UK Copyright: How it compares internationally and who are the winners and losers

Due to popular demand, :-), slides first and text of talk below.

| View | Upload your own

Westminster eForum: IP and the Future of Copyright

UK Copyright: How it compares internationally and who are the winners and losers

March 2008

Ray Corrigan

Open University

Academics tend to get to talk to monochromatic audiences of peers or students and I usually find myself talking to lawyers about technology or technologists about law. So I am delighted to have the opportunity to address such a diverse group of people today, as I firmly believe a cross-disciplinary, evidence-based approach to intellectual property policy-making is essential in our modern world. So many thanks to the Westminster eForum for inviting me along today.

My brief for this morning is to look at current UK copyright legislation – how it compares internationally, and who are the winners and losers. I will be starting with a whistle-stop tour of UK copyright law in historical context, before looking at international comparisons and then focusing on the winners and losers.

Copyright protects literary, dramatic, artistic and musical works, such as books, music, software, films, sound recordings, databases, packaging, tickets, lists of rules, advertisements. It protects the expression of an idea not the idea itself. So if I wrote an article about painting a wall blue and this had never been thought of before, the article would be protected by copyright but everyone would be free to paint their walls blue.

To make things we need resources, including intangible resources like information and ideas. Authors, inventors, blues musicians, creators of all kinds do not create things out of thin air. They use language, stories, professional skills, musical notes and chords, facts and ideas, all building on the work of earlier creators, and their own talents and experience.

To understand copyright in the UK, we really need to understand something about its historical context. The Statute of Anne is sometimes referred to as the first copyright act[1] but was primarily concerned with regulating the monopolistic practices of the book trade. The copyright of the Statute of Anne was designed to protect publishers’ rights to exclusive publication but by 1774, the House of Lords in Donaldson v Beckett held that the limitations on copyright in the statute also applied to authors. What started as a law to protect publishers became a law to protect the rights of authors and today copyright protects the content of the published work itself. Thomas Babbington Macaulay went on to describe copyright in speeches to the House of Commons in the 1840s as a tax on readers to benefit authors.

In 1885 the Berne Convention for the Protection of Literary and Artistic Works was established to encourage respect for copyright internationally. With Victor Hugo being one of the prime movers in developing the convention it arguably stems from the continental tradition of copyright deriving its legitimacy from the rights of the author, as opposed to the English copyright which was based on economic rights.

Britain incorporated its interpretation of the Berne Convention and its subsequent revisions into the Copyright Acts of 1911 and 1956 and the Copyright Designs and Patents Act 1988. There have been a whole host of other important international regulatory instruments which have had an impact on UK copyright law –

• The Rome Convention (International Convention for the Protection of Performers, Producers of Phonograms and Broadcasting Organizations, 1961)
• The GATT/WTO Agreement on Trade Related Aspects of Intellectual Property Rights (TRIPS signed 1994, coming into force in 1995)
• The 1996 World Intellectual Property Organisation (WIPO) Treaties
• Many EU directives since the early 1990s – the intellectual property rights enforcement directive, e-commerce directive, copyright and related rights directive, and directives on databases, software, semiconductors and copyright term harmonisation

– listed primarily to illustrate that the UK does not have a completely free hand in setting domestic copyright policy. So, for example, prior to the copyright term harmonisation directive of 1993, the UK copyright term, in line with the Berne Convention was the life of the author plus 50 years. It was then extended to life plus 70 in line with the directive. Outside of the EU and the US which extended its term to life plus 70 in 1998, in order to match the EU, many jurisdictions still offer the Berne norm of life plus 50, though Mexico is now at life plus 100 years.

Andrew Gowers published his review of UK intellectual property policy in 2006 and made a number of important recommendations, some perceived as controversial, others less so. He recommended stronger enforcement, a private copyright exception to allow format shifting e.g. from CDs to MP3 players, that the UK Patent Office should become the UK Intellectual Property Office, which has had a number of operational implications for our next speaker; and the setting up of an advisory board on IP to include advisers from industry. He also, unusually, commissioned an economic study to consider the extension of copyright term in sound recordings and firmly came out against such a move.

Since the mid 1990s when the World Wide Web (that part of the Internet accessible through a browser) hit the public consciousness, the copyright landscape has been undergoing an upheaval of earthquake proportions. In addition to domestic changes to copyright laws all over the world, there have been a number of international instruments like the 1996 WIPO treaties, EU directives and a number of bilateral and multilateral trade agreements which affect the shape of copyright policies. It is impossible in a short talk to cover every aspect of all of them so I’m just going to consider a couple – copyright terms and how a variety of jurisdictions deal with alleged illicit music sharing via the Internet.

There is no simple answer to the question ‘how long does copyright last for?’ It depends on a number of factors including what type of work it is, where and when it was created and/published and whether it was produced by an individual creator or by or for a commercial agent. In the US and EU copyright in literary works now lasts for the life of the author plus 70 years. In Mexico it is life plus 100 years and many other jurisdictions still maintain the Berne Convention norm of life plus 50 years. Sound recordings are now protected in the EU for 50 years and the US for 95 years. Andrew Gowers recommended against extending this term, as I mentioned previously but Internal Market Commissioner Charlie McCreevy recently committed himself to extending the term in sound recordings at an EU level to match the US term of 95 years. This raises a number of questions e.g.

If the economic case against term extension is so strong, as Gowers concluded, are there other compelling reasons for such an extension and how can we test them?

If the move is to match the US situation, will it mean that artists lose royalties on radio play in the EU which are not available for radio play in the US?

Etc.

Now aside from copyright terms, it is probably also worth thinking about different approaches to ISP liability for copyright infringement. Gowers recommended a voluntary agreement between the relevant agents – the ISPs and the music industry – with the threat of government regulation if they can’t sort it out between them. In the US, ISPs can avail themselves of the DMCA s512 and CDA s230 safe harbour provisions to avoid liability for copyright infringement, provided they have acted quickly to remove the relevant material, once they are notified of an alleged infringement. Arguably Articles 12-15 of the (2000/31/EC) e-commerce directive (and the UK Electronic Commerce (EC Directive) Regulations 2002, s17-19) gives EU ISPs a similar privilege.

But a Belgian court case,[2] towards the end of 2007, has raised significant questions about this by pointing out that the EU copyright directive of 2001 states that “Member States shall ensure that rights holders are in a position to apply for an injunction against intermediaries whose services are used by a third party to infringe a copyright or related right”. The court ordered the ISP to deploy filters to block copyright infringement. The case is under appeal but will be worth watching closely.

Arguably the most useful thing that ISPs can do for the music labels is to link an IP address to an individual ISP subscriber. The Totalise v Motley Fool[3] Internet defamation case in 2001 made it legitimate for an ISP to reveal personal information in this way despite possibly contravening section 35 of the Data Protection Act. The automatic rubber stamping of the revelation of personal data allowed under the DMCA in the US is arguably not permissible in the EU (see the Sheffield Wednesday case[4] from 2007 where the UK High Court ruled that comments made on a fan's website, though technically defamatory, were still sufficiently trivial that they did not merit invading personal privacy to the extent that the club's directors should be allowed to access the identity of the 7 individuals making those comments.) In Canada the situation is similar to the EU where, in 2005, the Canadian federal appeal court refused to allow the music industry access to the identity of ISP customers suspected of engaging in copyright infringement.[5]

But the disclosure of identity is just the first step in the process of going to court or issuing a cease and desist letter. This takes time and money and is not streamlined and although Ireland, England, the US and a number of other jurisdictions facilitate the identification of ISP subscribers suspected of illicit file sharing, upper courts in Germany, Canada and elsewhere have blocked such revelations on privacy grounds. So the process can be a bit of a lottery for all concerned.

This leads us neatly on to winners and losers.

There are three main parties with a stake in the copyright pie:

• Creators

• Agents (and I use the term in the economic sense here to cover all the commercial entities involved in the copyright arena e.g. music, film, software, media companies, publishers etc.)
• And the general public (or consumers)

Each of the three sets of stakeholders will have within them a massive range of different kinds of creators, businesses or consumers – all of which will have their own demands of the copyright system – but for simplicity sake I am just going to look at the three groups.

We can take a theoretical stab at how the state of the copyright system – depending on, for example term, scope, penalties, case law, enforcement – will affect each of our stakeholder groups. And we can see from the graphs that the optimum system is different for each group but for it to work the interests of all three groups must be catered for. So immediately we see the need for compromise. Strong copyright might raise economic incentives to create and commercialise, for creators and agents, but it may restrict public access and the access of creators to build on the work of earlier creators. Weak copyright lowers economic incentives for creators and agents but consumers and second generation creators have greater access and freedoms. So there always have to be trade offs for the system to work, since theoretically

Z_a > Z_c > Z_consumers

(possibly) and we can construct a model illustrating that the “best” copyright system, at least from an economic perspective, is one where the weighted sum of the benefits to creators, agents and the public is maximised.

The problem is that there is very little empirical evidence available on copyright and intellectual property policymaking more generally. And the studies that are available are often contradictory. So for example Oberholzer and Strumpf (2004) concluded that Napster had little effect on music sales, yet Blackburn (2004) concluded that it had a substantial effect. The only thing we really know is that internet music swapping, the volume of which we can only guess at but again do not know, has a non-trivial relationship with music sales.

• Some file sharers would otherwise have bought the music,
• some buy more as a result of finding bands they like,
• some get access to music that is no longer commercially available or music released under different licenses like creative commons,
• some would not otherwise get access to the music at all because they lack the disposable income and so on.

So who are the winners and losers when copyright changes?

Let’s take Commissioner McCreevy’s proposed 45 year term extension in sound recordings for example.

Clear winners are creators and agents with commercially successful works which would otherwise fall into the public domain 45 years earlier. Now only about 4% of copyright works older than 20 years are commercially available, so 96% remain locked up for another 45 years even though no one is selling them. So the public lose out, as do creators who would like to build on those works (and the 4%).

Another recent development has been the French government’s signing of a memorandum of understanding with the ISPs and the entertainment industry, to facilitate a 3 strikes rule. The idea is that people suspected of infringement get one warning, one temporary suspension of services for a second offence and then get locked out of the Net for a third offence. Japanese ISP associations are considering a similar deal but in Sweden the government has rejected such an idea.

The winners are again some creators and agents whose sales are undermined by the users targeted. Losers are the public subject to constant surveillance, some agents like ISPs who bear the cost of policing the system, and the folk who get cut off from the Net – a severe sanction – possibly without due process guaranteed by human rights laws. Practical considerations might mean that for the scheme to be workable on the part of the ISPs it would have to be automated and internal to the ISPs – though in the French case the process is to be supervised by a judge and independent tribunal.

The system also raises quite a few other legal questions e.g. there is a presumption of guilt not innocence. The person linked to the IP address identified as an alleged source of infringement is automatically assumed to be guilty and has the burden of proving their innocence. There are a large number of ways that people might be wrongly accused - there are a lot of reasons why the person linked to the IP address - i.e. the formal ISP subscriber - might not be the infringer. It could be other family members or their friends or others accessing open wireless access points (wifi piggybacking), or trojans enabling remote control of that machine.

There are a lot of questions of detail with no clear answers yet available. Will there be access to the courts for those wrongly accused? How long does the Internet ban last? Etc.

Even if we could overcome these problems, there is the legal question about whether a 3 strikes law is a proportionate response to the specific problem. According to the Promusicae v Telefonica case in the European Court of Justice (2008), the rights of the music labels to protect their copyrights must be balanced with the basic human rights of users of the Net. Having access to the Net is now a basic part of nearly everyone's life in the developed world and it relates to basic rights to

• free expression
• freedom of association
• education
• and employment

And the European Convention on Human Rights and every other serious international charter of rights says that if a law is not proportionate it is not legal.

In other words, even with the legitimate aim of defending or protecting copyrights, the ECJ clearly instructed member state governments that they are not to endanger human rights or proportionality. Some legal commentators, most notably Professor Lilian Edwards of Southampton University, actually think that this part of the decision was clear dicta from the court, aimed directly at the kind of 3 strikes notice and disconnect schemes the French have implemented and others are considering. So there is a good chance that the ECJ would strike down such schemes challenged at that level, on the grounds of proportionality.

I will round off, then, with a call for evidence based policy making on copyright and ask you to remember that radio took 40 years to reach an audience of 15 million. TV took 15 years and the World Wide Web part of the Internet did it in 3 years. The law cannot and does not have to instantly react to changes in technology. So when it comes to regulating in this area, I tend to subscribe to London University Professor Chris Reed’s doctrine of creative inertia – watch closely to see what happens, gather robust empirical evidence on creators, agents and consumers, and legislate based on that evidence.

Thanks for your time and attention.

---

[1] There were earlier related acts such as the Star Chamber Decrees of 1586 and 1637, the Ordinances of 1643 and 1647 and the Licensing Act of 1662 (which expired in 1694)

[2] SABAM v Tiscali (Scarlet). See http://www.cardozoaelj.net/issues/08/case001.pdf for a translation of the decision.

[3] See http://www.hrothgar.co.uk/YAWS/reps/totalise.htm for full decision

[4] See http://www.bailii.org/ew/cases/EWHC/QB/2007/2375.html for full judgement

[5] See http://www.canlii.org/en/ca/fca/doc/2005/2005fca193/2005fca193.html BMG Canada Inc. v. Doe, 2005 FCA 193 (CanLII)

Update: After the problem with Slideshare I noticed there was a typo on one of the original slides which I have now corrected (Slide 7. Now reads CDA s230, instead of CDA s236)

Westminster eForum: IP and the future of copyright

I had the privilege of opening the Westminster eForum's seminar on Intellectual Property and the Future of Copyright on Monday. It was a wide ranging session including speakers and delegates from all corners of the intellectual property landscape.

The most impressive speaker on the day was Ian Fletcher, Chief Executive of the UK's Intellectual Property Office. He talked with authority and conviction on the need for evidence based policy making in this area. I must have looked like a nodding dog at the speakers' table alongside, since I found myself agreeing with everything he had to say.

Intellectual property policy has traditionally been an evidence-free zone and to hear someone in such a position demonstrating a commitment to build an economic and social evidence base was extremely heartening. He was also prepared to say that:

• some interested groups were very good at lobbying and influencing decision making in IP
• we must recognise that every creator's inputs are someone else's outputs
• that we must be very careful about our use of language and not allow it to distort the debate or our understanding
• that we have to gather robust and thorough empirical evidence on how to move forward and that some will not like what the evidence has to say
• we need to ask hard questions including whether copyright term is actually too long and should be reduced - he asked a whole series of difficult and genuinely open questions like this without intent to pre-judge the outcomes of any evidence gathering
• that there tends to be a constant leveraging up of the strength and scope of IP protections - the US has this, so the EU should have likewise; the EU has that, so the US should have the same etc.
• that Andrew Gowers' key insight was to bring economics to the IP table

With that kind of thinking at the heart of the UK IPO, we can look to the future with some optimism.

The other highlights of the seminar were contributions from Becky Hogge of the Open Rights Group and film-maker, Jamie King, director of Steal This Film II. On the industry side Shira Perlmutter of the IFPI was quietly effective though I disagreed with some of what she had to say; Richard Mollet of the BPI started out well as you would expect of a confident, experienced PR professional but then, from my perspective, slightly misjudged the mood and came across as irritated that others, such as Andrew Gowers, had a different world view which was taken seriously. What was interesting was when he admonished us to get our language right - we should apparently be labeling the '3 strikes' laws/memorandums/agreements as a "graduated response" approach. Kettles, pots and a certain colour come to mind and anyway I think I prefer Louise Ferguson's "Internet ASBOS" as a more appropriate tag.

If anyone would like a copy of my own contribution to the morning, let me know and I'll send you the text of my talk and associated slides. Alternatively I'm happy to post it in full here. I'm hoping it came across as relatively neutral but evidence-focussed and a reasonable indication to that effect was that I was subsequently quoted by various speakers on different sides of the debate as supporting what they had to say. I should say the back end of my speech was inspired by Lilian Edwards - some of it indeed was lifted directly from my blog post about Lilian's OII 'Musicians, fans and online copyright' talk recently! Other parts were based on the work I did with Mark Rogers of Oxford University on the economics of copyright.

Update: A recording of Becky Hogge's talk is now available at ORG.

USPTO reject Blackboard patents

The US Patent and Trademark Office has reportedly issued a preliminary ruling rejecting Blackboard's patent on delivering courses via the Net. The Chronicle says:

"The U.S. Patent and Trademark Office has issued a preliminary decision that rejects all 44 claims Blackboard Inc. made regarding the controversial patent it was granted for an online-learning system. If upheld, the decision could have sweeping ramifications for Blackboard's competitors and universities that use course-management software."

The ruling itself is available at Desire2Learn who are pleased:

"On March 25, the U.S. Patent & Trademark Office issued its Non-Final Action on the re-examination of the Blackboard Patent. We are studying the document, found here, but in short, the PTO has rejected all 44 of Blackboard's claims. We caution that this is a NON-final action; both Blackboard and Desire2Learn will have an opportunity to comment before a final action will issue, and after that, the decision will be subject to appeals.

However, we're still pleased."

Blackboard have responded to the ruling and are not so pleased but suggest it doesn't change anything:

"Today, the United States Patent and Trademark Office issued a first Office Action in the reexamination proceeding regarding Blackboard’s U.S. Patent 6,988,138 ("the'138 Patent"). This Office Action was expected and is the first step in a reexamination process that often takes years to complete. It has no effect on the validity of the patent, the lawsuit between Blackboard and Desire2Learn or the pending injunction against Desire2Learn that will go into effect on May 10th, 2008, precluding ongoing sale or use of their Learning Environment products and services...

Blackboard will now have two months to respond to each of the Patent Office’s questions, all of which were unsuccessfully raised by Desire2Learn in the recent litigation.

With that in mind, and given that more than 90% of patents that undergo reexamination of this kind ultimately are upheld, we remain very confident in the validity of our patent and that the Patent Office will agree with the ruling in Federal Court last month. While the reexamination process moves forward, the issued patent will remain both valid and enforceable."

The USPTO's decision and the reactions were relatively predictable and Desite2Learn are right to urge caution, as are Blackboard to point out it is only one step in a long process. So it is a case of keep watching on this one I'm afraid. Ultimately, though, the patent is unlikely to withstand detailed, robust, prolonged and rational scrutiny. Unfortunately, in the meantime, the damaging adjective in that list is "prolonged".

Germany's top court curbs anti-terrorism Law

From DW-World: Germany's Top Court Curtails Disputed Data Storage Law

"In a blow to Berlin's efforts to boost anti-terrorism measures, Germany's highest court on Wednesday, March 19 blocked parts of a sweeping data-collection law that had prompted large protests by civil liberties

Germany's constitutional court on Wednesday severely curbed parts of a wide-reaching and highly controversial data collection law that requires telecom companies to store telephone and Internet data for up to six months, dealing a setback to government efforts to fight terrorism.

The law which went into effect in January gave the federal government broad access to data including e-mail addresses, length of call and numbers dialed and in the case of mobile phones, the location calls are made from."

3 Strikes Copyright

The Times reported last month that the UK government were considering following the French lead and introducing a '3 strikes and you're off the Net' law for suspected copyright infringement. The music industry in the form of the IFPI and the BPI are very supportive of the idea, the ISPs less so.

Lilian Edwards gave a very interesting presentation on the legal aspects of a possible 3 strikes law in the UK at the OII's Musicians, fans and online copyright event at LSE last week.

Lilian began by asking if the government has a role here what are the angles? And then went on to say:

The music industry in Europe has followed their counterparts in the US in suing users of P2P networks but EU courts have been generally less willing to process such cases as efficiently as the US court system. In addition it does not seem to be very good business practice to sue your customers.

ISPs, supported by the e-commerce directive, can issue takedown notices for allegedly defamatory or copyright infringing material but this is not really scalable. Another option is the for ISPs to share of anonymised logs but music companies can do that anyway. The most useful thing that ISPs can do for the music labels is to link an IP address to an individual ISP subscriber. The Totalise v Motley Fool Internet defamation case in 2001 made it legitimate for an ISP to reveal personal information in this way despite arguably contravening section 35 of the Data Protection Act and many ISP's own privacy policies. The automatic rubber stamping of the revelation of personal data allowed under the DMCA in the US is arguably not permissible in the EU (see the Sheffield Wednesday case from 2007 where the UK High Court ruled that comments made on a fan's website, though technically defamatory, were still sufficiently trivial that they did not merit invading personal privacy to the extent that the club's directors should be allowed to access the identity of the 7 individuals making those comments.) In Canada the situation is similar to the EU where, in 2004, the Canadian federal appeal court refused to allow the music industry access to the identity of ISP customers suspected of engaging in copyright infringement.

But the disclosure of identity is just the first step in the process of going to court or issuing a cease and desist threat. This takes time and money and is not streamlined and it can lead to lots of embarrassment as we have seen in the US where 8 year olds and dead people get threatened and sued. These kinds of cases are very visible and not good public relations for the industry. So the music industry in particular would prefer a simple notice and disconnect model instead of a difficult, time consuming, costly, transparent and public process.

However, they need all the ISPs to agree or it is no use. At the moment, however, in the UK at least, they can't get everyone to agree.

And following on from a commitment made in the wake of the Gowers Review of Intellectual Property in the UK, without a voluntary agreement on the part of the industries concerned, the UK government are going to consult on legislation to sort it all out. There are no details yet on what form such legislation might take and it was heartening to hear from a representative of the government earlier in the day that they had no fixed ideas in the area. One rumor, persistently doing the rounds, however, was that the UK was considering following the French with a 3 strikes law - a warning, a short suspension of services and then you're off the net for good sequence of strikes issued against people suspected of engaging in copyright infringement via the Net. There are absolutely no details available though the the hypothetical UK version of the proposal. How, for example to appeal a false accusation? What the arbitration process might be? Access to courts and visible/transparent due process when things go wrong for all parties. 4 Japanese ISP associations are apparently considering something similar to the 3 strikes approach.

Whatever form such a proposal might take it raises a number of legal objections.

Due process?
If we withdraw access to the Net from a large number of people in the UK (and 6 million plus are considered to be engaged in copyright infringement via the Net in the UK alone), should such withdrawal be by a closed industry procedure? Practical considerations mean that for the scheme to be workable on the part of the ISPs it would have to be automated and internal to the ISPs. No impartial process or judge would be overseeing it (as is happening in the French case). But we have to realise that ISPs are not Net police but service providers. They are not set up for policing. In court copyright infringement would have to be increased to the standard of a criminal infringement because withdrawal of access to the Internet feels very much like a criminal sanction.

In addition there is a presumption of guilt not innocence. The person linked to the IP address identified as an alleged source of infringement is automatically assumed to be guilty and has the burden of proving their innocence. There are a large number of ways that people might be wrongly accused - there are a lot of reasons why the person linked to the IP address - i.e. the formal ISP subscriber - might not be the infringer. It could be other family members or their friends or others accessing open wireless access points (wifi piggybacking), or trojans enabling remote control of that machine.

There should be an absolute commitment to starting with a presumption of innocence rather than a presumption of guilt by an industry with an economic stake in an outcome whereby someone is held responsible.

Will legal access be available to the accused? Or does someone have to be cut off first? Article 6.1 of the European Convention on Human Rights (ECHR) and every substantive international human rights instrument guarantees the right to due process. Is access to the Net itself a basic human right? Article 36 of the ECHR would suggest so or at least it is very close. The French scheme is better than an unmediated scheme since it allows for the access to an independent tribunal with the oversight of a judge.

Even if we could overcome these problems, there is a serious legal question about whether a 3 strikes law is a proportionate response to the specific problem. According to the recent Promusicae case in the European Court of Justice the rights of the music labels to protect their copyrights must be balanced with the basic human rights of users of the Net. Having access to the Net is now a basic part of nearly everyone's life in the developed world and it relates to basic rights to

• free expression
• freedom of association
• education
• and employment

and the ECHR and every other serious international charter of rights says that if a law is not proportionate it is not legal. As Lilian said in the immediate aftermath of the Promusicae decision:

"the Court finally held that, turning to fundamental rights in the EC Charter, if the fundamental rights to property, and to privacy (which appear therein, as well as in the ECHR) appear to come into conflict when EC Directived are implemented in national laws , well, then , IP does not take precedence over privacy (or vice versa): instead, national courts must "make sure that they do not rely on an interpretation of [national laws] which which would be in conflict with these rights." (para 68) Put it plainly: IP rights do not trump DP rights, says the ECJ.

In other words also - my interpretation purely, now - although the ECJ have not said that laws requiring automatic disclosure of personal data to rights holders to protect IP rights would be illegal under the PECD, a serious warning has been issued to national legislatures not to be pushed into passing such laws, without considering first if rights of protection of personal data are being taken properly into account."

In other words, even with the legitimate aim of defending or protecting copyrights, the ECJ clearly instructed member state governments that they are not to endanger human rights or proportionality. Lilian actually thinks that this part of the decision was a clear dicta from the court aimed directly at the kind of 3 strikes notice and disconnect schemes the French have implemented and others are considering.

More on Musicians Fans and Online Copyright when I get the chance.

Google loses bid for EU trademark on 'GMail'

Google has lost in its attempt to get an EU trademark registered on "GMail" according to a ruling by the EU Office for Harmonisation in the Internal Market (OHIM). The ruling is briefly covered in all the usual tech. news outlets.

Essentially Google's mark is considered to be too similar to an earlier German trademark.

"The services of the earlier mark, amongst others, are, telecommunications, particularly
services in and for electronic communication networks, like Internet or World Wide
Web, electronic mail service, dissemination of information.

The services of the contested mark are, telecommunications; communications by
computer terminals; message sending; electronic mail services.

The contested services are identical to those of the earlier right or indeed included
within the broader terms of the earlier right’s specification since they are all
telecommunications services...

The earlier figurative mark is protected in Germany. Therefore, it is the impression that
the signs make on the German public and their meaning and pronunciation in the
German language which are relevant for their comparison.

Likelihood of confusion in only one part of the Community is sufficient as a relative
ground for the rejection of the application in issue...

The Office is of the opinion that the high degree of
similarity between the marks leaves little room for small differences to be observed by
the general public. Moreover, the general public is used to companies using variations
of trade marks so they will see the contested application as a simple version of the
earlier right and believe they come from the same undertaking.

As has been discussed, the dominant elements of both marks are identical and
furthermore they are the first words to which attention is drawn. The fact that that
earlier right has additional wording is irrelevant since the relevant consumer would see
this as emphasising the “GMAIL” services due to its promotional qualities which highlight
the speed of the services concerned.

Therefore, when taking into account that the services in comparison are identical, the
Office concludes that there is a strong likelihood of confusion given the strong visual
and phonetic similarity between the marks in dispute.

Therefore, the contested CTM application is to be rejected in full due to its similarity to
the earlier German trade mark registration."

FIPR say Phorm is illegal

The Foundation for Information Policy Research has said that the Phorm wiretapping adware service is illegal under UK law. They have sent an open letter, penned by Richard Clayton and Nicholas Bohm, to the Information Commissioner, Richard Thomas, on the matter, as he is investigating the Phorm service. FIPR's associated press release states:

"The Foundation for Information Policy Research (FIPR) has today released the text of an open letter to Richard Thomas, the Information Commissioner (IC) on the legality of Phorm Inc's proposal to provide targeted advertising by snooping on Internet users' web browsing.

The controversial Phorm system is to be deployed by three of Britain's largest ISPs, BT, Talk Talk and Virgin Media. However, in FIPR's view the system will be processing data illegally:

• It will involve the processing of sensitive personal data: political opinions, sexual proclivities, religious views, and health -- but it will not be operated by all of the ISPs on an "opt-in" basis, as is required by European Data Protection Law.
• Despite the attempts at anonymisation within the system, some people will remain identifiable because of the nature of their searches and the sites they choose to visit.
• The system will inevitably be looking at the content of some people's email, into chat rooms and at social networking activity. Although well-known sites are said to be excluded, there are tens or hundreds of thousands of other low volume or semi-private systems.

More significantly, the Phorm system will be "intercepting" traffic within the meaning of s1 of the Regulation of Investigatory Powers Act 2000 (RIPA). In order for this to be lawful then permission is needed from not only the person making the web request BUT ALSO from the operator of the web site involved (and if it is a web-mail system, the sender of the email as well).

FIPR believes that although in some cases this permission can be assumed, in many other cases, it is explicitly NOT given -- making the Phorm system illegal to operate in the UK:

• Many websites require registration, and only make their contents available to specific people.
• Many websites or particular pages within a website are part of the "unconnected web" -- their existence is only made known to a small number of trusted people.

The full text of the open letter can be viewed at:

http://www.fipr.org/080317icoletter.html

QUOTES

Said Nicholas Bohm, General Counsel, FIPR:

"The need for both parties to consent to interception in order for it to be lawful is an extremely basic principle within the legislation, and it cannot be lightly ignored or treated as a technicality. Even when the police are investigating as serious a crime as kidnapping, for example, and need to listen in to conversations between a family and the criminals, they must first obtain an authorisation under the relevant Act of Parliament: the consent of the family is not by itself sufficient to make their monitoring lawful."

Said Richard Clayton, Treasurer, FIPR:

"The Phorm system is highly intrusive -- it's like the Post Office opening all my letters to see what I'm interested in, merely so that I can be sent a better class of junk mail. Not surprisingly, when you look closely, this activity turns out to be illegal. We hope that the Information Commissioner will take careful note of our analysis when he expresses his opinion upon the scheme.""

Update: BBC report on same.

Stanford support RDR in Harry Potter Lexicon case

The Stanford Center for Internet and Society are supporting RDR Books in their defence of the lawsuit being brought by JK Rowling and her publishers, over the publication of a print version of the Harry Potter Lexicon website. Anthony Falzone of the CIS says:

"In our brief, we explain both why the Lexicon is the sort of important and transformative work that fair use has long protected, and why Ms. Rowling is not entitled to the injunction she seeks.

Read our full brief here.

And if you want to know what Rowling says, here is her brief, too, filed last month.

UPDATE: Ms. Rowling's d reply brief was filed on February 27. The briefing on her preliminary injunction motion is now complete, and the hearing on this motion is scheduled for March 13 in New York."

Extending wiretapping to the Net

From the Economist:

"Governments want to extend wiretapping rules from phones to the internet, but doing so is hard

AMONG the many benefits of the internet's rise over the past decade has been the advent of free phone calls between its users—and much cheaper calls even for people who are not online, since ordinary calls can be partly routed over the internet. For people who work in foreign countries, have friends and relatives spread around the world, or simply have to make a lot of calls, this is great news. But for law-enforcement organisations who are used to being able to tap conventional telephone networks, it is causing increasingly painful headaches. Around the world, the emergence of voice-over-internet-protocol (VoIP) telephony is forcing authorities and communications firms into both conflict and co-operation.

Their shared problem is a fundamental one that results from the very nature of the internet. In the old world of telecoms, the path of a call was easy to follow: a continuous analogue or digital connection was established between the two parties, so it was easy for investigators to select a point somewhere along the line (at the telephone exchange nearest to the caller, for example) to tap the call.

On the internet things are very different. All information, whether e-mails, web pages, music downloads or voice calls, is chopped up into small packets of data and fired off across the network. The path one packet takes across the sprawling network may be different from the path of the next, and packets may arrive at the destination out of order, or not arrive at all. If intercepting a traditional phone call is like apprehending a single suspect at his home, eavesdropping on a VoIP call is more like trying to capture all the members of a gang as they cross a busy city in a fleet of separate vehicles. "

Apple sued for patent infringement

From the Washington Post:

"Apple Inc. was sued Wednesday over allegations its iTunes online music store and iPod music players are illegally using a patented method for distributing digital media over the Internet.

Atlanta-based ZapMedia Services Inc. sued Apple in U.S. District Court for the Eastern District of Texas, accusing the Cupertino-based company of violating two ZapMedia patents...

The patents in question cover a way of sending music and other digital content from servers to multiple media players, a broad description that could also apply to a wide swath of other companies selling digital media and the devices to play it."

Parallels there with the Blackboard v Desire2Learn case but impossible to tell without having more details. Blackboard, a Washington DC company were recently awarded damages against Desire2Learn, an Ontario company, by a Texas jury.

In addition, given that Acacia has successfully enforced patents through the courts in the same ballpark, the Zapmedia folks might well find themselves on the receiving end of lawyerly letters from that general direction, expecially if they succeed in the Apple suit. In fact Acacia reportedly sued Apple over iTunes just last month.

EU approves Google takeover of DoubleClick

It seems the EU Commission has cleared the proposed acquisition of DoubleClick by Google.

"The European Commission has cleared under the EU Merger Regulation the proposed acquisition of the online advertising technology company DoubleClick by Google, both of the US. The Commission’s in-depth investigation, opened in November 2007 (see IP/07/1688), concluded that the transaction would be unlikely to have harmful effects on consumers, either in ad serving or in intermediation in online advertising markets. The Commission has therefore concluded that the transaction would not significantly impede effective competition within the European Economic Area (EEA) or a significant part of it."

Harmonising international approach to copyright exceptions and limitations

Bernt Hugenholtz and Ruth L. Okediji have just published their Open Society Institute (OSI) sponsored report on Conceiving an International Instrument on Limitations and Exceptions to Copyright. The 56 page study is based on contributions from some of the top intellectual property scholars in the world, including Jerome H. Reichman at Duke University and Pamela Samuelson of UC Berkeley.

They conclude:

"The task of developing a global approach to limitations and exceptions is one of the
major challenges facing the international copyright system today. At risk are fundamental
elements of the copyright system which were historically designed to require accountability
to goals and purposes far beyond individual economic gain. As new technologies challenge
copyright’s internal balance, and as the costs of globalization heighten the vital need for
innovation and knowledge dissemination, a multilateral instrument that can effectively
harness various national practices with regard to L&E’s, and that can provide a framework
for dynamic evaluation of how global copyright norms can be most effectively translated into
a credible system that appropriately values author and user rights is a necessity."

The full report emphasizes the public interest function of copyright law (cf. the interests of creators and business) :

"It is a well-established principle of copyright doctrine that the qualified grant of
proprietary rights over the fruits of creative enterprise is directed first and foremost at the
promotion of the public interest."

- and merits close attention.

Bush vetoes ban on waterboarding

So despite the acting head of the Justice Department's Office of Legal Counsel, Steven Bradbury, reportedly saying last month that waterboarding is no longer allowed under US law, it seems that President Bush does not agree.

"President Bush said yesterday he vetoed legislation that would ban the CIA from using harsh interrogation methods such as waterboarding to break suspected terrorists because it would end practices that have prevented attacks.

"The bill Congress sent me would take away one of the most valuable tools in the war on terror," Bush said in his weekly radio address taped for broadcast yesterday. "So today I vetoed it."

The bill provides guidelines for intelligence activities for the year and includes the interrogation requirement. It passed the House in December and the Senate last month.

"This is no time for Congress to abandon practices that have a proven track record of keeping America safe," the president said."

According to the Times Diplomatic Correspondent, Catherine Philp, John McCain is supporting the President's veto.

"John McCain, the Republican presidential candidate, who authored a law banning torture of detainees in American custody, surprised many by supporting the President's veto, arguing that imposing military rules on the CIA would deny it the use of many legitimate techniques.

Mr McCain has also said, however, that he would define waterboarding as torture, effectively outlawing it. Barack Obama and Hillary Clinton, the two Democratic candidates, are both supporters of increased measures banning coercive techniques although campaign commitments kept both of them from voting on this most recent Bill."

Fine per track proposed to increase from $150k to $1.5 million

A provision in the latest proposed US intellectual property bill, which would have increased statutory fines for online copyright infringement to a maximum of $1.5 million per track has been reportedly removed from the Prioritizing Resources and Organization for Intellectual Property (PRO IP) Act.

"A U.S. House of Representatives subcommittee has stripped out a provision in a copyright enforcement bill that would have increased fines for compilation CDs containing pirated music by 10 times or more.

Critics of the original version of the Prioritizing Resources and Organization for Intellectual Property (PRO IP) Act had complained that one provision would assess fines for each separate copyright work on a compilation work such as a CD, meaning the fines for a 10-song compilation CD would range from $7,500 to $1.5 million, instead of the current $750 to $150,000. But the House Judiciary Committee's Subcommittee on Courts, the Internet, and Intellectual Property voted on Thursday to approve an amendment that stripped out the controversial provision."

Interested parties will recall in the autumn of last year a woman who decided to face the RIAA in court was ordered by a jury to pay $222000 for infringing the copyright in 24 songs ($9250 per song). The RIAA at the time suggested she had got away lightly since it could have been $3.6 million at the maximum statutory rate of $150k per song.

Thanks to Michael Geist for the links.

Student may be sanctioned over FaceBook study group

It's a pity there aren't a few more details in this story as it appears that a student is possibly facing expulsion from college for organising an Facebook group for discussing assignments. There are a lot of shades of grey when dealing with possible plagiarism cases but throw the internet into the mix and it becomes a story the press like to recycle about mass armies of cheating students. For the student's and the university's sake I hope this one is a case of innocent and entirely appropriate mutual support between students. Should that be the situation, however, don't expect to see the outcome splashed about in the media - 'student found innocent of cheating on the net' doesn't make a good headline.

Diebold Accidentally Leaks Results Of 2008 Election Early

From the Onion:

Diebold Accidentally Leaks Results Of 2008 Election Early

Funny.

Which in translation means...

An attempt at translating my previous post into plain English:

Copyright law is complicated and affects loads of people, who we can divide into 3 main groups:

• creators
• business
• the public

For copyright to work, it has to be balanced enough for all three groups to benefit. But the

best system for creators ≠ best system for business ≠ best system for the public.

So we need a messy compromise, where no group will be completely happy but all three benefit. If we did come up with a compromise we would have no idea how it might work in practice because very few people have ever tried to measure, in a rigorous scholarly way, how copyright works in real life and who the winners and losers have been.

The American film industry was convinced in the early 1980s, for example, that the video cassette recorder would destroy their industry due to home taping. Yet in the end sales of video cassettes and DVDs became their biggest source of income.

Public debate about copyright tends to be dominated by unhelpful rhetoric, language and name-calling, like "pirates", which deliberately mixes up the interests of the three main groups - creators, business and the public. So proposed changes, for example, are often dressed up as being in the interests of artists/creators, whereas in reality they are about protecting business interests or public access, depending on which side the person calling for the change happens to be on.

The copyright system is going through a bit of an upheaval and lots of people want to change it to suit themselves.

Verdict: Not great on the plain English scale (and it needs more engaging narrative on wizards and goblins) but possibly not too bad for a first attempt?

Pratchett disapproves of lawsuit on Harry Potter Lexicon

It seems that Terry Pratchett disapproves of the latest Harry Potter lawsuit over the forthcoming printed version of the Harry Potter Lexicon website. He is quoted by the Independent as saying:

""In fantasy writing, accusations of copying are very difficult to make. You know who invented wizards? Who invented Goblins? If we were going to start paying royalties for nicking one another's ideas, we'd have all given our life savings to the Tolkien family a long time ago."

As I and others have said before, it is difficult to believe that JK Rowling, who has lavished such praise on the work of the folks behind the HP lexicon in the past, is behind the lawsuit. Creators, even those in the blockbuster category, rarely have complete control of the actions of commercial agents (and I use the term in the economics sense here to include publishers, film companies etc.) acting on their behalf. That's why it is useful, when thinking about the whole area of legal protection for creative and inventive endeavours, to separate out the three main sets of interests. Generally there are:

• the creators/inventors/artists/writers etc
  
• the commercial organisations engaged in finding commerically exploitable creative talent, production, aggregation and distribution (literary and talent agents, entertainment companies, manufacturers, broadcasters etc. - the whole gamut of commercial enterprises surrounding creative work) - maybe I should just call this the 'creativity business'
  
• the general public/consumers

Very often, in public debate, the interests of the first category (creators) are claimed to coincide exactly with the interests of the second (commercial agents); and the optimisation of the welfare of creators is assumed to result in a derivative automatic benefit for the third category (the public), in access to the resultant explosion of creative enterprise.

In reality, balance in intellectual property regulation is not quite as simple as getting the IP regulatory landscape right for the supposed coincident interests of creators and the creativity business. (Not that even this could really be considered to be 'simple', if you just think, as Terry Pratchett says, of the need for new creators to have capacity to build on existing creative/inventive works, meaning those works can't be locked behind legal or other protective fences either too securely or for too long).

With three sets of agents (again thinking of 'agents' in the way an economist uses the term), each category itself incorporating a huge and diverse range of subsets each with its own unique interests, we need to deal with the reality that an optimal regulatory system for creators, even if it was possible to define such a thing, will be different to that for business interests, which in turn will be different to that for the general public.

We also need to recognise that whatever system we settle on, therefore, will be sub-optimal for at least two of our three categories of economic agents - whatever happens it will be a messy compromise which cannot, by definition, please everybody. Yet for the system to work and creativity, commercial and public access to thrive, the welfare of all three sets of agents need to be strongly protected. You could say, as Mark Rogers and I did in a paper for the World Economics Journal a few years ago, that societal welfare delivered by the intellectual property system will equal the weighted sum of benefits derived from the system by creators, agents and consumers.

Yet even if we could work out a model economic optimisation formula for the three generic sets of agents, we currently would not have the empirical evidence to run through the model in order to help create a picture of what an optimal IP system might look like. So yet again we're back to the need for some fundamental empirical research to be done in the area, which could then be usefully employed to inform policy; and get out from under the usual trading of rhetoric that passes for public debate in this widely misunderstood and really important area of public policy.

By the way, I'm a fan of the writings of both Pratchett and Rowling.

NIH Public Access Policy - University Compliance

Mike Carroll has:

"written a White Paper on behalf of SPARC, Science Commons, and the Association of Research Libraries explaining the nature of the new copyright-related risk that NIH grantees face and identifying six options they have for managing that risk.

The White Paper, Complying with the National Institutes of Health Public Access Policy: Copyright Considerations and Options, is now available for download at http://www.arl.org/sparc/advocacy/nih/copyright.html."

Essential reading for open access scholars and policymaking staff in US universities.

Battle over Bush wiretapping may be nearing an end

From SiliconValley.com: Battle over wiretapping may be nearing an end

"The chairman of the House Intelligence Committee hinted Sunday that a bitter battle over an expired eavesdropping law may be moving toward a conclusion that gives phone companies the retroactive legal protections long sought by President Bush.

The chairman, Rep. Silvestre Reyes, D-Texas, said in an interview on CNN that the committee had been talking to the companies "because if we're going to give them blanket immunity, we want to know and understand what it is we're giving immunity for."

Reyes did not specify what provisions a House bill might contain. But his use of the words "blanket immunity" suggested that he might be moving toward a Senate bill, backed by Bush, that would protect phone companies that assisted in a federal program of wiretapping without warrants after the Sept. 11, 2001, terrorist attacks."

Patient database open to access by non-qualified NHS staff

From Computer Weekly:

"A document obtained by Computer Weekly under the Freedom of Information Act also provides evidence that NHS Connecting for Health - which runs part of the £12.4bn National Programme for IT [NPfIT] - has quietly decided to weaken assurances given to patients about the confidentiality of records.

Doctors are angry because they say that patients were given an assurance that non-clinical staff would be unable to access the national summary care record database which is being trialled at NHS trusts in various parts of England."

Proudly spamming OU courses

Jim Groom and Tony Hirst have been building on each others tinkering. This is terrific.

"There has been a bit of excitement about the possibilities for pushing the uses of RSS towards a mythical eduglu as of late. Brian posted about it here and got some great feedback, soon after D’Arcy Norman and Bill Fitzgerald ramped up their work with Drupal. Then there was David’ Wileys re-publishing of his course on WordPress.com, and Brian (again) frames the implications beautifully, and then Stephen Downes uses this example to point towards Tony Hirst’s Disaggregation of MIT OCW. In short, an amazing distributed thread to follow.

So while I was looking at Tony Hirst’s work with MIT’s Open CourseWare, he must have been leaving a comment pointing to a series of feeds on the Open Learn OER site. Additionally, he suggested that there isn’t any reason why these feeds couldn’t be pulled into a blog rather neatly. And you know what, he couldn’t have been more right!

I gave it a shot on a WordPress Multi-User installation I keep around for just these sorts of things. I pulled the Open University courses feeds into individual blogs using Wp-o-Matic, a tried and true spamblogging plugin. And I am pretty excited by the results. (As an aside, I find great pleasure in re-purposing the wicked tools of spammers to make re-publishing open educational resources that much easier.)

[...]

This was a pretty amazing experiment for me because it illustrates just how much I learn from reading blogs on a daily basis. Ideas happen in a series of relations, and I so thoroughly enjoy taking other people’s genius and testing it out. When I saw the Goya class get pulled in successfully in just over a minute, I started to realize just how powerful these open resources can be once they are freed from their repositories. What is stopping K-12s and universities from setting up WPMu installations (or Drupal, or what have you) and pulling these amazing resources in? Or even pushing them out themselves? Another question that needs to be asked is how many of the other open resources out there have the stellar RSS feeds these OpenLearn OERs do?"

This is amazing stuff. The power of the net and bright people...

Wiggin report: 70% of P2P Users Would Stop if Warned by ISP

Via Slashdot: '70% of P2P Users Would Stop if Warned by ISP'

""As the UK considers a three strikes policy to fight copyright infringement, a new survey reports that 70% of UK broadband users would stop using P2P if they received a warning from their ISP. 'Wiggin commissioned the 2008 Digital Entertainment Survey, which found that 70 percent of all people polled said they would stop illegally sharing files if their ISP notified them in some way that it had detected the practice. When broken down by age group, an unexpected trend emerges: teenagers are generally more likely to change their behavior than older Internet users.'"

EBay Ends Patent Suit With MercExchange

It seems that the long running eBay v MercExhange case is over. From AP:

"EBay Inc. has settled a seven-year patent dispute with MercExchange LLC that prompted an important intellectual-property ruling from the U.S. Supreme Court.

The online auction company said in a statement Thursday that it bought the three MercExchange patents it had been accused of violating. The price was not disclosed; eBay said the figure would not materially affect its financial results...

EBay said the settlement would end all claims by MercExchange. In addition to the three patents involved in the case, eBay said it would license other technologies from MercExchange.

EBay spokeswoman Kim Rubey said she could not elaborate.

"

James Boyle in the FT on copyright terms

James Boyle has, as ever, a cogently argued piece in the FT on the question of the EU database directive, copyright terms and the absence of empirical evidence in intellectual property policy making generally.

"Readers of these columns have heard me lament in the past about the fact that intellectual property policy is an “evidence-free zone”. It is the trickiest of regulatory matters to get the right level of intellectual property protection – giving incentives to creators and distributors, yet not overly burdening future innovators or imposing unnecessary monopoly prices on consumers. Getting this balance right should be a matter of empiricism, not faith. We do, for example, have good evidence about what kind of policies on database rights and on state generated data – such as maps, traffic and weather information – actually work best. In each case, the European Union has picked a plausible position – stronger rights will mean more production and innovation – and seen it convincingly falsified through empirical analysis.The same is true with the length of our copyright term. Brilliant economists, including five Nobel laureates, have pointed out that our current copyright terms are far too long. We extend copyright long beyond the time necessary to provide incentives to create and distribute...

At the end of last year, I did note a ray of hope. In two cases, both in Europe, policymakers had actually looked at evidence in order to decide what to do! The Commission studied the EU database market to see if the database right was doing any good. It was not. The UK government commissioned the Gowers Review of intellectual property policy to see whether we should extend the term of sound recordings retrospectively...

They came to the same conclusion every single disinterested academic policy review has come to: “Policymakers should adopt the principle that the term and scope of protection for IP rights should not be altered retrospectively.”

But it was not to be. Faced with a tidal wave of pressure by publishers of databases, who liked their monopolies very much, thank you, the Commission shamefully gave in and left the directive in place. While the British government showed more spine on sound recordings, the European Commission has now announced that it thinks the copyright over sound recordings should be extended to 95 years!

Mr McCreevy's harmonisation argument – appropriate given the subject – is worth thinking through. Political scientists tell us that there are types of issues where we can almost guarantee that the state will get things wrong; cases where the benefits of some proposed policy go to a small and well-organised lobby of repeat players while the much larger costs fall on a wider and less well informed public. That is why it is so important to have policies that are justified with facts rather than faith."

Why Facebook's new policies still pose a privacy risk

Anita Ramasastry has been contemplating Facebook's about-face in deciding to allow subscribers to allegedly totally delete their details from the system. She concludes that the new policies still pose significant privacy risks.

"Has Facebook become like the Hotel California, where "you can check out any time you like, but you can never leave"? Until recently, that was how it felt to Facebook users who wanted to remove themselves, but found the process was neither quick nor straightforward.

Facebook used the term "deactivate" in its privacy policy, and "deactivation," it turned out, was not the same as deletion. Instead, Facebook would keep material stored in case users later wanted to reactivate their accounts. Thus, the site reportedly warned users that "[r]emoved information may persist in backup copies for a reasonable period of time," and "[e]ven after removal, copies of user content may remain viewable."

In light of recent criticisms in the blogosphere, however, Facebook has wisely changed its policy. It now allows users to remove themselves and their data from Facebook with a single email request.

In this column, I will examine Facebook's prior policy, and analyze whether it was legal. I will also consider other facets of Facebook's data retention and privacy policies. Finally, I will argue that users need to be more cautious about signing up for social networking sites because, on such sites, their privacy cannot be fully guaranteed...

Facebook's Prior Rules Were Legal in the U.S., But Perhaps Not in the EU...

Unfortunately, even true deletion of a profile by Facebook is unlikely to address users' concerns about embarrassing information remaining accessible. Information may be cached outside Facebook, or simply saved by an individual who views it...

Most savvy Internet users will be well aware of the risks of copying and caching information posted on Facebook and similar sites. But they may not be aware that Facebook reserves the right to supplement user profiles with information it collects from other sources. In other words, on Facebook, users may not even have full control over their own profiles...

Finally, as the Electronic Privacy Information Center (EPIC) has pointed out, those users who install third-party applications - which the Facebook Platform allows -- also face privacy concerns. When someone installs an application, the application (program) can "see" or retrieve the same information the user can see...

In sum, users who think that simply removing their Facebook profiles will protect their privacy should think again. Until Facebook changes other rules, serious privacy risks will persist on the site."

HMRC Advice on what to do if you suspect fraud with national insurance numbers

The HMRC publishes:

"a list of former Inland Revenue Manuals used by Her Majesty's Revenue & Customs (HMRC). These manuals are published in line with the Code of Practice on Access to Government Information. Further information is also available at Internal Guidance."

The National Insurance Manual is very instructive, particularly NIM39140 - National Insurance Numbers (NINOs): Format and Security: What to do if you suspect or discover fraud It reads in full:

"(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

* (This text has been withheld because of exemptions in the Freedom of Information Act 2000)
* (This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)
(This text has been withheld because of exemptions in the Freedom of Information Act 2000)
(This text has been withheld because of exemptions in the Freedom of Information Act 2000)
(This text has been withheld because of exemptions in the Freedom of Information Act 2000)
(This text has been withheld because of exemptions in the Freedom of Information Act 2000)
(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000)

(This text has been withheld because of exemptions in the Freedom of Information Act 2000) "

Thanks to Ken via the ukcrypto list for the pointer.

That Blackboard decision again

Martin is as close as I've seen him to angry in his writing about the jury deciding in favour of Blackboard.

"

It strikes me there are three ways to be the market leader in an industry:

i) Have such cool products it doesn't matter how you behave (cf. Apple)

ii) Have an average product and bully everyone else out of the market so the customer has no choice (cf. Microsoft)

iii) Work with your customers to develop your product and get good will (cf. nearly every other tech company).

I don't have an MBA, but it strikes me that option i) is damn hard to pull off and happens to only one or two products in a decade. Option ii) is so old school, industrial type thinking that even Microsoft are shying away from it now. This is particularly true in a sector like education. Unlike, washing machines say, people really care about education. You can't bully them, treat them with contempt and work against the community and expect to have the market. People are too smart and will work around you. Which leaves option iii) as your only sensible option. And the BB patent is about as far as you can get from this as is imaginable.

So when universities find ways to deliver, support, facilitate learning online (for instance using a set of third party apps held together by eduglu), are BB going to sue them? And will they sue every application in the pack? Google Calendar when used in a loosely coupled learning suite is now in infringement of copyright?

You have to say that when it comes to misunderstanding your market, the BB patent will be a classic case study. Until we have the opportunity to look back and laugh however, we should make sure we do everything to boycott them."

Whilst I share Martin's sentments, I don't agree that you can't bully and treat educational institutions with contempt and still expect to have a market. Blackboard and many other systems suppliers are locked into educational and other institutions; and in universities, as elsewhere, the people and processes charged with making decisions about such things are not always the most rational in the world. In addition, given the avoid-litigation-at-all-costs mentality in the education sector generally, Blackboard's court win, I fear, could do more long term damage than I would like to see.

Lessig decides against running for Congress

Larry Lessig has decided that he is not going to run for Congress after all.

"After lots of thinking and advice, I have decided it does not make sense for the Change Congress movement for me to a run for Congress in CA12. We would have just over 30 days to introduce a district to me and to an idea. That would not be enough time to convince them to turn away from an extremely popular politician with 30 years of public service. And while anyone within the district would understand that, outside the district, the lesson would be that a "Change Congress" message has no salience or support. That would, in my view, harm the movement more than it would help."

Jury decide in favour of Blackboard

At the end of last week a federal jury awarded Blackboard $3.1 million in damages against competitor Desire2Learn for patent infringement. This is a bit of a surprise since two federal judges gave preliminary rulings in August 2007 invalidating most of Blackboard's patent.

Desire2Learn has posted a copy of the judge's instructions to the jury. Well worth a read.

Michael Feldstein, one of the bloggers following the case most closely, has posted an eye-witness account of the trial by Jim Farmer of Georgetown University. Also well worth reading in full.

From the Chronicle:

"A federal jury in Texas awarded Blackboard Inc. $3.1-million on Friday, saying that a smaller Canadian competitor, Desire2Learn Inc., had infringed its patent for a system of delivering course materials online. The jury also found that Desire2Learn had not shown clear and convincing evidence that Blackboard's patent was invalid.

Blackboard's general counsel, Matthew Small, said the verdict validated the company's assertion, which has been challenged by many higher-education technology experts, that its system was unique when the U.S. Patent and Trademark Office granted Blackboard the patent in 2006. The office agreed last year to take another look at the patent after Desire2Learn and others challenged its validity. That review is still pending.

"They won this round, but the battle is not over by any stretch of the imagination," John Baker, president and chief executive of Desire2Learn, said in an interview Friday. "We'll continue to fight and hopefully remove from the educational community this very dark cloud."

The company is considering several options, including appealing the verdict, continuing to challenge the patent at the federal level, and modifying its software so it does not infringe Blackboard's patent.

Mr. Baker said he was "shocked" when the jury announced its decision after deliberating for nine hours over two days in the U.S. District Court in Lufkin. The trial lasted two weeks...
Eben Moglen is founding director and chairman of the Software Freedom Law Center, an advocacy group for open-source software that has challenged Blackboard's patent. Mr. Moglen, who is also a professor of law at Columbia University, said there is plenty of evidence, presented both in the trial, and to the federal patent office, of similar technology that existed before Blackboard's patent was issued. He added that his group plans to continue fighting to invalidate Blackboard's patent...

Peter A. Schilling, director of information technology at Amherst College, said colleges may decide it's too risky to use any course-management system other than Blackboard's. The patent, he said, is so broadly written that professors may be afraid to even use wikis or blogs."

HansRosling's insights on poverty

One of my favorite TED talks was Hans Rosling's amazing

New insights on poverty and life around the world

Pogue's TED medley on the history of TV and music on the Net

NYT tech columnist David Pogue has been singing at TED about the history of music and TV on the Internet, a 3-minute TED medley, or a "TEDley", as he calls it.



Thanks to Glyn at ORG for the link.

NHS multimillion pound IT: the risks

Consultants in London have expressed serious concerns that thenew NHS IT systems are putting patients at risk.

"It's costing millions but the new NHS computer system in London and southern England poses a risk to patients say some consultants. The new NHS IT system is causing serious concern among clinicians.

Last summer, the then boss of the National Health Service IT system, Richard Granger, candidly admitted he was "ashamed" - saying some of the hospital software was "appalling".

Seven months on, Channel 4 News has spoken to clinicians who are seriously concerned about the system...

The pressure is now on Connecting for Health to show that IT in the NHS brings real benefits. But the opinions of some doctors who've experienced the systems are making that difficult.

Chris Taylor added: "Given that the system has been in some form implemented in hospitals for over a year and that there have been entire consultant groups who have raised their concerns, almost protests, it is beyond comprehension that this system, in its current form, is now being implemented. It just really is beyond comprehension. I have no other word for that."

The stakes, then, couldn't be higher for the future of the NHS IT programme. Because unless the problems with the new hospital system are resolved soon, the chance of realising genuine longer term benefits of IT in the NHS could be in jeopardy."

Searching Laptops at US Borders and Airports

Anita Ramasastry believes that US government practice in searching laptop computers at borders and airports puts constitutional rights [of free speech and freedom from unreasonable search and seizure] in peril.

"This month, the Asian Law Caucus (ALC) and the Electronic Frontier Foundation (EFF), two civil liberties groups based in Northern California, filed a lawsuit under the Freedom of Information Act (FOIA) to force the government to disclose its policies on border searches, including its rules governing the seizure and copying of the contents of electronic devices. The two groups also want to find out the criteria the government uses to determine when border agents will ask travelers about their political beliefs, religious practices, and other First-Amendment-related activities.

Though the groups' initial FOIA request for relevant documents was made on October 31, 2007, they have yet to receive any documents - even though FOIA stipulates that a request for public information should receive a response within 20 days. Accordingly, they have filed suit to compel a response...

The ALC and EFF's position is that members of the public have a right to know when the government will search their laptops or other electronic devices and, when a search does occur, what types of data the government might, read, copy, or store...

My research indicates that no appellate court has yet addressed the question of whether "reasonable suspicion" is necessary for a laptop search. However, in United States v. Arnold, a California federal district court held that it is. The court reasoned that a search of travelers' files on a laptop is akin to a search of his or her memory, as laptops are "capable of storing thoughts." It wrote "[W]hile not physically intrusive as in the case of a strip or body cavity search, the search of one's private and valuable personal information stored on a hard drive or other electronic storage device can be just as much, if not more, of an intrusion into the dignity and privacy interests of a person."

The government appealed, and the appeal was argued before the Ninth Circuit in October 2007. The Court has yet to issue a decision. Let's hope that when it does, the Ninth Circuit will affirm the district court's well-reasoned opinion, and require reasonable suspicion for laptop searches...

A search of a laptop is much more similar to the search of one's mind, than of one's suitcase. Commentators have pointed out that laptops and PDAS are much like diaries. They record intimate details of our lives, track months and years of our personal histories, list our friends, business associates, and clients, and reflect our opinions on topics ranging from the election to the stock market to the war in Iraq. Finally, their capacity is far great than that of a suitcase which, limited by its physical dimensions, contains a small inventory of items.

In some professions, moreover, a search of a laptop or PDA can pose special dangers. A lawyer's may contain attorney-client privileged information or attorney work product that is for lawyers' eyes only. A journalist's may contain contact information for confidential sources. A social worker's may have sensitive client files focused on personal case histories. A businessperson's may contain trade secrets or information about a future share offering that has not been announced."

Judge orders wikileaks site shut down

From the NYT: Judge Orders Wikileaks Web Site Shut

"In a move that legal experts said could present a major test of First Amendment rights in the Internet era, a federal judge in San Francisco on Friday ordered the disabling of a Web site devoted to disclosing confidential information.

The site, Wikileaks.org, invites people to post leaked materials with the goal of discouraging “unethical behavior” by corporations and governments. It has posted documents concerning the rules of engagement for American troops in Iraq, a military manual concerning the operation of prison at Guantánamo Bay, Cuba, and other evidence of what it has called corporate waste and wrongdoing...

In a statement on its site, Wikileaks compared Judge White’s orders to ones eventually overturned by the Unites States Supreme Court in the Pentagon Papers case in 1971. In that case, the federal government sought to enjoin publication of a secret history of the Vietnam War by The New York Times and The Washington Post."

Stefan Brands new start-up

Stefan Brands has started a new company.

"Imagine you could prove you were 21 without revealing your date of birth -- or anything else about you, for that matter. Or qualify for a loan without disclosing your net worth. Or enjoy the benefits of e-commerce, e-health and e-government without a moment's fear that you are open to identity theft.

Sound impossible? It is. But it won’t be if cryptographer and entrepreneur Stefan Brands has his way.

Brands runs Credentica, a Montreal-based startup that is rolling out an encryption-and-authentication system called U-Prove that allows users to disclose the absolute minimum to complete digital transactions -- and to do so in a way that ensures the information they need to reveal has no shelf life whatsoever...

The U-Prove approach has been tried before, without commercial success. Most companies tried to sell privacy software to consumers, which was the wrong approach.

So Brands is flipping it around by developing a software developers kit that would appeal to businesses and government agencies that want to prevent costly and damaging data breaches on behalf of their customers.

In addition, Brands hopes that by providing a somewhat stripped-down version of his technology under a noncommercial license he can encourage developers to explore its potential applications -– just like RSA Data Security did in the 1980s when it offered free, noncommercial use of its public-key cryptosystem and went on to dominate the online security market."

Scheier says : "Cryptographer Stefan Brands has a new company, Credentica, that allows people to disclose personal information while maintaining privacy and minimizing the threat of identity theft.
http://www.credentica.com/
http://www.wired.com/politics/security/news/2008/02/...
I know Stefan; he's good. The cryptography behind this system is almost certainly impeccable. I like systems like this, and I want them to succeed. I just don't see a viable business model. I'd like to be proven wrong."

Kim Cameron says:

"Google’s Ben Laurie has a new paper called Selective Disclosure in which he argues the importance of zero knowledge proofs and privacy-enhancing cryptography. I fully share his view of the importance of these technologies.

Everyone with a technical interest in identity should look at Credentica’s recently released SDK, called U-Prove. It holistically embodies the cryptographic breakthroughs of Stefan Brands.

There is also a competing system from IBM called IDEMIX, though it is not yet publicly available and I can’t talk about it first-hand.

On his way toward explaining how these systems work, Ben takes the time to put forward his own Laws of Identity (”Let a thousand flowers bloom!”) He is responding to my Fourth Law, which asserts the need for the Identity Metasystem to support both public identifiers (for example, my blogging address) and private ones (my account number with a given company, unknown to anyone but me and them). He says:

“For an identity management system to be both useful and privacy preserving, there are three properties assertions must be able to have. They must be:

• Verifiable: There’s often no point in making a statement unless the relying party has some way of checking it is true. Note that this isn’t always a requirement - I don’t have to prove my address is mine to Amazon, because its up to me where my goods get delivered. But I may have to prove I’m over 18 to get alcohol delivered.
• Minimal: This is the privacy preserving bit - I want to tell the relying party the very least he needs to know. I shouldn’t have to reveal my date of birth, just prove I’m over 18 somehow.
• Unlinkable: If the relying party or parties, or other actors in the system, can, either on their own or in collusion, link together my various assertions, then I’ve blown the minimality requirement out of the water.”

These are important things for the Identity Metasystem to support, and I make the same points in my own version of the laws. But I don’t think these characteristics are the whole story - rather, they describe requirements for certain use cases. However, there are other use cases, and it was the goal of the original Laws of Identity to embrace them as well.

For example, when I blog I want to use an identity that is linkable. I want anyone who is interested in my ideas to be able to talk about them with anyone else, and tell them how to get to my web site, which is - in the most literal sense of the word - a “linkable” characteristic of my identity...

I take Ben’s real point to be that an important and mainstream use case is one where verifiability, minimal disclosure AND unlinkability, should all be achievable at the same time. This I agree with."

They take a bit of time to digest but for anyone serious about understanding digital identity Kim and Ben's exchanges are absolutely essential reading.

AT&T Copyright Fighting

Nicholas Weaver has been speculating on how AT&T are planning to implement their promise to filter illegally torrented copyrighted materials on their networks.

"All that is necessary is that the MPAA or their contractor automatically spiders for torrents. When it finds torrents, it connects to each torrent with manipulated clients. The client would first transfer enough content to verify copyright, and then attempt to map the participants in the Torrent.

Now the MPAA has a "map" of the participants, a graph of all clients of a particular stream. Simply send this as an automated message to the ISP saying "This current graph is bad, block it". All the ISP has to do is put in a set of short lived (10 minute) router ACLs which block all pairs that cross its network, killing all traffic for that torrent on the ISP's network. By continuing to spider the Torrent, the MPAA can find new users as they are added and dropped, updating the map to the ISP in near-real-time."

Although the approach raises a host of problems which he accepts and he would much prefer that ISPs avoided getting into the copyright policing game, he suspects that this kind of approach provides an attractive cost-benefit picture to the AT&Ts of this world.

Bring back the fear

Also via Cryptogram: the Onion has an amusing editorial on terror.

"We must all do whatever we can to preserve America by refocusing our priorities back on the contemplation of lethal threats—invisible nightmarish forces plotting to destroy us in a number of horrific ways. It is only through the vigilance and determination of every patriot that we can maintain the sense of total dread vital to the prolonged existence of a thriving, quivering America...

Not so very long ago, we winced every time we saw someone with facial hair or a backpack. Average people were terrified of opening their mail for fear of getting a face full of anthrax. Those were perhaps our country's greatest days. Yet that once-phobic spirit that defined our times is drastically changing...

We can no longer rely solely on our enemies to menace the populace—we must find that horror within ourselves. Though we have made great strides in frightening ourselves about illegal immigrants, bird-flu pandemics, and random psychotic school shootings, it is not enough. What happened to that country I used to know and love, where a Korean grocer could be killed out of irrational xenophobia merely because someone thought he was an Arab? Such an act is, I am disappointed to say, almost unthinkable in today's increasingly less-than-utterly-petrified climate...

Let's all come together as in fearful days of yore and do what we must to keep America free from peace of mind once and for all."

Security v Privacy the false dichotomy

Bruce Schneier, in his latest Cryptogram tackles the false dichotomy of security v privacy head on.

"We've been told we have to trade off security and privacy so often -- in debates on security versus privacy, writing contests, polls, reasoned essays and political rhetoric -- that most of us don't even question the fundamental dichotomy.

But it's a false one.

Security and privacy are not opposite ends of a seesaw; you don't have to accept less of one to get more of the other. Think of a door lock, a burglar alarm and a tall fence. Think of guns, anti-counterfeiting measures on currency and that dumb liquid ban at airports. Security affects privacy only when it's based on identity, and there are limitations to that sort of approach.

Since 9/11, approximately three things have potentially improved airline security: reinforcing the cockpit doors, passengers realizing they have to fight back, and -- possibly -- sky marshals. Everything else -- all the security measures that affect privacy -- is just security theater and a waste of effort.

By the same token, many of the anti-privacy "security" measures we're seeing -- national ID cards, warrantless eavesdropping, massive data mining, and so on -- do little to improve, and in some cases harm, security. And government claims of their success are either wrong, or against fake threats.

The debate isn't security versus privacy. It's liberty versus control...

If you set up the false dichotomy, of course people will choose security over privacy -- especially if you scare them first. But it's still a false dichotomy. There is no security without privacy. And liberty requires both security and privacy. The famous quote attributed to Benjamin Franklin reads: "Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety." It's also true that those who would give up privacy for security are likely to end up with neither."

Freedom of expression is dead

In 1998 Kimbrew McLeod got a US registered trademark on the expression "freedom of expression". He was interviewed for today's Radio 4 Mine All Mine show about intellectual property and pointed out that because he had failed to file a section 8 form five years into the life of his unusual trademark, it lapsed. As a consequence if you check out the status of the trademark, a US government website now declares that "freedom of expression is dead."

The programme also quotes Andrew Gowers as saying that "the whole point of intellectual property rights is to recognise that there is almost no form of innovation or creation that is completely original. Almost any form of innovation or creation that you can imagine builds on innovations creations of thousands and probably millions of people before. And if you lose sight of that and have laws that are too restrictive you go wrong; and so it's always been a balance designed to incentivise and reward creation and innovation on one hand and on the other to allow the free flow and competition of ideas."

Lessig to run for Congress?

Larry Lessig is considering running for Congress in an attempt to start diluting the power of money on the US political process.