EU Parliament reject ACTA; Commission say NO!

Well I missed watching it live because I forgot that Brussels is an hour ahead of us here in the UK but the EU Parliament has declined the opportunity to postpone their vote on ACTA today. The European People’s Party, as they promised, called for a postponement of the vote. This was rejected by 420 MEPs. 255 voted to postpone and there were 9 abstentions.

The Parliament then decided to reject the ACTA agreement itself (478 votes to 39, with 165 abstentions) based on ACTA rapporteur, David Martin's recommendations.

"on the draft Council decision on the conclusion of the Anti-Counterfeiting Trade Agreement between the European Union and its Member States, Australia, Canada, Japan, the Republic of Korea, the United Mexican States, the Kingdom of Morocco, New Zealand, the Republic of Singapore, the Swiss Confederation and the United States of America

(12195/2011 – C7-0027/2012 – 2011/0167(NLE))

(Consent)

The European Parliament,

–   having regard to the draft Council decision (12195/2011),

–   having regard to the draft Anti-Counterfeiting Trade Agreement between the European Union and its Member States, Australia, Canada, Japan, the Republic of Korea, the United Mexican States, the Kingdom of Morocco, New Zealand, the Republic of Singapore, the Swiss Confederation and the United States of America (12196/2011),

–   having regard to the request for consent submitted by the Council in accordance with Article 207(4) and Article 218(6), second subparagraph, point (a) (v), of the Treaty on the Functioning of the European Union (C7-0027/2012),

–   having regard to Rules 81 and 90(7) of its Rules of Procedure,

–   having regard to the recommendation of the Committee on International Trade and the opinions of the Committee on Development, the Committee on Industry, Research and Energy, the Committee on Legal Affairs and the Committee on Civil Liberties, Justice and Home Affairs(A7-0204/2012),

1.  Declines to consent to conclusion of the agreement;

2.  Instructs its President to notify the Council that the agreement cannot be concluded;

3.  Instructs its President to forward its position to the Council, the Commission and the governments and parliaments of the Member States and of Australia, Canada, Japan, the Republic of Korea, the United Mexican States, the Kingdom of Morocco, New Zealand, the Republic of Singapore, the Swiss Confederation and the United States of America."

The BBC and ZDNet have short reports as do lots of other outlets now, including the Parliament press office.

The voting process itself was remarkable and courtesy of modern technology you can see it for yourself in glorious technicolour via the EU Parliament website. The ACTA discussion starts at 12.51.30 local time but it's worth watching the run up to it if only for the incredible speed at which votes get done on important agricultural issues. The ACTA bit takes only 6 and half minutes in total.  Honestly if you were to blink you'd miss a vote.  Or if you lost concentration you could find yourself voting for one thing thinking it was something else.

On ACTA Christofer Fjellner of the EPP opens proceedings at 12.51.46. To applause in the chamber he asked for a postponement of the ACTA vote since the European Court of Justice was scheduled to consider the agreement.  This was supported by Klaus-Heiner Lehne, again to a spattering of applause, rounding off with the old classic "I don't think that people on the internet should be making up our minds for us." (In fairness to Mr Lehne that was a translation of what he said rather than a precise quote from his native tongue).

The vice president in the chair, Alejo Vidal-Quadras, then asked for any speakers against the motion to postpone the vote.  David Martin indicated his readiness and Mr Vidal-Quadras invited him to speak. Mr Martin, to laughter and applause, in his lilting Scottish brogue, said:

"ACTA has been rejected by 5 parliamentary commitees.  It has been killed off so many times that it now only exists thanks to the EPP life support machine. No emergency surgery, no transplant, no large period of recuperation is going to save ACTA.

It's time to give it its last rites.  Time to allow its friends to mourn and for the rest of us to get on with our lives.  Thank you Mr President."

The vice president then moved to the vote on the motion to postpone. 255 in favour, 420 against, 9 abstentions. He quickly moved then to the substantive vote on ACTA making clear that those who wanted to reject ACTA should vote against it. The vote went 478 to 39 to reject.

There was immediately huge applause in approval of the decision and a demonstration from multiple MEPs, standing up with posters reading "Hello Democracy Goodbye ACTA".

Their revelry brought disapproval from the vice president, who like a teacher reprimanding a naughty child, told them to sit down and put their posters away. There was then a sting in the tail for the celebrating MEPs. Mr Vidal-Quadras said "The agreement has not been accepted by parliament and so I shall give the floor to the Commission.  You have the floor Commissioner."

Maroš Šefčovič, Vice President of the Commission and Commissioner for Inter-Institutional Relations and Administration (bet you didn't know we had one of those!), stood up to make a brief statement.  He referred to what had been said by Commissioner De Gucht earlier in the plenary (ACTA was coming whether they liked it or not) to "underline the importance of ACTA for creativity, innovation and the economic potential inthe EU. How important the agreement is for the external competitiveness of the EU economy." He was, therefore, "informing the honorable members that the Commission will maintain its request to the European Court of Justice for an opinion on whether ACTA is compatible with the treaties and in particular with the Charter of the fundamental rights of the European Union."

He was loudly heckled at this point and the camera cut to David Martin shaking his head. There was also some applause.  He went on to state that they would study the opinion of the Court and discuss it with the other signatories of ACTA and with the EU Parliament and "would then consider further steps to take."

I caught the last few minutes of David Martin's press conference after the vote.  Surprisingly, given the furore surrounding ACTA, it only lasted a little under 17 minutes (possibly because it is a busy news day elsewhere?). Mr Martin emphasised his concerns that ACTA is too vague, open to misinterpretation and could endanger fundamental freedoms. He spoke of the need for a wide ranging debate about the Internet and appropriate methods for rewarding creators whilst protecting fundamental freedoms.  He believes we have spent 20 years dealing with the internet as if it was a physical world which it is not.

To be pedantic, the Net has a very substantive physical layer. However, I absolutely agree with the underlying point that regulators should make an effort to understand the technology they are trying to regulate.

He was asked a question about the other countries that have signed ACTA.  Mr Martin responded that the agreement has 11 signatories.  To come into force it needs 6 of those to ratify.  But his considered view is that ACTA is dead, not just in the EU but elsewhere. He has information to suggest Australia will follow the EU lead and reject ACTA in parliament next week.  It is not clear now if Canada will ratify the agreement and he thinks it will now struggle to get the 6 ratifications it needs.

In a none-too-oblique retort to Commissioners De Gucht and Šefčovič that ACTA was alive and kicking whatever the EU Parliament said, Mr Martin also said that he believed that the agreement could not be put before the Parliament again. There might be some legal or procedural loopholes that he was not aware of but as far as he understood ACTA has now been permanently killed off in the EU.

The post vote explanations, from the few MEPs who were prepared to hang around, of their stance in Parliament covered all the old ground -

• IP rights have to be respected
• We need a debate and effective protection for rights holders
• ACTA was a step too far
• The EU would now have to look seriously at how to protect IP
• ACTA disproportionate 
• 3 strikes disproportionate
• Criminal sanctions were draconian 
• Copyright infringement was inappropriately conflated with counterfeiting medicines
• Undermined privacy, democracy, freedom of speech and human rights
• Negotiation process lacked transparency
• Coated in secrecy
• ISPs would be inappropriately turned into network police

Irish MEP Seán Kelly had apparently asked why India and China were not signed up for ACTA and the response was ACTA was a "coalition of the willing".  More like "a coalition of the innocent" thought Mr Kelly since most of the IP infringement came from China and India in his opinion.

And the final speaker was rather amusing too, if unintentionally. Eija-Riitta Korhola from Finland launched into an angry rant about how we must protect intellectual property, how "we've made ourselves laughable", how MEPs had let themselves be misled on ACTA by false information from the media, that ACTA was fair and the Parliament should have waited for the ECJ decision which would have been evidence based before deciding whether ACTA was a good thing or not. ACTA seems to have been an emotional issue for her.

So where does this all leave us with ACTA?  Well the EU Parliament has now firmly rejected the agreement by a large majority.  The Commission, however, Ian Paisley style, says NO! They're not having tin pot democratic institutions like the EU Parliament getting in the way of them ACTAing (sorry, couldn't help it) in the economic interests of the EU by implementing ACTA, so they're promising it will be back, like the Terminator.

ACTA may be temporarily on ice but I don't share David Martin's confidence that it is dead.  It will return again once the ECJ has considered it and its provisions are likely to re-surface in any case as part of the EU's ongoing discussions on IPR enforcement. But for now those opposed to the agreement can give themselves a pat on the back for winning one significant battle.

Update: IPWatch, KEI and Michael Geist are worth reading.

7th Gikii 2012 - call for papers

Lilian Edwards and Daithí Mac Síthigh tell me that the 7th Gikii workshop is scheduled 16 & 17 September at UEA London. 

7th Gikii 2012 - call for papers!!
Call for Papers: 7th Gikii Workshop, 17-18 September 2012
UEA London
102 Middlesex Street
London
E1 7EZ UK

It’s harder than it used to be to write a Call for Papers for GikII, the so-cool-it-hurts blue skies workshop for papers exploring the interstices between law, technology and popular culture. Back in the day,  you could dazzle the noobs just by mentioning past glories like the first paper on Facebook and privacy, Harry Potter and the Surveillance of Doom, regulation of autonomous agents according to the Roman law of slavery, edible technologies and copyright in Dalek knitting patterns. But nowadays we live in a world where we routinely encounter unmanned surveillance drones used to deliver tacos or made out of cats ,  commercial asteroid mining with Richard Branson, 3d printers used to create human organs and the fact that Jeremy Hunt still has a job. 

Still, if any of these or the other many phenomena of the digital age in desperate need of legal attention are digging a tunnel out of your brain, then send us an abstract for the 7^th Gikii workshop!  Maybe this year it will be your paper which contributes the seminal GikII meme following in the honoured footsteps of LOLcats, flying penises, and knitted Daleks.

Gikii has run since 2006 in venues such as Edinburgh, Oxford, London, Amsterdam and Gothenberg with attendees coming from Europe, the US, Canada, Australia, Japan, India and Latin America. There is no conference fee, but attendees may be asked to contribute to the conference dinner on 17^th September. If desired, we can suggest London accommodation ranging from cheap to more expensive.  This year’s Gikii is run with the kind assistance of the Law School, University of East Anglia at their London centre, and will commence at lunchtime Sep 17^th running through to end September 18th.  These dates also offer an opportunity to combine GikII with the 7^th SCL Policy Forum (details at http://www.scl.org/site.aspx?i=ev25696 ) in what has been termed the “week of geek”.

Abstracts of no longer than 500 words should be sent to lilian.edwards@strath.ac.uk and "Karen Mc Cullagh (LAW)" K.Mccullagh@uea.ac.uk  by August 13^th 2012. Acceptances will be announced shortly thereafter. A limited number of places will be available for participants not giving papers, and preference will be given for these to scholars (including postgraduate students) who have not previously attended GikII. Registration for these places will open at gikii.com when acceptance of abstracts is notified.

Gikii is one of my favorite conferences. Always thought provoking, friendly and enjoyable. And you get to talk about anything -  my own (fairly staid by Gikii standards!) back catalogue includes Maxwell's demon and the internet, the battle of the book, airborne minefields and Fighter Command's information system, a Wilson-Boyle plan to save the public domain, teaching algebra with tiddlywinks, going OER without permission.

Other much more interesting stuff from Gikii:

Chris Lever, "Netizen Kane"
Daithi Macsithigh, "What We Talk About When We Talk About Google"
Dinusha Mendis, "If Music be the food of Twitter - then tweet on, tweet on"
Judith Rauhofer, "The Rainbow Connection - of geeks, trolls and muppets"
Martin Jones, "Human! We used to be exactly like them"
Miranda Mowbray, "What the Moai know about Cloud Computing: Stone-age Polynesian technology and the hottest trend in computing today"
Nicola Osborne, "Dammit! I'm a Tech (the "Services" or "Site") Punter (the "User" or "Member") not a Lawyer!"
Trevor Callghan, "GOOGLE WANT FREND!"
Andres Guadamuz. "Luddism 2.0"
Bernt Hugenholz, The Googlification of Copyright. The GBS and its Consequences for Europe
Burkhard Schafer, ZombAIs and family law: technology beyond the grave
F.E. Guerra-Pujol,  Blade Runner, Time Scarcity and the Optimal Lifespan of Robots and Clones'

Judith Rauhofer,  “Get out of my head, bloodsucker! Notions of surveillance in the vampire mind” 

Lillian Edwards, Death 2.0

TJ McIntyre, Won't somebody please think of the children!?

Alana Maurushat, Proxy and the Enchanted Shield:  Copyright and Computer Security

Miranda Mowbray,  The Fog over the Grimpen Mire: Cloud Computing Services and the Law

Peter Yu,  Legal Transplants in the Digital Age

Lilian Edwards, Ian Brown, Chris Marsden, "Cybersalking 2.0"

Andrea Matwyshwn, Black Collar Crime Daithi Mac Sithigh, "I’m in ur tube blocking ur internets: The Politics, Perception and Parody of Network Neutrality Legislation" Burkhard Shafer Wiebke Abel, and Gerald Schaefer, "An Officer and a Gentleman: Teaching Autonomous Agents the Laws of Armed Warfare"

I could go on but it's time to tune into ACTA vote at the European Parliament. On Gikii 7 - make it if you can!

IP lobbyist stamina

It's a fairly busy news day on the intellectual property front. Ofcom has published their draft code on how the Digital Economy Act will work in practice. It seems to amount to an industrial scale threatening letters regime with a form of 3 strikes coming into force by March 2014. Concern is widespread despite the government commitment to repealing the odious clause 17 web blocking provision. Consumer Focus are particularly aggrieved at the backbone-less appeal process which will lead to accused infringers having to pay a £20 fee to challenge accusations of copyright infringement.

‘Consumers are innocent until proven guilty. Twenty pounds may sound like a small sum, but it could deter those living on low-incomes from challenging unfair allegations. Ultimately consumers could be subject to “technical measures”, including being cut off from the internet, and the ability to appeal is therefore critical to ensure consumers who have done nothing wrong are not deprived of essential internet access further down the line.¹
‘This fee is intended to prevent “vexatious appeals”. But this could be achieved without pricing low income consumers out of their right to appeal, by giving the Appeals Body the power to fine those who have brought frivolous appeals.  However the best way to reduce unnecessary appeals is for Ofcom to require a high standard of evidence from copyright holders, preventing thousands of notifications being sent out on the basis of flimsy evidence.’

Elsewhere, La Quadrature du Net calls for a final push on ACTA following the largely successful campaigning of recent months which led to key EU parliamentary committees rejecting the agreement, the most recent being the International Trade committee (INTA) just last week.

And in China, seemingly under the radar of Western news media, the diplomatic conference to finalize a new treaty for audiovisual performers, Beijing Treaty on Audiovisual Performances (BTAP) was concluded. The treaty was signed but is not yet ratified.

"Signature of the treaty constitutes a preliminary endorsement by demonstrating the state’s intent to examine the treaty domestically and consider ratification, though signing does not create a binding legal obligation to ratify."

WIPO Director General Francis Gurry said:

“The conclusion of the Beijing Treaty is an important milestone toward closing the gap in the international rights system for audiovisual performers and reflects the collaborative nature of the multilateral process”

Whereas Mr Gurry, with his active support for the development agenda and opposition to ACTA, for example, has been a huge improvement on the previous leadership at WIPO, I can't agree that further IP rights, outlined in this treaty, for pop/movie stars are either necessary or proportionate.  I've never really understood what problem this particular treaty or the extra rights therein, (which by the way can be contracted away to studios and music labels), was trying to solve. Meryl Streep and Antonio Banderas are pleased.

Meanwhile Commissioner Kroes, a supporter of ACTA, has been making a speech on the importance of the European cultural sector.

The thing that these various stories highlight again is the amazing stamina of IP lobbyists. They lose the occasional battle but ultimately seem to have more resources and stamina than their opponents and are always prepared to play the long game.  WIPO are handing out further IP rights to Hollywood stars.  3 strikes is coming to the UK via the DEA and Ofcom.  And ACTA, though nearly defeated, at least for the moment, in the EU is the object of furious behind the scenes activity by lobbyists and supporters at the EU parliament to try to stop the parliament effectively rejecting it in early July.

PS A reader has pointed out, quite correctly, that I failed to mention the biggest supporter of ACTA in the Commission, Commissioner De Gucht, and his intention to bypass the democratic inconveniences in the EU on ACTA.  The good Commissioner has stated (just prior to the INTA committee vote last week) that

"If you decide for a negative vote before the European Court rules, let me tell you that the Commission will nonetheless continue to pursue the current procedure before the Court, as we are entitled to do. A negative vote will not stop the proceedings before the Court of Justice.

If the Court questions the conformity of the agreement with the Treaties we will assess at that stage how this can be addressed."

Let me attempt a translation of that: 

He intends to ensure the Commission ignore any EU Parliament vote to reject ACTA; furthermore, should the ECJ reject ACTA, the Court will be bypassed too; and until both of these venerable institutions find a way to come up with the right answer and accept ACTA, all available means (and given the history of this process, probably some less savoury activities too) will be pursued to ensure it gets put in place in the EU.

EFF right idea but wrong target on software patents

The EFF has started a campaign against software patents. They state the problem as:

"Software patents are hard to understand. Really hard, because patent lawyers can get away with writing them in extremely vague and broad language. This means that innovators are left without clear guidance on what patents they might be infringing. It also allows trolls to exploit the vague and confusing patent language to extort higher licensing fees than they would otherwise be entitled."

Much though I like the good folk at the EFF I think maybe they've got their target slightly wrong here.  Software patents can be vague and broad but I'm not sure those particular features distinguish them from any other types of patents.  Yes patent holders exploit the language but companies like Intellectual Ventures or Blackboard, IBM or Myriad Genetics don't really care if it is hardware, software or even, these days, bioware or business methods at the heart of a case.  What they exploit, primarily, is the cost of patent litigation system.  Going to court is so expensive it is really only feasible for those with deep pockets.  For smaller companies the patent system is a licence to pay a lawyer.  If one of the bigger corporations decide to target you the only rational economic response is to settle. Otherwise the risk of bankruptcy is severe.

Greg Aharonian has been a vocal and long time critic of those opposed to software patents. He makes the perfectly logical argument that:

"The Church-Turing thesis (for every algorithm, there is a circuit) requires software and hardware patentability to be equivalent, especially in light of hardware-software codesign tools, where you design both (and their combinations) with equal effort."

And he's right.  If our societal values and patent systems legitimise patents of certain types of electronic hardware then there is no logical reason why the software equivalent of that circuit should not be patentable.

My problem with these types of patents, software and  hardware equivalents, is that they amount to patenting algorithms.  Software is mathematics and mathematics should not be patentable.  Now I know this is a much more complicated case to articulate in practice to technically and mathematically challenged policymakers. But the trouble with focusing on simple but erroneous targets is that they lead to simple but erroneous "solutions" that don't fix anything.

The patent system is complicated.  The technologies that it is increasingly covering are also incredibly complicated.  The principle that mathematics should not be patentable is clear but gets lost in translation when the messy dysfunctionality of the patent system gets applied, in real life, to the complexity of modern technology. Too much of the public debate on intellectual property consists of IP maximalists and IP minimalists shouting PR digestible slogans at each other.  My concern is that the EFF's campaign here might just end up in the same unproductive arena, focusing attention on a beguiling but deceptive underlying issue of vague patent language.  Vague and broad patent language is a problem but it is not one that is exclusive to software patents.

GNI Digital Freedoms Report

I attended the launch of the Global Network Initiative (GNI) report Digital Freedoms in International Law: Practical Steps to Protect Human Rights Online at the Free Word Centre in London yesterday. The executive summary gives an overview:

"With around 2.3 billion users, the Internet has become part of the daily lives of a significant percentage of the global population, including for political debate and activism. While states are responsible for protecting human rights online under international law, companies responsible for Internet infrastructure, products and services can play an important supporting role. Companies also have a legal and corporate social responsibility to support legitimate law enforcement agency actions to reduce online criminal activity such as fraud, child exploitation and terrorism. They sometimes face ethical and moral dilemmas when such actions may facilitate violations of human rights. In this report we suggest practical measures that governments, corporations and other stakeholders can take to protect freedom of expression, privacy, and related rights in globally networked digital technologies. These are built on a detailed analysis of international law, three workshops in London, Washington DC and Delhi, and extensive interviews with government, civil society and corporate actors. "

David Sullivan (Policy and Communications Director, Global Network Initiative)welcomed everyone explaining the GNI "is a multi-stakeholder group of companies, civil society organizations (including human rights and press freedom groups), investors and academics, who have created a collaborative approach to protect and advance freedom of expression and privacy in the ICT sector. GNI provides resources for ICT companies to help them address difficult issues related to freedom of expression and privacy that they may face anywhere in the world. GNI has created a framework of principles and a confidential, collaborative approach to working through challenges of corporate responsibility in the ICT sector." GNI want multi-stakeholder scrutiny of policy proposals surrounding the internet.

Kirsty Hughes, the Chief Executive of Index on Censorship, opened with the tale of the Azerbaijani blogger who had been jailed and tortured and continually harassed since his release. Azerbaijan government representatives even heckled and yelled at him as he spoke at the OSCE Internet Freedom conference in Dublin earlier this week.  The opportunity for expression facilitated by modern technology, she said, is brilliant compared to just 20 years ago.  But the downside is that the technology facilitates surveillance.

The Google transparency report 2012 reports that Google had few takedown requests from China. Is that good news or are China so good at censorship  they don't need Google's help? The volume of takedown requests increased drastically in India (49%) and the US (103%). There are huge concerns from the big ISPs about this.  Ms Hughes rounded off by saying Index on Censorship are committed to doing a lot more about internet censorship issues.

The first panel of the day was chaired by Ms Hughes and included Richard Allan (Director of Policy EMEA, Facebook), Stephen Deadman (Group Privacy Officer and Head of Legal, Vodafone) and Douwe Korff (Professor of International Law, London Metropolitan University).  Mr Deadman was invited to speak first to address the question of who has access to our communications.  He looks after privacy and security at Vodaphone and noted the law enforcement and human rights issues have increased by an order of magnitude over the past 10 years. Telecommunications companies (telcos) have come together to express their concern about pressures from various governments to disclose data undermining human rights.  Ten have recently published a set of principles around human rights in their sector.

For telcos surveillance is a fact of life. It is the nature of their business. The level of support provided to law enforcement authorities is on an industrial scale.  That affects the way they have to manage law enforcement. Working with law enforcement is not rare.  It is very common. So the processes have to ensure that cooperation happens in a legitimate way. However the technology has changed hugely whilst there has been very little change in how telcos provide support for law enforcement.  The Communications Data Bill, he hopes, will lead to an enlightening public debate on this.

There are two key issues for Vodaphone:

1. How can surveillance powers be adapted to the modern world in legitimate, proportionate and necessary ways?
2. How do telcos operate in markets where even basic human rights do not exist?

Richard Allan from Facebook followed. His answer to the question of who controls access to your communications is you. "The default mode is you control access to your communications." (Ahem) Operators have a moral (ahem) and legal obligation to ensure that control is meaningful.  The challenge is that governments want to override your control of your data.  Data retention is the evil twin of data protection. (That got a laugh.  You could tell he'd learned his script and was practiced at delivering it.)

Override powers are in law and companies have to abide by them if they want to operate in that jurisdiction. And the government will not leave you alone if you are as big as Facebook.  Richard Allan then asked what do we want as citizens? He wants informed consent and accountability.  So called "informed consent", imho, is a meaningless concept in the context of companies like Facebook since their users have no idea of what exactly it is they are giving away. However he followed through with the informed consent and accountability line and explained what he thought it meant - clear what the override powers are, when they are being used and what they are being used for (aka transparency); and he wants to give his consent to these things only through the judicial process.  He also wants to have to give consent (aka have his say in) to what society considers banned speech.    He also wants the authorities to be held accountable.  If commerce knew the rules were clear and governments accountable that would make their life much easier.

Note in the Facebook worldview the real evil twin is government and the good twin is commerce. It was a subtle message, slickly delivered. Yet I didn't get that from Vodaphone's Stephen Deadman.  Mr Deadman was direct in stating clearly that surveillance is in the operations dna of telcos, that support for law enforcement is provided on an industrial scale and that the regulations need to catch up with the technology via an open informed public debate. He didn't try to blame the evil government bogeyman but insisted we need to adopt proportionate, legitimate and necessary surveillance powers for the modern world.

Professor Korff came next and launched into his task with some passion.  Technology is evolving he said.  In the old days the amount of data gathered was relatively limited. Now installing a surveillance black box generates a vast amount of data.  This is fundamentally dangerous.

The way the surveillance technology is built varies. These systems need ongoing continuous maintenance and support.  The amount of data is huge and the UK government are being disingenuous or clueless if they think they are only going to gather minimal data through the provisions outlined in the Communications Data Bill (CDB).  Peter Sommer eloquently explained at the recent Scrambling for Safety conference that communications and content data cannot be separately simply in the way the government believes.

If CDB goes ahead in the UK, Prof Korff believes, we will all effectively be tagged like criminals are now.

The international law surrounding all this is really complicated. During the Arab spring in Tunisia, Egypt and other places states of emergency were declared by respective governments and normal laws suspended. Terrorism falls between peacetime and emergency but government authorities want to operate as they would in a state of emergency.  Different jurisdictions have different perspectives on speech.  In parts of Europe it is against the law to deny the holocaust.  In the US the first amendment gives people a constitutional right to do so.  It's difficult to apply conflicting laws across borders.

When researching the report they looked at the emergency standards in international law and the Ruggie principles. Ruggie focused on companies breaching human rights. In the GNI report they wanted to focus on states forcing companies to undermine human rights.

Index on Censorship CEO Kirsty Hughes then posed the question: When is it a company's obligation to challenge the law?

Stephen Deadman of Vodaphone, in fairness, again didn't attempt to duck the question.  He suggested it depended on the context.  He argued that companies cannot engage in civil disobedience if they have a physical presence in a particular market. But they do have an obligation to push back in whatever way makes sense in that market.  Sometimes this has a positive outcome.  They were under pressure from the Egyptian government to spam people with state sponsored messages.  Vodaphone pushed back and said no.  The government could have forced the issue but chose not to. The practical reason companies like Vodaphone cannot go any further than this, he insisted, was that it could have serious consequences for employees on the ground in those countries where human right abuses are rife.  Local Vodaphone employees have rights too and the company has an obligation not to put them in danger.

He was then asked if Vodphone would decide to go into or withdraw from a market on the basis of a specific country's human rights record.  Disappointingly here he retreated into the standard PR response mode.  For Vodaphone, human rights is one of the factors they consider but the key question is whether the people in that market would be better off with them, a company that respects human rights, than without. He could not and would not give a guarantee that they would refuse to go into a country on human rights grounds.

The Facebook response to when is it a company's obligation to challenge the law was a pleading - Facebook don't have a choice; when you're as big as Facebook nasty governments won't leave you alone.  The cure is to get a global regulatory framework that is the same for everyone.  Part of that framework is in place in the cybercrime convention.

Douwe Korff then suggested if there was no rule of law in a country it was not a very stable place to invest.  One of the recommendations in the GNI report is a single point of contact in each country for communications data access requests to companies.  Part of the problem for companies getting established in new countries is the multiple levels of corruption and many corrupt officials demanding data from telcos for example.  It's therefore a good idea to get agreement eg through UK ambassadors at high level what/who the single point of contact for surveillance data requests would come from.  Then if low level officials demand data they get referred to the higher authority.  It facilitates transparency of the process.

Stephen Deadman responded Vodaphone have taken this approach in a number of markets. It is easier for the company and the central government gets the benefit of monitoring these processes centrally too.

At this point there was a question from the audience prefaced with an accusation that neither Vodaphone nor Facebook are transparent about the number of requests they receive. There is a bizarre situation in some countries where you may only find out your data have been mined when you're in the dock.  In many countries there are no prohibitions on telling data subjects data has been requested by the government authorities.  Why do Vodaphone and Facebook not tell users about surveillance requests and how many geolocation  requests are they getting in the UK.

Stephen Deadman explicitly refuted the suggestion that Vodaphone have the freedom to share this information with users in many countries.  He also said it should be for governments to provide the information right across the whole market rather than individual operators disclosing.

Richard Allan said Facebook are looking at Google's transparency report and wondering if they could do something similar. But in terms of "tipping off" (my hackles were raised slightly by that) Facebook do their own assessment of the law enforcement requests for information; and tipping off is not appropriate in most cases e.g. child abuse investigation.  More cases Facebook get are legitimate investigations.  Typically totalitarian regimes don't make data requests from Facebook.  Newspapers protect sources.  Facebook and Vodaphone are not newspapers.  Facebook primarily view it as a safety issue.  Cooperating with law enforcement is a big part of that.  Safety and security are the overriding objectives.

Stephen Deadman then forcefully pointed out that Vodaphone get very little background on law enforcement requests for information.  They get a request form and follow a process.  Vodaphone is not in a position to assess the case from an investigative, criminal or legal process perspective and should not be.  It is not part of Vodaphone's remit to investigate or prosecute crimes.  They must, however, ensure due process is followed with respect to the information they supply to law enforcement.  But their capacity to say to law enforcement that they are overstepping the mark is non existent.  Vodaphone, however, get radically different types of data requests to companies like Facebook or Google.

Douwe Korff jumped in at this point and I could tell I wasn't alone in taking offence at Richard Allan's "tipping off" phrase. All this, he said, is a dialogue in secret behind your back.  On publishing the data on numbers of requests he doesn't trust government.  By all means they should publish their statistics but the telcos should too and then we can compare the two sets of data and find the holes. Companies should minimise and push back against government overreaching every time.  He doesn't believe Facebook have the competence to assess criminal cases and whether information requests are legitimate.  Companies should know the legal setup of any country they get into and with the help of academics and civil society etc facilitate understanding through transparency.  He objected strenuously to Facebook's "tipping off" language too.

Eric King of Privacy International asked for clarification of Vodaphone's interpretation of the Regulation of Investigatory Powers Act (RIPA).  His own understanding was that the RIPA default is that telcos are not gagged if they get a data access request.  He also wanted to know what degree of human supervision happens in these industrial scale law enforcement cooperations.

Stephen Deadman said Vodaphone do have oversight and review processes.  Most cases have some kind of review, some are automated.  Vodaphone doesn't have a legal opinion that says that it cannot disclose data requests under RIPA.  In other countries so prohibitions do apply.  Going down the route of transparency is something he accepts is a good idea in principle.  It does have a number of operational, cost and other practicality issues to consider though.

Mr Deadman did also, later in proceedings, say that advanced markets are the best at surveillance - this is a simple emergent feature of the different levels of technical competence.

Prof Korff then pointed out that black boxes are dangerous technology because they are indiscriminate.  The only control on them is the good behaviour or good intentions of the agencies that operate them. Without transparency no one is watching the watchmen.

There followed rather long PR statement on behalf of Facebook from Richard Allan.  All about ow Facebook what to make the world more open, how they are getting increasingly transparent, how they are much and unfairly maligned for not warning people enough, how a stazi type control system would not work and how Facebook has a network of activists showing people how to use Facebook safely.

There was a question from a member of  the House of Lords on how long the panel members thought it would be before the surveillance technology became useless except for catching stupid crooks.

Prof Korff: the circumvention technology arms race will continue and ordinary people will become more educated about the dangers online.

Richard Allan:  That is the rationale for the Communications Data Bill - technology is changing so fast the government need to keep up and they claim they can only do so with sweeping powers.  So we have to be careful with that kind of argument. They argue the more difficult it is the more data they want.

Vodaphone's Stephen Deadman agreed - the Bill is the response to that fear. He wonders if we have really looked at this holistically?  We need a debate as to what surveillance is legitimate, proportionate and necessary.

Kirsty Hughes' final question then was how worried should we be about the Communications Data Bill?

Prof Korff - "Very worried"

Richard Allan - "On a scale of 1 to 10, 11!"

Stephen Deadman - "Concerned."

That rounded off the first panel of the day.  I'll stick another note here on the second panel as, when and if time allows

Coalition mass surveillance bill

There has been little doubt for some time that the Home Secretary, Theresa May, has been completely house trained and now buys into the mass surveillance mindset of her Nu Labour predecessors.  The latest evidence comes in her scaremongering justifications for the indefensible draft Communications Data Bill (CDB).

"As criminals make increasing use of internet based communications, we need to ensure that the police and intelligence agencies continue to have the tools they need to do the job we ask of them: investigating crime and terrorism, protecting the vulnerable and bringing criminals to justice.
For many years our police and security and intelligence agencies have used communications data from landline telephones and mobiles to catch criminals and to protect the public. This information – which does not include the content of a phone call or email – has played a role in nearly every serious organised crime investigation and in all major Security Service counter-terrorism operations over the past decade and is fundamental to policing across the UK. But the ability of the police and others to use this vital tool is disappearing because communications data from new technologies is less available and often harder to access. Without action there is a serious and growing risk that crimes enabled by email and the internet will go undetected and unpunished, that the vulnerable will not be protected and that terrorists and criminals will not be caught and prosecuted. No responsible Government could allow such a situation to develop unaddressed.
The purpose of this Bill, therefore, is to protect the public and bring offenders to justice by ensuring that communications data is available to the police and security and intelligence agencies in future as it has been in the past."

All the old bogeymen are wheeled out.  In multiple media engagements she drags up all four horsemen of the infocalypse - terrorists, drug dealers, child abusers and organised crime - and more, on several occasions quoting the Met police chief as insisting passing this legislation is a "matter of life and death".

She goes to great pains to point out that the CDB is "not about creating big government database - communications service providers will be asked to hold this data". (That's "asked" as in compelled). The attempt to distance herself from the Nu Labour apparatchiks obsessed with massive database cures for all ills is laughable. As if compelling commercial communications providers (and potentially everyone if the broad definitions in Clause 28 of the Bill are any guide) to build and maintain massive databases to which government has open access is somehow morally superior?!

Let's just look at what part 1 of the draft bill actually says as opposed to "we just want to protect you cuddly kittens" newspeak version promoted by the Home Secretary.

"1 Power to ensure or facilitate availability of data

(1) The Secretary of State may by order—

(a) ensure that communications data is available to be obtained from telecommunications operators by relevant public authorities in accordance with Part 2, or

(b) otherwise facilitate the availability of communications data to be so obtained from telecommunications operators.

(2) An order under this section may, in particular—

(a) provide for—

(i) the obtaining (whether by collection, generation or otherwise) by telecommunications operators of communications data,

(ii) the processing, retention or destruction by such operators of data so obtained or other data held by such operators,

(iii) the entering into by such operators of arrangements with the Secretary of State or other persons under or by virtue of which the Secretary of State or other persons engage in activities on behalf of the operators on a commercial or other basis for the purpose of enabling the operators to comply with requirements imposed by virtue of this section,

(b) impose requirements or restrictions on telecommunications operators or other persons or provide for the imposition of such requirements or restrictions by notice of the Secretary of State.

(3) Requirements imposed by virtue of subsection (2) may, in particular, include—

(a) requirements (whether as to the form or manner in which the data is held or otherwise) which ensure that communications data can be disclosed without undue delay to relevant public authorities in accordance with Part 2,

(b) requirements for telecommunications operators—

(i) to comply with specified standards,

(ii) to acquire, use or maintain specified equipment or systems, or

(iii) to use specified techniques,

(c) requirements which—

(i) are imposed on a telecommunications operator who controls or provides a telecommunication system, and

(ii) are in respect of communications data relating to the use of telecommunications services provided by another telecommunications operator in telecommunication system concerned.

(4) Nothing in this Part authorises any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system.

(5) In this section—

“processing”, in relation to communications data, includes its reading, organisation, analysis, copying, correction, adaptation or retrieval and its integration with other data,

“relevant public authority” has the same meaning as in Part 2.

(6) See—

(a) section 25 for the way in which this Part applies to public postal operators and public postal services, and

(b) section 28 for the definitions of “communications data” and “telecommunications operator” and for other definitions relevant to this Part."

I won't dissect all the parts of clause 1 here but the introduction to the draft bill itself explains what this means:

"Part 1 makes provision for ensuring or otherwise facilitating the availability of communications data to be obtained from telecommunications operators. Clause 1 enables the Secretary of State, by order, to ensure that communications data is available to be obtained by public authorities" 

The bottom line is that the relevant Secretary of State, most likely the Home Secretary, gets unlimited powers to mould data access regulations in perpetuity without the need to consult parliament in any meaningful way:

(1) The Secretary of State may by order—

(a) ensure that communications data is available to be obtained from telecommunications operators by relevant public authorities in accordance with Part 2, or

(b) otherwise facilitate the availability of communications data to be so obtained from telecommunications operators.

(2) An order under this section may, in particular—

[...]

(b) impose requirements or restrictions on telecommunications operators or other persons or provide for the imposition of such requirements or restrictions by notice of the Secretary of State"

This is basically a really dangerous Henry VIII clause. There is no mechanism for amending Henry VIII orders and they usually get rubber-stamped by Parliament without material scrutiny.  Ms May and her successors get to order anyone to do anything that can be related to facilitating access to communications data:

If you combine this with, as Francis Davey points out, with the broad definitions given in clause 28 of the bill, e.g.

"“person” includes an organisation and any association or combination of persons

[..]

“telecommunications operator” means a person who—

(a) controls or provides a telecommunication system, or

(b) provides a telecommunications service,

“telecommunication system” means a system (including the apparatus comprised in it) that exists (whether wholly or partly in the United Kingdom or elsewhere) for the purpose of facilitating the transmission of communications by any means involving the use of electrical or electro-magnetic energy,

“telecommunications service” means a service that consists in the provision of access to, and of facilities for making use of, a telecommunication system (whether or not one provided by the person providing the service)"

- this Bill could theoretically, as currently drafted mean that we might be obliged to keep "who, what, when and where" records of family and friends social gatherings which involve listening to music, TV watching, internet or mobile phone use, electronic gaming or just chatting.

Wendy Grossman summarises it nicely:

"So we're talking - again - about spending huge sums of government money on a project that only a handful of people want and whose objectives could be better achieved by less intrusive means. Give police better training in computer forensics, for example, so they can retrieve the evidence they need from the devices they find when executing a search warrant.

Ultimately, the real enemy is the lack of detail in the draft bill. Using the excuse that the communications environment is changing rapidly and continuously, the notes argue that flexibility is absolutely necessary for Clause 1, the one that grants the government all the actual surveillance power, and so it's been drafted to include pretty much everything, like those contracts that claim copyright in perpetuity in all forms of media that exist now or may hereinafter be invented throughout the universe. This is dangerous because in recent years the use of statutory instruments to bypass Parliamentary debate has skyrocketed. No. Make the defenders of this bill prove every contention; make them show the evidence that makes every extra bit of intrusion necessary."

So much for the promising promises of the then new coalition government in 2010 "to reverse the substantial erosion of liberties under the Labour government". Henry Porter's optimism at the time has given way to weary disappointment as he points out that the authoritarian forces within government pressing for a surveillance state are alive, well and thriving,

"the onerous truth is that the price of liberty is eternal vigilance...

We should not let this bill pass."

Indeed.

Help ORG stop the snoopers' charter

The Open Rights Group needs your help to fight the Communications Data Bill. The announcement on the Bill was slipped out on Thursday when David Cameron was giving evidence before the Leveson inquiry. At least £1.8 billion is to be spent on mass surveillance technology at the same time as sacking police officers and military personnel.



As ORG say,

"Your communications via Google, Facebook or Skype will now be open to what may be a large number of government officials. We want to see the powers to collect and access communications data tightened up, not extended ever further."

And they're offering training sessions to help you get involved in educating people and MPs about these dangerous proposals -

"a series of events to get the campaigning going at the grassroots, and help people working with their MPs.

http://www.openrightsgroup.org/events/2012/censorship-and-surveillance-campaign-training

• London, Wednesday, 20 June 2012
• Edinburgh, Saturday, 23 June 2012
• Manchester, Wednesday, 27 June 2012
• Sheffield, Thursday, 28 June 2012
• Birmingham, Wednesday, 4 July 2012
• Bristol, Saturday, 7 July 2012"

You don't need any previous knowledge of the issues or experience talking with your MP. 

Each training event will last for around four hours. They will cover a background briefing on the issues and an overview of the campaigns followed by some practical training on how to speak to your MP. 

The sessions will be sociable and entertaining as well as extremely informative.  And if you wonder whether it is worth an evening of your time just remember that you cannot protect democracy by building state infrastructure of mass surveillance. Bruce Schneier put it more accessibly, "technology shouldn't give big brother a head start... it's bad civic hygiene to build technologies that could someday be used to facilitate a police state."

Congratulations Dr Doctorow

Congratulations to the prolific Cory Doctorow who fittingly, on Friday last, 8 June 2012, was awarded an honorary doctorate by the Open University.

(Image via Matt Locke).

Professor Marian Petre made the presentation explaining why Cory had been honoured.

"Cory Doctorow is a science fiction novelist, blogger and civil rights activist. He is the co-editor of the hugely popular weblog Boing Boing (boingboing.net), and is a regular columnist for The Guardian, Wired, Popular Science, Make, The New York Times, and many other newspapers, magazines and websites. He was formerly Director of European Affairs for the Electronic Frontier Foundation (eff.org) and was a founder of the UK-based Open Rights Group, both non-profit civil liberties organizations that defend freedom in technology law, policy, standards and treaties. He has worked at the UN, with standards bodies, governments, industry, universities and other non-profit organizations promoting a balanced approach to intellectual property law, a policy area of special educational concern to the Open University. In 2007, he served as the Fulbright Chair at the Annenberg Center for Public Diplomacy at the University of Southern California.

His internationally-renowned science fiction novels are simultaneously published by Tor Books and released on the Internet under Creative Commons licenses that encourage their re-use and sharing, a demonstration of his philosophy on open publication. He has won the Locus and Sunburst Awards, and been nominated for the Hugo, Nebula and British Science Fiction Awards. Entertainment Weekly has called Doctorow "The William Gibson of his generation."

At a time when technological developments and associated regulations are transforming our society, including our concepts of privacy and freedom of expression, Doctorow has been a tireless campaigner for the free flow of ideas, educating the press, policymakers, OU students and the general public alike about civil liberties issues related to technology and intellectual property law.

In IP law in recent years, far removed from the attention of most ordinary people, there has been a dramatic expansion in government-granted monopolies over broad swathes of knowledge – patents on human genes or ways of doing business, repeated extensions of the term of copyright – which present a clear and present danger to the mission of the Open University to promote ‘educational opportunity and social justice by providing high-quality university education to all who wish to realise their ambitions and fulfil their potential.' Through his campaigning, his writings, his multitude of accessible and entertaining talks, all freely available on the Internet, Cory Doctorow has told this complex story, in a way we can all understand, of the largely successful lobbying of IP industries as they struggle to protect and extend their knowledge-based monopolies in the face of developments in technology. His boundless energy and advocacy of innovative business models and the removal of barriers to achievement does a service, not just to the OU and the general public, but the entertainment industries themselves which, even as they succeed in getting more and more draconian copyright laws and locked-down technologies, continue to experience a shrinking turnover of their products.

In addition to this wide-ranging contribution in areas of special educational concern to the OU, Doctorow has made his specific unique contributions to OU courses like TU100 (My Digital Life).

Doctorow was named one of Forbes magazine's 2007/8 Web Celebrities, and one of the World Economic Forum's Young Global Leaders for 2007. Doctorow co-founded the open source peer-to-peer software company OpenCola, sold to OpenText, Inc in 2003. He serves on the boards and advisory boards of a variety of cultural and charitable foundations and civil rights organisations such as the Participatory Culture Foundation, the MetaBrainz Foundation, Technorati, Inc, the Organization for Transformative Works, Areae, the Annenberg Center for the Study of Online Communities, and Onion Networks, Inc.

In summary, we nominate Cory Doctorow for an honorary Open University DUni, in recognition of his tireless endeavours and recognised international standing in areas of special educational concern to the University – technology law, policy and standards and the free flow of ideas – and our mission to ‘promote educational opportunity and social justice by providing high-quality university education to all who wish to realise their ambitions and fulfil their potential.’"

Oracle v Google ruling a win for Google

Judge Alsup has issued an Order re Copyrightability of certain replicated elements of the Java Application Programming Interface. I like the way he opens, describing the case as "the first of the so-called “smartphone war” cases tried to a jury."

An interesting element of the case, evident in his summary of the ruling and the substance of the decision, is that the judge actually learnt some java to help him come to a decision. A technically literate judge - that's something of a rarity. It would be nice if policymakers and the courts generally made such efforts in relation to technology.

"SUMMARY OF RULING
So long as the specific code used to implement a method is different, anyone is free
under the Copyright Act to write his or her own code to carry out exactly the same function
or specification of any methods used in the Java API. It does not matter that the declaration or
method header lines are identical. Under the rules of Java, they must be identical to declare a
method specifying the same functionality — even when the implementation is different.
When there is only one way to express an idea or function, then everyone is free to do so and
no one can monopolize that expression. And, while the Android method and class names could
have been different from the names of their counterparts in Java and still have worked,

copyright protection never extends to names or short phrases as a matter of law.

It is true that the very same functionality could have been offered in Android
without duplicating the exact command structure used in Java. This could have been done by

re-arranging the various methods under different groupings among the various classes and
packages (even if the same names had been used). In this sense, there were many ways to group
the methods yet still duplicate the same range of functionality.
But the names are more than just names — they are symbols in a command structure
wherein the commands take the form
java.package.Class.method()
Each command calls into action a pre-assigned function. The overall name tree, of course, has
creative elements but it is also a precise command structure — a utilitarian and functional set
of symbols, each to carry out a pre-assigned function. This command structure is a system or
method of operation under Section 102(b) of the Copyright Act and, therefore, cannot be
copyrighted. Duplication of the command structure is necessary for interoperability.

I wonder if the comment that

"copyright protection never extends to names or short phrases as a matter of law"

is a dig at the 2005 Bridgeport music decision where the US Court of Appeals for the 6th Circuit ruled that a 2 second sampling of 3 notes constituted copyright infringement.

And how about this on APIs:

"An API is like a library. Each package is like a bookshelf in the library. Each class is
like a book on the shelf. Each method is like a how-to-do-it chapter in a book. Go to the right
shelf, select the right book, and open it to the chapter that covers the work you need. As to the
37 packages, the Java and Android libraries are organized in the same basic way but all of the
chapters in Android have been written with implementations different from Java but solving the
same problems and providing the same functions. Every method and class is specified to carry
out precise desired functions and, thus, the “declaration” (or “header”) line of code stating the
specifications must be identical to carry out the given function."

 Mark Lemley at Stanford (and owner/coordinator of the excellent Cyberprof list) gets a mention.

 "the number of software patents in force in the United States has dramatically increased from

barely a thousand in 1980 to hundreds of thousands today...This has caused at least one noted commentator to observe:

As software patents gain increasingly broad protection, whatever
reasons there once were for broad copyright protection of
computer programs disappear. Much of what has been considered
the copyrightable “structure, sequence and organization” of a
computer program will become a mere incident to the patentable
idea of the program or of one of its potentially patentable
subroutines.

Mark Lemley, Convergence in the Law of Software Copyright?, 10 HIGH TECHNOLOGY LAW JOURNAL 1, 26–27 (1995)."

Whereas it's true copyright causes all sorts of problems for programming I remain as unconvinced as Donald Knuth was in 1994 that software should be subject to proprietary patent rights.  I find the idea that software is mathematics too convincing for that.

Most notably in this case, though, Judge Alsup is pretty scathing about Oracle's claims in concluding:

"In closing, it is important to step back and take in the breadth of Oracle’s claim. Of the
166 Java packages, 129 were not violated in any way. Of the 37 accused, 97 percent of the
Android lines were new from Google and the remaining three percent were freely replicable
under the merger and names doctrines. Oracle must resort, therefore, to claiming that it owns,
by copyright, the exclusive right to any and all possible implementations of the taxonomy-like
command structure for the 166 packages and/or any subpart thereof — even though it 

copyrighted only one implementation. To accept Oracle’s claim would be to allow anyone
to copyright one version of code to carry out a system of commands and thereby bar all others
from writing their own different versions to carry out all or part of the same commands.
No holding has ever endorsed such a sweeping proposition.

CONCLUSION
This order does not hold that Java API packages are free for all to use without license.
It does not hold that the structure, sequence and organization of all computer programs may be
stolen. Rather, it holds on the specific facts of this case, the particular elements replicated by
Google were free for all to use under the Copyright Act. Therefore, Oracle’s claim based on
Google’s copying of the 37 API packages, including their structure, sequence and organization
is DISMISSED. To the extent stated herein, Google’s Rule 50 motions regarding copyrightability
are GRANTED (Dkt. Nos. 984, 1007). Google’s motion for a new trial on copyright infringement
is DENIED AS MOOT (Dkt. No. 1105)."

It's a 2-1 win for Google on the merits of the case which, given a jury recently decided Google didn't infringe Oracle's claimed patents, is a killer blow to Oracle's bid to extract multiple truckloads of cash from Google's coffers.

Apologies for the formatting issues with the extracts from the ruling.

The universality of organisational stupidity

1.   Knowledge = Power [sic]

2.   Time = Money [sic ditto]

3.   Power = Work/Time [Science]

Substitute 1. into 3. to give:

4.   Knowledge = Work/Time

Substituting 2. into 4. demonstrates:

5.    Knowledge = Work/Money

Re-arranging 5. leads to the conclusion that

6.     Money = Work/Knowledge

Hence we derive and/or demonstrate the universal nature of organisational stupidity. I was thinking of using this in opening my book on the convergent evolution towards insanity of large organisations.  But insanity, at least in a legal sense, is to do with a person's capacity to be responsible for their actions in the context of a loss of contact with reality. Stupidity is a feature of the insanity of large organisations but I'm wondering if it is a sufficiently important feature or emergent property of the insanity to merit inclusion in the introduction? Answers on a postcard (or electronic equivalent) please...

A Global reality: don't put your data in the cloud, Mrs Worthington

Hogan Lovells have produced a very practical and succinct white paper, A Global Reality: Governmental Access to Data in the Cloud.

The authors examine government access to personal data in the cloud across ten jurisdictions and conclude that we're kidding ourselves if we believe controls on government access are tighter in the EU than the US.

"Businesses often assume knowledge of the laws regulating
governmental access to data in their home jurisdictions, and
they make further assumptions about the legal regimes
abroad where Cloud service providers may be located."

The authors mention the PATRIOT Act as a particular bogey man for critics of the US in this regard. Whereas the PATRIOT Act does give governmental authorities wide ranging powers equivalent anti- terrorism laws in other jurisdictions mean

"Every single country ... examined vests authority in the
government to require a Cloud service provider to disclose
customer data in certain situations, and in most instances
this authority enables the government to access data
physically stored outside the country’s borders, provided
there is some jurisdictional hook."

The result is that:

"Some erroneously believe the best way to limit governmental
access to data is to use Cloud service providers present only
in “safe” jurisdictions – places where data are thought to be
free from troublesome governmental access."

But even when particular jurisdictions don't seem to have nominally permissive access regimes,

"The existence of Mutual Legal Assistance Treaties greatly
diminishes any argument that data stored in one jurisdiction
is immune from access by governmental authorities in
another jurisdiction." 

Just as civil rights activists have been explaining for years, you can drive a coach and horses through the loopholes in the statutory protections for privacy in the EU.

The report points out that in terms of protection the EU could, by virtue of the existence of the data retention directive (Directive 2006/24/EC) be structurally weaker on personal data protection in theory than the US.

"a law that perpetuates the existence of data that might not otherwise be available to governmental authorities (because it would have been deleted) is a factor to be considered in evaluating the favorability of one jurisdiction over another as a service provider location."

Being a short overview of 10 jurisdictions the Hogan Lovells report doesn't have the capacity to go into the practical application of the various legal regimes. They clearly and succinctly outline the situation in each jurisdiction - the US, Canada, Australia, Denmark, France, Germany, Ireland, Japan, Spain and the UK and also note that "Proposals for reform of privacy rules in the EU do not contemplate altering the current environment in which law enforcement has significant access to data in the Cloud."  In the UK, for example,

"The government may intercept communications if doing so is
“necessary” in the interests of national security; for the
prevention or detection of a serious crime; to safeguard the
economic well-being of the UK; or in response to a request
under an international mutual legal assistance agreement.
There is no need for court approval and the details of such
an “interception warrant” must be kept secret."

The table at the end of the paper provides a neat summary indicating you can barely slip a cigarette paper between the access regimes across all 10 jurisdictions reviewed. The lesson?

For the foreseeable future, if you want to protect your data from essentially unrestrained government access, (without even thinking about private sector and criminal access and sharing), don't put your data in the cloud, Mrs Worthington.

Report authors, Winston Maxwell and Christopher Wolf, should be commended for condensing a complex subject in such an accessible way.

Update: One of the smartest thinkers/practitioners around on privacy and the Net, Caspar Bowden, has pointed out that the over-simplification in the report, as simplification often does, distorts the real story here. The claim that the EU might be structurally weaker than the US on privacy regulations, for example, does not stand up to any kind of close scrutiny. Caspar draws particular attention to the DOJ's belief that the PATRIOT Act is subject to secret government interpretation and additionally that such claims are unsustainable when the details of the PATRIOT Act and the FISA (Foreign Intelligence Surveillance Act) Amendment Act 2008 (s.1881a) are examined and compared to EU regulations.

Update 2

Caspar Bowden says:

"This paper, and several others of its kind over past few years, manage to avoid mentioning ... :

- the FISA Amendment Act 2008 s.1881a, which created a new power targeted only at non-US persons outside the US, to intercept communications and access "remote computing services" (i..e Cloud computing) from any company subject to US jurisdiction, which compels access, without any warrant, to...

- ...information which merely "relate" to "the conduct of the foreign affairs of the United States" or "with respect to" a "foreign territory" or "a foreign-based political organization". Isn't is strange how all US accounts of US laws seem to omit these limbs of the (enormous and rambling) definitions?

- s.215 of the Patriot Act, which is being interpreted according to some secret doctrine that is (possibly/probably) about grabbing arbitrary data stored on disk under powers designed for library records, thus avoiding a warrant. This will likely be worse if you are outside the US, because you will have no chance at all to get standing in a US court (assuming you ever found out about it).

All this is quite illegal in ECHR territories, which grant universal rights irrespective of nationality (within the jurisdiction of the 50 signatory states), with laws that are precise and foreseeable in their effect, for purposes which cannot include spying on ordinary lawful democratic political activities and beliefs"

He goes on to comment specifically on some of the detail:

"pp1. "As one observer put it, France's anti-terrorism laws make the Patriot Act look "namby-pamby" by comparison."
- following the footnotes, that 'observer' is one Gary Schmitt, former staff director of the US Senate Select Committee on Intelligence

pp2. - "it is incorrect to assume that the United States government’s access to data in the Cloud is greater than that of other advanced economies"
- Untrue: FISA explicitly discriminates both the protections and allowed purposes by nationality, given inferior (or zero) protection to foreigners, especially outside US

pp.2 - Kennard: "In a number of critical areas, the U.S. provides more restrictions to the access of personal data than do European Member States."
- Untrue: under no Cloud-relevant circumstances will the data of a European in Europe receive greater protection under US law than under European law

pp.2 - "Despite the procedural hurdles that may exist to request and obtain information pursuant to MLATs..."
Misleading - euphemism for fact EU law enforcement authorities may have to wait 6 months while their MLAT requests stack up in the US Department of Justice (thus discouraging sending very many)

pp2. - "The existence of Mutual Legal Assistance Treaties greatly diminishes any argument that data stored in one jurisdiction is immune from access by governmental authorities in another jurisdiction."
Wrong - unless the US wants to do any political spying (e.g. on the European Commission where apparently use of US cloud apps is rife for preparing official documents)

pp.4 - "The reality is that most of the investigatory methods in the Patriot Act were available long before it was enacted. And those investigative tools had, and still have, limitations imposed by the United States Constitution and by statute"
Misleading: - although the US Constitution is silent on the matter, the US mostly doesn't recognize (ask John Yoo) foreigners as having Constitutional rights, even those physically within US territory. Which is sort of the point in Cloud computing.

pp.4 "Under the ECPA, if a government body seeks disclosure of customer data from a Cloud service provider, it can only do so if a judge issues a search warrant or special ECPA court order, or if the government issues a valid subpoena to the provider"
Omission - which is why the secret interpretation malarkey of Patriot 215 is important, because it by-passes this law and then some (no probable cause, or reasonable grounds to believe etc.)

pp5. "FISA Orders and NSLs were available to the United States government even before the Patriot Act was enacted. The Patriot Act merely expanded some of the
provisions of these access methods. For example, it added “gag order” provisions"
- here's what that merely amounted to for one small ISP owner

pp.5 "A Cloud service provider also may petition the court to overturn the “gag order.”"
- only took Nick Merrill six years of life

pp5. "...relevant to the concerns of foreign countries about their nationals’ data, a recent ruling by a United States appeals court one level below the Supreme Court confirmed that statutory protections are extended to non-United States citizens for data physically maintained in the United States and stored in the Cloud"
Misleading & wrong: - there's no reference given, but they plainly mean the Suzlon case, which only applies to ECPA (Electronic Communications Privacy Act) not ways of getting at data under FISA or Patriot or relying on 4th Amendment protection, and isn't a Supreme Court decision anyhow. But well done Microsoft for litigating hard anyway, even if it is self-serving to reassure your foreign customers.
====

[...]

====
pp.12 "In short, the proposals for reform of privacy rules in the EU do not contemplate altering the current environment in which law enforcement has significant access to data in the Cloud."
Sadly true but also misleading: the draft of the proposed new EU DP Regulation which leaked in Dec 2011 contained an Article (42) which would have required Cloud providers to get the approval of data protection authorities before responding to direct US law enforcement authorities' requests (e.g. under Patriot/FISA), on pain of severe fines, and to notify the individual. Presumably after heavy lobbying, this Article was removed in the published proposal, replaced with a pathetically weak Recital 132 which says if the Commission finds out something naughty is going on they should jolly well do something about it quickly""

Caspar would be grateful for comments, corrections and refinements. Thanks to Caspar and to Peter Sommer who originally drew my attention to the report via the excellent FIPR alerts.

The $8 (or maybe $6) billion iPod

Rob Reid, founder of the Rhapsody online music subscription service has being doing some copyright Maths at TED.



He suggests we put aside the emotive debates about copyright and associated monsters like SOPA and ACTA and look at the numbers.  The MPAA, for example, claim the internet is costing the US economy $58 billion a year "due to content theft".  $58 billion which if you had it laid out in pennies would stretch all the way to Mars. It's also equivalent to the entire US corn crop failing, along with all fruit, wheat, cotton, rice and a number of other crops.

Music revenues are down about $8 billion a year since Napster's early days according to the music labels.  Movie and cable TV along with publishing revenues are up so where's the missing $50 billion, once the $8 billion drop in music sales is accounted for? With copyright revenues up in most sectors the missing $50 billion must be "foregone growth in a market that has no historic norms", i.e. a market that didn't previously exist.  His tongue in cheek answer to the missing link is "the insidious cost of ringtone piracy."

The MPAA also tell us the economy loses 373,000 jobs to content theft. Interesting given that in 1998 the US Bureau of Labour Statistics showed the entertainment companies were employing 270,000 people.

He goes on to talk about the $150,000 statutory damages available in the US for copyright infringement, (hence the notorious excessive damages in the Jammie Thomas and Joel Tenenbaum cases).  He claims the original MP3 player the Rio could store 10 songs i.e. $1.5 million worth of songs. In an iPod with a 40,000 song capacity this runs to $6 billion "worth of stolen media." It's a pity he got his sums wrong here, as he actually says "$8 billion worth of stolen media or about 75,000 jobs."  Maybe the error is deliberate and he's making a subtle point about the normal rules of mathematics being ignored in copyright debates and policy?  His conclusion that you might find copyright math strange is an understatement.  The five minute talk is nevertheless worth a look.

Update: Rob Reid explains his $8 billion calculation:

"In determining a given device’s maximum capacity for infringing material, I assumed an average song length of three minutes, and an encoding rate of 128 kilobits/second. I went with 128 kbps because using the AAC codec,[25] this is the rate at which music achieves “hi-fi transparency[26] — which is to say, it becomes indistinguishable from CD quality in most listening environments. This rounds very closely to 1 megabyte of data per minute of music.[27] At 32 megabytes, the Rio (1999’s Christmas hit) therefore had room for about 10 songs, which, if pirated, could represent up to $1.5MM in liabilities under US law. Today’s iPod classic, with its 160GB capacity, can hold 53,333 songs, which at $150,000 a pop is precisely $8 billion. Incidentally, Apple markets the iPod classic as having room for just 40,000 songs, but by my math, that’s selling it short. I meant to note this in the presentation, but I was running way over time by then, and spared everyone the convoluted math (so if the leap from 40,000 songs to an $8 billion liability confused anyone, I apologize — I had meant to take a quick detour through that 53,333 figure!)."

That's a really helpful clarification.  The problem with simplifying  is you end up losing precision to the point of getting it wrong. I hesitate to extend the pedantry but 53,333 songs at at $150,000 a pop is precisely $7,999,950,000 not $8 billion. Another 1/3 of a song at $50,000 is needed to reach the magic $8 billion.  Of course the odd $50k in the copyright wars is barely discernible small change...