February 28, 2012

UK Police Agency Takes Over Popular Music Website

February 17, 2012 | By Maira Sutton

News broke Tuesday that a British police agency called the Serious Organised Crime Agency (SOCA), had taken control of the popular music blog RnBXclusive and arrested one of the site’s creators for fraud. The normal content from the site was completely unavailable, replaced with a new splash page: a notice from SOCA stating that it had taken control of the domain. Initial reports claimed that that the RnBXclusive.com domain had been seized by the UK government agency — bringing to mind images of a post-SOPA fractured Internet — but it turned out that the website takeover was done with the cooperation of the UK-based hosting company, Rackspace’s UK arm. For its part, Rackspace claimed that the music site was taken down for breaching its Terms and Conditions.

The initial splash page that the site displayed after the takedown was replete with exaggerations and misstatements of law. Techdirt’s Mike Masnick ripped the notice apart, explaining the problems with the way that SOCA handled the situation. The original SOCA notice has since been taken down and replaced with a more accurately worded statement, but an image of the original is viewable here.

The baseless claims in the original notice included the statement that a majority of the music files previously available via the site had been stolen, and that:

As a result of illegal downloads young, emerging artists may have had their careers damaged. If you have illegally downloaded music you will have damaged the future of the music industry.

Most disconcertingly, the notice stated that visitors who had downloaded music from RnBXclusive may have committed a crime with a penalty of 10 years imprisonment and an unlimited fine. It also stated that SOCA has "the capability to monitor and investigate you, and can inform your Internet service provider of these infringements."

Then, in a move that could only be described as intimidating, it went on to display the visitor’s operating system and IP address with a statement below that read, "The above information can be used to identify you and your location."

This situation is alarming on several levels. It is unknown whether there was a court order that directed the hosting provider to take down this site, or whether the hosting company voluntarily removed the previous content. Open Rights Group is reporting that Rackspace’s UK arm is hosting the holding page. Why would it allow SOCA to put up the holding page without a court order?

We initially feared that this was a domain seizure, as when last year the domain registrar for .uk domains, Nominet, admitted to helping police authorities seize 3,000 websites and proposed new rules to expedite domain takedowns so that police authorities would not need court orders to do so. Whether this proposal was actually enacted remains unclear, but the chilling effect that both these cases have on free expression is undeniable.

Technology writer Glyn Moody reports that SOCA charged fraud because the music blog had allegedly been sharing pre-release works somehow obtained without authorization from music industry sites. If that’s true, SOCA’s involvement may not be quite as surprising as it initially appeared. But as SOCA has released no evidence in support of its allegation, it will be interesting to see how this proceeds.

In any case, this week’s takeover sets a dangerous precedent for copyright enforcement measures in the UK. If the hosting provider took down this site voluntarily without any court oversight, it raises the prospects of future cases being dealt with in a similar extrajudicial manner. Though the Internet blacklist legislation which would have facilitated similar takedowns in the U.S. has been stopped for now, we must keep a close eye on these sorts of alternative methods of online censorship that are implemented in the name of copyright enforcement.

~

For more updates on this story visit Open Rights Group or follow them on twitter at @Openrightsgroup

Permalink • Print • Comment

EU Court of Justice: Social Networks Can’t Be Forced to Monitor and Filter to Prevent Copyright Infringement

February 17, 2012 | By Gwen Hinze

In another important victory for Internet users’ fundamental rights and the open Internet, the highest court in Europe ruled yesterday that social networks cannot be required to monitor and filter their users’ communications to prevent copyright infringement of music and movies.  The European Court of Justice (ECJ) found that imposing a broad filtering obligation on social networks would require active monitoring of users’ files in violation of EU law and could undermine citizens’ freedom of expression.

The SABAM v. Netlog decision follows a landmark ruling by the ECJ in the SABAM v. Scarlet Extended case in November 2011, where the Court held that a Belgian ISP (Scarlet) could not be required to adopt a system to filter and block the transfer of potentially copyright infringing music files on its network. In that case, the Belgian copyright collective management organization SABAM had obtained an injunction (a court order) against the ISP, requiring it to install a system that would filter all of its users’ communications for potential copyright-infringing material.

Yesterday’s ruling also involved SABAM. It had sought a similarly broad injunction against Belgian social media platform Netlog.  The 2001 EU copyright directive mandates that copyright holders be able to obtain injunctions against intermediaries whose services are used by third parties to infringe copyright, but that is bounded by other EU obligations, including protection of citizens’ fundamental rights. The ECJ was asked to rule on the permissible scope of these injunctions, given their impact on Internet users’ fundamental rights and online service providers’ businesses.

The ECJ found that forcing Netlog to install a filtering system that would identify and prevent its users from making available any potentially copyright infringing files would require “active observation” of Netlog’s users. Following the 2011 SABAM v Scarlet decision, it held that implementing such a system would fall afoul of the key principle in Article 15 of the EU e-Commerce Directive, which prohibits EU member states from imposing a general obligation on ISPs and hosting services to monitor information they transmit or store, or to actively seek facts or circumstances that indicate illegal activity.

The Court also criticized the injunction on a second basis. In the 2011 Scarlet ruling and the 2008 Promusicae v. Telefonica decision, the ECJ held that in adopting measures to protect copyright holders, EU member states and courts must strike a fair balance between the protection of copyright, and the protection of the fundamental rights of individuals and businesses who are affected by those measures. The Court found that the filtering system being sought by SABAM required the identification, systematic analysis, and processing of information connected with the profiles of Netlog’s users. This would violate Netlog’s users’ right to protection of their personal data, enshrined in Article 8 of the Charter of Fundamental Rights of the EU. In addition, because the filtering system could not effectively distinguish between lawful and unlawful content, it could block lawful content, and undermine Netlog users’ right to receive and impart information protected under Article 11 of the Charter.

Given the protection required of citizens’ fundamental rights under the Charter of Fundamental Rights, the ECJ concluded that courts in EU countries can’t issue injunctions against hosting service providers that require them to install a filtering system with features as broad as the one in this case which (a) was directed at information stored on the hosting platform’s servers by its users, (b) applied indiscriminately to all its users, (c) was installed as a preventative measure (requiring hosting services to decide whether content is infringing), (d) was at the sole expense of the hosting provider, and (e) for an unlimited period of time.

So what does all this mean? Here’s a couple of our thoughts.

The ECJ ruling is directed at EU member countries, but it will have significant implications for the future of the global Internet. Injunctions are one of several strategies that intellectual property rightsholders have been pursuing to force Internet intermediaries to become copyright police. In countries around the world, IP rightsholders have used injunctions to impose filtering, blocking and user termination obligations on Internet intermediaries. These efforts are likely to expand under ACTA, because it requires signatory countries to make available broad injunctions to IP rightsholders, including temporary injunctions while a case is pending. By precluding pre-emptive filtering and blocking injunctions, the SABAM v. Scarlet and SABAM v. Netlog rulings set an important limit on this strategy for EU countries.

Because injunctions are issued by courts, usually after a process of weighing up all affected parties’ interests, measures imposed in this way theoretically provide better protection for Internet users than those adopted in private party voluntary agreements such as those we’ve seen in Ireland and Belgium. As we’ve noted elsewhere, Internet intermediaries are not competent to make legal determinations about whether particular content or conduct infringes copyright. Copyright holders’ efforts to require Internet intermediaries to take on this role under the guise of greater “co-operation” raise serious concerns about due process, transparency and accountability, and online free expression. In that respect, we welcome the ECJ’s clarification on the scope of injunctions available under EU law.

At the same time, we recognize that the ECJ’s Scarlet and Netlog decisions will now lead to increased lobbying pressure from rightsholder groups to change EU law, perhaps as part of the European Commission’s review of the 2004 Intellectual Property Rights Enforcement Directive. Let’s hope that EU policymakers approach this in as thoughtful and balanced a way as the ECJ.

Permalink • Print • Comment

What Does It Mean to be “Pro-Technology and Pro-Internet?”

February 24, 2012 | By Mitch Stoltz

Ahead of the Academy Awards this weekend, Chris Dodd, head of the Motion Picture Association of America, would like to assure you that "Hollywood is pro-technology and pro-Internet." But what does that mean? The comments filed at the Copyright Office this month by MPAA and RIAA, together with the Business Software Alliance, the Entertainment Software Association, and other copyright owners' groups, paint a clear picture of these groups' vision for the future of the Internet and digital technologies.

EFF is asking the Copyright Office for legal exemptions to the Digital Millennium Copyright Act to allow jailbreaking (or "rooting") of smartphones, tablets, and game consoles, so that people can run their software of choice on the devices they own. EFF is also asking for exemptions that will allow noncommercial video remixers to use video clips from DVDs and online video services. Other organizations are asking for exemptions for various forms of digital video, accessibility for the disabled, and other important projects. Under the DMCA, exemptions expire every three years, and have to be justified all over again. Many of you sent comments and signed petitions in support of EFF's exemption requests, and the Copyright Office received almost 700 comments.

MPAA and friends don't approve of a single one of the exemption requests. "The risk associated with encouraging people to circumvent and test the limits of fair use is too high," they say, and the makers of computing devices should be able to stop "unintended uses" of their products. In fact, say the entertainment lobbies, giving you the ability to modify your own devices for your own use will "wreak havoc" on "markets for consumer access to works."

Let's unpack this. Almost everything we do on the Internet or with digital media makes a copy—even viewing a webpage. In many cases, the fair use rule of copyright law is what keeps these everyday activities from being copyright violations. But proving definitively that a use is fair often requires a courageous artist or entrepreneur to go to court and risk massive penalties for the chance of having a judge say that what they're doing is legal. According to the entertainment lobbies, the U.S. government should not encourage people to do this.

Ironically, most of the devices that let us create and experience movies, music, software, and so on "test the limits of fair use"—and many have wound up in court. If this were discouraged, we may never have had the VCR, the MP3 player, the digital video recorder, image-searching websites, or social networks—at least not without asking the entertainment industries' permission first. 

And speaking of permission, MPAA regrets that "the Copyright Office missed an opportunity to endorse" the custom of "asking permission" before innovating.

So what should the Copyright Office be doing? MPAA et al. humbly suggest that the Office should be protecting the "ongoing viability of business models" that create "predictability with respect to how works will be accessed and how copyrighted software and technologies used to facilitate such access will be used and manipulated." You won't find that in any law, although it sounds a lot like the goals of the now-defunct SOPA and PIPA bills. Again, let's look behind the euphemisms: the entertainment lobbies want the U.S. government to protect their members' bottom lines by regulating how digital technologies can be used. Only uses that receive Hollywood's permission, and are "predictable," should pass muster.

Apparently this is what Mr. Dodd means when he says "Hollywood is pro-technology and pro-Internet": technology that blocks "unintended uses" and an Internet subject to Hollywood's veto power. SOPA and PIPA may be dead, but the agenda behind them seems alive and well.

Permalink • Print • Comment

How Internet Companies Would Be Forced to Spy on You Under H.R. 1981

February 23, 2012 | By Rainey Reitman

Online commentators are pointing to the Internet backlash against H.R. 1981 as the new anti-SOPA movement. While this bill is strikingly different from the Stop Online Piracy Act, it does have one thing in common: it’s a poorly-considered legislative attempt to regulate the Internet in a way experts in the field know will have serious civil liberties consequences. This bill specifically targets companies that provide commercial Internet access – like your ISP – and would force them to collect and maintain data on all of their customers, even if those customers have never been suspected of committing a crime.

Under H.R. 1981, which has the misleading title of Protecting Children From Internet Pornographers Act of 2011, Congress would force commercial Internet access providers to keep for one year a “log of the temporarily assigned network addresses the provider assigns to a subscriber to or customer of such service that enables the identification of the corresponding customer or subscriber information under subsection (c)(2) of this section.”  Let’s break that down into simple terms.

Temporarily Assigned Network Addresses: More than IP Addresses

Under this proposal, ISPs would have to maintain “temporarily assigned network addresses” to enable the identification of a subscriber. At a minimum, this refers to the IP addresses assigned by ISPs, including the Internet services associated with mobile phones.  It could also potentially include mobile phone numbers or other forms of cell phone identification, such as the three major mobile device identifiers: IMEI, IMSI, TMSI. These are the tracking IDs for your mobile devices, the unique identifiers that mobile phone companies use to track handsets and the accounts associated with them.

IP Addresses Aren't a Perfect Identifier

An IP address is like a street address or a phone number; it's the arrow that points packets of information your way when people send you things over the Internet. But it cannot tell you who is actually sitting behind a computer screen, typing at a computer.

Currently IP addresses by themselves aren’t a perfect way to identify individuals. One reason is because there are only a limited number of IPv4 addresses (the current schema most ISPs use to allocate IP addresses), and so there are many situations in which a bunch of Internet users are sharing a single IP address. This strategy, called Network Address Translation (NAT), is a creative way to deal with the shortage of IP addresses while we are still in the protracted process of transitioning to IPv6. All of which is to say: H.R. 1981 mandates that companies keep a log of assigned network addresses in order to identify customers, but IP addresses are only one clue in figuring out a user's identity.

IP Addresses: Useful for Location Tracking

But there’s another element many commentators are forgetting: even if a single IP address isn’t a perfect identifier, a collection of IP addresses assigned to a user can be combined with other data elements to create a frighteningly detailed map of a person’s location over time. For example, law enforcement could review the IP addressses an individual used to log onto her email account over the period of several months to create a detailed picture of when she was at home, when she went to work, when she was in transit, and when she went to sleep – and whether there were certain days she deviated from her typical schedule.

IP addresses can also indicate information about a user's physical proximity to other users. For example, if two people are using the same IP address at the same time, they are likely at the same location. Law enforcement might be very interested in how IP addresses can indicate one's associations in this way.

Law enforcement could also demand that a social network hand over the IP addresses and logged-in times of an individual using its service. Law enforcement could then combine this information with data from an ISP or mobile carrier to figure who was assigned to each of those IP addresses. For mobile providers, each entry could be combined with data about one’s GPS location. So a law enforcement agent could know when an individual was posting to a social network as well as her location. ISPs will be slightly less exact but still provide a detailed portrait of an individual’s physical location each time she logged in. 

This is no nightmare scenario. This is exactly what the U.S. government attempted when it pressured Twitter to hand over Icelandic parliamentarian Birgitta Jónsdóttir’s data as part of the WikiLeaks investigation. And we’ve seen numerous other occasions where law enforcement pressured Internet companies to hand over the IP addresses and times of individuals using their services.

Law enforcement is coming to understand that IP addresses are a powerful key to location data and to tracking people's movements over time. But in order for this data to be most useful to them, they need ISPs and mobile carriers to keep records of who is assigned to which IP addresses, and when.

The Supreme Court has already decided that tracking an individual’s car with a GPS device for months at a time without a search warrant is blatantly unconstitutional.  But by passing H.R. 1981, law enforcement hopes to create a mountain of data that will facilitate the location tracking of anyone who uses the Internet, if that person is under suspicion for any reason in the coming year.

Detailed Banking Information

Because the actual language of the bill is somewhat vague, activists at Demand Progress have correctly noted that this legislation might force Internet companies to retain even more data just to be on the safe side. The proposed bill is an amendment to 18 USC § 2703, the law currently defining the circumstances under which companies that store electronic data on customers must disclose it to the government. H.R. 1981 is attempting to amend and expand this law in a way that “enables the identification of the corresponding customer or subscriber information under subsection (c)(2) of this section.”

So what is subsection (c)(2)?  It requires a provider to turn over to the government without a warrant:

  • Name
  • Address
  • Records of session times and durations
  • Length of service (including start date) and types of service utilized
  • Credit card or bank account number

The language of H.R. 1981 is dangerously unclear – it would definitely require a network to maintain an historical log of IP addresses, but will ISPs believe it also requires them to maintain detailed records on customers’ addresses, credit card, and bank information? Such an interpretation would create a honeypot of sensitive data ripe for overly ambitious law enforcement agents, malicious hackers, or even accidental disclosures.

This Attack on the Internet Has Nothing to Do With Child Pornography

H.R. 1981 is touted as a way to crack down on child pornography, but the data retention mandates of this bill will affect every Internet user who uses a U.S. ISP.  It’s sad to see our legislators using the mantle of child pornography to order Internet companies to spy on users, forcing ISPs to keep mountains of unnecessary data about innocent Internet subscribers in the hopes that it might one day be useful to law enforcement.  That’s exactly why Representative Zoe Lofgren proposed an amendment to rename the bill the 'Keep Every American's Digital Data for Submission to the Federal Government Without a Warrant Act of 2011.'

This type of legislation goes against the fundamental values of our country where individuals are treated as innocent until proven guilty. H.R. 1981 would uproot this core American principle, forcing ISPs to treat everyone like a potential criminal. 

Help us defeat the Internet spying bill. Contact Congress today.

Permalink • Print • Comment

August 2, 2011

How The New ‘Protecting Children’ Bill Puts You At Risk

By Violet Blue | August 1, 2011, 11:37pm PDT

Summary

A bill now makes the online activity of every American available to authorities upon request under the guise of protecting children from pornography.

Violet Blue

Violet Blue is a Forbes Web Celeb, SF Appeal contributor, a high-profile tech personality and one of Wired's Faces of Innovation. She is regarded as the foremost expert in the field of sex and technology, a sex-positive pundit in mainstream media (MacLife, Forbes.com, The Oprah Winfrey Show, others) and is regularly interviewed, quoted and featured prominently by major media outlets (from ABC News to the Wall Street Journal). A published feature writer and columnist, Violet also has many award-winning, best-selling books; her books are featured on Oprah's website. She was the notorious sex columnist for the San Francisco Chronicle. She headlines at conferences ranging from ETech, LeWeb and SXSW: Interactive, to Google Tech Talks at Google, Inc. The London Times named Blue one of the 40 bloggers who really count.

Last Thursday the U.S. House of Representatives passed a bill that makes the online activity of every American available to police and attorneys upon request under the guise of protecting children from pornography.

The Republican-majority sponsored bill is called the Protecting Children From Internet Pornographers Act of 2011 .

It has nothing to do with pornography, and was opposed by over 30 civil liberties and consumer advocacy organizations, as well as one brave indie ISP that is urging its customers to do everything they can to protest the invasion of privacy.

“Protecting Children” forces ISPs to retain customer names, addresses, phone numbers, credit card numbers, bank account numbers, and dynamic IP addresses.

It’s like having your wallet plus the web sites you visit tracked and handed over on request. These logs are now going to be retained for the scope of one and a half years.

(I have to wonder if ISPs can sell this data, too.)

This has nothing to do with porn. In case you’re like the Reps that passed this nightmare and you’ve forgotten: pornography is legal in the United States.

It is pedophilia that is illegal. But for the sake of harnessing hysteria to get a bill passed, clearly these particular Republicans find it convenient to conflate “pornographers” as pedophiles. Last time I checked in on the matter, pedophiles did not operate within the laws surrounding adult pornography.

Personally, I’m insulted as a porn-loving American girl to be included by way of consumer participation in this disgusting and misleading characterization. And that my privacy has just been sold for something that doesn’t actually help the children.

I don’t feel confident that treating us all like the criminals our system can’t catch is going to protect any children, especially when the people who passed the bill can’t – or won’t – distinguish the difference between legal adult pornography and pedophilia.

CNET’s Declan McCullagh reminds us that “the mandatory logs would be accessible to police investigating any crime and perhaps attorneys litigating civil disputes in divorce, insurance fraud, and other cases as well.” CNET reported that mandatory data retention was being fast-tracked in January, 2011.

The fact that civil litigants could subpoena your internet activity and the contents of your wallet has nothing to do with the labeled and stated purpose of this bill.

“The bill is mislabeled,” said Rep. John Conyers of Michigan, the senior Democrat on the panel. “This is not protecting children from Internet pornography. It’s creating a database for everybody in this country for a lot of other purposes.”

The Electronic Frontier Foundation spearheaded consumer and privacy groups’ opposition to the bill and hosted a one-click letter-writing campaign . This included the ACLU, the Bill of Rights Defense Committee, Patient Privacy Rights and many more.

Because of the way the bill requires information to be collected and stored, the EFF called the bill “ripe for abuse by law enforcement officials” and said that because the laws designed to protect the private data of consumers from government access are insufficient and out-of-date, it creates “a perfect storm for government abuse.”

Small ISPs Are Ringing The Alarm

While consumer groups opposed it and tech news outlets I trust are spelling out concerns, it was when my own ISP made a blog post that it was clear that this bill isn’t just a problem for privacy proponents.

Sonic.net ’s CEO Dane Jasper personally posted Help us, protect your privacy online .

Today we retain most IP allocation logs for just two weeks; we don’t need them beyond that period, so they are deleted. Storing logs longer presents an attractive nuisance, and would potentially make our customers the target of invasions of privacy.

Any lawyer can simply file a Doe lawsuit, draft up a subpoena and request a customer’s identity. It’s far too easy.

Do the wheels of justice – or investigation – move too slowly, and should data be retained for a long time to allow for legitimate investigation? No, there are already tools in place that law enforcement can easily use to ask ISPs to preserve log information of real online criminals.

The 1996 Electronic Communication Transactional Records Act allows law enforcement to require an ISP to keep data for 90 days upon law enforcement request, giving time for a legitimate search warrant to be reviewed by a judge and issued.

The CEO points out that because the bill applies to commercial providers, naturally it won’t catch people pursuing criminal activity, who can simply use public Wi-Fi.

Or 4G wireless, such as through a cell carrier.

Lifehacker points this out in What You Need to Know About the Internet Snooping Bill (and How You Can Protect Yourself) :

One nice feature of the PCFIPA of 2011 bill is that it doesn’t include cellular data, so if you’ve thought about switching to 4G wireless data at home you’ll soon have another reason.

That’s right: wireless carriers are exempt from having to store all your data and provide it on notice. This is likely because unlike small ISPs such as Sonic, wireless carriers lobbied the bill authors to get out of it .

The Department of Justice fought against the mobile exemption .

Obviously if someone is going to distribute pedophilia they could do it over a 4G wireless card just as easily as their DSL account, so in a certain context, the wireless carriers have lobbied their way out of the cost burden.

That also makes this bill anti-small business, because smaller ISPs like Sonic have to bear the costs, while Verizon and friends, don’t.

I think that ultimately, the ones bearing the true costs will be us.

And don’t give me that ‘if you’re not doing anything wrong you shouldn’t worry’ line. It’s as ripe as Congressman Weiner’s old line, ‘my account was hacked.’

Permalink • Print • 1 Comment
« Previous PageNext Page »
Made with WordPress and an easy to use WordPress theme • Sky Gold skin by Denis de Bernardy