in the ex parte phase, sometimes sua sponte and sometimes in response to concerns raised by ISPs or amicus briefs. The courts have addressed two main concerns rooted in due process: joinder and personal jurisdiction.

First, joinder. Courts in West Virginia, Texas and California have severed over 40,000 defendants from these cases on the grounds that they are not properly sued jointly. Rule 20 requires that, for parties to be joined in the same lawsuit, the claims against them must arise from a single transaction or a series of closely related transactions. The only thing linking the defendants in these cases is the use of a computer protocol, called BitTorrent, to allegedly infringe the same movie. As one court observed “[M]erely committing the same type of violation in the same way does not link defendants together for purposes of joinder.” Tellingly, only a handful of cases have been re-filed against individuals in the proper jurisdictions following these mass dismissals.

Second, lack of personal jurisdiction. This takes a bit of technical knowledge, but at bottom the concern is that plaintiffs have not met their burden of pleading specific facts sufficient to support the court’s exercise of personal jurisdiction over the defendants. In fact, the plaintiffs own filings normally demonstrate that personal jurisdiction over many of the thousands sued is lacking. This is because while the defendants initially are unnamed “John Does,” they are conditionally identified by an Internet Protocol (IP) address that plaintiffs’ allege was collected during its investigations of BitTorrent users. IP addresses are assigned to Internet users by the user’s ISP, then are used by Web sites and other places a person visits online to ensure that the information sought by the user is routed over the Internet to the user’s computer. Because it assigns the IP addresses to its customers, an ISP can usually connect a particular IP address to the customer using it at that time. Readily available free online tools allow an IP address to be tracked back to the ISP that is assigned to it, and that is how plaintiffs know which ISP to subpoena for which IP address.

Importantly, in addition to allowing the plaintiffs’ to identify the ISP to subpoena defendants, the IP address lookup also gives sufficient information to the plaintiffs to allow them to determine the location of the defendant, usually to within about 25 miles. This geolocation is generally sufficient to identify the judicial district where the defendant is located. So the process by which the plaintiff locates the relevant ISP is the same process by which it can discover the likely proper jurisdiction for the lawsuit. Yet the mass copyright cases continue to be brought not where the defendant (or even the plaintiff) is located, but rather where plaintiffs’ counsel is located, a strategic decision that greatly impacts the defendants’ ability to marshall a defense.

Indeed, a plaintiffs’ attorney in West Virginia recently brought six separate cases targeting thousands of customers of ISPs that did not even do business in West Virginia. In dismissing the case, the court admonished: “These amended complaints shall proceed only against Does with IP addresses of computers located within the State of West Virginia. According to testimony presented to the court, there is a publicly-available website that allows the plaintiff to determine the physical location of each Does’ computer at the time of the alleged copyright infringements.”

Amici are also concerned that courts have failed to apply the appropriate First Amendment test for revealing the identity of Internet users. This test, which has been applied in online copyright infringement cases as early as 2004, requires a careful balancing of the free speech interests of the defendant with the needs of the plaintiff and imposes a number of procedural and substantive obligations that help achieve that balance. Many of the mass copyright cases have failed to make those required showings.

While several courts have raised joinder and jurisdictional concerns, and many defendants have been dismissed based on them, at least one judge in the District Court for the District of Columbia, has ruled that the defendants suffer no due process concerns or harms until they are formally named in the litigation. Given the business model of pursuing settlements that are less than the cost of a defense, however, this ruling is troubling.

The explosion of these mass copyright cases raise novel issues for the courts. Moreover, given the pressure to settle created by the prospect of being named in and defending a copyright infringement suit involving pornographic works, often in a distant location, the initial decision to allow the identities of the accused to be revealed may be the only judicial decision made in the case. Judges presented with these lawsuits, and counsel for ISPs of the accused users, should carefully consider the due process issues raised by courts around the country, and take special care in considering whether to allow early discovery. Finally, this situation could be greatly helped by the issuance of some published decisions so that courts and litigants across the country can better draw upon the experience of others.

Permalink • Print • Comment
« Previous PageNext Page »
Made with WordPress and an easy to customize WordPress theme • Sky Gold skin by Denis de Bernardy