Friday, September 21, 2007
RIAA Sends Another Wave Of Settlement Letters
RIAA Sends Another Wave Of Settlement Letters Not a lot more to say about that really that hasn't already been said many times before.
Family sues Virgin Mobile over use of Texas teen's photo in advertisement
Here's an interesting case. It seems Virgin Mobile in Australia used a photo from Flickr in their adverts. The photographer had posted the photo with a creative commons license. But the family of the girl, Alison Chang, in the photo are suing Virgin for causing her grief and humiliation.
"The picture of 16-year-old Chang flashing a peace sign was taken at an April church car wash by Alison's youth counselor, who posted it that day on his Flickr page, according to Alison's brother, Damon. In the ad, Virgin Mobile printed one of its campaign slogans, "Dump your pen friend," over Alison's picture.
The ad also says "Free text virgin to virgin" at the bottom.
The experience damaged Alison's reputation and exposed her to ridicule from her peers and scrutiny from people who can now Google her, the family charged in the lawsuit."
The case raise some quite tricky questions about intellectual property, attribution, damage to reputation and privacy. I suspect it is one of those that will be settled out of court but worth watching.
"The picture of 16-year-old Chang flashing a peace sign was taken at an April church car wash by Alison's youth counselor, who posted it that day on his Flickr page, according to Alison's brother, Damon. In the ad, Virgin Mobile printed one of its campaign slogans, "Dump your pen friend," over Alison's picture.
The ad also says "Free text virgin to virgin" at the bottom.
The experience damaged Alison's reputation and exposed her to ridicule from her peers and scrutiny from people who can now Google her, the family charged in the lawsuit."
The case raise some quite tricky questions about intellectual property, attribution, damage to reputation and privacy. I suspect it is one of those that will be settled out of court but worth watching.
Fashion and the piracy paradox
James Surowiecki has been applying his wisdom of crowds mind to intellectual property in the fashion industry.
"In 1932, a group of American fashion manufacturers found themselves beset by a proliferation of cheap knockoffs. Designs, then as now, were not protected by patents or copyrights, so the manufacturers decided to take direct action to stop the copying. They set up the Fashion Originators Guild of America to monitor retailers and keep track of original designs; if you look at vintage dresses from the thirties, you can find labels reading “A registered original design with Fashion Originators Guild.” Retailers selling knockoffs were “red-carded,” and guild members wouldn’t sell their merchandise to red-carded stores. This was unpopular with the retailers, but it seems to have put a damper on the copying. The only hitch in the plan was that it was illegal: in 1941, the Supreme Court ruled that the manufacturers’ arrangement violated antitrust law, and the knockoff artists stayed in business."
He (or at least two law professor's whose paper he's been reading) reckons that obsolescence in the industry only comes about through widespread copying which then provides an incentive for designers to produce the next big thing.
"More striking, a recent paper by the law professors Kal Raustiala and Christopher Sprigman suggests that weak intellectual-property rules, far from hurting the fashion industry, have instead been integral to its success. The professors call this effect “the piracy paradox.”
The paradox stems from the basic dilemma that underpins the economics of fashion: for the industry to keep growing, customers must like this year’s designs, but they must also become dissatisfied with them, so that they’ll buy next year’s."
"In 1932, a group of American fashion manufacturers found themselves beset by a proliferation of cheap knockoffs. Designs, then as now, were not protected by patents or copyrights, so the manufacturers decided to take direct action to stop the copying. They set up the Fashion Originators Guild of America to monitor retailers and keep track of original designs; if you look at vintage dresses from the thirties, you can find labels reading “A registered original design with Fashion Originators Guild.” Retailers selling knockoffs were “red-carded,” and guild members wouldn’t sell their merchandise to red-carded stores. This was unpopular with the retailers, but it seems to have put a damper on the copying. The only hitch in the plan was that it was illegal: in 1941, the Supreme Court ruled that the manufacturers’ arrangement violated antitrust law, and the knockoff artists stayed in business."
He (or at least two law professor's whose paper he's been reading) reckons that obsolescence in the industry only comes about through widespread copying which then provides an incentive for designers to produce the next big thing.
"More striking, a recent paper by the law professors Kal Raustiala and Christopher Sprigman suggests that weak intellectual-property rules, far from hurting the fashion industry, have instead been integral to its success. The professors call this effect “the piracy paradox.”
The paradox stems from the basic dilemma that underpins the economics of fashion: for the industry to keep growing, customers must like this year’s designs, but they must also become dissatisfied with them, so that they’ll buy next year’s."
NYT drop subscription fees
The NYT are going to drop their subscription fees. It seems their bean counters have been doing some sums and figured out ad revenues from increased traffic to a 'free' site would be worth more than subscription fees.
Tuesday, September 18, 2007
WSJ on Microsoft's EU Waterloo
The Wall Street Journal folk are less than impressed that the EU court of first instance rejected Microsoft's appeal against the EU's antitrust ruling. (Full article only available to subscribers)
"The ruling by the European Union's second most powerful court was a judicial slam dunk for Brussels. The court upheld the European Commission's 2004 judgment that Microsoft had abused the dominance of its Windows operating system... and affirmed the record €497 million fine that Brussels levied on the company.
The decision was clear and emphatic... We can't think of anything else good to say about this outcome...
Microsoft's general counsel, Brad Smith, points out that Apple's iPod dominates the MP3 player market, in which Microsoft's Zune is the underdog, and that Google's search engine has whipped Microsoft's MSN and all other comers... Mr. Smith seems to be implying that two can play at this game of making "strategic complaints."
Firms that do so risk little of their own time, energy or money. Once it takes up a case, the Commission does the heavy lifting. The targeted companies incur huge costs to defend themselves. European regulators, and now judges, apparently believe that the proper venue for competition among technology companies is in the courtrooms rather than research labs. Everyone will be worse off, except, of course, lawyers."
Update: The EU Commissioner is not very happy with the DOJ for criticised the Microsoft decision in the EU Court of First Instance.
"A U.S. official's criticism of a European Union court ruling dismissing Microsoft's monopoly abuse appeal was "totally unacceptable," EU antitrust chief Neelie Kroes said Wednesday.
Kroes said it was wrong for a representative of the U.S. administration to criticize "an independent court of law outside its jurisdiction."
"The European Commission does not pass judgment on rulings by U.S. courts and we expect the same degree of respect from U.S. authorities on rulings by EU courts," she said. "It is absolutely not done.""
"The ruling by the European Union's second most powerful court was a judicial slam dunk for Brussels. The court upheld the European Commission's 2004 judgment that Microsoft had abused the dominance of its Windows operating system... and affirmed the record €497 million fine that Brussels levied on the company.
The decision was clear and emphatic... We can't think of anything else good to say about this outcome...
Microsoft's general counsel, Brad Smith, points out that Apple's iPod dominates the MP3 player market, in which Microsoft's Zune is the underdog, and that Google's search engine has whipped Microsoft's MSN and all other comers... Mr. Smith seems to be implying that two can play at this game of making "strategic complaints."
Firms that do so risk little of their own time, energy or money. Once it takes up a case, the Commission does the heavy lifting. The targeted companies incur huge costs to defend themselves. European regulators, and now judges, apparently believe that the proper venue for competition among technology companies is in the courtrooms rather than research labs. Everyone will be worse off, except, of course, lawyers."
Update: The EU Commissioner is not very happy with the DOJ for criticised the Microsoft decision in the EU Court of First Instance.
"A U.S. official's criticism of a European Union court ruling dismissing Microsoft's monopoly abuse appeal was "totally unacceptable," EU antitrust chief Neelie Kroes said Wednesday.
Kroes said it was wrong for a representative of the U.S. administration to criticize "an independent court of law outside its jurisdiction."
"The European Commission does not pass judgment on rulings by U.S. courts and we expect the same degree of respect from U.S. authorities on rulings by EU courts," she said. "It is absolutely not done.""
Volkswagen and the Nazi YouTube parody
According to Wired magazine, Volkswagen are having a legal dispute with YouTube.
"A legal spat between YouTube and Volkswagen is throwing light on the increasing copyright surveillance of social networking sites.
Volkswagen has filed a subpoena seeking the identity of a YouTube user who posted a Nazi-themed parody of a recent VW Golf commercial. Volkswagen's move underscores the privacy risks to a blossoming community of users on sites like YouTube and Yahoo Video, and social-networking sites like Facebook and MySpace."
"A legal spat between YouTube and Volkswagen is throwing light on the increasing copyright surveillance of social networking sites.
Volkswagen has filed a subpoena seeking the identity of a YouTube user who posted a Nazi-themed parody of a recent VW Golf commercial. Volkswagen's move underscores the privacy risks to a blossoming community of users on sites like YouTube and Yahoo Video, and social-networking sites like Facebook and MySpace."
Monday, September 17, 2007
Neglected diseases, differential pricing and drug patents
Nature had some interesting articles on incentives for development and distribution of and access to drugs for neglected diseases in a recent edition. See in particular:
Neglected Diseases: At what price? by Patricia M. Danzon
Neglected Diseases: The road to recovery by Carlos M. Morel et al
and
Neglected Diseases: Patent sense by Paul Herrling
Thanks to Thiru Balasubramaniam via the A2K list for the pointer.
Neglected Diseases: At what price? by Patricia M. Danzon
Neglected Diseases: The road to recovery by Carlos M. Morel et al
and
Neglected Diseases: Patent sense by Paul Herrling
Thanks to Thiru Balasubramaniam via the A2K list for the pointer.
Microsoft lose the latest round in EU
Microsoft has lost its appeal against the EU's antitrust ruling in the EU's court of first instance, right off the back of numerous US states requesting that the overseer of the company's US antitrust agreement extend her supervision of the company due to its approach to compliance on that side of the pond. Don't expect this to be the end of the story. Microsoft's lawyers are very smart.
Update: The FFII agree that Microsoft's lawyers are very smart:
Update: The FFII agree that Microsoft's lawyers are very smart:
The Foundation for a Free Information Infrastructure (FFII) says that Microsoft was expecting the 17 September verdict of the EU's anti-trust case, and will exploit software patents to keep its monopoly grip on the global IT market.
FFII president Pieter Hintjens explains, "The decision seems positive but it is five years out of date. During that time, Microsoft has lobbied for software patents in Europe and bought patents on many trivial concepts. It has claimed patent violations against Linux, put patent timebombs into its formats and interfaces, and turned fear of patents into a core part of its business strategy. It will now open its formats, because that lets it extend its software patent franchise even further."
EU Commission: UK failed to implement a third of the Data Protection Directive
Following the EU's investigation the UK's implementation of the data protection directive, the Commission has surprisingly expressed dissatisfaction with the UK approach to about a third of the Directive.
"The articles of the Directive which the Commission claims have not been implemented properly are articles 2, 3, 8, 10, 11, 12, 13, 22, 23, 25 and 28 – just under a third of the 34 articles in the Directive.
These Articles relate to: the definitions used in the Directive (e.g. the meaning of personal data); the scope of the Directive's application to manual files; the conditions when sensitive personal data can be processed; the fair processing notices give to individuals; the rights granted to data subjects; the application of exemptions from these rights; the ability of individuals to seek a remedy when there is a breach; the liability of organisations for breaches of data protection law; the transfer of personal data outside European Union; and the powers of the Information Commissioner.
Data Protection expert Dr Chris Pounder of Pinsent Masons, the law firm behind OUT-LAW.COM, said that the extent of the objections reflects official attitude towards data protection policy. "All UK Governments involved in implementing the Directive have had a policy of minimising the Data Protection Directive's effect," he said. "The number of problems raised by the Commission seem to indicate that the UK Government may have misjudged the situation and minimised the effect of too many obligations"."
Thanks to Glyn via ORG for the pointer. The UK government had until recently been keeping the details of the EU's complaints under wraps but it seems Out-Law got the information via a freedom of information request. It's a coincidence that the details should begin to emerge now since I had just posted a note about loopholes in privacy legislation to the ORG list in recent days :
"The idea that regulation is a cure for privacy problems is widely held but I don't subscribe to it.
The EU and its member states have mountains of privacy regulations. Frequently when these regulations come under pressure, such as with the EU-US safe harbour provisions for transfer of personal data or the PNR agreement with the US, they buckle. In addition there are numerous loopholes that dedicated privacy regulation evaders can drive a coach and horses through. Even where the loopholes don't apply and in the face of the efforts of people like the Information Commissioner to explain the dangers and sound legal opinions to the effect that they will breach existing privacy regulations, the government still push through ID cards, the Children's Index database ContactPoint, data retention and an unending stream of terror, crime, immigration and other laws and regulations that undermine current protections (at best, though some would argue they destroy the existing protections completely).
Privacy is a complex issue and can't be addressed through regulation alone any more than complex systemic messes like terrorism or immigration can be solved by regulation (and imagined magical computer systems that keep everyone under surveillance then point out the
baddies) alone. Privacy levels and awareness are an emergent property of a whole series of complicated interracting and dynamic factors, relating to social, psychological, market, environmental, technological (in the Lessig architectural sense or possibly more accurately in the Kim Cameron/ Stefan Brands/ Caspar Bowden/ Ben Laurie/ etc. architectural sense) prevailing winds (and I'm sure members of the list can think of many more).
Apologies for the rant."
"The articles of the Directive which the Commission claims have not been implemented properly are articles 2, 3, 8, 10, 11, 12, 13, 22, 23, 25 and 28 – just under a third of the 34 articles in the Directive.
These Articles relate to: the definitions used in the Directive (e.g. the meaning of personal data); the scope of the Directive's application to manual files; the conditions when sensitive personal data can be processed; the fair processing notices give to individuals; the rights granted to data subjects; the application of exemptions from these rights; the ability of individuals to seek a remedy when there is a breach; the liability of organisations for breaches of data protection law; the transfer of personal data outside European Union; and the powers of the Information Commissioner.
Data Protection expert Dr Chris Pounder of Pinsent Masons, the law firm behind OUT-LAW.COM, said that the extent of the objections reflects official attitude towards data protection policy. "All UK Governments involved in implementing the Directive have had a policy of minimising the Data Protection Directive's effect," he said. "The number of problems raised by the Commission seem to indicate that the UK Government may have misjudged the situation and minimised the effect of too many obligations"."
Thanks to Glyn via ORG for the pointer. The UK government had until recently been keeping the details of the EU's complaints under wraps but it seems Out-Law got the information via a freedom of information request. It's a coincidence that the details should begin to emerge now since I had just posted a note about loopholes in privacy legislation to the ORG list in recent days :
"The idea that regulation is a cure for privacy problems is widely held but I don't subscribe to it.
Privacy is a complex issue and can't be addressed through regulation alone any more than complex systemic messes like terrorism or immigration can be solved by regulation (and imagined magical computer systems that keep everyone under surveillance then point out the
baddies) alone. Privacy levels and awareness are an emergent property of a whole series of complicated interracting and dynamic factors, relating to social, psychological, market, environmental, technological (in the Lessig architectural sense or possibly more accurately in the Kim Cameron/ Stefan Brands/ Caspar Bowden/ Ben Laurie/ etc. architectural sense) prevailing winds (and I'm sure members of the list can think of many more).
Apologies for the rant."
MediaDefender Internal Emails leaked on BitTorrent
From TorrentFreak:
"When we reported in July that an Anti-Piracy Gang Launches their own Video Download Site to Trap People and that the company was called Media Defender and, as anyone who aims to be a credible news resource would, we checked and double checked our sources. We said, with some confidence:
Media Defender, a notorious anti piracy gang working for the MPAA, RIAA and several independent media production companies, just launched their very own video upload service called “miivi.com”. The sole purpose of the site is to trap people into uploading copyrighted material, and bust them for doing so.
However, in comments made to Ars technica, Media Defender’s Randy Saaf chose to rubbish our claims, calling it an ‘accidentally un-secured internal project’.
From the emails we cannot be sure that it’s an entrapment site or that it is related to the MPAA (perhaps it’s a legit a P2P video client?), but it does look suspicious.
Unfortunately for Media Defender - a company dedicated to mitigating the effects of internet leaks - they can do nothing about being the subject of the biggest BitTorrent leak of all time. Over 700mb of their own internal emails, dating back over 6 months have been leaked to the internet in what will be a devastating blow to the company. Many are very recent, having September 2007 dates and the majority involve the most senior people in the company. Apparently this is not the first time that a MediaDefender email leaked onto the Internet."
Interesting insight into the kind of tactics being used by the entertainment industry to combat online copying and distribution of their wares. It also raises loads of interesting legal questions. If this one is genuine, for example:
"Dylan,
Another thing we can do to increase Google and other search engine traffic is to get more link-ins. At the next MiiVi meeting, I’m going to ask Randy for permission to incentivize people to link-in a MiiVi video on their MySpace. Colin is already doing this and it helps the word-of-mouth spread, even if the link-ins are nominal. I’m not sure what we could do in the link-in regard early on, but getting the cumulative ~1000+ MySpace friends of MediaDefender employees to see MiiVi link-ins can’t hurt….
Colin — start coming up with a list the list of keywords and descriptors for hidden metadata entries, per Dylan’s e-mail below.
Thanks,
Ben"
Wouldn't it amount to entrapment? It certainly suggests a honeypot at least, which MediaDefender has apparently denied. The very Mr Randy Saaf who made the denials though has apparently been actively trying to hide teh company's connection with the honeypot site.
"From: Randy Saaf
Sent: Wed 6/13/2007 12:54 AM
To: Colin Keller
Cc: Ben Grodsky; Steve Lyons; Jay Mairs
Subject: miivi emails
Colin:
Set up your email so that you always reply with a ckeller@miivi.com, dmca@miivi.com, or an info@miivi.com address respectively. I don’t want MediaDefender anywhere in your email replies to people contacting Miivi. Steve and Ben can help you set up your email for this. Make sure MediaDefender can not be seen in any of the hidden email data crap that smart people can look in.
I am setting up ckeller@miivi.com to forward to ckeller@mediadefender.com.
R"
This one could run for a while.
"When we reported in July that an Anti-Piracy Gang Launches their own Video Download Site to Trap People and that the company was called Media Defender and, as anyone who aims to be a credible news resource would, we checked and double checked our sources. We said, with some confidence:
Media Defender, a notorious anti piracy gang working for the MPAA, RIAA and several independent media production companies, just launched their very own video upload service called “miivi.com”. The sole purpose of the site is to trap people into uploading copyrighted material, and bust them for doing so.
However, in comments made to Ars technica, Media Defender’s Randy Saaf chose to rubbish our claims, calling it an ‘accidentally un-secured internal project’.
From the emails we cannot be sure that it’s an entrapment site or that it is related to the MPAA (perhaps it’s a legit a P2P video client?), but it does look suspicious.
Unfortunately for Media Defender - a company dedicated to mitigating the effects of internet leaks - they can do nothing about being the subject of the biggest BitTorrent leak of all time. Over 700mb of their own internal emails, dating back over 6 months have been leaked to the internet in what will be a devastating blow to the company. Many are very recent, having September 2007 dates and the majority involve the most senior people in the company. Apparently this is not the first time that a MediaDefender email leaked onto the Internet."
Interesting insight into the kind of tactics being used by the entertainment industry to combat online copying and distribution of their wares. It also raises loads of interesting legal questions. If this one is genuine, for example:
"Dylan,
Another thing we can do to increase Google and other search engine traffic is to get more link-ins. At the next MiiVi meeting, I’m going to ask Randy for permission to incentivize people to link-in a MiiVi video on their MySpace. Colin is already doing this and it helps the word-of-mouth spread, even if the link-ins are nominal. I’m not sure what we could do in the link-in regard early on, but getting the cumulative ~1000+ MySpace friends of MediaDefender employees to see MiiVi link-ins can’t hurt….
Colin — start coming up with a list the list of keywords and descriptors for hidden metadata entries, per Dylan’s e-mail below.
Thanks,
Ben"
Wouldn't it amount to entrapment? It certainly suggests a honeypot at least, which MediaDefender has apparently denied. The very Mr Randy Saaf who made the denials though has apparently been actively trying to hide teh company's connection with the honeypot site.
"From: Randy Saaf
Sent: Wed 6/13/2007 12:54 AM
To: Colin Keller
Cc: Ben Grodsky; Steve Lyons; Jay Mairs
Subject: miivi emails
Colin:
Set up your email so that you always reply with a ckeller@miivi.com, dmca@miivi.com, or an info@miivi.com address respectively. I don’t want MediaDefender anywhere in your email replies to people contacting Miivi. Steve and Ben can help you set up your email for this. Make sure MediaDefender can not be seen in any of the hidden email data crap that smart people can look in.
I am setting up ckeller@miivi.com to forward to ckeller@mediadefender.com.
R"
This one could run for a while.
Thursday, September 13, 2007
Jack Goldsmith on 'The Terror Presidency'
NPR has a remarkable interview (accessible here) with Jack Goldsmith on some controversial events and processes in the Bush administration during his tenure as the Department of Justice's Office of Legal Counsel.
No checks and balances in the US in time of war
Jack Balkan says:
"The sad lesson of the past year is that the modern Presidency-- armed with control over military intelligence and a large standing army-- can have its way in matters of war even if the President's policies are very unpopular, and there is very little Congress can do to stop it.
This lesson should be abstracted from one's feelings about the current occupant of the White House. George W. Bush is a failure-- I won't mince words-- but even a failed President can do pretty much what he wants in war given the way our constitutional system has developed following the Second World War and the rise of the National Security State. The ascendant National Surveillance State, if anything, makes the President's hand even stronger.
We are moving, or more correctly, we have already moved, toward a system of one person rule on matters of war and peace. It is a very dangerous tendency in American constitutionalism. If you think that the Iraq episode has been a disaster, imagine an even more foolhardy and reckless President taking even greater and more dangerous risks. The Iraq war demonstrates that, in the context of modern politics and contemporary security threats, the framers' original system of checks and balances has utterly failed us."
"The sad lesson of the past year is that the modern Presidency-- armed with control over military intelligence and a large standing army-- can have its way in matters of war even if the President's policies are very unpopular, and there is very little Congress can do to stop it.
This lesson should be abstracted from one's feelings about the current occupant of the White House. George W. Bush is a failure-- I won't mince words-- but even a failed President can do pretty much what he wants in war given the way our constitutional system has developed following the Second World War and the rise of the National Security State. The ascendant National Surveillance State, if anything, makes the President's hand even stronger.
We are moving, or more correctly, we have already moved, toward a system of one person rule on matters of war and peace. It is a very dangerous tendency in American constitutionalism. If you think that the Iraq episode has been a disaster, imagine an even more foolhardy and reckless President taking even greater and more dangerous risks. The Iraq war demonstrates that, in the context of modern politics and contemporary security threats, the framers' original system of checks and balances has utterly failed us."
Educators are on the wrong side of the copyright wars
In my nose-to-the-grindstone-administrative-box-ticking frenzy of recent weeks I failed to notice this piece in Reason magazine putting forward the theory that Educators are on the wrong side of the copyright wars
"Last month, the U.S. Senate passed legislation enlisting colleges in the effort to police peer-to-peer networks and file-sharing, in order to prevent "piracy" by students of music, movies, and for that matter, books.
But this is a particularly egregious case because it enforces rules that are specifically inimical to education, and that run contrary the fundamental mission of a college or university—the sharing of information...the very essence of a university ought to place it in fierce opposition to demands that it police its students for the excessive sharing of information. On the contrary, colleges and universities ought to be working toward an environment in which information can be shared with more freedom."
"Last month, the U.S. Senate passed legislation enlisting colleges in the effort to police peer-to-peer networks and file-sharing, in order to prevent "piracy" by students of music, movies, and for that matter, books.
One might wonder exactly why Senate Majority Leader Harry Reid—who introduced the amendment to the Higher Education Reauthorization Act, then tempered it when there was an outcry from college administrators—is concerned about campus file sharing, other than a general commitment to fight crime. A cynic might suggest the entertainment industry's considerable patronage of the Democratic Party.
According to The Chronicle of Higher Education, Reid's measure "called on the Recording Industry Association of America and the Motion Picture Association of America to draft annual lists of the 25 colleges receiving the most notices of copyright infringement. Those colleges would face a choice: Either use technological tools to block peer-to-peer file sharing, or risk forfeiting federal student aid.In other words, colleges would be put under the supervision of the RIAA and MPAA...But this is a particularly egregious case because it enforces rules that are specifically inimical to education, and that run contrary the fundamental mission of a college or university—the sharing of information...the very essence of a university ought to place it in fierce opposition to demands that it police its students for the excessive sharing of information. On the contrary, colleges and universities ought to be working toward an environment in which information can be shared with more freedom."
Safe harbours for Internet intermediaries
Mark Lemley has written a fascinating paper on the patchwork of safety nets available to Internet intermediaries like telcos and ISPs to avoid liablity for the dodgy behaviour of their subscribers or remotely linked, with or without knowledge and aforethought, associates.
Abstract:
"Internet intermediaries - service providers, Web hosting companies, Internet backbone providers, online marketplaces, and search engines - process hundreds of millions of data transfers every day, and host or link to literally tens of billions of items of third party content.
Some of this content is illegal. In the last 12 years, both Congress and the courts have concluded that Internet intermediaries should not be liable for a wide range of content posted or sent through their systems by another. The reasoning behind these immunities is impeccable: if Internet intermediaries were liable every time someone posted problematic content on the Internet, the resulting threat of liability and effort at rights clearance would debilitate the Internet.
While the logic of some sort of safe harbor for Internet intermediaries is clear, the actual content of those safe harbors is not. Rather, the safe harbors actually in place are a confusing and illogical patchwork. For some claims, the safe harbors are absolute. For others, they preclude damages liability but not injunctive relief. For still others they are dependent on the implementation of a �notice and takedown� system. And for at least a few types of claims, there is no safe harbor at all. This patchwork makes no sense. In this article, I suggest that it be replaced with a uniform safe harbor rule. A single, rationally designed safe harbor based on the trademark model would not only permit plaintiffs the relief they need while protecting Internet intermediaries from unreasonable liability, but would also serve as a much needed model for the rest of the world, which has yet to understand the importance of intermediaries to a vibrant Internet."
Thanks to Derek Slater for the link.
Abstract:
"Internet intermediaries - service providers, Web hosting companies, Internet backbone providers, online marketplaces, and search engines - process hundreds of millions of data transfers every day, and host or link to literally tens of billions of items of third party content.
Some of this content is illegal. In the last 12 years, both Congress and the courts have concluded that Internet intermediaries should not be liable for a wide range of content posted or sent through their systems by another. The reasoning behind these immunities is impeccable: if Internet intermediaries were liable every time someone posted problematic content on the Internet, the resulting threat of liability and effort at rights clearance would debilitate the Internet.
While the logic of some sort of safe harbor for Internet intermediaries is clear, the actual content of those safe harbors is not. Rather, the safe harbors actually in place are a confusing and illogical patchwork. For some claims, the safe harbors are absolute. For others, they preclude damages liability but not injunctive relief. For still others they are dependent on the implementation of a �notice and takedown� system. And for at least a few types of claims, there is no safe harbor at all. This patchwork makes no sense. In this article, I suggest that it be replaced with a uniform safe harbor rule. A single, rationally designed safe harbor based on the trademark model would not only permit plaintiffs the relief they need while protecting Internet intermediaries from unreasonable liability, but would also serve as a much needed model for the rest of the world, which has yet to understand the importance of intermediaries to a vibrant Internet."
Thanks to Derek Slater for the link.
Where are the UK's public intellectuals?
The Vice Chancellor of Buckingham University, Terence Keakey, has been lamenting the negative and distorted incentives generated by the 'Research Assessment Exercise' (which most people outside the higher education sector will be blissfully oblivious to) and its impact on the funding of universities.
"The Research Assessment Exercise is killing British universities as centres of public thought. Once, British universities fostered some of the most important public intellectuals in the world, but today British academics are rarely known outside their disciplines.The most influential living intellectual in the world is Noam Chomsky; in 2005, the readers of the British magazine Prospect voted him precisely that...
He made the leap from brilliant researcher to public intellectual exactly 40 years ago, in 1967, when he published his essay "The Responsibility of Intellectuals" in the New York Review of Books. That responsibility, Chomsky wrote, is to "expose the lies of government". Chomsky places that responsibility on his fellow academics...
Over the past 40 years, Chomsky has campaigned against American foreign policy, but it has been primarily as an academic that he has made his impact, showing by careful scholarship that American foreign policy is institutionally dishonest...
...today most people know that everything George Bush says is untrue...
MIT's support for Chomsky has been solid: even when it was receiving 80 per cent of its research income from the Department of Defense, Chomsky could launch his jeremiads without internal criticism.
If our universities are to reassume their proper role of speaking truth unto power, they will have to value scholarship and public engagement as strongly as they now value research. We should, as a first step, ditch the RAE and identify proper funds and proper incentives for leisure and thought at work."
On the positive side he has a point about the paymaster dictating the agenda, which doesn't fit too comfortably with he role of the academic to explore truths (rather than expose lies). Though a campaign to facilitate leisure time (by which he really means scholarship and thinking time) for academics is unlikely to win too many advocates in modern media circles; and I suspect his satirical claim that everything George Bush says is false may well be taken out of context should anyone in Whitehall or Washington come across this call for a change to university funding structures.
"The Research Assessment Exercise is killing British universities as centres of public thought. Once, British universities fostered some of the most important public intellectuals in the world, but today British academics are rarely known outside their disciplines.The most influential living intellectual in the world is Noam Chomsky; in 2005, the readers of the British magazine Prospect voted him precisely that...
He made the leap from brilliant researcher to public intellectual exactly 40 years ago, in 1967, when he published his essay "The Responsibility of Intellectuals" in the New York Review of Books. That responsibility, Chomsky wrote, is to "expose the lies of government". Chomsky places that responsibility on his fellow academics...
Over the past 40 years, Chomsky has campaigned against American foreign policy, but it has been primarily as an academic that he has made his impact, showing by careful scholarship that American foreign policy is institutionally dishonest...
...today most people know that everything George Bush says is untrue...
MIT's support for Chomsky has been solid: even when it was receiving 80 per cent of its research income from the Department of Defense, Chomsky could launch his jeremiads without internal criticism.
But MIT is an independent university, and there is no RAE in America. Consequently, MIT's physics department can process as many defence grants as it wants, but the linguistics department, where Chomsky works, is free from governmental pressure...
The President of MIT answers solely to the trustees, who are alumni, donors, and proud of MIT's academic independence. But the real master – and paymaster – of a British vice-chancellor is the Government. Of course a troublesome Chomsky in Britain would be discouraged...If our universities are to reassume their proper role of speaking truth unto power, they will have to value scholarship and public engagement as strongly as they now value research. We should, as a first step, ditch the RAE and identify proper funds and proper incentives for leisure and thought at work."
On the positive side he has a point about the paymaster dictating the agenda, which doesn't fit too comfortably with he role of the academic to explore truths (rather than expose lies). Though a campaign to facilitate leisure time (by which he really means scholarship and thinking time) for academics is unlikely to win too many advocates in modern media circles; and I suspect his satirical claim that everything George Bush says is false may well be taken out of context should anyone in Whitehall or Washington come across this call for a change to university funding structures.
Latest EDRI-Gram
The latests EDRI-Gram is available. Some highlights (see original for links):
The European Court of Human Rights could influence the UK DNA database
12 September, 2007 » Privacy | Biometrics
Sir Stephen Sedley has recently proposed the enlargement of the DNA database in UK to cover the entire population and visitors that stay in UK even for a week, under the argument of creating a fairer system and eliminating the ethnical unbalance in the present database. But a case brought by 2 English people to the European Court of Human Rights (ECHR) could change a lot in how the database will operate.
The UK DNA database is one of the largest in the world covering data from everybody having had anything to do with any crime, minor or major, guilty or not. According to Sadley, the database is biased against ethnic minorities. "It means where there is ethnic profiling going on disproportionate numbers of ethnic minorities get onto the database. It also means that a great many people who are walking the streets and whose DNA would show them guilty of crimes, go free."
The proposal met opposition from the Prime Minister who believes that would raise civil liberties concerns but also complicated logistical issues.
Shami Chakrabarti, director of human rights organization Liberty, also said that a database for everybody in the country was "a chilling proposal, ripe for indignity, error and abuse".
The present UK DNA database is already raising issues related to the way people's data are included in it. Shadow home secretary David Davis considers the system is arbitrary and erratic. The highest concern is related to the fact that the data of people proven innocent cannot be removed from the database. And this is exactly what has triggered a case at the ECHR, that could change the whole situation.
The case was brought in front of ECHR by Michael Marper and a teenager, known as S, both arrested in 2001, the former on harassment charges and the latter with attempted robbery. They were both cleared and with no criminal records. In 2002 they required their data to be removed from the Home Office database but the Court of Appeal ruled against it. Among the appeal judges that heard the case was Sir Stephen Sedley that proposed a "universal DNA database" even in that judgment.
Mr Marper and the juvenile argued that keeping their fingerprints and DNA samples was an infringement of their private life rights as per Article 8 of the European Convention on Human Rights. Their concern is related mostly to the possible future misuse of their data.
The situation seems to be now in the hands of ECHR. A ruling by ECHR against the British Government could not only stop Lord Justice's proposal to enlarge the DNA database but also lead to the destruction of the DNA and fingerprint evidence of people that have been found innocent. The case is considered important by the judges in Strasbourg as they have sent the case before the grand chamber, because it raises a serious problem affecting the interpretation of the European Convention on Human Rights.
"This decision by the European Court of Human Rights gives us significant hope that these cases will finally result in a massive change in the law - providing protection for those acquitted of crimes against their fingerprints and DNA samples being kept, putting them on a level footing with those not previously accused of any crimes (...) We think this will be one of the most important human rights challenges the court has grappled with in recent years" stated Peter Mahy, a civil liberties specialist at Sheffield-based Howells who represent Marper and "S".
All UK 'must be on DNA database' (5.09.2007)
http://news.bbc.co.uk/1/hi/uk/6979138.stm
Plan to put everyone in DNA database hinges on human rights case (7.09.2007)
http://www.out-law.com//default.aspx?page=8455
Europe to rule on whether police can keep DNA of innocent people (8.09.2007)
http://news.independent.co.uk/uk/legal/article2941849.ece
EDRI-gram : UK Home Office plans to fingerprint children starting 11 (14.03.2007)
http://www.edri.org/edrigram/number5.5/uk-fingerprint-children
previous
US gains new advantages in the EU-USA PNR agreement
12 September, 2007 » Airline Passenger Data
In some recently published documents, Statewatch revealed that very soon after the EU-USA agreement on PNR (passenger name record) was signed on 28 June 2007, the US government announced some changes in its Privacy Act that give exemptions from responding to request for personal information held to DHS (Department of Homeland Security) and ATS (Automated Targeting System). US Government also sent a written request to the Council of EU to agree on keeping secret all the documents on the negotiations for at least 10 years.
The declared purpose of the above-mentioned exemptions is for "national security, law enforcement, immigration and intelligence activities. These exemptions are needed to protect information relating to DHS investigatory and enforcement activities from disclosure to subjects or others related to these activities (....) Disclosure of information to the subject of an inquiry could also permit the subject to avoid detection or apprehension."
The exemptions are related to the new "Arrival and Departure System" (ADIS) that the USA is to introduce and which is meant to authorise people to travel only after PNR and API (Advance Passenger Information) data has been checked and cleared by US agency watchlists: "ADIS consists of centralized computerized records for and will be used by DHS and its components. .. The information is collected by, on behalf of, in support of, or in cooperation with DHS and its components and may contain personally identifiable information collected by other Federal, state, local, tribal, foreign, or international government agencies."
The Automated Targeting System, that is to be exempted as well, is a system of 6 modules of dealing with Passenger Name Record (PNR) data.
The exemptions seem to be meant to counterbalance "the set backs" for the US government in the EU-US PNR agreement signed in June. In the text of the agreement it is stated that DHS has taken the decision "to extend administrative Privacy Act protections to PNR data stored in the ATS regardless of the nationality or country of residence of the data subject, including data that relates to European citizens. Consistent with U.S. law, DHS also maintains a system accessible by individuals, regardless of their nationality or country of residence, for providing redress to persons seeking information about or correction of PNR."
The exemptions introduced now contradict this statement, as also notice Tony Bunyan, Statewatch editor : "The adoption of these two exemptions will seriously diminish any rights EU citizens have to find out what data is held on them and who it is held by. Did the Council and the Commission, who negotiated the agreement, know the US was planning to introduce them, and if not why not?"
Another measure taken by the US Government related to the agreement signed in June is one regarding the confidentiality of the negotiations that led to signing the act. On 30 July 2007, Mr Paul Rosenzweig, Acting Assistant Secretary for Policy at the US Department for Homeland Security sent a written request to the Council of European Union to agree on keeping secret all the documents on the negotiations for at least 10 years after the entering into force of the agreement.
EU's Article 29 Data Protection Working Party issued on 17 August an opinion on the new EU-USA PNR agreement concluding that it sensibly weakened the safeguards provided by the previous agreement and that "the new agreement leaves open serious questions and shortcomings, and contains too many emergency exceptions."
"Yet again we see the USA telling the EU what to do. In this case how it should operate the EU Regulation on access to documents. How can any request for PNR documents be fairly considered under EU law when it has already agreed to exercise a US veto? Are we going to see documents for all future EU-US agreements kept secret too? US access to PNR data and its further processing is an issue of substantial public interest which directly effects the rights and privacy of EU citizens and therefore all the documentation should be in the public domain for parliaments and people to see and discuss. It is a quite outrageous request and it is even more outrageous that the EU is going to agree to it" commented Tony Bunyan, Statewatch editor.
US changes the privacy rules to exemption access to personal data (4.09.2007)
http://www.statewatch.org/news/2007/sep/04eu-usa-pnr-exemptions.htm
US demands 10 year ban on access to PNR documents (2.09.2007)
http://www.statewatch.org/news/2007/sep/02eu-usa-pnr-secret.htm
Proposed Rules, Federal Register - DHS, 6 CFR Part 5, Privacy Act of 1974: Implementation of Exemptions (22.08.2007)
http://www.statewatch.org/news/2007/aug/usa-adis-privacy-act-exemption...
http://www.statewatch.org/news/2007/aug/usa-ats-exemptions-privacy-act...
Article 29 Data Protection Working Part - Opinion 5/2007 on the follow-up agreement between the European Union and the United States of America on the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security concluded in July 2007 (17.08.2007)
http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2007/wp138_en...
EDRI-gram: Final agreements between EU and USA on PNR and SWIFT (4.07.2007)
http://www.edri.org/edrigram/number5.13/eu-us-pnr-swift
The European Court of Human Rights could influence the UK DNA database
12 September, 2007 » Privacy | Biometrics
Sir Stephen Sedley has recently proposed the enlargement of the DNA database in UK to cover the entire population and visitors that stay in UK even for a week, under the argument of creating a fairer system and eliminating the ethnical unbalance in the present database. But a case brought by 2 English people to the European Court of Human Rights (ECHR) could change a lot in how the database will operate.
The UK DNA database is one of the largest in the world covering data from everybody having had anything to do with any crime, minor or major, guilty or not. According to Sadley, the database is biased against ethnic minorities. "It means where there is ethnic profiling going on disproportionate numbers of ethnic minorities get onto the database. It also means that a great many people who are walking the streets and whose DNA would show them guilty of crimes, go free."
The proposal met opposition from the Prime Minister who believes that would raise civil liberties concerns but also complicated logistical issues.
Shami Chakrabarti, director of human rights organization Liberty, also said that a database for everybody in the country was "a chilling proposal, ripe for indignity, error and abuse".
The present UK DNA database is already raising issues related to the way people's data are included in it. Shadow home secretary David Davis considers the system is arbitrary and erratic. The highest concern is related to the fact that the data of people proven innocent cannot be removed from the database. And this is exactly what has triggered a case at the ECHR, that could change the whole situation.
The case was brought in front of ECHR by Michael Marper and a teenager, known as S, both arrested in 2001, the former on harassment charges and the latter with attempted robbery. They were both cleared and with no criminal records. In 2002 they required their data to be removed from the Home Office database but the Court of Appeal ruled against it. Among the appeal judges that heard the case was Sir Stephen Sedley that proposed a "universal DNA database" even in that judgment.
Mr Marper and the juvenile argued that keeping their fingerprints and DNA samples was an infringement of their private life rights as per Article 8 of the European Convention on Human Rights. Their concern is related mostly to the possible future misuse of their data.
The situation seems to be now in the hands of ECHR. A ruling by ECHR against the British Government could not only stop Lord Justice's proposal to enlarge the DNA database but also lead to the destruction of the DNA and fingerprint evidence of people that have been found innocent. The case is considered important by the judges in Strasbourg as they have sent the case before the grand chamber, because it raises a serious problem affecting the interpretation of the European Convention on Human Rights.
"This decision by the European Court of Human Rights gives us significant hope that these cases will finally result in a massive change in the law - providing protection for those acquitted of crimes against their fingerprints and DNA samples being kept, putting them on a level footing with those not previously accused of any crimes (...) We think this will be one of the most important human rights challenges the court has grappled with in recent years" stated Peter Mahy, a civil liberties specialist at Sheffield-based Howells who represent Marper and "S".
All UK 'must be on DNA database' (5.09.2007)
http://news.bbc.co.uk/1/hi/uk/6979138.stm
Plan to put everyone in DNA database hinges on human rights case (7.09.2007)
http://www.out-law.com//default.aspx?page=8455
Europe to rule on whether police can keep DNA of innocent people (8.09.2007)
http://news.independent.co.uk/uk/legal/article2941849.ece
EDRI-gram : UK Home Office plans to fingerprint children starting 11 (14.03.2007)
http://www.edri.org/edrigram/number5.5/uk-fingerprint-children
previous
US gains new advantages in the EU-USA PNR agreement
12 September, 2007 » Airline Passenger Data
In some recently published documents, Statewatch revealed that very soon after the EU-USA agreement on PNR (passenger name record) was signed on 28 June 2007, the US government announced some changes in its Privacy Act that give exemptions from responding to request for personal information held to DHS (Department of Homeland Security) and ATS (Automated Targeting System). US Government also sent a written request to the Council of EU to agree on keeping secret all the documents on the negotiations for at least 10 years.
The declared purpose of the above-mentioned exemptions is for "national security, law enforcement, immigration and intelligence activities. These exemptions are needed to protect information relating to DHS investigatory and enforcement activities from disclosure to subjects or others related to these activities (....) Disclosure of information to the subject of an inquiry could also permit the subject to avoid detection or apprehension."
The exemptions are related to the new "Arrival and Departure System" (ADIS) that the USA is to introduce and which is meant to authorise people to travel only after PNR and API (Advance Passenger Information) data has been checked and cleared by US agency watchlists: "ADIS consists of centralized computerized records for and will be used by DHS and its components. .. The information is collected by, on behalf of, in support of, or in cooperation with DHS and its components and may contain personally identifiable information collected by other Federal, state, local, tribal, foreign, or international government agencies."
The Automated Targeting System, that is to be exempted as well, is a system of 6 modules of dealing with Passenger Name Record (PNR) data.
The exemptions seem to be meant to counterbalance "the set backs" for the US government in the EU-US PNR agreement signed in June. In the text of the agreement it is stated that DHS has taken the decision "to extend administrative Privacy Act protections to PNR data stored in the ATS regardless of the nationality or country of residence of the data subject, including data that relates to European citizens. Consistent with U.S. law, DHS also maintains a system accessible by individuals, regardless of their nationality or country of residence, for providing redress to persons seeking information about or correction of PNR."
The exemptions introduced now contradict this statement, as also notice Tony Bunyan, Statewatch editor : "The adoption of these two exemptions will seriously diminish any rights EU citizens have to find out what data is held on them and who it is held by. Did the Council and the Commission, who negotiated the agreement, know the US was planning to introduce them, and if not why not?"
Another measure taken by the US Government related to the agreement signed in June is one regarding the confidentiality of the negotiations that led to signing the act. On 30 July 2007, Mr Paul Rosenzweig, Acting Assistant Secretary for Policy at the US Department for Homeland Security sent a written request to the Council of European Union to agree on keeping secret all the documents on the negotiations for at least 10 years after the entering into force of the agreement.
EU's Article 29 Data Protection Working Party issued on 17 August an opinion on the new EU-USA PNR agreement concluding that it sensibly weakened the safeguards provided by the previous agreement and that "the new agreement leaves open serious questions and shortcomings, and contains too many emergency exceptions."
"Yet again we see the USA telling the EU what to do. In this case how it should operate the EU Regulation on access to documents. How can any request for PNR documents be fairly considered under EU law when it has already agreed to exercise a US veto? Are we going to see documents for all future EU-US agreements kept secret too? US access to PNR data and its further processing is an issue of substantial public interest which directly effects the rights and privacy of EU citizens and therefore all the documentation should be in the public domain for parliaments and people to see and discuss. It is a quite outrageous request and it is even more outrageous that the EU is going to agree to it" commented Tony Bunyan, Statewatch editor.
US changes the privacy rules to exemption access to personal data (4.09.2007)
http://www.statewatch.org/news/2007/sep/04eu-usa-pnr-exemptions.htm
US demands 10 year ban on access to PNR documents (2.09.2007)
http://www.statewatch.org/news/2007/sep/02eu-usa-pnr-secret.htm
Proposed Rules, Federal Register - DHS, 6 CFR Part 5, Privacy Act of 1974: Implementation of Exemptions (22.08.2007)
http://www.statewatch.org/news/2007/aug/usa-adis-privacy-act-exemption...
http://www.statewatch.org/news/2007/aug/usa-ats-exemptions-privacy-act...
Article 29 Data Protection Working Part - Opinion 5/2007 on the follow-up agreement between the European Union and the United States of America on the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security concluded in July 2007 (17.08.2007)
http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2007/wp138_en...
EDRI-gram: Final agreements between EU and USA on PNR and SWIFT (4.07.2007)
http://www.edri.org/edrigram/number5.13/eu-us-pnr-swift
Wednesday, September 12, 2007
NTP roll out the patent lawyers again
From Reuters:
"NTP Inc, which last year won a $612.5 million settlement from the maker of Blackberry, has sued four of the top U.S. mobile service providers for infringing eight patents related to wireless e-mail.
"NTP Inc, which last year won a $612.5 million settlement from the maker of Blackberry, has sued four of the top U.S. mobile service providers for infringing eight patents related to wireless e-mail.
The lawsuits, against Verizon Wireless, Sprint Nextel Corp (S.N: Quote, Profile , Research), T-Mobile USA and the mobile unit of AT&T Inc (T.N: Quote, Profile , Research) were filed September 7 in the U.S. District Court for the Eastern District of Virginia, according to court documents."
A rare courtroom win for the tinkerers
The EFF have succeeded in blocking DirecTV's broadsweep legal tactics at least in the case of a couple of security researchers.
"In an important ruling today, the 9th U.S. Circuit Court of Appeals blocked satellite television provider DirecTV's heavy-handed legal tactics and protected security and computer science research into satellite and smart card technology after hearing argument from the Electronic Frontier Foundation (EFF).
The cases, DirecTV v. Huynh and DirecTV v. Oliver, involved a provision of federal law prohibiting the "assembly" or "modification" of equipment designed to intercept satellite signals. DirecTV maintained that the provision should cover anyone who works with equipment designed for interception of their signals, regardless of their motivation or whether any interception occurs. But in a hearing earlier this year, EFF argued that the provision should apply only to entities that facilitate illegal interception by other people and not to those who simply tinker or use the equipment, such as researchers and others working to further scientific knowledge of the devices at issue.
"Congress never meant this law to be used as a hammer on those who use or tinker with new technologies," said EFF Senior Staff Attorney Jason Schultz. "We're pleased the court recognized that researchers need to be protected."
These cases were part of DirecTV's nationwide legal campaign against hundreds of thousands of individuals, claiming that they were illegally intercepting its satellite TV signal simply because they had purchased smart card technology. Because DirecTV made little effort to distinguish legal uses of smart card technology from illegal ones, EFF has worked to limit the lawsuits to only those cases where DirecTV has proof that their signals were illegally received."
"In an important ruling today, the 9th U.S. Circuit Court of Appeals blocked satellite television provider DirecTV's heavy-handed legal tactics and protected security and computer science research into satellite and smart card technology after hearing argument from the Electronic Frontier Foundation (EFF).
The cases, DirecTV v. Huynh and DirecTV v. Oliver, involved a provision of federal law prohibiting the "assembly" or "modification" of equipment designed to intercept satellite signals. DirecTV maintained that the provision should cover anyone who works with equipment designed for interception of their signals, regardless of their motivation or whether any interception occurs. But in a hearing earlier this year, EFF argued that the provision should apply only to entities that facilitate illegal interception by other people and not to those who simply tinker or use the equipment, such as researchers and others working to further scientific knowledge of the devices at issue.
"Congress never meant this law to be used as a hammer on those who use or tinker with new technologies," said EFF Senior Staff Attorney Jason Schultz. "We're pleased the court recognized that researchers need to be protected."
These cases were part of DirecTV's nationwide legal campaign against hundreds of thousands of individuals, claiming that they were illegally intercepting its satellite TV signal simply because they had purchased smart card technology. Because DirecTV made little effort to distinguish legal uses of smart card technology from illegal ones, EFF has worked to limit the lawsuits to only those cases where DirecTV has proof that their signals were illegally received."
Tuesday, September 11, 2007
PETs so last century
From the ever thoughtful blogging on the identity trail comes an interesting essay on privacy enhancing technologies (PETs) from a privacy advocate.
"In May the European Commission endorsed the development and deployment of PETs(1), in order to help “ensure that certain breaches of data protection rules, resulting in invasions of fundamental rights including privacy, could be avoided because they would become technologically more difficult to carry out.” The UK Information Commissioner issued similar guidance on PETs in November 2006(2)...
Are PETs the answer to information privacy concerns? A closer look at the European and UK communiqués suggests otherwise - for all their timeliness and prominence, they reflect thinking about PETs that is becoming outdated. The reports cite, as examples of PETs, technologies such personal encryption tools for files and communications, cookie cutters, anonymous proxies and P3P (a privacy negotiation protocol). Not a single new privacy-enhancing technology category here in seven years...
Unfortunately, few of the privacy-enhancing tools cited by advocates have enjoyed widespread public adoption or viability (unless installed and activated by default on users’ computers, e.g. SSL and Windows firewalls). The reasons are several and varied: PETs are too complicated, too unreliable, untrusted, expensive or simply not feasible to use. The threat model they respond to, and benefits they offer, are not always clear or measurable to users. PETs may interfere with normal operation of computer applications and communications, for example, they can render web pages non-functional...
Perhaps the underlying difficulty may be a conceptualization of PETs as a technology, tool or application exclusively for use by individuals, complete in itself, expressed perhaps in its purest form by David Chaum’s digital cash Stefan Brands' private credentials. As brilliant as those ideas are, they have had limited deployment and viability to date. It seems that, to be viable, PETs must be also meet specific, recognizable needs of organizations...
A more comprehensive approach to defining and using PETs is required - one that clearly accommodates the interests and rights of individuals in a substantial way, yet which can be adopted or at least accommodated by organizations with whom individuals must inevitably deal. This requires a more systemic, process-oriented, life-cycle, and architectural approach to engineering privacy into information technologies and systems.
"In May the European Commission endorsed the development and deployment of PETs(1), in order to help “ensure that certain breaches of data protection rules, resulting in invasions of fundamental rights including privacy, could be avoided because they would become technologically more difficult to carry out.” The UK Information Commissioner issued similar guidance on PETs in November 2006(2)...
Are PETs the answer to information privacy concerns? A closer look at the European and UK communiqués suggests otherwise - for all their timeliness and prominence, they reflect thinking about PETs that is becoming outdated. The reports cite, as examples of PETs, technologies such personal encryption tools for files and communications, cookie cutters, anonymous proxies and P3P (a privacy negotiation protocol). Not a single new privacy-enhancing technology category here in seven years...
Unfortunately, few of the privacy-enhancing tools cited by advocates have enjoyed widespread public adoption or viability (unless installed and activated by default on users’ computers, e.g. SSL and Windows firewalls). The reasons are several and varied: PETs are too complicated, too unreliable, untrusted, expensive or simply not feasible to use. The threat model they respond to, and benefits they offer, are not always clear or measurable to users. PETs may interfere with normal operation of computer applications and communications, for example, they can render web pages non-functional...
Perhaps the underlying difficulty may be a conceptualization of PETs as a technology, tool or application exclusively for use by individuals, complete in itself, expressed perhaps in its purest form by David Chaum’s digital cash Stefan Brands' private credentials. As brilliant as those ideas are, they have had limited deployment and viability to date. It seems that, to be viable, PETs must be also meet specific, recognizable needs of organizations...
A more comprehensive approach to defining and using PETs is required - one that clearly accommodates the interests and rights of individuals in a substantial way, yet which can be adopted or at least accommodated by organizations with whom individuals must inevitably deal. This requires a more systemic, process-oriented, life-cycle, and architectural approach to engineering privacy into information technologies and systems.
PETs as we know them are effectively dead, reduced to a niche market for paranoids and criminals, claimed by some security products (e.g., two-factor authentication dongles) or else deployed by organizations as a public relations exercise to assuage specific customer fears and to build brand confidence (e.g. banks' anti-phishing tools, web seals)."
Subscribe to:
Posts (Atom)