Thursday, October 20, 2011

Hargreaves’ exceptions: format-shifting, parody, research and archiving

At the invitation of Consumer Focus I attended the Pictfor/Consumer Focus Hargreaves’ exceptions: format-shifting, parody, research and archiving panel event, in Committee Room 20 at the House of Commons on Tuesday evening this week. My first ever visit to the innards of Westminster.

The event was chaired by Labour MP, Jim Dowd.

The first speaker on the night was Martin Brennan of JB7  and Advertising Standards Authority spat fame. He opened by explaining that in the midst of his nightmare dispute with the ASA, over allegedly inciting copyright infringement, he felt like the Michael Douglas character in one of his favorite films, Falling Down, when he turns to the cop at the end and says "I'm the bad guy? How did that happen?"

The Brennan JB7 is basically a big iPod which you can use to copy and play all your music without the aid/intervention of a computer. He put 6 years of work and 3 re-mortgages into developing the machine, went from £0 to £7 Milllion (30,000 units) in sales.

The ASA decided, in response to a single anonymous complaint, after 10 million adverts, that Martin Brennan should include a prominent warning on all his ads declaring that copying CDs is not allowed under UK law. Yet the Apple iPods in use in the UK have millions of copied CDs and songs unlawfully copied from the internet and "rip, mix and burn" Apple have no obligation to include such a warning in their ads. As Mr Brennan said:

"I'm not a pirate."

"My customers are not pirates"

The JB7 is simply a "better way to enjoy music you've already paid for."

He rounded off with some general comments about the Hargreaves review recommendations.  Mr Brennan considers himself to be a designer.  He was thrilled to get his first patent at the age of 21 and reckons it was a great one which involved a genuine inventive step.  Since then as an employee in various contexts he's been forced to put his name to junk patents by employers.  The patent system is clogged full of such patents unworthy of protection and as an inventor he believes one of the ways of tackling the issue is, as Hargreaves suggests, increase patent fees. On copyright he thinks the term of copyright is ridiculously out of control and he would have no objection to anyone freely taking and making use of software he wrote 20 years ago. He positively supports Hargreaves notion of a digital copyright exchange.

Finally he said he was forced to include the copyright warnings in his adverts and he believes they have damaged his sales. He is similarly quoted in the Hargreaves review (chapter 5):
“My company is possibly one of the best examples of the sort of SME that can help lead this countryout of the recession – 10,000% growth in 30 months during the recession – but out of date legislationand red tape may sabotage my growth. It is no exaggeration to say that this matter has caused me more sleepless nights and wasted days than any other in my company’s history... Aside from legal headaches I face the cost of reassuring customers that record companies will not sue them. It’s daft because US companies Apple and Microsoft have been selling format shifting products in the UK for a decade."
Milliions routinely disregard, knowingly or unknowingly, the letter of UK copyright law but he's forced to warn people about it even though the government has accepted there should be a format shifting exception.

Next up was Professor Martin Kretschmer, of Bournemouth University's Centre for Intellectual Property Policy and Management. He has produced a very impressive and incredibily rare beast in intellectual property policy circles, an empirical report on the legal basis, rationale and economic effects of copyright levies, (in connection with his ESRC Fellowship at the UK Intellectual Property Office). The report was formally launched the following day at the Work Foundation.

He talked about there being significant copyright infringement through the use of mobile devices. He looked at a range of countries approaches and considered what the UK might do. Article 5 of the 2001 information society directive lists 20 possible exceptions and limitations to the scope of copyright. The UK has, thus far, chosen not to use all of them. (Though Hargreaves has recommended that we do). And since 2001 levies on electronic devices have tripled - €500 million per annum is collected in levies in the EU for private copying.

Of the 20 exceptions 3 require compensation - private copying, reprography and reproduction of broadcasts by social institutions. The Hargreaves review (chapter 5) recommends a limited private copying exception without compensation, partly on the basis of earlier versions of Prof Kretschmer's work in this area and the empirical evidence he provided to the review.
"5.30 The Review favours a limited private copying exception which corresponds to what consumers are already doing. As rights holders are well aware of consumers’ behaviour in this respect, our view is that the benefit of being able to do this is already factored into the price that rights holders are charging. A limited private copying exception which corresponds to the expectations of buyers and sellers of copyright content, and is therefore already priced into the purchase, will by definition not entail a loss for right holders.
5.31 The Government should introduce an exception to allow individuals to make copies for their own and immediate family’s use on different media. Rights holders will be free to pursue whatever compensation the market will provide by taking account of consumers’ freedom to act in this way and by setting prices accordingly."
Prof Kretschmer explained that the EU "fair compensation" provisions of the 2001 directive were interpreted by the European Court of Justice in the 2010 Padawan case as meaning the compensation must be the same everywhere and calculated on the basis of harm.  As the court stated,
"“fair compensation must necessarily be calculated on the basis of the criterion of the harm caused to authors of protected works by the introduction of the private copying exception”
This is different to a concept developed by the highest German federal court in 1964 of "equitable remuneration".  At the time it was decided that anyone who wanted to buy a tape recorder had to provide their personal details.  This was challenged in the courts and the federal court eventually held it to be an unconstitutional invasion of privacy.  Instead they came up with the concept of a statutory licence - equitable remuneration or levies on tape machines and associated ancilliaries to compensate copyright holders.

Professor Kretschmer concluded that we should be highly critical of the EU's fuzzy concept of fair compensation based on harm.  He does believe that ill defined concept, however, gives the UK scope to produce a narrowly conceived private copying exception for consumers - eg to effectively enable copying of CD collections onto Brennan JB7 players.  He reckons 96% or more of music on the average iPod is copied, most is not listened to; and a sufficiently clear, narrowly focussed private copying exception would do nothing to approve mass unlawful copying of songs from the internet, whilst enabling people to lawfully format shift legitimately purchased music. Such format shifting causes no harm to rightsholders  - and as Martin Brennan argued it may even enhance the value of music CDs thereby improving sales - so there would be no requirement for compensatory levies.

Third on the roster for the evening was Richard Brousson, legal counsel at the British Film Institute (BFI). He spoke passionately about the difficulties the BFI faces because the existing archiving exception in the Copyright, Designs and Patents Act excludes film. The BFI is tasked, amongst other things, with preserving and restoring the most significant film collection in the world for today and future generations - a hugely important part of the UK's cultural heritage. He also gave an insight into the difficulties researchers face in accessing our cultural heritage because film is excluded from the existing non-commercial research exception.

The BFI is a registered charity partly funded by government and in recent times has additionally taken on  most of the functions of the British Film Council which was abolished in the coalition government's bonfire of the quangos. You can get chapter and verse on their aims and objectives in the BFI royal charter. They are involved in the preservation of over 275,000 films and 210,000 TV programmes and the exceptions in the 1988 act don't cover the copying of moving images which instantly gives the BFI a problem. Mr Broussan also mentioned that a significant proportion of the films involved were orphan works.

He argued that copyright law is overdue reform if we want to avoid the systematic, legally approved destruction of our cultural heritage. The exceptions in the 1988 act and even specifically the section 29 "research and private study" exception does not apply to moving images. The law is significantly impeding the ability of researchers to access, understand and build on our cultural heritage.  One of the ways the BFI has been dealing with this is through their Screen Online partnership with educational institutions like Cambridge, Derby and Newcastle universities - a terminal based physical walled garden which they also hope to roll out to other universities in the none too distant future.

The complex rights issues do mean they, like the Open University, have to employ a dedicated and expert group of rights and contracts officers and they regularly run into problems with the usual Hollywood crew refusing rights for educational use or archiving, for example.  So the entrenched position of the large rightholders and the perilous state of copyright law and the risks it exposes the BFI to, if for example they attempt to preserve or transfer a copy of an old film in a physically deteriorating medium into a new format, mean it is extremely difficult for them to fulfil their royal charter objectives.

The fourth speaker was James Sedley of Greenpeace.  I'll report on his contribution and some of the subsequent Q&A in a later post.

Tuesday, October 18, 2011

Independent review of the UK's extradition arrangements published

The Independent review of the United Kingdom's extradition arrangements has just been published by the Home Office. It looks like bad news for Gary McKinnon who is facing extradition to the US and is potentially embarrassing for the coalition government which commissioned the review at least partly because of the McKinnon case. Deputy Prime Minister Nick Clegg in particular, prior to the last election, was a vocal supporter of McKinnon and stern critic of what he called the "lopsided" extradition agreement with the US.

Specifically on the imbalance in extradition provisions between the UK and US, however, the report concludes:

"The United States/United Kingdom Treaty
1.20 We have concluded that the United States/United Kingdom Treaty does not operate in
an unbalanced manner. The United States and the United Kingdom have similar but
different legal systems. In the United States the Fourth Amendment to the
Constitution ensures that arrest may only lawfully take place if the probable cause test
is satisfied: in the United Kingdom the test is reasonable suspicion. In each case it is
necessary to demonstrate to a judge an objective basis for the arrest.
1.21 In our opinion, there is no significant difference between the probable cause test and
the reasonable suspicion test.
1.22 In the case of extradition requests submitted by the United States to the United
Kingdom, the information within the request will satisfy both the probable cause and
the reasonable suspicion tests.
1.23 In the case of extradition requests submitted by the United Kingdom to the United
States the request will contain information to satisfy the probable cause test.
1.24 There is no practical difference between the information submitted to and from the
United States. "

Thursday, October 13, 2011

EPDS, net neutrality, privacy & UK Commission on Bill of Rights

Following the EDPS's opinion on net neutrality, traffic management and the protection of privacy and personal data, I've sent the Commission on a Bill of Rights an addendum to my original response to their discussion paper, Do we need a UK Bill of Rights. A copy follows.
As an addition to my response of Friday, August 26, 2011, and in particular the use and activities of the private/corporate sector in circumventing or ignoring human rights obligations and the potential for constitutional net neutrality principles to counteract such behaviours, could I draw your attention to the Opinion of the European Data Protection Supervisor, Peter Hustinx, on net neutrality, traffic management and the protection of privacy and personal data.

http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2011/11-10-07_Net_neutrality_EN.pdf

In my original response I suggested:

"I would suggest bringing the private sector into the remit of the bill of rights in relation to:

    Right to respect for private and family life, home and correspondence (Article 8);
    Freedom of thought, conscience and religion (Article 9);
    Freedom of expression (Article 10);
    Freedom of peaceful assembly and association (Article 11);
    Right to an effective remedy (Article 13);
    Prohibition of discrimination (Article 14).

On articles 9, 10 and 11 it may be possible to address these alternatively through technological architecture obligations and principles of net neutrality.  I recognise that the consideration, drafting and implementation of such provisions are likely to be complex but however it is done the private sector cannot be provided with a free pass to ignore fundamental rights."

Mr Hustnix analysis provides an insight into how such net neutrality provisions could also provide support for the protections of Article 8. He concludes:

"85. ISPs' increasing reliance on monitoring and inspection techniques impinges upon
the neutrality of the Internet and the confidentiality of communications. This raises
serious issues relating to the protection of users’ privacy and personal data.

86. While the Commission’s Communication on the open internet and net neutrality in
Europe briefly touches on these issues, the EDPS feels that more should be done
in order to come to a satisfactory policy on the way forward...

89. ...additional legislative measures may be necessary. In
such a case, the Commission should put forward policy measures aiming at
strengthening the legal framework and ensuring legal certainty. New measures
should clarify the practical consequences of the net neutrality principle, as this has
already been done in some Member States, and ensure that users can exercise a real
choice, notably by forcing ISPs to offer non-monitored connections."

Whilst he refers in his conclusion to legislative rather than constitutional measures, he makes the point in the body of the report that article 8 privacy principles are sacrosanct and technology neutral; and government, corporate or incidental/inbuilt technological feature bypassing of those principles is unacceptable.
Just a reminder that the Commission's discussion paper is the first step in their programme of public consultation. You can respond via or to their address. The deadline for responses is 11 November 2011.

Wednesday, October 12, 2011

TSA gone wild

Nice graphic from Jason Powers on airport security.

TSA Gone Wild
Via: forkparty.

Update: Edited links for accurate attribution.

Friday, September 30, 2011

Airport digital strip search machines: to see or not to see...

To see or not to see, that is the question

In the political arena – and airport security examined in the OU/BBC’s Bang Goes the Theory(26/9/’11) is a good example – the desire to reduce risk at almost any cost is notable. Authorities on both sides of the Atlantic regularly advocate the need, in the context of the ‘war on terror’, to introduce measures like airport scanners, sometimes described as digital strip search machines, in order to be seen to be improving public safety.  Often, the more expensive and hi-tech and visible the approach is seen to be the better.

We are asked to give up a little bit of privacy to improve overall security. People with nothing to hide, we are told, have nothing to fear.[1] The systems proposed will help catch the baddies and protect the goodies. I will touch on the validity of these claims a little later but for the moment I have a question. Is it true that people always want the level of risk they are facing in life to be reduced? 

Evolution has effectively turned every single one of us into our own personal risk managers. We make decisions every day that involve taking risks. Some people eat, drink and smoke too much and do not take enough exercise, in spite of the health hazards associated with such a lifestyle. They may not always be consciously aware of it but they are balancing their interpretation of the long-term risks of damage to health against the short-term rewards of enjoying their food, drink and smoking.

Many actively seek out the thrill of risky pursuits or professions like mountain climbing or racing car driving. The motto of the SAS is “who dares wins”. Just helping the kids to safely cross a busy road to get to the local park involves the balancing of risks and rewards. So perhaps a more legitimate pursuit for those professionally involved in risk management at airports would be the balancing of risks against benefits rather than the reduction of risks? We need to weigh the costs against the benefits when making decisions about airport security.

Unfortunately this can be a complicated business.  We need to consider security trade offs - the facts, effectiveness, economics, societal values, technology, health, safety, political, legal and ethical issues.

Fortunately, security expert, Bruce Schneier [2] has developed a user friendly check list that virtually anyone can use to do a pretty decent evaluation of security measures deployed in all kinds of contexts, including airports.  Schneier suggests we ask a series of relatively straightforward questions.

  1. What problem are you trying to solve?
  2. What is your solution?
  3. How well does your solution address the problem?
  4. What other problems does your solution create
  5. How much does it cost?
  6. Is it worth it?
Let’s try to apply Schneier’s questions to airport scanners.

  1. What problem are you trying to solve?
We hope to prevent attackers with malign intent getting onto airliners with dangerous weapons and the adverse consequences arising from such circumstances.

  1. What is your solution?
Full body scanners (digital strip search machines).  In the Bang programme presenter, Liz Bonnin, extolled the virtues of a millimetre wave scanner but it is important to note that there are generally two generic types of scanners deployed in airports (and other contexts) – (a) millimetre wave scanners and (b) X-ray backscattermachines. The latter seems to be the most commonly used in the US. 

3. How well does your solution solve your problem?

Well here is where things get interesting.  If you have a compliant attacker, like a Bang presenter, who tries to smuggle through a potential weapon which the scanner can detect – like Liz’s ceramic knife, secured under her bra strap – then if the security personnel are paying attention they will spot the knife. And indeed the expert, Paul Mason from Redline Aviation Security, did detect the knife on the scanner image.  Queue imaginary impressed music - dah dah – and Liz’s “awesome… excellent stuff” reaction. She had got her ceramic knife through the metal detector without being spotted after all. But would she have been as impressed if the knife had been detected through a pat down search?

The key problem though is not that Liz’s knife could have been spotted through a simpler, cheaper route, although these physical searches create their own difficult issues.[3] The key problem is that a number of researchers have shown that the machines are ineffective at detecting explosives and other weapons. In 2010 the US Government Accountability Office, the independent agency which investigates how the federal government spends tax revenues, concluded [4] that airport scanners might not have found the explosives used by notorious underwear bomber, Umar Farouk Abdulmutallab.

Security expert, Werner Gruber, gave a stark demonstration on German television in early 2010 that the scanners were ineffective. He used bomb making components concealed on his person and undetected by the scanner to start an intense fire in a controlled experiment outside the studio immediately after he was scanned.[5] On the plus side, the machine did detect his mobile phone, penknife and microphone.

Also in Germany the millimetre wave type machines in trials at Hamburg airport last year were shown to have problems with creases in clothes.

So there are significant questions about the effectiveness of these machines.[6]

  1. What other problems does your solution create?
There are significant security, ethical, operational, legal and health and safety problems with the routine deployment of these machines in airports (and other contexts like train stations).

The security problems are not obvious until someone points them out.  More and more complicated and intrusive airport security causes long queues – lots of people gathered together in a small space. The result is that an attacker armed with a bomb doesn’t have to make it onto a plane.  He can harm a large number of people without ever having to go through security. And contrary to the suggestion in Bang there is no evidence that strip search machines make the process of getting through airport security quicker. Bruce Schneier calls it “security theatre” when you create the impression of improved security without actually improving security. The misplaced belief or confidence that the machine will catch the bad guys can undermine our security as we pay less attention to other indicators of nefarious intent.

I occasionally wonder what Winston Churchill would have made of these types of technological “solutions”.

“We will fight them on the beaches, we will fight them with no dignity…”. What kind of values is a society displaying when routine (even if only of the virtual variety) strip searching is considered acceptable?  Note I’m not passing judgment here just asking the question if respect for personal privacy is a value that is important any more.

The operational issues are legion.  In Bang it was suggested that displays are remote from the scanners, viewed by same sex operators who only see the image and never the individual scanned.  Whereas that is the case in some airports the set up is not universal.  How do we know, by the way, that the scanned image is only being transmitted to the remote operator (if that be the case) at the airport? In truth we do not.  The Bang crew suggested full body images are never recorded. Actually many, if not all, of these systems have recording capability [7] and lots of images have been leaked onto the Internet.[8]

There are numerous stories [9] about young women and ethnic minorities being disproportionately selected for scanning and other passengers being pressurized or maltreated by security staff and/or police when deciding to opt out of being scanned.

The other operational issue that was mentioned in the program was the question of how revealing the images produced by the machines were. Liz said the “technology is based on contours – your underwear is so close to your body that it kinda helps conceal the more detailed bits of your anatomy”; or as one of her co-presenters, Dallas Campbell put it “Your bits and bobs, your bits and bobs.” With reference to the images displayed during the course of the program that was arguably the case.  What wasn’t said, however, was that the machines can be fine tuned, increasing the intensity of the beam, to leave little to the imagination.  Tuning is in the hands of the airport authorities and ultimately the operators.

The legal issues with these strip search machines are complicated. It is possible that their use is in breach of Article 8 the European Convention on Human Rights [10] which guarantees a right to privacy. [11] Their operation, in the case of children, is likely to breach UK and other jurisdictions’ child protection legislation regarding the making of indecent images of children.[12] There are also data protection and data retention questions.

Then there are the health questions.  It is probable, as stated in the Bang program, that the health risks are small with the millimetre wave machines that Liz Bonnin reviewed. The chances are you’ll be exposed to more radiation during an average flight that anything fired at you in a millimetre wave machine but the scanners have not been independently tested to rigorous academic standards. So there is no independent verification of how they work or what the specific exposure levels might be.

The X-ray backscatter machines are a different story, however. In April 2010 Professor John Sedat and a number of his highly respected academic colleagues at the University of California - biochemistry & biophysics, cancer, X-ray and imaging experts and members of the US National Academy of Sciences – wrote [13] to Dr John P. Holdren, President Obama’s chief science adviser, [14] explaining their “concerns about the potential serious health risks of the recently adopted whole body back scatter X-ray airport security scanners”. They point out that though the machines nominally use low energy beams the dose is concentrated into the skin and immediately adjacent tissue. Since this is such a small fraction of body weight, “the real dose to the skin is now high”.  They also point out that the use of these machines with specific categories of individuals raises particular concerns. These include over 65s, females with a predisposition to develop breast cancer, pregnant women, HIV or cancer patients and children. They worry about operators increasing the intensity of the beam if images are not clear enough for them and conclude:

“There is good reason to believe these scanners will increase the risk of cancer to children and other vulnerable populations.  We are unanimous in believing that the potential health consequences need to be rigorously studied.”

So in answer to our fourth question – what other problems does your solution create – it seems there are significant ethical, operational, legal and health issues to be considered.

  1. How much does your solution cost?
I understand airport scanning machines cost between £60k and £200k. In addition there are the ethical, security, operational, legal and safety costs mentioned above.

  1. Is it worth it?
Frankly no.

To sum up – they are very expensive, they don’t work very well,[15] can compromise security and they create lots of other problems. There is no need to peer through the clothes of people traversing through airports.  If there are tens of millions of pounds available to install these machines it would be better spent on intelligence gathering and pursuing rigorous investigations

So why are so many of these expensive scanners being deployed in airports and other places?[16] Essentially it is because no politician or public official, in the aftermath of the next major incident or attack, wants to be the one held up to ridicule and abuse for not putting enough prior resources into security.[17] They must be seen to be “doing something” after every attack and they must be able to claim “no one could have foreseen” or “we did as much as humanly possible”.  And when it comes to airport security it seems there are no limits to the resources (and stupidity) [18] that gets poured into it.


[1] See Nothing to Hide: The False Tradeoff between Privacy and Security by Daniel J. Solove. Yale University Press, 2011, New Haven & London
[2] See for example Beyond Fear: thinking about security in an uncertain world by Bruce Schneier Copernicus Books, 2003.  New York
[3] So-called “enhanced” pat down searches introduced in the US have led to all kinds of problems. See for example Rape Survivor Devastated by TSA Enhanced Pat Down at http://pncminnesota.wordpress.com/2010/11/08/rape-survivor-devasted-by-tsa-enhanced-pat-down/ and TSA pat-down leaves traveler covered in urine http://www.msnbc.msn.com/id/40291856/ns/travel-news/t/tsa-pat-down-leaves-traveler-covered-urine/
[4] GAO Statement for the Record To the Committee on Homeland Security, House of Representatives Homeland Security: Better Use of Terrorist Watchlist Information and Improvements in Deployment of Passenger Screening Checkpoint Technologies Could Further Strengthen Security (January, 2010) http://www.gao.gov/products/GAO-10-401T
[5] Video with some English subtitles available on YouTube at http://youtu.be/idICUSiGcqo
[7] The Electronic Privacy Information Center, EPIC, a civil rights group in the US obtained evidence through freedom of information requests in 2010 that the body scanners being used at federal courts house, for example, can store and record images. http://epic.org/privacy/airtravel/backscatter/ EPIC are pursuing a federal legal case to have airport scanners banned on constitutional grounds, so far without success.
[9] Bruce Schneier has a selection of links to some of these on his blog at http://www.schneier.com/blog/archives/2010/11/tsa_backscatter.html
[11] And on the other the side of the pond the 4th amendment to the constitution that guarantees protection from unreasonable search and seizure
[14] Assistant to the President for Science and Technology, Director of the White House Office of Science and Technology Policy, and Co-Chair of the President's Council of Advisors on Science and Technology (PCAST)
[15] See also Leon Kaufman and Joseph W. Carlson (2010) "An evaluation of airport x-ray backscatter units based on image characteristics" Journal of Transporation Security, Volume 4, Number 1, 73-94.  http://www.springerlink.com/content/g6620thk08679160
[16] EG the Z back scanner van http://en.wikipedia.org/wiki/Backscatter_X-ray
[17] Schneier calls this CYA security and I respectively refer the reader to his essay on the same at http://www.schneier.com/blog/archives/2007/02/cya_security_1.html
[18] [sic] ban on liquids etc. Choose your favourite dopey airport security measure.

Update: edited to cure broken links.

Friday, September 23, 2011

Freeview HD DRM FoI update

Apologies to those of you following the BBC/Freeview HD DRM saga for not posting more updates on the succession of communications I've had with the BBC, ITV, Channel 4, Ofcom, the British Library, the BFI and others.  I'm not finding much time in the average week for blogging at the moment.

The latest exchanges have been this afternoon, relating to legal advice the BBC received on the competition issues - they have refused to disclose this - and a meeting that took place between the broadcasters, the rights holders and Ofcom on 10 March 2010 at Freeview's offices. Ofcom has no record of who attended this meeting.

The BBC has justified its refusal to release details of the legal advice they got on the HD DRM competition issues citing section 42 of the Freedom of Information Act. (Section 42 combined with section 2(2)(b) refusal). Section 42 is a qualified exemption for legal advice. Section 2(2)(b) is

"in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information."

Their response is understandable but I've asked for an internal review and requested associated information citing the authority of the Three Rivers House of Lords case from 2004.    For the uninitiated,

Three Rivers District Council and others (Respondents) v. Governor and Company of the Bank of England (Appellants) [2004] UKHL 48 on appeal from:[2002] EWHC 2730

suggested privilege does not cover all situations where legal advice relates to business matters. Additionally the court suggested that copies of, or discussion about such legal advice may not be privileged if such copies/discussions are for non privileged purposes.

Ofcom's lack of institutional records on a key meeting between themselves, broadcasters and rights holders on the HD DRM issue is perhaps a little surprising. Or perhaps not.

Friday, September 02, 2011

Is ACTA compatible with fundamental rights?

Ian Brown and Douwe Korff have prepared a draft report, for the the Greens/European Free Alliance group in the European Parliament, on whether ACTA (The Anti-Counterfeiting Trade Agreement) is compatible with fundamental human rights. They conclude that it is not.

"SUMMARY & CONCLUSIONS
ACTA was negotiated in unwarranted secrecy, without adequate input from civil society or parliamentarians, but in close cooperation with major IP right holders.  Not surprisingly, this resulted in a text that gives disproportionate protection to big business;  fails to level the playing field between developed and developing nations in international trade relations;  hampers innovation (especially by SMEs);  fails to promote grassroots culture;  and could impede the dissemination of knowledge for people across the world (and access to health care and generic medicines).
Human rights were effective ignored, apart from the inclusion in the Agreement of vague and ineffective “without prejudice” clauses that fail to redress the balance, and are little more than fig-leaves.  The inclusion of a detailed provision on the need to respect human rights in the protection of IPR, on the lines of the “138 Amendment” to Directive 2002/21/EC, was rejected as “not needed”.
This was wrong.  Our analysis shows that ACTA, as currently drafted, seriously threatens fundamental rights in the EU and in other countries, at various levels.  Specifically:
THE RIGHT TO FREEDOM OF EXPRESSION AND INFORMATION:
  1.  Re Application of ACTA to trivial or small-scale, not-for-profit technical infringements of IP rights, and to the dissemination of IP-protected information without the agreement of the right holder where this is justified on higher public interest grounds:
  •  Article 23 ACTA requires State parties to lower the criminal threshold for IPR infringements, and to widen the scope of the criminal offences, without a de minimis exception;
  •  Without such an exception and/or similar exceptions on the lines of the U.S. “fair use” and “fair comment” rules, IPR enforcement will disproportionately restrict the freedom to seek, receive and impart information and ideas;
  •  Since a de minimis exception can be seen as a limitation on procedural matters rather than on the substance of IP rights, this is not remedied by the fact that ACTA allows States to retain substantive exceptions to IP law;
  •  In our opinion, an explicit de minimis rule and an explicit public interest defence are the minimum that are required to bring Article 23 in accordance with the European Convention on Human Rights (ECHR) and the EU Charter of Fundamental Rights (CFR).
  1.  Re Application of ACTA to evasion of Digital Rights Management systems:
  •  ACTA too easily assumes that right holders’ rights always trump user rights, that right holders can impose whatever kinds of DRM restrictions they like, and that these are always lawful in terms of contract- and consumer law, no matter how draconian.
  •  In our opinion, in specific contexts, this will not be right, and this approach therefore unduly and disproportionally restricts access to information, or the free dissemination of information, in violation of Article 10 ECHR and Article 11 CFR.
  1.  Re “Three strikes” and extended ISP liability:
  •  the revised, final text of Article 27.1 – 3. ACTA no longer requires States to adopt the kind of draconian measures  - excessive ISP liability, “three strike” rules, etc. -  that were clearly originally in the minds of the drafters, and that the European Data Protection Superviser (EDPS) has shown to be clearly incompatible with European human rights and data protection law;
  •  However, it still suffers from some of the same defects as the “criminal enforcement” provision mentioned above.  Article 27 is still excessively vague;  it encourages non-EU States to adopt such human rights-unfriendly measures in support of mainly U.S. and EU corporations, who could not rely on such measures in their own regions;  and it could still be misread or misconstrued by EU States to adopt such measures.
  •  In our opinion, without clear stipulations that require States that sign up to the Agreement not to allow private-sector-imposed “three strike” rules and not to impose excessive ISP liability in respect of IPR infringements, ACTA fails to ensure that it will be applied (by EU and non-EU States) in accordance with European and international human rights standards.
THE RIGHT TO PROTECTION OF PERSONAL DATA:
  •  Articles 11 and 27(4) allow for the following:
  •  the surreptitious monitoring of the Internet use of millions of individuals without any concrete suspicion of illegality, and the systematic recording and analyses of information on their Internet use;
  •  the disclosure of the information gleaned from such surveillance to right holders, even though it may be wildly unreliable as an indicator of illegality, without any real safeguards to ensure that only information is disclosed which seriously suggests widespread infringement by identified individuals;
  •  on the basis of completely unclear standards (essentially, mere claims by right holders);
  •  by judicial and “other” authorities, i.e. also by authorities that are neither independent nor impartial in these respects;
  •  across borders, including from EU Member States with strict data protection laws to non-EU Member States with “inadequate” data protection laws (or no data protection laws at all) ; and
  •  in proceedings to which the individuals do not have access, and in which they are not heard (inaudita altera parte).
  •  The above-mentioned suspicionless monitoring and disclosures of unreliable but sensitive personal data are incompatible with European human rights and data protection law, except under very stringent conditions, as outlined in our Opinion with reference to the Opinion of the EDPS, which include:
  •  limiting such monitoring to “clear” cases of “major IPR infringements”, and even then only subject to a “prior check” by the relevant national data protection authority;
  •  limiting transborder disclosures to right holders and law enforcement agencies in non-EU countries that ensure “adequate” protection of the received data, but in either case again only subject to such a “prior check”;
  •  imposing serious checks on the validity of non-EU personal data disclosure orders, and on assurances of limiting the use of the data by the non-EU recipient to the purpose of the disclosure (which is not properly ensured by ACTA, in spite of phrases suggesting this).
  •  In our opinion, the absence of such stringent conditions in ACTA means that the Agreement in these respects is incompatible with the ECHR, the CFR, and European data protection rules.  
FAIR TRIAL/DUE PROCESS ISSUES RELATED TO OTHER FUNDAMENTAL RIGHTS:
  1.  Re Criminal law enforcement of IPR under ACTA:
  •  In our opinion, ACTA, by not including a de minimis exception to its compulsory and draconian enforcement regime, fails to ensure adequate protection of the right to freedom to obtain and disseminate information, the right to freedom from unreasonable search and arrest, the right to inviolability of the home, and the right to the peaceful enjoyment of one’s possessions, and thus violates those rights.
  1.  Re Civil-law enforcement of IPR under ACTA (including injunctions, provisional measures, and the awarding of damages):
  •  In our opinion, without clear provisions stressing that injunctions should be the exception, and inaudita proceedings the high exception, and that for both, there must be strong counterbalancing safeguards to preserve the “equality of arms” in IPR enforcement proceedings, ACTA is incompatible with the “fair trial” guarantees in the ECHR and the CFR.
  1.  Re “Privatisation” of IPR law under ACTA
  •  Rather than contributing to the upholding of freedom of expression and due process rights by the dominant, private-sector players on the Internet, ACTA erodes the development of the Rule of Law in that realm. It encourages the regulation of human rights-sensitive matters by private entities, outside the formal frameworks, and without ensuring compliance with “off-line” human rights standards.
  •  This “privatisation” of the IPR regime therefore, in effect, deprives individuals from their right to have crucial issues of Internet freedom properly adjudicated in proceedings that meet all the requirements of Article 6 ECHR/Article 47 CFR.  
Overall, ACTA tilts the balance of IPR protection manifestly unfairly towards one group of beneficiaries of the right to property, IP right holders, and unfairly against others. It equally disproportionately interferes with a range of other fundamental rights, and provides or allows for the determination of such rights in procedures that fail to allow for the taking into account of the different, competing interests, but rather, stack all the weight at one end.
This makes the entire Agreement, in our opinion, incompatible with fundamental European human rights instruments and -standards."
The report is a draft and open for a 30 day public comment period.

Friday, August 26, 2011

Response to Commission on a Bill of Rights

The Commission on a Bill of Rights established by the UK government in March this year has issued a discussion Paper, Do we need a UK Bill of Rights, the first step in their programme of public consultation. You can respond via or to their address. The deadline for responses is 11 November 2011. A copy of my response follows.

(1)   do you think we need a UK Bill of Rights?

Given the actions of the government, the media, the public and corporate sectors, the constant dilution, criticism and breaching (e.g. S and Marper v UK, 30562/04 [2008] ECHR 1581) of the Human Rights Act and other common law rights protections and the widespread development and deployment of modern communications technologies over the past 20 years, there is a case to be made that a Bill of Rights, covered by special constitutional supremacy protections, is increasingly necessary for the UK.

On the technology front alone it is worth bearing in mind the comments of European Data Protection Supervisor, Peter Hustinix, at the University of Edinburgh in the summer of 2011[1]:

 "Before 1995, the confidentiality of communications was a widely practiced rule. Interception or monitoring of communication was only allowed under strict conditions, subject to a series of safeguards."

Unfortunately now it seems confidentiality of communications is a widely ignored rule by the public and private sectors. Interception or monitoring of communication is commonplace on and offline.

It has been increasingly evident also, that government, under the glare and pressure of the 24 hour news cycle, requires robust constitutional constraints on their temptations to respond to complex socio-economic/political problems, such as the recent riots, with knee-jerk, liberty-undermining, ill-conceived legislation and/or irrational, populist mob ‘justice’ (e.g. the political pressure on the courts to issue excessively harsh sentences).

The prime minister’s idea, in the wake of the riots, of mandating control mechanisms in social media, for example, is at best unworkable and at worst will impede the activities of those trying to cope with emergency situations. Those very same networks are used by those in danger who through no fault of their own get caught up in a riot situation and emergency services trying to respond it. 

Additionally modern communications technologies and networks pervade all aspects of our lives these days in the UK, not just facilitating communications with friends, family and wider social circles but providing access to basic public and private services, education, employment, consumer markets.  Cutting access to these things on a mere suspicion involves an arbitrary interference with the right to communicate without due process, upending the principle of the burden of proof and applying pre-emptory criminal sanctions, potentially in the absence of any criminal act. It’s a short slippery slope from there to thought crimes (which arguably we already have in the UK with some of the anti-terrorism legislation already in place).  Such research as is currently available on this largely concludes that deep packet inspection that is fundamental to such activities is dangerous technology and that it :
  • is ineffective at blocking illicit material (false positive) and communications
  • blocks legal content (false negative) and communications
  • sometimes assists access to illicit material - eg organised gangs find it easy to get access to "secret" lists of banned communications
  • does not achieve the aim of removing nefarious communications from the Net
  • does absolutely nothing to protect society from criminal acts 
All states, including Western liberal democracies, want to block something and internet blocking is often based on vague arbitrary laws - you only have to look at the HADOPI regulations in France or the Digital Economy Act in the UK to see that.  The blocking also often relies on secret banned lists, collated by unaccountable quangos, public or private, in dark smoky rooms. These blocking provisions or banning orders additionally tend to ignore due process – those affected get to know about the blocking after the event and it can be difficult to challenge.

Yet the blocking is pretty easy to bypass by people who know what they are doing and criminal gangs who have ready access to people who can facilitate such circumvention.

More generally in the context of the bill of rights is the need to understand the power of the internet as a panopticon.  The internet applies the hard wired architecture of Bentham’s idea to the whole of society - the internet essentially facilitates mass surveillance of online activities and internet surveillance is linked to real world surveillance. Regardless of the relative amount of time we spend online we live in the real world.

In summary, the principle a bill of rights which confers and protects the civil and political rights of citizens and which has constitutional protections against parliamentary sovereignty is a sound one.  In practice I doubt the political will exists to give such a bill of rights supremacy over all other laws and over parliamentary sovereignty.  And if a new bill of rights is to be no more than a coalition government branded and diluted version of the Human Rights Act then there is little point in expending energy and resources pursuing it.

(2) what do you think a UK Bill of Rights should contain?

In principle it should minimally include the existing protections of the European Convention on Human Rights.

• Right to life (Article 2);
• Prohibition of torture or inhuman or degrading treatment or punishment (Article 3);
• Prohibition of slavery or servitude, or forced or compulsory labour (Article 4);
• Right to liberty and security (Article 5);
• Right to a fair trial (Article 6);
• No punishment without law (Article 7);
• Right to respect for private and family life, home and correspondence (Article 8);
• Freedom of thought, conscience and religion (Article 9);
• Freedom of expression (Article 10);
• Freedom of peaceful assembly and association (Article 11);
• Right to marry (Article 12);
• Right to an effective remedy (Article 13);
• Prohibition of discrimination (Article 14).
• Protection of property (Protocol 1,Article 1);
• Right to education (Protocol 1, Article 2);
• Right to free elections (Protocol 1, Article 3).

Additionally there has to be some provision tackling the increasing tendency of governments to sub contract activities to the private sector or other governments (in the case of torture) in a way which attempts to avoid/circumvent their human rights obligations. The US government’s mass, warrantless, unconstitutional, wiretapping activities were facilitated by the large telecom companies. The internet and associated technologies are largely controlled by the private sector, the primary interest of which is to make money not to operate in accordance with the principles of international human rights conventions.

I would suggest bringing the private sector into the remit of the bill of rights in relation to:

  • Right to respect for private and family life, home and correspondence (Article 8);
  • Freedom of thought, conscience and religion (Article 9);
  • Freedom of expression (Article 10);
  • Freedom of peaceful assembly and association (Article 11);
  • Right to an effective remedy (Article 13);
  • Prohibition of discrimination (Article 14).
On articles 9, 10 and 11 it may be possible to address these alternatively through technological architecture obligations and principles of net neutrality.  I recognise that the consideration, drafting and implementation of such provisions are likely to be complex but however it is done the private sector cannot be provided with a free pass to ignore fundamental rights.

I’m open to suggestions on how this aspect of the Bill would work.  It may be that a first step in the right direction would be for private sector organisations with substantial control of communications infrastructure to sign up to an internet charter of principles[2], based on the Convention and emerging constitutional-type principles of internet governance[3].

It is critical that respect for fundamental rights and the rule of law should apply to the operation of the internet and associated technologies. There should be no government or private sector secret compilations or deployment of secret blocking lists.  All restrictions of rights should be based on clear, accessible, transparent, foreseeable, proportionate, necessary, effective, regulations; no arbitrary unchecked authority, no bypassing of due process; absolutely no excuses for mass, suspicionless, warrantless surveillance e.g. data retention[4]; and these rules should not be limited to government and public sector activities but also apply to the private sector that effectively controls the technologies of the internet and, in a real practical sense, the control of the governance of the internet is inherent in the control of that  technological architecture.

(3) how do you think it should apply to the UK as a whole, including its four component countries of England, Northern Ireland, Scotland and Wales?

In principle, as far as possible, there should be no margin of appreciation in the application of the bill of rights to the constituent countries of the UK i.e. it should be applied consistently across the UK.

(4) having regard to our terms of reference, are there any other views which you would like to put forward at this stage?

Not at this stage.


[1] Public Lecture, University of Edinburgh, School of Law Edinburgh, 7 July 2011
"Do not track or right on track? – The privacy implications of online behavioural advertising"
[2] As suggested by Brown, I. and Korf, D. (2011) ‘Social Media, Political Activism and Human Rights’. Issue Paper for the Council of Europe Commissioner for Human Rights.
[3] For example, Council of Europe Recommendation CM/Rec(2008)6 of the Committee of Ministers to member states on measures to promote the respect for freedom of expression and information with regard to Internet filters.
See also UN General Assembly Human Rights Council Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression
[4] The EU Data Protection Supervisor, Peter Hustinix, has issued a strongly worded opinion saying the data retention directive is incompatible with the EU's privacy protections;.

Wednesday, July 20, 2011

Mark Rogers RIP

It is with great sadness that I write that my friend and colleague, Mark Rogers, died this morning after a long and incredibly dignified battle with a malignant brain tumour.

I’ve had privilege of knowing Mark for 11 years – we moved to the same location at roughly the same time, me the short hop from Oxford and Mark returning from a stint working in Australia.  Both of us with young families.  I’d been working at the Open University for about five years by then with Mark’s dad, Brian, one of the most decent human beings you could ever hope to meet.

An Oxford University economist of international renown, Mark’s recent work has formed one of the foundation stones of Professor Ian Hargreaves emphatic call for evidence based policy making in his review of the UK’s intellectual property regime.

Down to earth family man, friend, academic and practical economist, optimist, writer, basketball coach and player, runner, cyclist, all round handyman and an infinite well of sound personal and professional advice, Mark is one of those impossibly nice, exceptionally talented and generous individuals you’d like your children to emulate.

The dignity and positive outlook with which he has faced his illness were genuinely awe inspiring.  He is survived by his partner Shona and two children, Callum and Tegan. Needless to say it is impossible to articulate the impact on his family - nothing can prepare you for such an experience.

There is neither rhyme nor reason for the world and, more especially his family, to be prematurely deprived of the gifts this man still had to offer. Mark himself would tell us to appreciate what we have and had rather than focusing on the loss and inevitable sorrow. Nevertheless, Mark, we will grieve. There will never be another Mark Rogers.  It's been an honour knowing you and working with you and a privilege to call you my friend.  I will treasure those gifts.

Update: A memorial service for Mark will be held at Oxford University's Harris Manchester College, in the College Chapel at 2.30 pm on Tuesday 2 August.

The service will be conducted by Revd. Dr. Ralph Waller, Principal of Harris Manchester, and there will be refreshments afterwards in the college. The family are asking that there be no donations of flowers but instead donations are requested for the Sobell House Hospice Charity. Mark spent his final weeks being cared for in Sir Michael Sobell House, which is a specialist unit for adults with life threatening illness. Donations are being coordinated by the funeral directors: P.L.Barrett, 81 Ock Street, Abingdon, Oxfordshire, OX14 5AG, tel. +44 (0)1235 520 808, and can be sent to them with a note that the donation is in memory of Mark Rogers.

Aaron Swartz arrested

Aaron Swartz  has been arrested for breaching JSTOR's terms and conditions and for breaking into MIT's network to do so.  The indictment states:

"11. Between September 24, 2010, and January 6, 2011, Swartz contrived to:
a. break into a restricted computer wiring closet at MIT;
b. access MIT's network without authorization from a switch within that closet;
c. connect to JSTOR's archive of digitized journal articles through MIT's computer network;
d. use this access to download a major portion of JSTOR's archive onto his computers and computer hard drives ;
e. avoid JSTOR's and MIT's efforts to prevent this massive copying, measures which were directed at users generally and at Swartz's illicit conduct specifically; and
f.  ellude detection and identification;
all with the purpose of distributing a significant proportion of JSTOR's archive through one or more file sharing sites."

It also says "Swartz used MIT's computer networks to steal well over 4,000,000 articles from JSTOR."

Firstly copying is not stealing.  Secondly the Ars technica article above points to some evidence that Swartz has previously used large volumes of legal articles for research.  Thirdly there does not appear to be any evidence that he intended to distribute the articles on file sharing sites. Without knowing all the details I would guess that, despite his committment to openness, Aaron Swartz understands the legal issues and penalties too well to have any such intention.

So, again without knowing all the details it is hard to say definitively, but this looks more like a bureaucratic over-reaction to rule breaking than a serious criminal case.  Yet the consequences, should it go to trial and the court conclude malign intent, are extremely draconian.  It will bear watching closely and hopefully Aaron Swartz's friends in the legal, digital rights and academic communities will guide him carefully through it.

Update: Demand Progress has a support Aaron petition.

Update 2:  The charges are  -
1. wire fraud (18 USC sections 1343 and 2);
2. computer fraud (18 USC sections 1030(a)4 and 2);
3. unlawfully obtaining information from a protected computer (18 USC sections 1030(a)(2), (c)(2)(B)(iii) and 2);
4. recklessly damaging a protected computer (18 USC sections 1030(a)(5)(B), (c)(4)(A)(i)(I),(IV) & 2);

Update 3: According to Wired, JSTOR did not want a prosecution and it wasn't them that called in the police.  They got all the downloaded files back but the federal prosecutors and the New England Electronic Crimes Task Force see an opportunity to pursue a high profile computer crime case. It looks like it is the MIT police and the feds who are the prime movers behind the case rather than JSTOR. It would be interesting to know who made the original complaint though.