The Privacy Office of the US Department for Homeland Security released a report on the Secure Flight air passenger monitoring program just before Christmas. Summary:
"The Department of Homeland Security (DHS) Privacy Office conducted a review of the Transportation Security Administration's (TSA) collection and use of commercial data during initial testing for the Secure Flight program that occurred in the fall 2004 through spring 2005. The Privacy Office review was undertaken following notice by the TSA Privacy Officer of preliminary concerns raised by the Government Accountability Office (GAO) that, contrary to published privacy notices and public statements, TSA may have accessed and stored personally identifying data from commercial sources as part of its efforts to fashion a passenger prescreening program.
These new concerns followed much earlier public complaints that TSA collected passenger name record data from airlines to test the developmental passenger prescreening program without giving adequate notice to the public.1 Thus, the Privacy Office’s review of the Secure Flight commercial data testing also sought to determine whether the data collection from air carriers and commercial data brokers about U.S. persons was consistent with published privacy documents.
The Privacy Office appreciates the cooperation in this review by TSA management, staff, and contractors involved in the commercial data testing. The Privacy Office wishes to recognize that, with the best intentions, TSA undertook considerable efforts to address information privacy and security in the development of the Secure Flight Program. Notwithstanding these efforts, we are concerned that shortcomings identified in this report reflect what appear to be largely unintentional, yet significant privacy missteps that merit the careful attention and privacy leadership that TSA Administrator Kip Hawley is giving to the development of the Secure Flight program and, in support of which, the DHS Acting Chief Privacy Officer has committed to provide Privacy Office staff resources and privacy guidance."
Findings:
"As ultimately implemented, the commercial data test conducted in connection with the Secure Flight program testing did not match TSA's public announcements. Part of the reason for this discrepancy is the fact that the Fall Privacy Notices were drafted before the testing program had been designed fully. However well-meaning, material changes in a federal program's design that have an impact on the collection, use, and maintenance of personally identifiable information of American citizens are required to be announced in Privacy Act system notices and privacy impact assessments. In addition, not meeting these requirements can significantly impair a program's credibility.
The creation of an effective program requires contributions from operational personnel as well as policy and legal advisors. To be most successful, all groups must have effective communications and coordination. Given the disparity between the published Fall Privacy Notices that explained the commercial data test for Secure Flight and the actual testing program that was conducted, it seems readily apparent that closer consultation and better coordination at key decision points between the Secure Flight program office and TSA legal, policy, and privacy offices was needed. While this may have been due to short deadlines and resource constraints, the end result was that TSA announced one testing program, but conducted an entirely different one.
To TSA’s credit, after being informed of this significant discrepancy, TSA revised and reissued the SORN and PIA to reflect more closely the testing program’s conduct. Additionally, throughout the commercial data test, TSA made the security of the commercial data a high priority. TSA expressly prohibited the commercial entities
involved in testing from maintaining or using the PNR for any purpose other than Secure Flight testing, and it instituted real-time auditing procedures and strict rules for TSA access to the data. This was certainly challenging given the complex and changing nature of the program.
Whatever the causes, however, the disparity between what TSA proposed to do and what it actually did in the testing program resulted in significant privacy concerns being raised about the information collected to support the commercial data test as well as about the Secure Flight program. Privacy missteps such as these undercut an agency's effort to implement a program effectively, even one that promises to improve security."
Recommendations:
"Based on its extensive review of the commercial data test, the Privacy Office offers the following recommendations for Secure Flight. These can also serve as guideposts for any Departmental initiative that involves the collection, use, and maintenance of personally identifiable information:
1. Privacy expertise should be embedded into a program from the beginning so that program design and implementation will reflect privacy-sensitive information handling practices.
2. Programs should create a detailed "data flow map" to capture every aspect of their data collection and information system life cycle. Such an exercise will help produce accurate public documents explaining program compliance with the fair information practices principles of the Privacy Act of 1974, which must guide collection and use of personally identifiable data in the government space.
3. Good communications and collaborative coordination between operational personnel and policy, privacy, and legal advisors are essential in order to ensure that key documents explaining an information collection program are accurate and fully descriptive.
4. Programs that use personal information succeed best if the public believes that information to be collected is for a necessary purpose, will be used appropriately, will be kept secure, and will be accessible for them to review. To obtain such public trust requires the transparency and accountability that can be reflected in careful drafting of publicly available SORNs and PIAs.
5. Privacy notices should be written and published only after the design of a program or a program phase has been fully described in writing and decided upon by authorized program officials;
6. Privacy notices should be revised and republished when program design plans change materially or a new program phase is going to be launched; and
7. Program use of commercial data must be made as transparent as possible and explained in as much detail as is feasible."
It's an important report especially given the recent formal agreement between the EU and US re-introding the transfer of EU airline passenger name records to the US security authorities, though sadly it will probably only register on the radar of PNR or civil liberties geeks.
Wednesday, January 10, 2007
Government attack information commissioner
The government has attacked the Information Commissioner over his stance on attempting to get them to be more open about the processes surrounding ID cards. Basically the Commissioner decided that the government should publish the 'Gateway' reviews/evaluations of their plans. Smart decision.
The government, however, are complaining that if the general public were to see these reviews it might cause "substantial harm." So basically their smart internal people told them the ID scheme was a lousy idea and because they have been selling it to Jo Public as a wonderful panacea for a variety of ills, they don't want the reality of the advice they received to be made public. This is exactly the kind of thing that kills public confidence in government, politicians and the political process. They have been overselling the utility of their big ID card idea, in spite of clear internal and external advice and evidence that the scheme won't work. Now they don't want their internal frank advice published because it would cause "substantial harm" and might "damage public confidence" in the scheme.
Thanks to HJ Affleck at FIPR for the link.
The government, however, are complaining that if the general public were to see these reviews it might cause "substantial harm." So basically their smart internal people told them the ID scheme was a lousy idea and because they have been selling it to Jo Public as a wonderful panacea for a variety of ills, they don't want the reality of the advice they received to be made public. This is exactly the kind of thing that kills public confidence in government, politicians and the political process. They have been overselling the utility of their big ID card idea, in spite of clear internal and external advice and evidence that the scheme won't work. Now they don't want their internal frank advice published because it would cause "substantial harm" and might "damage public confidence" in the scheme.
Thanks to HJ Affleck at FIPR for the link.
Monday, January 08, 2007
Felten's predictions for 2007
Ed Felten and friends have been making some predictions for 2007:
"(1) DRM technology will still fail to prevent widespread infringement. In a related development, pigs will still fail to fly.
(2) An easy tool for cloning MySpace pages will show up, and young users will educate each other loudly about the evils of plagiarism...
(5) Major record companies will sell a significant number of MP3s, promoting them as compatible with everything. Movie studios won’t be ready to follow suit, persisting in their unsuccessful DRM strategy...
(7) Some mainstream TV shows will be built to facilitate YouTubing, for example by structuring a show as a series of separable nine-minute segments.
(8) AACS, the encryption system for next-gen DVDs, will melt down and become as ineffectual as the CSS system used on ordinary DVDs...
(10) A worm infection will spread on game consoles.
(11) There will be less attention to e-voting as the 2008 election seems far away and the public assumes progress is being made. The Holt e-voting bill will pass, ratifying the now-solid public consensus in favor of paper trails.
(12) Bogus airport security procedures will peak and start to decrease. "
"(1) DRM technology will still fail to prevent widespread infringement. In a related development, pigs will still fail to fly.
(2) An easy tool for cloning MySpace pages will show up, and young users will educate each other loudly about the evils of plagiarism...
(5) Major record companies will sell a significant number of MP3s, promoting them as compatible with everything. Movie studios won’t be ready to follow suit, persisting in their unsuccessful DRM strategy...
(7) Some mainstream TV shows will be built to facilitate YouTubing, for example by structuring a show as a series of separable nine-minute segments.
(8) AACS, the encryption system for next-gen DVDs, will melt down and become as ineffectual as the CSS system used on ordinary DVDs...
(10) A worm infection will spread on game consoles.
(11) There will be less attention to e-voting as the 2008 election seems far away and the public assumes progress is being made. The Holt e-voting bill will pass, ratifying the now-solid public consensus in favor of paper trails.
(12) Bogus airport security procedures will peak and start to decrease. "
The anti-torture memos
Jack Balkan has gathered together all the thought provoking essays from the Balkanization blog dealing with the war on terror, introduced as follows:
"We've previously compiled a running list of all posts related to civil liberties, the War on Terror, and presidential power, listed by author.
By popular demand, here is a list of the essays grouped by topic. We've eliminated postings that are very short or that mostly quote newspaper articles. What follows is a compendium of substantive analyses on some of the key issues of the War on Terror by the authors here at Balkinization."
I doubt there is a better single source of analyses anywhere. Most of the articles are from 2005 and 2006 and they are divided into eight sections:
"Part I-- Civil Liberties
Part II-- Presidential Power and Constitutional Structure
Part III-- Torture and the "Torture Memos"
Part IV? The NSA Controversy and Government Surveillance
Part V-- Hamdan
Part VI-- The Military Commissions Act of 2006
Miscellaneous Posts
Posts by Guest Bloggers"
"We've previously compiled a running list of all posts related to civil liberties, the War on Terror, and presidential power, listed by author.
By popular demand, here is a list of the essays grouped by topic. We've eliminated postings that are very short or that mostly quote newspaper articles. What follows is a compendium of substantive analyses on some of the key issues of the War on Terror by the authors here at Balkinization."
I doubt there is a better single source of analyses anywhere. Most of the articles are from 2005 and 2006 and they are divided into eight sections:
"Part I-- Civil Liberties
Part II-- Presidential Power and Constitutional Structure
Part III-- Torture and the "Torture Memos"
Part IV? The NSA Controversy and Government Surveillance
Part V-- Hamdan
Part VI-- The Military Commissions Act of 2006
Miscellaneous Posts
Posts by Guest Bloggers"
US 2006 evoting failures report
A report just released by VotersUnite.Org, VoteTrustUSA, Voter Action and Pollworkers for Democracy catalogues a worrying series of problems with the US mid term elections in November 2006. Take this from the executive summary:
"In all, we looked at 1022 reports of problems associated with electronic voting equipment from 314 counties in 36 states...
The mid-term election revealed that the promise of easier voting, more accurate tallies, and
faster results with electronic systems has not been fulfilled. Voters in some jurisdictions
waited in line for hours to cast their ballots. Others cast their ballots accidentally before
they were done because they pressed the wrong button or left without casting their ballots
because they didn’t press the right button. Many voters watched the machine highlight a
candidate they didn’t select or fail to indicate a vote for a candidate they did select and
were then blamed for not being able to use a computer correctly.
Many polling places couldn’t open on time because of machine failures, and complex
procedures often left pollworkers frustrated and reluctant to serve again. Election directors
were often forced to rely on voting equipment vendors to set up the election, administer it,
and tally the votes because it was too complicated for their personnel to handle. Others
blamed themselves for not following the poorly documented, non-intuitive procedures
required to collect and tally the votes.
After the polls closed, poll workers and election officials struggled with a myriad of
reporting problems. Many couldn’t retrieve data from memory cards or couldn’t get the
tally software to combine totals from different computerized systems, while others couldn’t
figure out why the software was subtracting votes instead of adding them, or adding them
two and three times instead of only once; couldn’t determine for sure whether the first set
of results was correct, or the second set, or the third; couldn’t explain why one out of every
six voters didn’t have an electronic vote recorded for a hotly contested race; or why the
machines recorded more ballots than the number of voters who signed in to vote.
Often hidden from public view, equipment malfunctions such as these have normally been
exposed only when they are severe enough to attract media coverage...
While our source material is neither a complete list of problems nor even a
representative sampling, the number of incidents and the broad range of problems reported
is indicative of the widespread failure of electronic voting systems across the country and
how this failure affected the experience of voters on November 7, 2006."
So we had:
Update: Federal officials in the US have temporarily suspended testing of electronic voting systems at the lab that has certified most of the evoting systems in the US.
"In all, we looked at 1022 reports of problems associated with electronic voting equipment from 314 counties in 36 states...
The mid-term election revealed that the promise of easier voting, more accurate tallies, and
faster results with electronic systems has not been fulfilled. Voters in some jurisdictions
waited in line for hours to cast their ballots. Others cast their ballots accidentally before
they were done because they pressed the wrong button or left without casting their ballots
because they didn’t press the right button. Many voters watched the machine highlight a
candidate they didn’t select or fail to indicate a vote for a candidate they did select and
were then blamed for not being able to use a computer correctly.
Many polling places couldn’t open on time because of machine failures, and complex
procedures often left pollworkers frustrated and reluctant to serve again. Election directors
were often forced to rely on voting equipment vendors to set up the election, administer it,
and tally the votes because it was too complicated for their personnel to handle. Others
blamed themselves for not following the poorly documented, non-intuitive procedures
required to collect and tally the votes.
After the polls closed, poll workers and election officials struggled with a myriad of
reporting problems. Many couldn’t retrieve data from memory cards or couldn’t get the
tally software to combine totals from different computerized systems, while others couldn’t
figure out why the software was subtracting votes instead of adding them, or adding them
two and three times instead of only once; couldn’t determine for sure whether the first set
of results was correct, or the second set, or the third; couldn’t explain why one out of every
six voters didn’t have an electronic vote recorded for a hotly contested race; or why the
machines recorded more ballots than the number of voters who signed in to vote.
Often hidden from public view, equipment malfunctions such as these have normally been
exposed only when they are severe enough to attract media coverage...
While our source material is neither a complete list of problems nor even a
representative sampling, the number of incidents and the broad range of problems reported
is indicative of the widespread failure of electronic voting systems across the country and
how this failure affected the experience of voters on November 7, 2006."
So we had:
- Voters unable to get the machines to register their vote for their preferred candidates
- vendor companies running the elections because officials can't understand the machines
- and pollworkers not being able to work out final tallys or which of several final tallys to use.
Update: Federal officials in the US have temporarily suspended testing of electronic voting systems at the lab that has certified most of the evoting systems in the US.
Friday, January 05, 2007
Vista testers get TV blackout
Here's a wonderful example of how Microsoft Vista is going to bring the reality and insanity of DRM and remote corporate control of consumer gadgets to the masses, in a way which no amount of networked insider technobabble could ever do. It may well also generate enough stink to send DRM into temporary extinction.
"Some people testing Microsoft's Windows Vista got an unexpected holiday surprise: their TVs stopped working.
Media Center, which is included in the Home Premium and Ultimate versions of the Vista operating system, allows remote-control access to a variety of entertainment options, including television, for machines that have a TV tuner.
However, for those running the "release candidate 1" version of the software--the most broadly distributed of the Vista test versions--the TV feature stopped working on December 31.
Microsoft blamed the issue on the fact that it has a paid license for the video decoder and Dolby sound technology, and it only licensed those through December 31."
If Microsoft or anyone else start interfering with TV signals those of us who have been rambling on about the problems with these technologies for years will finally, through no fault of our own, see the message register on the radar of Joe and Jo Public.
"Some people testing Microsoft's Windows Vista got an unexpected holiday surprise: their TVs stopped working.
Media Center, which is included in the Home Premium and Ultimate versions of the Vista operating system, allows remote-control access to a variety of entertainment options, including television, for machines that have a TV tuner.
However, for those running the "release candidate 1" version of the software--the most broadly distributed of the Vista test versions--the TV feature stopped working on December 31.
Microsoft blamed the issue on the fact that it has a paid license for the video decoder and Dolby sound technology, and it only licensed those through December 31."
If Microsoft or anyone else start interfering with TV signals those of us who have been rambling on about the problems with these technologies for years will finally, through no fault of our own, see the message register on the radar of Joe and Jo Public.
Sony fined by French court over DRM
I hear from Cedric Manara, via the CyberlawEU list that a French court of first instance has fined Sony UK and Sony France for illegal business practices in connection with DRM on proprietary ATRAC 3 format music files which they sell via a Connect website. The files only play on Sony equipment and the court held that the company had not made this clear to customers and that this tying practice was in breach of the French Consumer code, article L. 122-1.
Friday, December 22, 2006
French court: privacy more important than copyright
A French court has decided that an individual's right to privacy, as gauranteed by French and European data protection principles, is more important than the entertainment industries' attempts to track down P2P copyright infringers. Current tracing methods drive a coach and horses through privacy regulations and the industries will have to be more refined in the processes used to identify suspects in future. The Society of Music Authors, Composers and Publishers plan to appeal the decision.
Cost analysis of Vista DRM
Peter Gutmann at the University of Auckland has been doing a cost analysis of the digital restrictions being built into Microsoft's new operating system, Vista. It makes fascinating reading, not only because it is informed by Microsoft insiders but because it demonstrates how large complex organisations can put phenomenal efforts into processes created by ridiculous decisions. Thanks to Ian Brown via the ORG list for the link and as Ian says the whole thing is completely insane. Sample:
"Executive Summary
-----------------
Windows Vista includes an extensive reworking of core OS elements in order to provide content protection for so-called "premium content", typically HD data from Blu-Ray and HD-DVD sources. Providing this protection incurs considerable costs in terms of system performance, system stability, technical support overhead, and hardware and software cost. These issues affect not only users of Vista but the entire PC industry, since the effects of the
protection measures extend to cover all hardware and software that will ever come into contact with Vista, even if it's not used directly with Vista (for example hardware in a Macintosh computer or on a Linux server). This document analyses the cost involved in Vista's content protection, and the collateral damage that this incurs throughout the computer industry.
Executive Executive Summary
---------------------------
The Vista Content Protection specification could very well constitute the longest suicide note in history.
Introduction
------------
This document looks purely at the cost of the technical portions of Vista's ncontent protection. The political issues (under the heading of DRM) have been examined in exhaustive detail elsewhere and won't be commented on further, unless it's relevant to the cost analysis. However, one important point that must be kept in mind when reading this document is that in order to work, Vista's content protection must be able to violate the laws of physics,
something that's unlikely to happen no matter how much the content industry wishes it were possible. This conundrum is displayed over and over again in the Windows content-protection specs, with manufacturers being given no hard-and-fast guidelines but instead being instructed that they need to display as much dedication as possible to the party line. The documentation is peppered
with sentences like:
"It is recommended that a graphics manufacturer go beyond the strict letter of the specification and provide additional content-protection features, because this demonstrates their strong intent to protect premium content".
This is an exceedingly strange way to write technical specifications, but is dictated by the fact that what the spec is trying to achieve is fundamentally impossible. Readers should keep this requirement to display appropriate levels of dedication in mind when reading the following analysis"
Wonderful.
"Executive Summary
-----------------
Windows Vista includes an extensive reworking of core OS elements in order to provide content protection for so-called "premium content", typically HD data from Blu-Ray and HD-DVD sources. Providing this protection incurs considerable costs in terms of system performance, system stability, technical support overhead, and hardware and software cost. These issues affect not only users of Vista but the entire PC industry, since the effects of the
protection measures extend to cover all hardware and software that will ever come into contact with Vista, even if it's not used directly with Vista (for example hardware in a Macintosh computer or on a Linux server). This document analyses the cost involved in Vista's content protection, and the collateral damage that this incurs throughout the computer industry.
Executive Executive Summary
---------------------------
The Vista Content Protection specification could very well constitute the longest suicide note in history.
Introduction
------------
This document looks purely at the cost of the technical portions of Vista's ncontent protection. The political issues (under the heading of DRM) have been examined in exhaustive detail elsewhere and won't be commented on further, unless it's relevant to the cost analysis. However, one important point that must be kept in mind when reading this document is that in order to work, Vista's content protection must be able to violate the laws of physics,
something that's unlikely to happen no matter how much the content industry wishes it were possible. This conundrum is displayed over and over again in the Windows content-protection specs, with manufacturers being given no hard-and-fast guidelines but instead being instructed that they need to display as much dedication as possible to the party line. The documentation is peppered
with sentences like:
"It is recommended that a graphics manufacturer go beyond the strict letter of the specification and provide additional content-protection features, because this demonstrates their strong intent to protect premium content".
This is an exceedingly strange way to write technical specifications, but is dictated by the fact that what the spec is trying to achieve is fundamentally impossible. Readers should keep this requirement to display appropriate levels of dedication in mind when reading the following analysis"
Wonderful.
Thursday, December 21, 2006
No place like home
Given Brian Tamanaha's revelation that The Wizard of Oz was originally written as a political allegory, I was tickled to come upon this Walt Handelsman animation. (Warning - it takes a while to load). Very much in the Eclectech tradition.
Free copies of Gore's Incnovenient Truth for teachers
The producer of "An Inconvenient Truth", the documentary on Al Gore's roadshow about global warming has decided to make 50 000 DVDs of the film available freely to teachers.
"when Laurie David, the producer of the global warming documentary "An Inconvenient Truth," narrated by former vice president Al Gore, wanted to distribute 50,000 copies to schools across the country, the National Science Teachers Association said it wouldn't help her...
Gerry Wheeler, the executive director of the National Science Teachers Association, said he would put global warming at or near the top of the list of must-teach subjects, along with the science of HIV/AIDS.
In an interview, Wheeler said David had asked for an endorsement of the film, as well as its distribution, and that would have violated the association's rules. David said she asked only for distribution help and would have been happy to have the association include a note explicitly stating that it was not endorsing the movie."
Whatever the cause of the disagreement between David and the teachers association it's good to see the DVDs will still get distributed.
"when Laurie David, the producer of the global warming documentary "An Inconvenient Truth," narrated by former vice president Al Gore, wanted to distribute 50,000 copies to schools across the country, the National Science Teachers Association said it wouldn't help her...
Gerry Wheeler, the executive director of the National Science Teachers Association, said he would put global warming at or near the top of the list of must-teach subjects, along with the science of HIV/AIDS.
In an interview, Wheeler said David had asked for an endorsement of the film, as well as its distribution, and that would have violated the association's rules. David said she asked only for distribution help and would have been happy to have the association include a note explicitly stating that it was not endorsing the movie."
Whatever the cause of the disagreement between David and the teachers association it's good to see the DVDs will still get distributed.
ARCH have moved
The good folks at Action on Rights for Children have moved their blog to http://archrights.wordpress.com/ and draw our attention to a great piece by Ross Anderson in the Guardian today about the government's apparent U-turn to allow opting out of having your medical records put on the national spine database.
"The NHS's ill-starred computer project is in the news again. After polls showed that most doctors and patients oppose a compulsory national database of medical records, health minister Lord Warner produced a report on Monday and promised an opt-out. But don't break out the champagne yet. The report was cleverly spun; hidden in an appendix is confirmation that you can opt out of the Summary Care Record, but not the Detailed Care Record.
The first is merely a synopsis for emergency care. It will have your current prescriptions, and will say, for example, whether you are diabetic. But ministers are not offering an easy opt-out from the second - the database replacing your current GP and hospital records. They plan to "upload" your GP data over the next year or two to a regional hosting centre run by a government contractor. The data will initially remain under your GP's nominal control but, after hospital records have been uploaded too, the chief medical officer will be the custodian of the whole lot.
Your "electronic health record" will be used for many purposes, from cost control through audit to research. So the Home Office plans to use health data to help predict which children are likely to offend (despite a recent report to the information commissioner that collecting large amounts of data on children without their parents' consent will probably break human rights law)."
"The NHS's ill-starred computer project is in the news again. After polls showed that most doctors and patients oppose a compulsory national database of medical records, health minister Lord Warner produced a report on Monday and promised an opt-out. But don't break out the champagne yet. The report was cleverly spun; hidden in an appendix is confirmation that you can opt out of the Summary Care Record, but not the Detailed Care Record.
The first is merely a synopsis for emergency care. It will have your current prescriptions, and will say, for example, whether you are diabetic. But ministers are not offering an easy opt-out from the second - the database replacing your current GP and hospital records. They plan to "upload" your GP data over the next year or two to a regional hosting centre run by a government contractor. The data will initially remain under your GP's nominal control but, after hospital records have been uploaded too, the chief medical officer will be the custodian of the whole lot.
Your "electronic health record" will be used for many purposes, from cost control through audit to research. So the Home Office plans to use health data to help predict which children are likely to offend (despite a recent report to the information commissioner that collecting large amounts of data on children without their parents' consent will probably break human rights law)."
High Court rule against Home Office gagging order
Did I miss media reports of this case ? The High Court ruled last month that the Information Commissioner was right to pursue a case against the Home Office in relation to a certificate signed by David Blunkett, when he was Home Secretary, blocking disclosure of personal data, in response to a freedom of information request, on national security grounds. The Home Office had asked the High Court for a judicial review of a decision by the Information Tribunal in July 2005 to quash the certificate.
FoI junkies should read the decision in full, the crux of which is contained in paragraphs 36 to 44. Someone made a data subject request to the Home Office and, not satisfied with the response, then complained to the Information Commissioner. The Commissioner's office then engaged in a protracted exchange of letters with the Home Office, extracts of which are provided in the decision. When it became clear to officials that their fencing wasn't disuading the Assistant Commissioner, they got David Blunkett to sign a gagging order. Next step the Information Tribunal where the government argued, as I understand it, that the Information Commissioner had no right to appeal Mr Blunkett's "section 28" gagging order. The Tribunal disagreed and quashed the section 28 certificate.
The government then basically made the same argument to the High Court i.e. that the Information Commissioner had no right to question the Home Secretary's decision to issue a section 28 notice on national security grounds:
"Exemption from disclosure either is or is not required for the purpose of safeguarding national security. Accordingly, if it is exempt from disclosure the Commissioner has no powers which he can exercise under Part V, and accordingly has no function to perform in relation to those powers which could entitled him to second guess a Ministerial Certificate."
Mr Justice McKay, like the Tribunal, rejected this notion, concluding that section 51 of the Data Protection Act:
"entitles, if not requires, the Commissioner, if he considers it appropriate, to "check" (to use the language of the Directive) whether an exemption under section 28 has been properly claimed. If it has not, it is a necessary corollary that the data controller has not "observed" the requirements of the Act. He has failed to give the data subject access to material which is not exempt by reason of section 28. As the Tribunal has said, the consequence is that the Commissioner is entitled to seek to satisfy himself that the material is indeed exempt under section 28. The claimant can then decide whether the material can be disclosed to the Commissioner without that disclosure damaging national security."
It's an interesting and potentially worrying result for a government currently engaged in efforts to undermine the transparency facilitated by the Freesom of Information Act. I have no idea whether there were real national security issues at stake in this case or not and that is a question to be determined by further proceedings. But in principle it has to be correct that the Commissioner has the right to check the exercise of arbitrary power, does it not?
FoI junkies should read the decision in full, the crux of which is contained in paragraphs 36 to 44. Someone made a data subject request to the Home Office and, not satisfied with the response, then complained to the Information Commissioner. The Commissioner's office then engaged in a protracted exchange of letters with the Home Office, extracts of which are provided in the decision. When it became clear to officials that their fencing wasn't disuading the Assistant Commissioner, they got David Blunkett to sign a gagging order. Next step the Information Tribunal where the government argued, as I understand it, that the Information Commissioner had no right to appeal Mr Blunkett's "section 28" gagging order. The Tribunal disagreed and quashed the section 28 certificate.
The government then basically made the same argument to the High Court i.e. that the Information Commissioner had no right to question the Home Secretary's decision to issue a section 28 notice on national security grounds:
"Exemption from disclosure either is or is not required for the purpose of safeguarding national security. Accordingly, if it is exempt from disclosure the Commissioner has no powers which he can exercise under Part V, and accordingly has no function to perform in relation to those powers which could entitled him to second guess a Ministerial Certificate."
Mr Justice McKay, like the Tribunal, rejected this notion, concluding that section 51 of the Data Protection Act:
"entitles, if not requires, the Commissioner, if he considers it appropriate, to "check" (to use the language of the Directive) whether an exemption under section 28 has been properly claimed. If it has not, it is a necessary corollary that the data controller has not "observed" the requirements of the Act. He has failed to give the data subject access to material which is not exempt by reason of section 28. As the Tribunal has said, the consequence is that the Commissioner is entitled to seek to satisfy himself that the material is indeed exempt under section 28. The claimant can then decide whether the material can be disclosed to the Commissioner without that disclosure damaging national security."
It's an interesting and potentially worrying result for a government currently engaged in efforts to undermine the transparency facilitated by the Freesom of Information Act. I have no idea whether there were real national security issues at stake in this case or not and that is a question to be determined by further proceedings. But in principle it has to be correct that the Commissioner has the right to check the exercise of arbitrary power, does it not?
Linking to copyright infringement
There has a fair bit of excitable commentary around the bazaars about a rather obscure Australian court case, Cooper v Universal Music Australia. Mr Cooper had a website which, though it did not host infringing MP3 files, did provide easy access to such files - he provided links to the files and facilitated automated upload of these links. The court held him liable for authorising infringment of copyright. The most useful and comprehensive commentary on the case comes from Kim Weatherall. Though she finds the decision troubling, she also cautions us to take a deep breath:
"It's important to appreciate the limitations of this decision. On repeated occasions in recent times, judges of the Australian federal court have emphasised that whether a person is authorising infringement is a highly fact-dependent issue. That is, the judges say that it is a case-by-case analysis, and they really mean it. As I said at the time that the first instance judgment was handed down, just because a judge holds in this context that linking is authorisation of infringement, doesn't mean that linking in another context will be authorisation.
In other words, context is all.
In this Cooper case, you have to remember that Cooper:
So far as internet users and remote website operators were concerned, the website was in substance an invitation to use the hyperlinks provided and to add new links in order that sound recordings could be downloaded from remote websites, and a principal purpose of the website was to enable infringing copies of the downloaded sound recordings to be made.
That is what was held to be infringement by authorising - not just a blog with a single link to something unauthorised. It's closer to US-style Grokster-style inducement analysis (at least as outlined in the more sophisticated judgment of Kenny J) than a general ban on linking.
So when you see a quote like this:
"We don't make any distinctions between big websites or small websites", [the spokesman for Music Industry Piracy Investigations (MIPI)] said, adding that MIPI would consider individual blogs on a "case-by-case basis as to whether it would be appropriate to take action".
Ms Heindl's message to Australians is clear: "If you are linking to copyrighted material in an unauthorised fashion, then you can be held liable for copyright infringement."
You need to take it with a grain of salt. As I said. Context is all.
That said, I stand by my criticisms of yesterday. "
"It's important to appreciate the limitations of this decision. On repeated occasions in recent times, judges of the Australian federal court have emphasised that whether a person is authorising infringement is a highly fact-dependent issue. That is, the judges say that it is a case-by-case analysis, and they really mean it. As I said at the time that the first instance judgment was handed down, just because a judge holds in this context that linking is authorisation of infringement, doesn't mean that linking in another context will be authorisation.
In other words, context is all.
In this Cooper case, you have to remember that Cooper:
- Set up a website visited by hundreds of thousands of people
- Set it up with the quite apparent aim of (a) allowing upload of links to MP3s, automatically, and (b) ensuring people could easily search for, and find, mp3 files they wanted
- Set it up to have lists constituting the Australian, UK, Billboard and other charts
So far as internet users and remote website operators were concerned, the website was in substance an invitation to use the hyperlinks provided and to add new links in order that sound recordings could be downloaded from remote websites, and a principal purpose of the website was to enable infringing copies of the downloaded sound recordings to be made.
That is what was held to be infringement by authorising - not just a blog with a single link to something unauthorised. It's closer to US-style Grokster-style inducement analysis (at least as outlined in the more sophisticated judgment of Kenny J) than a general ban on linking.
So when you see a quote like this:
"We don't make any distinctions between big websites or small websites", [the spokesman for Music Industry Piracy Investigations (MIPI)] said, adding that MIPI would consider individual blogs on a "case-by-case basis as to whether it would be appropriate to take action".
Ms Heindl's message to Australians is clear: "If you are linking to copyrighted material in an unauthorised fashion, then you can be held liable for copyright infringement."
You need to take it with a grain of salt. As I said. Context is all.
That said, I stand by my criticisms of yesterday. "
Wednesday, December 20, 2006
Post Office People
The Post Office has predictably come in for its usual perennial criticism in the wake the announcement that the price of stamps will be going up again.
We should, however, remember that there are still thousands of truly dedicated people working for the organisation and doing a great job in spite of the things that have been visited upon them by government, media and management.
In a classic illustration of how things get done when people care, I recently received an important parcel which had the wrong address and postcode on it. In fact the only things that were correct on the parcel were my name and the number of the house. Yet it still found its way to to its rightful destination, albeit a little late, thanks to my local postman recognising my name and other people in the Post Office chain caring enough to send it to some likely sorting offices along the way. No one in the Post Office gained by putting that extra effort in - if anything their targets on time for delivery were nominally damaged - but they still gave a enough of damn to get the thing through.
Well done and thanks to all concerned, especially my local postman who has always been terrific.
We should, however, remember that there are still thousands of truly dedicated people working for the organisation and doing a great job in spite of the things that have been visited upon them by government, media and management.
In a classic illustration of how things get done when people care, I recently received an important parcel which had the wrong address and postcode on it. In fact the only things that were correct on the parcel were my name and the number of the house. Yet it still found its way to to its rightful destination, albeit a little late, thanks to my local postman recognising my name and other people in the Post Office chain caring enough to send it to some likely sorting offices along the way. No one in the Post Office gained by putting that extra effort in - if anything their targets on time for delivery were nominally damaged - but they still gave a enough of damn to get the thing through.
Well done and thanks to all concerned, especially my local postman who has always been terrific.
The real meaning of the Wizard of Oz
I share Brian Tamanaha's complete surprise that Frank Baum's story The Wizard of Oz was originally written as a political allegory. (I saw the Judy Garland film before reading the book but loved both as a boy, not that it was something that any red blooded male would have openly admitted in a tough neighbourhood at the time).
There is at least a thick volume's worth of material to be filled with stories like this about children's literature and IP disputes in the genre. Maybe I should suggest that to my publishers as my next writing project? Here's what Tamanaha had to say:
"Every now and then I read something that comes as a complete surprise. You might have the same reaction to the following passage from Jack Weatherford's The History of Money (1997), which comes out of his discussion of the late nineteenth century debate over adding silver to the gold monetary standard:
I hesitate to sully a discovery that is fascinating for its own sake, but I will use this example to quickly make a serious (albeit tangential) point. The original meaning theory of constitutional interpretation has prominent contemporary advocates--including, famously, Justice Scalia--who point to solid political theory arguments in support. But we must be mindful of the elusiveness and haze that envelops original meanings. Unless we turn constitutional interpretation over to trained historians with ample resources and time (and even then there will be problems), our assumptions about original meaning will be precarious."
To make an even more tangential point in the context of what I call "digital decision making" in my book, policymakers dealing with large scale digital systems and technologies they don't understand, don't even come anywhere close to the competence of trained historians. If we are to be mindful of the elusiveness and haze Tamanaha notes here in relation to expert interpretation of original historical meanings, how much more so do we need to be in the deployment of high and wide impact digital systems of mass surveillance by people who have demonstrated little or no understanding of these systems.
There is at least a thick volume's worth of material to be filled with stories like this about children's literature and IP disputes in the genre. Maybe I should suggest that to my publishers as my next writing project? Here's what Tamanaha had to say:
"Every now and then I read something that comes as a complete surprise. You might have the same reaction to the following passage from Jack Weatherford's The History of Money (1997), which comes out of his discussion of the late nineteenth century debate over adding silver to the gold monetary standard:
The most memorable work of literature to come from the debate over gold and silver in the United States was The Wonderful Wizard of Oz, published in 1900, by journalist L. Frank Baum, who greatly distrusted the power of the city financiers and who supported a bimetallic dollar based on both gold and silver. Taking great literary license, he summarized and satirized the monetary debate and history of the era through a charming story about a naive but good Kansas farm girl named Dorothy, who represented the average rural American citizen. Baum seems to have based her character on the Populist orator Leslie Kelsey, nicknamed "the Kansas Tornado."I'm sure others know about this, and maybe I'm exposing my particular ignorance, but I had no idea that The Wizard of Oz was a political allegory. What makes this discovery especially jolting, for me at least, is that its meaning at the time--when many people would have recognized Baum's allusions--was so radically different from its taken-for-granted meaning today.
After the cyclone violently rips Dorothy and her dog out of Kansas and drops them in the East, Dorothy sets out on the gold road to fairyland, which Baum calls Oz, where the wicked witches and wizards of banking operate. Along the way she meets the Scarecrow, who represents the American farmer; the Tin Woodman, who represents the American factory worker; and the Cowardly Lion, who represents William Jennings Bryan. The party's march on Oz is a re-creation of the 1894 march of Coxey's Army, a group of unemployed men led by 'General' Jacob S. Coxey to demand another public issue of $500 million greenbacks and more work for common people...
I hesitate to sully a discovery that is fascinating for its own sake, but I will use this example to quickly make a serious (albeit tangential) point. The original meaning theory of constitutional interpretation has prominent contemporary advocates--including, famously, Justice Scalia--who point to solid political theory arguments in support. But we must be mindful of the elusiveness and haze that envelops original meanings. Unless we turn constitutional interpretation over to trained historians with ample resources and time (and even then there will be problems), our assumptions about original meaning will be precarious."
To make an even more tangential point in the context of what I call "digital decision making" in my book, policymakers dealing with large scale digital systems and technologies they don't understand, don't even come anywhere close to the competence of trained historians. If we are to be mindful of the elusiveness and haze Tamanaha notes here in relation to expert interpretation of original historical meanings, how much more so do we need to be in the deployment of high and wide impact digital systems of mass surveillance by people who have demonstrated little or no understanding of these systems.
Foolproof
I like this, by Brian Hayes in American Scientist, via Arts and Letters Daily, regarding the proof that the trisection of angles is impossible. (Warning: not recommended for maths-phobes)
"Mathematical proof is foolproof, it seems, only in the absence of fools...
Socrates, drawing figures in the sand, undertakes to coach an untutored slave boy, helping him to prove a special case of the Pythagorean theorem. I paraphrase very loosely:
"Mathematical proof is foolproof, it seems, only in the absence of fools...
Socrates, drawing figures in the sand, undertakes to coach an untutored slave boy, helping him to prove a special case of the Pythagorean theorem. I paraphrase very loosely:
Socrates: Here is a square with sides of length 2 and area equal to 4. If we double the area, to 8 units, what will the length of a side be?A purported trisection procedure is required to take an angle ? and produce ?/3. Since the procedure has to work with any angle, we can refute it by exhibiting just one angle that cannot be trisected. The standard example is 60 degrees. Suppose the vertex of a 60-degree angle is at the origin, and one side corresponds to the positive x axis. Then to trisect the angle you must draw a line inclined by 20 degrees to the x axis and passing through the origin.Boy: Umm, 4?
Socrates: Does 4 x 4 = 8?
Boy: Okay, maybe it's 3.
Socrates: Does 3 x 3 = 8?
Boy: I give up.
Socrates: Observe this line from corner to corner, which the erudite among us call a diagonal. If we erect a new square on the diagonal, note that one-half of the original square makes up one-fourth of the new square, and so the total area of the new square must be double that of the original square. Therefore the length of the diagonal is the length we were seeking, is it not?
Boy: Whatever...
To draw any line, all you need is two points lying on the line. In this case you already have one point, namely the origin. Thus the entire task of trisection reduces to finding one more point lying somewhere along the 20-degree line. Surely that must be easy! After all, there are infinitely many points on the line and you only need one of them. But the proof says it can't be done.
To see the source of the difficulty we can turn to trigonometry. If we knew the sine and cosine of 20 degrees, the problem would be solved; we could simply construct the point x=cos20, y=sin20. (Of course we need the exact values; approximations from a calculator or a trig table won't help.) We do know the sine and cosine of 60 degrees: The values are ?3/2 and 1/2. Both of these numbers can be constructed with ruler and compass. Furthermore, formulas relate the sine and cosine of any angle ? to the corresponding values for ?/3. The formulas yield the following equation (where for brevity the symbol u replaces the expression cos?/3):
cos? = 4u 3 - 3u.
For the 60-degree angle, with cos? = 1/2,the equation becomes 8u 3 - 6u = 1. Note that this is a cubic equation. That's the nub of the problem: No process of adding, subtracting, multiplying, dividing and taking square roots will ever solve the equation for the value of u."RIAA drop lawsuit v NY mum
The RIAA have decided, according to the Washington Post, to drop "its lawsuit against Patti Santangelo, a mother of five who became the best-known defendant in the industry's battle against music piracy." Though they are continuing with the action against two of her children.
Tuesday, December 19, 2006
What BlackBoard's patent tells you about them
Martin has been giving a keynote address outlining his concerns about BlackBoard's patent at a conference of BlackBoard users.
"I talked about web 2.0 and some of the usual VLE topics I have covered (succession, metaphors, future directions, etc). From a BB audience perspective the key slide was one that focused on the patent where I played the YouTube movie on software patents, gave some of Michael Feldstein’s interpretations of the patent, and linked it back to the succession model. The Blackboard company representatives in the audience looked a little unhappy with this, although slightly battle weary too – I suspect they are getting tired of talking about it. In the questions someone asked me about other patents and I outlined some of their dangers and why I considered them an ‘educational menace’. So, it was a good audience to raise that topic in (in many ways better than preaching to the converted at an open source conference, say). I think it is also another example of why it is such a dumb move on BB’s part. Without the patent I wouldn’t have said anything bad about them, I had a lot of time for them. What the patent does is effectively polarise users, forcing them in to mutually opposing camps. It has made me much more of an advocate of open source for example, and that reaction manifested across many HE institutions will ultimately do a good deal of harm to BB."
"I talked about web 2.0 and some of the usual VLE topics I have covered (succession, metaphors, future directions, etc). From a BB audience perspective the key slide was one that focused on the patent where I played the YouTube movie on software patents, gave some of Michael Feldstein’s interpretations of the patent, and linked it back to the succession model. The Blackboard company representatives in the audience looked a little unhappy with this, although slightly battle weary too – I suspect they are getting tired of talking about it. In the questions someone asked me about other patents and I outlined some of their dangers and why I considered them an ‘educational menace’. So, it was a good audience to raise that topic in (in many ways better than preaching to the converted at an open source conference, say). I think it is also another example of why it is such a dumb move on BB’s part. Without the patent I wouldn’t have said anything bad about them, I had a lot of time for them. What the patent does is effectively polarise users, forcing them in to mutually opposing camps. It has made me much more of an advocate of open source for example, and that reaction manifested across many HE institutions will ultimately do a good deal of harm to BB."
How to fix almost anything
Jonathan Rowe suggests that the most effective way to ensure serious problems get addressed is to ensure that wealthy and powerful people suffer the consequences of those problems. That way they have a direct incentive to tackle them.
"To put this another way, when big shots can glide through life in gilded cocoons, it breaks the social feedback loop. Those in a position to do something about a problem do not feel an urgency to do so...
We naturally get worked up about the things that rattle our own cages. Potentially it is a mighty social force; but it goes untapped when the rich and powerful are exempt from the problems that most Americans face. If every CEO in America had to fly economy class, send their children to public school, and deal with computer help lines themselves rather than have gofers do it for them, the quality of life in America would increase measurably. If the very rich had trouble getting medical insurance they would show as much concern for that problem as they do for the diseases they themselves contract. This basically is the thinking behind Rep. Charles Rangel’s proposal to revive the draft. Imagine Dick Cheney speaking at one of those mega-buck Republican fundraisers, to an audience worried that their own offspring might be drafted. The bellicosity and swagger over an Iraq would be quite a bit less. "
"To put this another way, when big shots can glide through life in gilded cocoons, it breaks the social feedback loop. Those in a position to do something about a problem do not feel an urgency to do so...
We naturally get worked up about the things that rattle our own cages. Potentially it is a mighty social force; but it goes untapped when the rich and powerful are exempt from the problems that most Americans face. If every CEO in America had to fly economy class, send their children to public school, and deal with computer help lines themselves rather than have gofers do it for them, the quality of life in America would increase measurably. If the very rich had trouble getting medical insurance they would show as much concern for that problem as they do for the diseases they themselves contract. This basically is the thinking behind Rep. Charles Rangel’s proposal to revive the draft. Imagine Dick Cheney speaking at one of those mega-buck Republican fundraisers, to an audience worried that their own offspring might be drafted. The bellicosity and swagger over an Iraq would be quite a bit less. "
Subscribe to:
Posts (Atom)