Friday, June 22, 2012

EFF right idea but wrong target on software patents

The EFF has started a campaign against software patents. They state the problem as:
"Software patents are hard to understand. Really hard, because patent lawyers can get away with writing them in extremely vague and broad language. This means that innovators are left without clear guidance on what patents they might be infringing. It also allows trolls to exploit the vague and confusing patent language to extort higher licensing fees than they would otherwise be entitled."
Much though I like the good folk at the EFF I think maybe they've got their target slightly wrong here.  Software patents can be vague and broad but I'm not sure those particular features distinguish them from any other types of patents.  Yes patent holders exploit the language but companies like Intellectual Ventures or Blackboard, IBM or Myriad Genetics don't really care if it is hardware, software or even, these days, bioware or business methods at the heart of a case.  What they exploit, primarily, is the cost of patent litigation system.  Going to court is so expensive it is really only feasible for those with deep pockets.  For smaller companies the patent system is a licence to pay a lawyer.  If one of the bigger corporations decide to target you the only rational economic response is to settle. Otherwise the risk of bankruptcy is severe.

Greg Aharonian has been a vocal and long time critic of those opposed to software patents. He makes the perfectly logical argument that:
"The Church-Turing thesis (for every algorithm, there is a circuit) requires software and hardware patentability to be equivalent, especially in light of hardware-software codesign tools, where you design both (and their combinations) with equal effort."
And he's right.  If our societal values and patent systems legitimise patents of certain types of electronic hardware then there is no logical reason why the software equivalent of that circuit should not be patentable.

My problem with these types of patents, software and  hardware equivalents, is that they amount to patenting algorithms.  Software is mathematics and mathematics should not be patentable.  Now I know this is a much more complicated case to articulate in practice to technically and mathematically challenged policymakers. But the trouble with focusing on simple but erroneous targets is that they lead to simple but erroneous "solutions" that don't fix anything.

The patent system is complicated.  The technologies that it is increasingly covering are also incredibly complicated.  The principle that mathematics should not be patentable is clear but gets lost in translation when the messy dysfunctionality of the patent system gets applied, in real life, to the complexity of modern technology. Too much of the public debate on intellectual property consists of IP maximalists and IP minimalists shouting PR digestible slogans at each other.  My concern is that the EFF's campaign here might just end up in the same unproductive arena, focusing attention on a beguiling but deceptive underlying issue of vague patent language.  Vague and broad patent language is a problem but it is not one that is exclusive to software patents.

Thursday, June 21, 2012

GNI Digital Freedoms Report

I attended the launch of the Global Network Initiative (GNI) report Digital Freedoms in International Law: Practical Steps to Protect Human Rights Online at the Free Word Centre in London yesterday. The executive summary gives an overview:
"With around 2.3 billion users, the Internet has become part of the daily lives of a significant percentage of the global population, including for political debate and activism. While states are responsible for protecting human rights online under international law, companies responsible for Internet infrastructure, products and services can play an important supporting role. Companies also have a legal and corporate social responsibility to support legitimate law enforcement agency actions to reduce online criminal activity such as fraud, child exploitation and terrorism. They sometimes face ethical and moral dilemmas when such actions may facilitate violations of human rights. In this report we suggest practical measures that governments, corporations and other stakeholders can take to protect freedom of expression, privacy, and related rights in globally networked digital technologies. These are built on a detailed analysis of international law, three workshops in London, Washington DC and Delhi, and extensive interviews with government, civil society and corporate actors. "

David Sullivan (Policy and Communications Director, Global Network Initiative)welcomed everyone explaining the GNI "is a multi-stakeholder group of companies, civil society organizations (including human rights and press freedom groups), investors and academics, who have created a collaborative approach to protect and advance freedom of expression and privacy in the ICT sector. GNI provides resources for ICT companies to help them address difficult issues related to freedom of expression and privacy that they may face anywhere in the world. GNI has created a framework of principles and a confidential, collaborative approach to working through challenges of corporate responsibility in the ICT sector." GNI want multi-stakeholder scrutiny of policy proposals surrounding the internet.

Kirsty Hughes, the Chief Executive of Index on Censorship, opened with the tale of the Azerbaijani blogger who had been jailed and tortured and continually harassed since his release. Azerbaijan government representatives even heckled and yelled at him as he spoke at the OSCE Internet Freedom conference in Dublin earlier this week.  The opportunity for expression facilitated by modern technology, she said, is brilliant compared to just 20 years ago.  But the downside is that the technology facilitates surveillance.

The Google transparency report 2012 reports that Google had few takedown requests from China. Is that good news or are China so good at censorship  they don't need Google's help? The volume of takedown requests increased drastically in India (49%) and the US (103%). There are huge concerns from the big ISPs about this.  Ms Hughes rounded off by saying Index on Censorship are committed to doing a lot more about internet censorship issues.

The first panel of the day was chaired by Ms Hughes and included Richard Allan (Director of Policy EMEA, Facebook), Stephen Deadman (Group Privacy Officer and Head of Legal, Vodafone) and Douwe Korff (Professor of International Law, London Metropolitan University).  Mr Deadman was invited to speak first to address the question of who has access to our communications.  He looks after privacy and security at Vodaphone and noted the law enforcement and human rights issues have increased by an order of magnitude over the past 10 years. Telecommunications companies (telcos) have come together to express their concern about pressures from various governments to disclose data undermining human rights.  Ten have recently published a set of principles around human rights in their sector.

For telcos surveillance is a fact of life. It is the nature of their business. The level of support provided to law enforcement authorities is on an industrial scale.  That affects the way they have to manage law enforcement. Working with law enforcement is not rare.  It is very common. So the processes have to ensure that cooperation happens in a legitimate way. However the technology has changed hugely whilst there has been very little change in how telcos provide support for law enforcement.  The Communications Data Bill, he hopes, will lead to an enlightening public debate on this.

There are two key issues for Vodaphone:

1. How can surveillance powers be adapted to the modern world in legitimate, proportionate and necessary ways?
2. How do telcos operate in markets where even basic human rights do not exist?

Richard Allan from Facebook followed. His answer to the question of who controls access to your communications is you. "The default mode is you control access to your communications." (Ahem) Operators have a moral (ahem) and legal obligation to ensure that control is meaningful.  The challenge is that governments want to override your control of your data.  Data retention is the evil twin of data protection. (That got a laugh.  You could tell he'd learned his script and was practiced at delivering it.)

Override powers are in law and companies have to abide by them if they want to operate in that jurisdiction. And the government will not leave you alone if you are as big as Facebook.  Richard Allan then asked what do we want as citizens? He wants informed consent and accountability.  So called "informed consent", imho, is a meaningless concept in the context of companies like Facebook since their users have no idea of what exactly it is they are giving away. However he followed through with the informed consent and accountability line and explained what he thought it meant - clear what the override powers are, when they are being used and what they are being used for (aka transparency); and he wants to give his consent to these things only through the judicial process.  He also wants to have to give consent (aka have his say in) to what society considers banned speech.    He also wants the authorities to be held accountable.  If commerce knew the rules were clear and governments accountable that would make their life much easier.

Note in the Facebook worldview the real evil twin is government and the good twin is commerce. It was a subtle message, slickly delivered. Yet I didn't get that from Vodaphone's Stephen Deadman.  Mr Deadman was direct in stating clearly that surveillance is in the operations dna of telcos, that support for law enforcement is provided on an industrial scale and that the regulations need to catch up with the technology via an open informed public debate. He didn't try to blame the evil government bogeyman but insisted we need to adopt proportionate, legitimate and necessary surveillance powers for the modern world.

Professor Korff came next and launched into his task with some passion.  Technology is evolving he said.  In the old days the amount of data gathered was relatively limited. Now installing a surveillance black box generates a vast amount of data.  This is fundamentally dangerous.

The way the surveillance technology is built varies. These systems need ongoing continuous maintenance and support.  The amount of data is huge and the UK government are being disingenuous or clueless if they think they are only going to gather minimal data through the provisions outlined in the Communications Data Bill (CDB).  Peter Sommer eloquently explained at the recent Scrambling for Safety conference that communications and content data cannot be separately simply in the way the government believes.

If CDB goes ahead in the UK, Prof Korff believes, we will all effectively be tagged like criminals are now.

The international law surrounding all this is really complicated. During the Arab spring in Tunisia, Egypt and other places states of emergency were declared by respective governments and normal laws suspended. Terrorism falls between peacetime and emergency but government authorities want to operate as they would in a state of emergency.  Different jurisdictions have different perspectives on speech.  In parts of Europe it is against the law to deny the holocaust.  In the US the first amendment gives people a constitutional right to do so.  It's difficult to apply conflicting laws across borders.

When researching the report they looked at the emergency standards in international law and the Ruggie principles. Ruggie focused on companies breaching human rights. In the GNI report they wanted to focus on states forcing companies to undermine human rights.

Index on Censorship CEO Kirsty Hughes then posed the question: When is it a company's obligation to challenge the law?

Stephen Deadman of Vodaphone, in fairness, again didn't attempt to duck the question.  He suggested it depended on the context.  He argued that companies cannot engage in civil disobedience if they have a physical presence in a particular market. But they do have an obligation to push back in whatever way makes sense in that market.  Sometimes this has a positive outcome.  They were under pressure from the Egyptian government to spam people with state sponsored messages.  Vodaphone pushed back and said no.  The government could have forced the issue but chose not to. The practical reason companies like Vodaphone cannot go any further than this, he insisted, was that it could have serious consequences for employees on the ground in those countries where human right abuses are rife.  Local Vodaphone employees have rights too and the company has an obligation not to put them in danger.

He was then asked if Vodphone would decide to go into or withdraw from a market on the basis of a specific country's human rights record.  Disappointingly here he retreated into the standard PR response mode.  For Vodaphone, human rights is one of the factors they consider but the key question is whether the people in that market would be better off with them, a company that respects human rights, than without. He could not and would not give a guarantee that they would refuse to go into a country on human rights grounds.

The Facebook response to when is it a company's obligation to challenge the law was a pleading - Facebook don't have a choice; when you're as big as Facebook nasty governments won't leave you alone.  The cure is to get a global regulatory framework that is the same for everyone.  Part of that framework is in place in the cybercrime convention.

Douwe Korff then suggested if there was no rule of law in a country it was not a very stable place to invest.  One of the recommendations in the GNI report is a single point of contact in each country for communications data access requests to companies.  Part of the problem for companies getting established in new countries is the multiple levels of corruption and many corrupt officials demanding data from telcos for example.  It's therefore a good idea to get agreement eg through UK ambassadors at high level what/who the single point of contact for surveillance data requests would come from.  Then if low level officials demand data they get referred to the higher authority.  It facilitates transparency of the process.

Stephen Deadman responded Vodaphone have taken this approach in a number of markets. It is easier for the company and the central government gets the benefit of monitoring these processes centrally too.

At this point there was a question from the audience prefaced with an accusation that neither Vodaphone nor Facebook are transparent about the number of requests they receive. There is a bizarre situation in some countries where you may only find out your data have been mined when you're in the dock.  In many countries there are no prohibitions on telling data subjects data has been requested by the government authorities.  Why do Vodaphone and Facebook not tell users about surveillance requests and how many geolocation  requests are they getting in the UK.

Stephen Deadman explicitly refuted the suggestion that Vodaphone have the freedom to share this information with users in many countries.  He also said it should be for governments to provide the information right across the whole market rather than individual operators disclosing.

Richard Allan said Facebook are looking at Google's transparency report and wondering if they could do something similar. But in terms of "tipping off" (my hackles were raised slightly by that) Facebook do their own assessment of the law enforcement requests for information; and tipping off is not appropriate in most cases e.g. child abuse investigation.  More cases Facebook get are legitimate investigations.  Typically totalitarian regimes don't make data requests from Facebook.  Newspapers protect sources.  Facebook and Vodaphone are not newspapers.  Facebook primarily view it as a safety issue.  Cooperating with law enforcement is a big part of that.  Safety and security are the overriding objectives.

Stephen Deadman then forcefully pointed out that Vodaphone get very little background on law enforcement requests for information.  They get a request form and follow a process.  Vodaphone is not in a position to assess the case from an investigative, criminal or legal process perspective and should not be.  It is not part of Vodaphone's remit to investigate or prosecute crimes.  They must, however, ensure due process is followed with respect to the information they supply to law enforcement.  But their capacity to say to law enforcement that they are overstepping the mark is non existent.  Vodaphone, however, get radically different types of data requests to companies like Facebook or Google.

Douwe Korff jumped in at this point and I could tell I wasn't alone in taking offence at Richard Allan's "tipping off" phrase. All this, he said, is a dialogue in secret behind your back.  On publishing the data on numbers of requests he doesn't trust government.  By all means they should publish their statistics but the telcos should too and then we can compare the two sets of data and find the holes. Companies should minimise and push back against government overreaching every time.  He doesn't believe Facebook have the competence to assess criminal cases and whether information requests are legitimate.  Companies should know the legal setup of any country they get into and with the help of academics and civil society etc facilitate understanding through transparency.  He objected strenuously to Facebook's "tipping off" language too.

Eric King of Privacy International asked for clarification of Vodaphone's interpretation of the Regulation of Investigatory Powers Act (RIPA).  His own understanding was that the RIPA default is that telcos are not gagged if they get a data access request.  He also wanted to know what degree of human supervision happens in these industrial scale law enforcement cooperations.

Stephen Deadman said Vodaphone do have oversight and review processes.  Most cases have some kind of review, some are automated.  Vodaphone doesn't have a legal opinion that says that it cannot disclose data requests under RIPA.  In other countries so prohibitions do apply.  Going down the route of transparency is something he accepts is a good idea in principle.  It does have a number of operational, cost and other practicality issues to consider though.

Mr Deadman did also, later in proceedings, say that advanced markets are the best at surveillance - this is a simple emergent feature of the different levels of technical competence.

Prof Korff then pointed out that black boxes are dangerous technology because they are indiscriminate.  The only control on them is the good behaviour or good intentions of the agencies that operate them. Without transparency no one is watching the watchmen.

There followed rather long PR statement on behalf of Facebook from Richard Allan.  All about ow Facebook what to make the world more open, how they are getting increasingly transparent, how they are much and unfairly maligned for not warning people enough, how a stazi type control system would not work and how Facebook has a network of activists showing people how to use Facebook safely.

There was a question from a member of  the House of Lords on how long the panel members thought it would be before the surveillance technology became useless except for catching stupid crooks.

Prof Korff: the circumvention technology arms race will continue and ordinary people will become more educated about the dangers online.

Richard Allan:  That is the rationale for the Communications Data Bill - technology is changing so fast the government need to keep up and they claim they can only do so with sweeping powers.  So we have to be careful with that kind of argument. They argue the more difficult it is the more data they want.

Vodaphone's Stephen Deadman agreed - the Bill is the response to that fear. He wonders if we have really looked at this holistically?  We need a debate as to what surveillance is legitimate, proportionate and necessary.

Kirsty Hughes' final question then was how worried should we be about the Communications Data Bill?

Prof Korff - "Very worried"

Richard Allan - "On a scale of 1 to 10, 11!"

Stephen Deadman - "Concerned."

That rounded off the first panel of the day.  I'll stick another note here on the second panel as, when and if time allows

Monday, June 18, 2012

Coalition mass surveillance bill

There has been little doubt for some time that the Home Secretary, Theresa May, has been completely house trained and now buys into the mass surveillance mindset of her Nu Labour predecessors.  The latest evidence comes in her scaremongering justifications for the indefensible draft Communications Data Bill (CDB).
"As criminals make increasing use of internet based communications, we need to ensure that the police and intelligence agencies continue to have the tools they need to do the job we ask of them: investigating crime and terrorism, protecting the vulnerable and bringing criminals to justice.
For many years our police and security and intelligence agencies have used communications data from landline telephones and mobiles to catch criminals and to protect the public. This information – which does not include the content of a phone call or email – has played a role in nearly every serious organised crime investigation and in all major Security Service counter-terrorism operations over the past decade and is fundamental to policing across the UK. But the ability of the police and others to use this vital tool is disappearing because communications data from new technologies is less available and often harder to access. Without action there is a serious and growing risk that crimes enabled by email and the internet will go undetected and unpunished, that the vulnerable will not be protected and that terrorists and criminals will not be caught and prosecuted. No responsible Government could allow such a situation to develop unaddressed.
The purpose of this Bill, therefore, is to protect the public and bring offenders to justice by ensuring that communications data is available to the police and security and intelligence agencies in future as it has been in the past."
All the old bogeymen are wheeled out.  In multiple media engagements she drags up all four horsemen of the infocalypse - terrorists, drug dealers, child abusers and organised crime - and more, on several occasions quoting the Met police chief as insisting passing this legislation is a "matter of life and death".

She goes to great pains to point out that the CDB is "not about creating big government database - communications service providers will be asked to hold this data". (That's "asked" as in compelled). The attempt to distance herself from the Nu Labour apparatchiks obsessed with massive database cures for all ills is laughable. As if compelling commercial communications providers (and potentially everyone if the broad definitions in Clause 28 of the Bill are any guide) to build and maintain massive databases to which government has open access is somehow morally superior?!

Let's just look at what part 1 of the draft bill actually says as opposed to "we just want to protect you cuddly kittens" newspeak version promoted by the Home Secretary.
"1 Power to ensure or facilitate availability of data
(1) The Secretary of State may by order—
(a) ensure that communications data is available to be obtained from telecommunications operators by relevant public authorities in accordance with Part 2, or
(b) otherwise facilitate the availability of communications data to be so obtained from telecommunications operators.
(2) An order under this section may, in particular—
(a) provide for—
(i) the obtaining (whether by collection, generation or otherwise) by telecommunications operators of communications data,
(ii) the processing, retention or destruction by such operators of data so obtained or other data held by such operators,
(iii) the entering into by such operators of arrangements with the Secretary of State or other persons under or by virtue of which the Secretary of State or other persons engage in activities on behalf of the operators on a commercial or other basis for the purpose of enabling the operators to comply with requirements imposed by virtue of this section,
(b) impose requirements or restrictions on telecommunications operators or other persons or provide for the imposition of such requirements or restrictions by notice of the Secretary of State.
(3) Requirements imposed by virtue of subsection (2) may, in particular, include—
(a) requirements (whether as to the form or manner in which the data is held or otherwise) which ensure that communications data can be disclosed without undue delay to relevant public authorities in accordance with Part 2,
(b) requirements for telecommunications operators—
(i) to comply with specified standards,
(ii) to acquire, use or maintain specified equipment or systems, or
(iii) to use specified techniques,
(c) requirements which—
(i) are imposed on a telecommunications operator who controls or provides a telecommunication system, and
(ii) are in respect of communications data relating to the use of telecommunications services provided by another telecommunications operator in telecommunication system concerned.
(4) Nothing in this Part authorises any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system.
(5) In this section—
“processing”, in relation to communications data, includes its reading, organisation, analysis, copying, correction, adaptation or retrieval and its integration with other data,
“relevant public authority” has the same meaning as in Part 2.
(6) See—
(a) section 25 for the way in which this Part applies to public postal operators and public postal services, and
(b) section 28 for the definitions of “communications data” and “telecommunications operator” and for other definitions relevant to this Part."
I won't dissect all the parts of clause 1 here but the introduction to the draft bill itself explains what this means:
"Part 1 makes provision for ensuring or otherwise facilitating the availability of communications data to be obtained from telecommunications operators. Clause 1 enables the Secretary of State, by order, to ensure that communications data is available to be obtained by public authorities" 
The bottom line is that the relevant Secretary of State, most likely the Home Secretary, gets unlimited powers to mould data access regulations in perpetuity without the need to consult parliament in any meaningful way:
(1) The Secretary of State may by order—
(a) ensure that communications data is available to be obtained from telecommunications operators by relevant public authorities in accordance with Part 2, or
(b) otherwise facilitate the availability of communications data to be so obtained from telecommunications operators.
(2) An order under this section may, in particular—
[...]
(b) impose requirements or restrictions on telecommunications operators or other persons or provide for the imposition of such requirements or restrictions by notice of the Secretary of State"
This is basically a really dangerous Henry VIII clause. There is no mechanism for amending Henry VIII orders and they usually get rubber-stamped by Parliament without material scrutiny.  Ms May and her successors get to order anyone to do anything that can be related to facilitating access to communications data:

If you combine this with, as Francis Davey points out, with the broad definitions given in clause 28 of the bill, e.g.
"“person” includes an organisation and any association or combination of persons
[..]
“telecommunications operator” means a person who—
(a) controls or provides a telecommunication system, or
(b) provides a telecommunications service,
“telecommunication system” means a system (including the apparatus comprised in it) that exists (whether wholly or partly in the United Kingdom or elsewhere) for the purpose of facilitating the transmission of communications by any means involving the use of electrical or electro-magnetic energy,
“telecommunications service” means a service that consists in the provision of access to, and of facilities for making use of, a telecommunication system (whether or not one provided by the person providing the service)"
- this Bill could theoretically, as currently drafted mean that we might be obliged to keep "who, what, when and where" records of family and friends social gatherings which involve listening to music, TV watching, internet or mobile phone use, electronic gaming or just chatting.

Wendy Grossman summarises it nicely:
"So we're talking - again - about spending huge sums of government money on a project that only a handful of people want and whose objectives could be better achieved by less intrusive means. Give police better training in computer forensics, for example, so they can retrieve the evidence they need from the devices they find when executing a search warrant.
Ultimately, the real enemy is the lack of detail in the draft bill. Using the excuse that the communications environment is changing rapidly and continuously, the notes argue that flexibility is absolutely necessary for Clause 1, the one that grants the government all the actual surveillance power, and so it's been drafted to include pretty much everything, like those contracts that claim copyright in perpetuity in all forms of media that exist now or may hereinafter be invented throughout the universe. This is dangerous because in recent years the use of statutory instruments to bypass Parliamentary debate has skyrocketed. No. Make the defenders of this bill prove every contention; make them show the evidence that makes every extra bit of intrusion necessary."

So much for the promising promises of the then new coalition government in 2010 "to reverse the substantial erosion of liberties under the Labour government". Henry Porter's optimism at the time has given way to weary disappointment as he points out that the authoritarian forces within government pressing for a surveillance state are alive, well and thriving,
"the onerous truth is that the price of liberty is eternal vigilance...
We should not let this bill pass."
Indeed.

Saturday, June 16, 2012

Help ORG stop the snoopers' charter

The Open Rights Group needs your help to fight the Communications Data Bill. The announcement on the Bill was slipped out on Thursday when David Cameron was giving evidence before the Leveson inquiry. At least £1.8 billion is to be spent on mass surveillance technology at the same time as sacking police officers and military personnel.



As ORG say,
"Your communications via Google, Facebook or Skype will now be open to what may be a large number of government officials. We want to see the powers to collect and access communications data tightened up, not extended ever further."
And they're offering training sessions to help you get involved in educating people and MPs about these dangerous proposals -
"a series of events to get the campaigning going at the grassroots, and help people working with their MPs.



You don't need any previous knowledge of the issues or experience talking with your MP. 

Each training event will last for around four hours. They will cover a background briefing on the issues and an overview of the campaigns followed by some practical training on how to speak to your MP. 

The sessions will be sociable and entertaining as well as extremely informative.  And if you wonder whether it is worth an evening of your time just remember that you cannot protect democracy by building state infrastructure of mass surveillance. Bruce Schneier put it more accessibly, "technology shouldn't give big brother a head start... it's bad civic hygiene to build technologies that could someday be used to facilitate a police state."

Monday, June 11, 2012

Congratulations Dr Doctorow

Congratulations to the prolific Cory Doctorow who fittingly, on Friday last, 8 June 2012, was awarded an honorary doctorate by the Open University.

(Image via Matt Locke).

Professor Marian Petre made the presentation explaining why Cory had been honoured.
"Cory Doctorow is a science fiction novelist, blogger and civil rights activist. He is the co-editor of the hugely popular weblog Boing Boing (boingboing.net), and is a regular columnist for The Guardian, Wired, Popular Science, Make, The New York Times, and many other newspapers, magazines and websites. He was formerly Director of European Affairs for the Electronic Frontier Foundation (eff.org) and was a founder of the UK-based Open Rights Group, both non-profit civil liberties organizations that defend freedom in technology law, policy, standards and treaties. He has worked at the UN, with standards bodies, governments, industry, universities and other non-profit organizations promoting a balanced approach to intellectual property law, a policy area of special educational concern to the Open University. In 2007, he served as the Fulbright Chair at the Annenberg Center for Public Diplomacy at the University of Southern California.
His internationally-renowned science fiction novels are simultaneously published by Tor Books and released on the Internet under Creative Commons licenses that encourage their re-use and sharing, a demonstration of his philosophy on open publication. He has won the Locus and Sunburst Awards, and been nominated for the Hugo, Nebula and British Science Fiction Awards. Entertainment Weekly has called Doctorow "The William Gibson of his generation."
At a time when technological developments and associated regulations are transforming our society, including our concepts of privacy and freedom of expression, Doctorow has been a tireless campaigner for the free flow of ideas, educating the press, policymakers, OU students and the general public alike about civil liberties issues related to technology and intellectual property law.
In IP law in recent years, far removed from the attention of most ordinary people, there has been a dramatic expansion in government-granted monopolies over broad swathes of knowledge – patents on human genes or ways of doing business, repeated extensions of the term of copyright – which present a clear and present danger to the mission of the Open University to promote ‘educational opportunity and social justice by providing high-quality university education to all who wish to realise their ambitions and fulfil their potential.' Through his campaigning, his writings, his multitude of accessible and entertaining talks, all freely available on the Internet, Cory Doctorow has told this complex story, in a way we can all understand, of the largely successful lobbying of IP industries as they struggle to protect and extend their knowledge-based monopolies in the face of developments in technology. His boundless energy and advocacy of innovative business models and the removal of barriers to achievement does a service, not just to the OU and the general public, but the entertainment industries themselves which, even as they succeed in getting more and more draconian copyright laws and locked-down technologies, continue to experience a shrinking turnover of their products.
In addition to this wide-ranging contribution in areas of special educational concern to the OU, Doctorow has made his specific unique contributions to OU courses like TU100 (My Digital Life).
Doctorow was named one of Forbes magazine's 2007/8 Web Celebrities, and one of the World Economic Forum's Young Global Leaders for 2007. Doctorow co-founded the open source peer-to-peer software company OpenCola, sold to OpenText, Inc in 2003. He serves on the boards and advisory boards of a variety of cultural and charitable foundations and civil rights organisations such as the Participatory Culture Foundation, the MetaBrainz Foundation, Technorati, Inc, the Organization for Transformative Works, Areae, the Annenberg Center for the Study of Online Communities, and Onion Networks, Inc.
In summary, we nominate Cory Doctorow for an honorary Open University DUni, in recognition of his tireless endeavours and recognised international standing in areas of special educational concern to the University – technology law, policy and standards and the free flow of ideas – and our mission to ‘promote educational opportunity and social justice by providing high-quality university education to all who wish to realise their ambitions and fulfil their potential.’"

Friday, June 01, 2012

Oracle v Google ruling a win for Google

Judge Alsup has issued an Order re Copyrightability of certain replicated elements of the Java Application Programming Interface. I like the way he opens, describing the case as "the first of the so-called “smartphone war” cases tried to a jury."

An interesting element of the case, evident in his summary of the ruling and the substance of the decision, is that the judge actually learnt some java to help him come to a decision. A technically literate judge - that's something of a rarity. It would be nice if policymakers and the courts generally made such efforts in relation to technology.
"SUMMARY OF RULING
So long as the specific code used to implement a method is different, anyone is free
under the Copyright Act to write his or her own code to carry out exactly the same function
or specification of any methods used in the Java API. It does not matter that the declaration or
method header lines are identical. Under the rules of Java, they must be identical to declare a
method specifying the same functionality — even when the implementation is different.
When there is only one way to express an idea or function, then everyone is free to do so and
no one can monopolize that expression. And, while the Android method and class names could
have been different from the names of their counterparts in Java and still have worked,
copyright protection never extends to names or short phrases as a matter of law.
It is true that the very same functionality could have been offered in Android
without duplicating the exact command structure used in Java. This could have been done by
re-arranging the various methods under different groupings among the various classes and
packages (even if the same names had been used). In this sense, there were many ways to group
the methods yet still duplicate the same range of functionality.
But the names are more than just names — they are symbols in a command structure
wherein the commands take the form
java.package.Class.method()
Each command calls into action a pre-assigned function. The overall name tree, of course, has
creative elements but it is also a precise command structure — a utilitarian and functional set
of symbols, each to carry out a pre-assigned function. This command structure is a system or
method of operation under Section 102(b) of the Copyright Act and, therefore, cannot be
copyrighted. Duplication of the command structure is necessary for interoperability.
I wonder if the comment that
"copyright protection never extends to names or short phrases as a matter of law"

is a dig at the 2005 Bridgeport music decision where the US Court of Appeals for the 6th Circuit ruled that a 2 second sampling of 3 notes constituted copyright infringement.

And how about this on APIs:
"An API is like a library. Each package is like a bookshelf in the library. Each class is
like a book on the shelf. Each method is like a how-to-do-it chapter in a book. Go to the right
shelf, select the right book, and open it to the chapter that covers the work you need. As to the
37 packages, the Java and Android libraries are organized in the same basic way but all of the
chapters in Android have been written with implementations different from Java but solving the
same problems and providing the same functions. Every method and class is specified to carry
out precise desired functions and, thus, the “declaration” (or “header”) line of code stating the
specifications must be identical to carry out the given function."
 Mark Lemley at Stanford (and owner/coordinator of the excellent Cyberprof list) gets a mention.
 "the number of software patents in force in the United States has dramatically increased from
barely a thousand in 1980 to hundreds of thousands today...This has caused at least one noted commentator to observe:
As software patents gain increasingly broad protection, whatever
reasons there once were for broad copyright protection of
computer programs disappear. Much of what has been considered
the copyrightable “structure, sequence and organization” of a
computer program will become a mere incident to the patentable
idea of the program or of one of its potentially patentable
subroutines.
Mark Lemley, Convergence in the Law of Software Copyright?, 10 HIGH TECHNOLOGY LAW JOURNAL 1, 26–27 (1995)."
Whereas it's true copyright causes all sorts of problems for programming I remain as unconvinced as Donald Knuth was in 1994 that software should be subject to proprietary patent rights.  I find the idea that software is mathematics too convincing for that.

Most notably in this case, though, Judge Alsup is pretty scathing about Oracle's claims in concluding:
"In closing, it is important to step back and take in the breadth of Oracle’s claim. Of the
166 Java packages, 129 were not violated in any way. Of the 37 accused, 97 percent of the
Android lines were new from Google and the remaining three percent were freely replicable
under the merger and names doctrines. Oracle must resort, therefore, to claiming that it owns,
by copyright, the exclusive right to any and all possible implementations of the taxonomy-like
command structure for the 166 packages and/or any subpart thereof — even though it 
copyrighted only one implementation. To accept Oracle’s claim would be to allow anyone
to copyright one version of code to carry out a system of commands and thereby bar all others
from writing their own different versions to carry out all or part of the same commands.
No holding has ever endorsed such a sweeping proposition.
CONCLUSION
This order does not hold that Java API packages are free for all to use without license.
It does not hold that the structure, sequence and organization of all computer programs may be
stolen. Rather, it holds on the specific facts of this case, the particular elements replicated by
Google were free for all to use under the Copyright Act. Therefore, Oracle’s claim based on
Google’s copying of the 37 API packages, including their structure, sequence and organization
is DISMISSED. To the extent stated herein, Google’s Rule 50 motions regarding copyrightability
are GRANTED (Dkt. Nos. 984, 1007). Google’s motion for a new trial on copyright infringement
is DENIED AS MOOT (Dkt. No. 1105)."
It's a 2-1 win for Google on the merits of the case which, given a jury recently decided Google didn't infringe Oracle's claimed patents, is a killer blow to Oracle's bid to extract multiple truckloads of cash from Google's coffers.

Apologies for the formatting issues with the extracts from the ruling.

Monday, May 28, 2012

The universality of organisational stupidity

1.   Knowledge = Power [sic]

2.   Time = Money [sic ditto]

3.   Power = Work/Time [Science]

Substitute 1. into 3. to give:

4.   Knowledge = Work/Time

Substituting 2. into 4. demonstrates:

5.    Knowledge = Work/Money

Re-arranging 5. leads to the conclusion that

6.     Money = Work/Knowledge

Hence we derive and/or demonstrate the universal nature of organisational stupidity. I was thinking of using this in opening my book on the convergent evolution towards insanity of large organisations.  But insanity, at least in a legal sense, is to do with a person's capacity to be responsible for their actions in the context of a loss of contact with reality. Stupidity is a feature of the insanity of large organisations but I'm wondering if it is a sufficiently important feature or emergent property of the insanity to merit inclusion in the introduction? Answers on a postcard (or electronic equivalent) please...

Friday, May 25, 2012

A Global reality: don't put your data in the cloud, Mrs Worthington

Hogan Lovells have produced a very practical and succinct white paper, A Global Reality: Governmental Access to Data in the Cloud.

The authors examine government access to personal data in the cloud across ten jurisdictions and conclude that we're kidding ourselves if we believe controls on government access are tighter in the EU than the US.
"Businesses often assume knowledge of the laws regulating
governmental access to data in their home jurisdictions, and
they make further assumptions about the legal regimes
abroad where Cloud service providers may be located."
The authors mention the PATRIOT Act as a particular bogey man for critics of the US in this regard. Whereas the PATRIOT Act does give governmental authorities wide ranging powers equivalent anti- terrorism laws in other jurisdictions mean
"Every single country ... examined vests authority in the
government to require a Cloud service provider to disclose
customer data in certain situations, and in most instances
this authority enables the government to access data
physically stored outside the country’s borders, provided
there is some jurisdictional hook."
The result is that:
"Some erroneously believe the best way to limit governmental
access to data is to use Cloud service providers present only
in “safe” jurisdictions – places where data are thought to be
free from troublesome governmental access."
But even when particular jurisdictions don't seem to have nominally permissive access regimes,
"The existence of Mutual Legal Assistance Treaties greatly
diminishes any argument that data stored in one jurisdiction
is immune from access by governmental authorities in
another jurisdiction." 
Just as civil rights activists have been explaining for years, you can drive a coach and horses through the loopholes in the statutory protections for privacy in the EU.

The report points out that in terms of protection the EU could, by virtue of the existence of the data retention directive (Directive 2006/24/EC) be structurally weaker on personal data protection in theory than the US.
"a law that perpetuates the existence of data that might not otherwise be available to governmental authorities (because it would have been deleted) is a factor to be considered in evaluating the favorability of one jurisdiction over another as a service provider location."
Being a short overview of 10 jurisdictions the Hogan Lovells report doesn't have the capacity to go into the practical application of the various legal regimes. They clearly and succinctly outline the situation in each jurisdiction - the US, Canada, Australia, Denmark, France, Germany, Ireland, Japan, Spain and the UK and also note that "Proposals for reform of privacy rules in the EU do not contemplate altering the current environment in which law enforcement has significant access to data in the Cloud."  In the UK, for example,
"The government may intercept communications if doing so is
“necessary” in the interests of national security; for the
prevention or detection of a serious crime; to safeguard the
economic well-being of the UK; or in response to a request
under an international mutual legal assistance agreement.
There is no need for court approval and the details of such
an “interception warrant” must be kept secret."
The table at the end of the paper provides a neat summary indicating you can barely slip a cigarette paper between the access regimes across all 10 jurisdictions reviewed. The lesson?

For the foreseeable future, if you want to protect your data from essentially unrestrained government access, (without even thinking about private sector and criminal access and sharing), don't put your data in the cloud, Mrs Worthington.

Report authors, Winston Maxwell and Christopher Wolf, should be commended for condensing a complex subject in such an accessible way.

Update: One of the smartest thinkers/practitioners around on privacy and the Net, Caspar Bowden, has pointed out that the over-simplification in the report, as simplification often does, distorts the real story here. The claim that the EU might be structurally weaker than the US on privacy regulations, for example, does not stand up to any kind of close scrutiny. Caspar draws particular attention to the DOJ's belief that the PATRIOT Act is subject to secret government interpretation and additionally that such claims are unsustainable when the details of the PATRIOT Act and the FISA (Foreign Intelligence Surveillance Act) Amendment Act 2008 (s.1881a) are examined and compared to EU regulations.

Update 2

Caspar Bowden says:
"This paper, and several others of its kind over past few years, manage to avoid mentioning ... :

- the FISA Amendment Act 2008 s.1881a, which created a new power targeted only at non-US persons outside the US, to intercept communications and access "remote computing services" (i..e Cloud computing) from any company subject to US jurisdiction, which compels access, without any warrant, to...

- ...information which merely "relate" to "the conduct of the foreign affairs of the United States" or "with respect to" a "foreign territory" or "a foreign-based political organization". Isn't is strange how all US accounts of US laws seem to omit these limbs of the (enormous and rambling) definitions?

- s.215 of the Patriot Act, which is being interpreted according to some secret doctrine that is (possibly/probably) about grabbing arbitrary data stored on disk under powers designed for library records, thus avoiding a warrant. This will likely be worse if you are outside the US, because you will have no chance at all to get standing in a US court (assuming you ever found out about it).

All this is quite illegal in ECHR territories, which grant universal rights irrespective of nationality (within the jurisdiction of the 50 signatory states), with laws that are precise and foreseeable in their effect, for purposes which cannot include spying on ordinary lawful democratic political activities and beliefs"
He goes on to comment specifically on some of the detail:
"pp1. "As one observer put it, France's anti-terrorism laws make the Patriot Act look "namby-pamby" by comparison."
- following the footnotes, that 'observer' is one Gary Schmitt, former staff director of the US Senate Select Committee on Intelligence

pp2. - "it is incorrect to assume that the United States government’s access to data in the Cloud is greater than that of other advanced economies"
- Untrue: FISA explicitly discriminates both the protections and allowed purposes by nationality, given inferior (or zero) protection to foreigners, especially outside US

pp.2 - Kennard: "In a number of critical areas, the U.S. provides more restrictions to the access of personal data than do European Member States."
- Untrue: under no Cloud-relevant circumstances will the data of a European in Europe receive greater protection under US law than under European law

pp.2 - "Despite the procedural hurdles that may exist to request and obtain information pursuant to MLATs..."
Misleading - euphemism for fact EU law enforcement authorities may have to wait 6 months while their MLAT requests stack up in the US Department of Justice (thus discouraging sending very many)

pp2. - "The existence of Mutual Legal Assistance Treaties greatly diminishes any argument that data stored in one jurisdiction is immune from access by governmental authorities in another jurisdiction."
Wrong - unless the US wants to do any political spying (e.g. on the European Commission where apparently use of US cloud apps is rife for preparing official documents)

pp.4 - "The reality is that most of the investigatory methods in the Patriot Act were available long before it was enacted. And those investigative tools had, and still have, limitations imposed by the United States Constitution and by statute"
Misleading: - although the US Constitution is silent on the matter, the US mostly doesn't recognize (ask John Yoo) foreigners as having Constitutional rights, even those physically within US territory. Which is sort of the point in Cloud computing.

pp.4 "Under the ECPA, if a government body seeks disclosure of customer data from a Cloud service provider, it can only do so if a judge issues a search warrant or special ECPA court order, or if the government issues a valid subpoena to the provider"
Omission - which is why the secret interpretation malarkey of Patriot 215 is important, because it by-passes this law and then some (no probable cause, or reasonable grounds to believe etc.)

pp5. "FISA Orders and NSLs were available to the United States government even before the Patriot Act was enacted. The Patriot Act merely expanded some of the
provisions of these access methods. For example, it added “gag order” provisions"
- here's what that merely amounted to for one small ISP owner

pp.5 "A Cloud service provider also may petition the court to overturn the “gag order.”"
- only took Nick Merrill six years of life

pp5. "...relevant to the concerns of foreign countries about their nationals’ data, a recent ruling by a United States appeals court one level below the Supreme Court confirmed that statutory protections are extended to non-United States citizens for data physically maintained in the United States and stored in the Cloud"
Misleading & wrong: - there's no reference given, but they plainly mean the Suzlon case, which only applies to ECPA (Electronic Communications Privacy Act) not ways of getting at data under FISA or Patriot or relying on 4th Amendment protection, and isn't a Supreme Court decision anyhow. But well done Microsoft for litigating hard anyway, even if it is self-serving to reassure your foreign customers.
====

[...]

====
pp.12 "In short, the proposals for reform of privacy rules in the EU do not contemplate altering the current environment in which law enforcement has significant access to data in the Cloud."
Sadly true but also misleading: the draft of the proposed new EU DP Regulation which leaked in Dec 2011 contained an Article (42) which would have required Cloud providers to get the approval of data protection authorities before responding to direct US law enforcement authorities' requests (e.g. under Patriot/FISA), on pain of severe fines, and to notify the individual. Presumably after heavy lobbying, this Article was removed in the published proposal, replaced with a pathetically weak Recital 132 which says if the Commission finds out something naughty is going on they should jolly well do something about it quickly""
Caspar would be grateful for comments, corrections and refinements. Thanks to Caspar and to Peter Sommer who originally drew my attention to the report via the excellent FIPR alerts.


Monday, March 19, 2012

The $8 (or maybe $6) billion iPod

Rob Reid, founder of the Rhapsody online music subscription service has being doing some copyright Maths at TED.



He suggests we put aside the emotive debates about copyright and associated monsters like SOPA and ACTA and look at the numbers.  The MPAA, for example, claim the internet is costing the US economy $58 billion a year "due to content theft".  $58 billion which if you had it laid out in pennies would stretch all the way to Mars. It's also equivalent to the entire US corn crop failing, along with all fruit, wheat, cotton, rice and a number of other crops.

Music revenues are down about $8 billion a year since Napster's early days according to the music labels.  Movie and cable TV along with publishing revenues are up so where's the missing $50 billion, once the $8 billion drop in music sales is accounted for? With copyright revenues up in most sectors the missing $50 billion must be "foregone growth in a market that has no historic norms", i.e. a market that didn't previously exist.  His tongue in cheek answer to the missing link is "the insidious cost of ringtone piracy."

The MPAA also tell us the economy loses 373,000 jobs to content theft. Interesting given that in 1998 the US Bureau of Labour Statistics showed the entertainment companies were employing 270,000 people.

He goes on to talk about the $150,000 statutory damages available in the US for copyright infringement, (hence the notorious excessive damages in the Jammie Thomas and Joel Tenenbaum cases).  He claims the original MP3 player the Rio could store 10 songs i.e. $1.5 million worth of songs. In an iPod with a 40,000 song capacity this runs to $6 billion "worth of stolen media." It's a pity he got his sums wrong here, as he actually says "$8 billion worth of stolen media or about 75,000 jobs."  Maybe the error is deliberate and he's making a subtle point about the normal rules of mathematics being ignored in copyright debates and policy?  His conclusion that you might find copyright math strange is an understatement.  The five minute talk is nevertheless worth a look.

Update: Rob Reid explains his $8 billion calculation:
"In determining a given device’s maximum capacity for infringing material, I assumed an average song length of three minutes, and an encoding rate of 128 kilobits/second. I went with 128 kbps because using the AAC codec,[25] this is the rate at which music achieves “hi-fi transparency[26] — which is to say, it becomes indistinguishable from CD quality in most listening environments. This rounds very closely to 1 megabyte of data per minute of music.[27] At 32 megabytes, the Rio (1999’s Christmas hit) therefore had room for about 10 songs, which, if pirated, could represent up to $1.5MM in liabilities under US law. Today’s iPod classic, with its 160GB capacity, can hold 53,333 songs, which at $150,000 a pop is precisely $8 billion. Incidentally, Apple markets the iPod classic as having room for just 40,000 songs, but by my math, that’s selling it short. I meant to note this in the presentation, but I was running way over time by then, and spared everyone the convoluted math (so if the leap from 40,000 songs to an $8 billion liability confused anyone, I apologize — I had meant to take a quick detour through that 53,333 figure!)."
That's a really helpful clarification.  The problem with simplifying  is you end up losing precision to the point of getting it wrong. I hesitate to extend the pedantry but 53,333 songs at at $150,000 a pop is precisely $7,999,950,000 not $8 billion. Another 1/3 of a song at $50,000 is needed to reach the magic $8 billion.  Of course the odd $50k in the copyright wars is barely discernible small change...

Wednesday, March 14, 2012

Pictfor: Harvgreaves, consumer & creator rights

Consumer Focus and the Parliamentary Group on Internet Communications and Technology (Pictfor) had another panel discussion about the Hargreaves review yesterday evening in the Grand Committee room in Westminster Hall at the Houses of Parliament.  The speakers were Mike Holderness, Chair of the Creators’ Rights Alliance, Gwen Thomas, Consultant to the Association of Photographers, Saskia Walzel, Senior Policy Advocate at Consumer Focus, and Simon Indelicate of the UK band the Indelicates.

The event was chaired by Alun Michael MP, who opened proceedings opining that finding common ground was a more productive process to the usual situation where vested interests get together in their own silos and reinforce their own views. Stakeholders getting together, listening to each other and working out a way forward was much better than leaving it to government which has a huge capacity to get things wrong. So stakeholders should work out what needs to be done and get the law to underpin that with principles. He also mentioned that the panel event was a follow up to a Consumer Focus and creators rights day long event which had explored:
  • Copyright exceptions
  • Orphan works
  • How to smooth the flow of money from consumers to creators
- and associated issues. Then introduced the speakers, inviting Saskia Walzel of Consumer Focus to go first. Saskia opened by explaining Consumer Focus is the statutory watchdog for consumers. They work on copyright licensing, exceptions and enforcement.  The work on licensing grew out of their initial work on enforcement.

Consumer Focus are keen for licencing reform and the facilitation of the licensing of legal services in a timely manner. They have found that consumers are broadly supportive of copyright as a framework to ensure creators get a fair share of the revenues flowing from their work.  But equally consumers are bewildered by the complexity of copyright and for example the illegality of format shifting.

Historically consumers were not big stakeholders in the detailed archaic rules of copyright. It was relatively difficult for them to engage in infringement, so they didn't need to understand the rules. In the modern world though where the use of a computer connected to the internet results in de facto copyright infringement consumers need to understand and buy into copyright regulations.  So Consumer Focus strongly support Hargreaves recommendation for a limited private copying exception.

Saskia said the last major copyright law update in the UK was in 1988 in the time of tape recording machines. Ancient times and therefore unsuitable for the internet age. Consumers expect private copying to be legal. But also accept unlawful copying via peer to peer networks to be controlled.

In a digital age many exceptions intended to benefit creators are now used by consumers e.g. reporting and commenting done by bloggers. So exceptions need to work for consumers as well as creators. Consumers are users of copyrighted materials and share creator needs.

Consumer Focus argue there is a desperate need for a small claims court for copyright disputes.  The UK Intellectual Property Office hope to introduce such a system later this year. The cost of litigation under the current system is way beyond the means of most individual consumers and creators. The current system was created for commercial entities, the assumption being they would have the necessary funds to go to court if and when necessary.

Hargreaves conclusions were quite similar to those of the Gowers review in 2006. The primary difference was the Hargreaves concentrated on well functioning markets to support growth and therefore focused on licencing. Consumers and creators are large stakeholders in this. We need to ensure the fruits of consumer spending get back to creators. Creators in the UK often get a very small slice of the pie if any at all.  In a bid to address this creator groups have periodically called for levies on consumer technology like ipods. The thinking is that an extra revenue stream can be generated which creators could benefit from.  But the flaw in the plan is that it does not address the key problem of the money being soaked up by intermediary commercial agents like the big music labels. Nearly £800 million was spent on recorded music in 2011. Commercial companies and wealthy artists got the lion's share of it.

Saskia also noted that Hargreaves did not properly consider creators' rights. Though moral rights do get mentioned.

There is an underlying false assumption behind a lot of the public debate on copyright that creators' rights are coincident with commercial entities interests.  The Monopolies and Mergers Commission as far back as the mid 1980s found that the big music labels were engaged in monopolistic practices; and that they used their monopoly position to impose unfair contract terms on creators.  Yet they concluded that this was not against the public interest.

The interests of creators and commercial intermediaries are not the same. So how do we construct a copyright system where intermediaries do get paid but creators get a better share of the spoils?

The next speaker was Mike Holderness, Chair of the Creators’ Rights Alliance (CRA). He explained that the CRA has about 100,000 members, many of whom are sole traders. The CRA are concerned about how we will get growth.

He asked the question: what do? And then answered by stating it involved overwhelmingly the work of sole traders. These individuals have very little bargaining power in dealing with the commercial intermediaries.  Mike Holderness himself is a science writer.

Technological changes create massive possibilities e.g. to reach a worldwide audience but most of these possibilities are only theoretical.  The changes and the possibilities provided to sole traders by disintermediation are welcome.  But the problem is taking advantage of the changes because people trust big name brands.

Hargreaves concentrated too much on re-users and intermediaries (e.g. big search engines) as far as the CRA is concerned. It is hard to make a living as a professional creator. Wikipedia is a great example of what people will do for free but it's not reliable.  We have to have reliable information produced by people who dedicate their working lives to doing it.

There has been a lot of controversy around the phone hacking scandal and we need to get journalists to take responsibility for their work.  Yet they often have no control over how it is presented.  The journalist researches and writes a story.  It is then mangled by the editorial process at the newspaper where the first three paragraphs are rewritten to trot out the paper's editorial line. To get the story as it was intended to be conveyed you have some chance only if you start reading at the fourth paragraph. There are numerous examples of newspapers and magazines altering photographs e.g. Time Magazine's alteration of a photo of O.J.Simpson around the time of his arrest as a murder suspect making his skin look darker. An unaltered copy of the photo appeared simultaneously in Newsweek. The original photographer had no control over any of this. The president of the CRA herself had an article she wrote on gay marriage grossly distorted and misrpresented when published in the Gulf.

Publishers often have a standard creator rights waiver which writers are obliged to sign if they want their work published. So creators need an enforceable right to be named/accredited as happens in France. The UK has failed creators in the area of moral rights. Moral rights support the careers of individual creators.

These laws are not made for agents.  Every kid in the country will be a published author, holding copyright in their contributions to Facebook, before they can vote.  We therefore need to level the playing field in terms of relative bargaining power between individuals and large commercial services like Facebook.

As he then got the nod from the chair that his time was up, Mr Holderness concluded with a rapid "Libraries are a very wonderful thing!"

The third speaker was Gwen Thomas, Consultant to the Association of Photographers. Ms Thomas opened directly with a critique of the Hargreaves review suggesting it missed two key areas - contracts and moral rights.  The Association of Photographers did a survey in 2007 of about 2500 members. 50% of respondents said that their bargaining power had diminished in the previous ten years. 40% had been forced into signing moral rights waivers and 24% had seen decline in attribution over the same period. 31% said the decline was getting worse.

So they believe we need to strengthen moral rights and equalise bargaining power of commissioners, creators and users.

When the Copyright Designs and Patents Act (CDPA), introducing extra protection for photographs, came into force on 1 August 1989 it was a mixed blessing.  Nice in theory but that same day nearly all photographers got a letter from the big publishers including a contract to waive moral rights. They were obliged to assign the copyright in their photos to the publisher and waive their moral rights into the bargain. For every photographer refusing to assign copyright there is a queue of people prepared to do it.

Unlike for European colleagues UK law treats copyright like a property right. Therefore as property it is something you can give or sign away.

The UK needs to strengthen the Unfair Contract Terms Act 1977 which does not apply to intellectual property.

Moral rights are hugely important to photographers because derogatory treatment of their work is rife.  Most professionals are aware of moral rights but not that they need asserting. Everyone is a photographer but most are not aware of their rights under the law.

There is a lot of talk about orphaned works but images become orphaned unintentionally.  The original photographer knows they are not orphaned. Photographers can avail themselves of the economic benefits of lending rights when there is no name on the image.

Moral rights are incredibly important for reputations.  The moral right to object to the derogatory treatment is hugely important (this applies equally to digital artists and illustrators).  Images can be and are widely copied and mutilated on the internet and this can damage the career of a photographer.  Misuse, distortion and doctoring of images of people can damage the people in those photos.

We need stronger moral rights.  If we don't get them the UK photographic community will decline.

The problem with digital images is that the embedded metadata can be removed.  Photographers use the internet to sell themselves but images are constantly lifted.  The Association of Photographers calls for "effective sanctions against those who deliberately extract metadata."  When I asked later if they were asking for specific new anti-circumvention provisions in law to cover metadata in digital photographs Ms Thomas indicated with a nod that yes that was what they were interested in.

Simon Indelicate of the Indelicates band was the final speaker. He began by explaining he found the idea of copyright weird and then proceeded to outline the genealogy of one of his own songs, Savages, from the album Songs for Swinging Lovers. He described the song as being one of his favourite creations which he would hate to see mistreated.  The song draws inspiration from -
  • Ode to my Family by the Cranberries - chords
  • Orchestration from someone else
  • Beat - "used in every dance track since 1985 and every indie song since 2003"
  • The savage from Huxley's Brave New World, a title stolen from Shakespeare
  • Paraphrased line from West Side Story
  • The phrase "sweat of the brow" as used in a particular video game
  • A section stolen from a poet who stole it from another poet which ended up sounding like something from The NeverEnding Story.
  • Samples from recordings made by a violinist
None of the parts were done by corporates.  They were created by him being inspired by other creators. But he believes the resultant song is uniquely his and certainly uniquely important to him and his wife. Good art communicates and for that we need to be able to freely refer to our culture. Just like Milton freely referred to the Bible and Shakespeare. Creators need to be able to consume and use copyrighted materials.

He wants people to pay him for his creations but we need to recognise that our culture does not have the division between creators and consumers there used to be.  Creation needs constant access - free and open access - and also a chain of recognition.

At this point the chairman, Alun Michael, called for questions from the floor, with an opportunity for the panel to respond at the end. The 'questions' mostly turned out to be statements rather than questions.

Q1.  New technology is changing at an astonishing speed. Everyone has become a creator. Who needs to change fastest, intermediaries or legislators? (That, in fairness, was a question)

Q2. Could Gwen Thomas from the Photographers Association elaborate on how to draw the line between original work and what users can do with it? (Also a question. Pity Alun Michael didn't let the panelists respond at this stage.  It might have set the tone for a dialogue.)

Q3. David Hammerstein of the TransAtlantic Consumer Dialogue (TACD) said copyright is not in harmony. Citizens violate copyright massively. Therefore we need to adjust the law to fit reality. He finds though he is almost reluctant to describe it as such a "luddite" resistance to this change. So at the point when we have the ability to digitise orphan works we get the EU constructing a law to prevent it.  Copyright is almost absurd today. It is absurd that we need an international treaty to give blind and partially sighted people access to copyrighted works. 1.5 million Braille works can't be sent from the UK to India because it is illegal.  It's very important to release orphan works and facilitate easy access for those with visual disabilities.

Q4. Paul Ellis, co-founder of Stop43, who successfully lobbied against photography provisions in the Digital Economy Act, said orphan works are only orphans as far as the discoverer is concerned. A photographer knows his own work is not orphaned. Calling the copying of orphaned works a victimless crime is nonsense. Copyright is a human right under Article 27 of the Universal Declaration of Human Rights. Creators have to be allowed to make money from the work we create.  We can only do that through copyright.

Q5. A representative from the Open Rights Group asked Gwen Thomas if she could clarify whether it was moral rights or economic rights the Photographers Association was most concerned about. (Another question!)

Q6. A representative of the UK IPO mentioned they were working on a current government proposal that photographers should be equitably remunerated.

Q7.  James Firth of Open Digital asked how the panel viewed the global jurisdiction issue particularly in the light of the two recent copyright extradition cases. (Note the Home Secretary, in the latest stage of the UK TVShack case, decided yesterday that student Richard O'Dwyer should be extradited to the US).

Q8. I asked Gwen Thomas if she was calling for a specific new anti-circumvention provision in law to cover meta data in digital photographs.  She nodded.

Q9. Three or four (if EMI doesn't get rolled into Universal) music companies own 95%+ of the world's recorded music of the past 50 years.  These middlemen are standing in the way of consumer money getting to creators.  Transparency is important. We need clear audit trails of the cash flows.

Q10. Guy Fletcher of the Performing Rights Society (PRS) said they represent 75,000 writers and 5000 publishers.  In answer to the point made by one of the speakers about the Monopolies and Mergers Commission, they also investigated the PRS and found them to be effective.  About 60,000 of their writers don't make a living.  Those 60k need the collective bargaining strength of the PRS.  The Monopolies and Mergers Commission decided they were a necessary and benign monopoly.  The PRS Board is run by creators and publishers.  He welcomed the moral rights language in the 1988 copyright legislation.  However the writing community suffer like the photographers.  They bend to pressure and sign waivers.

Q11.  A former MP and representative of the CRA asked Saskia Walzel of Consumer Focus when the interests of consumers should override those of creators.  (Finished on a high with a question).

The panel then got the chance to respond in reverse order.

Simon Indelicate went first. He said the collecting agencies presented an interesting problem. When his band plays in small clubs in Germany those clubs pay large fees to the German collecting agency. As a result those clubs are barely financially viable. Yet his band never sees even a small proportion of the fees paid to the collecting society because they are too far down the food chain.

He believes we can improve the system with the aid of modern technology.  The collecting agency system is too monolithic at the moment - everyone loses apart from Bono.  On the points raised by Stop43 on unintended orphan works and moral rights, they are legitimate but all creators including Shakespeare stand on the shoulders of giants.  Copyright's purpose is to ensure more culture is made.  More culture is good for society and the Net is great at facilitating the creation of more culture.  He doesn't like the idea of the law making the creation of culture more difficult.

He also has a problem with the claim that he has a right to make money doing what he does.  As far as culture is concerned supply has exploded but demand has not kept pace.  Yes photographers should get paid but they don't have a right to make a living from photography.

His final contribution addressed the first question - he didn't care if corporations (i.e. intermediaries) changed because their business models were already causing them to fail.

Whilst making his points he was subject to some heckling by Labour MP, Jim Dowd, who had originally been scheduled to be on the panel in his place. He responded to Mr Dowd robustly and was cheerfully supported in that endeavour by the chair, Alun Michael.

Next up was Gwen Thomas from the Photographers Association.
She was particularly keen to address the question from the Open Rights Group representative about whether they were primarily concerned about moral or economic rights. Moral rights were pre-eminent.  The primary focus was integrity not money.  But the building of reputation through the protection of moral rights enabled photographers to derive income from their work.

Mike Holderness from the Creators' Rights Alliance was next.
He has a problem with the corporation that scanned all the world's books without permission and put them online. A creator should have the right to object to the distortion of their work in a way which damages their reputation.  He is pleased there is a sensible draft of a WIPO Treaty for an Improved Access for Blind, Visually-Impaired and Other Reading Disabled Persons. There were delays there because a lot of vested interests were trying to include crazy exceptions on the back of it.
Most importantly to round off Mr Holderness was emphatic about the need to level the playing field in terms of the relative bargaining power between individual creators and the corporations they do business with.

Saskia Walzel from Consumer Focus finished up the session for the panel.
She outlined some history explaining copyright was originally supposed to cover books and the law has been changed in response to changes in technology.  In the UK we have had big changes in copyright law in 1911, 1956 and 1988. So it is not unusual that it gets changed to cope with new technology. It is the current rate of change of the technology that is the problem.

It takes about 3 years to update primary legislation. So we should make copyright legislation more technology neutral.

Creators should always be attributed as has been the case in most European countries since the beginning of the 20th century.  That principle has not changed.

In the UK the time-shifting exception in 1988 has stood the test of time. Lots of language in the 1988 Act was technology specific (e.g. photocopying).  Such language will not stand the test of time.

Creators are the first owners of copyright.  They get that privilege so they can bargain with publishers.  Shakespeare had no copyright but still made money.  Copyright developed country by country. That's why Charles Dickens had so many problems with the US where so many publishers copied, printed and sold his books without ever paying him a penny.  There was no mutual respect between countries or recognition of the copyrights of foreign authors until the Berne Convention was negotiated in the late 19th century.

We as a society have decided that rewarding creators is important.  Some people are making money out of the copyright system. Too often these beneficiaries are not the creators.  So we need to focus on reforming the contracts and licencing systems to ensure creators get a fairer share of the spoils.

Alun Michael then closed proceedings by expressing his admiration in principle for the notion of technology neutral laws.  His concern is that technology makes everything unpredictable. Also that too often parliament is concerned with legislating to deal with specific problems of the day, rather than laying down blueprints of more general principles.

A few of closing notes:

1.  Thanks to Consumer Focus for inviting me along.

 2. I've attempted to report what was said accurately at this stage, rather than comment (with the exception being the comment about the way questions were handled).  Regular readers will know I have a different perspective to a number of the views expressed.

3. It is irritating when the blogger spellchecker refuses to work on long posts - precisely when it is needed - and I have to cut and paste and check in an external word processor.  If I've missed any typos let me know and I'll correct them.

Monday, March 12, 2012

EDPS opinion on the data protection reform package

The European Data Protection Supervisor (EDPS), Peter Hustinx, last week issued his opinion on the European Commission's data protection reform package. The Commission announced proposed changes to EU data protection rules in January, including a proposal for a Directive covering data protection in law enforcement. He is impressed with the intent of the new general data protection rules and simultaneously "seriously disappointed" (code for "appalled") at the carving out of a special anything goes directive for law enforcement. There is a decent summary of the opinion in the associated press release.
"On the package, Peter Hustinx, EDPS, says: "The proposed Regulation constitutes a huge step forward for the right to data protection in Europe. However, we are unfortunately still far from a comprehensive set of data protection rules on national and EU level in all areas of EU policy. The proposals are disappointing in the law enforcement area, and they leave many existing EU data protection instruments untouched, such as the data protection rules for the EU institutions and bodies and also all the specific law enforcement instruments...
"The proposed rules for data protection in the law enforcement area are unacceptably weak. In many instances there is no justification whatsoever for departing from the rules provided in the proposed Regulation. The law enforcement area requires some specific rules, but not a general lowering of the level of data protection."
The EDPS is concerned in particular with regard to:
  • the lack of legal certainty about the further use of personal data by law enforcement authorities;
  • the lack of a general duty for law enforcement authorities to demonstrate compliance with data 
  • protection requirements; 
  • the weak conditions for transfers to third countries; 
  • the unduly limited powers of supervisory authorities. "
In relation to new general Regulation on data protection he also has some specific concerns on the details:
  • the possibilities for restricting basic principles and rights;
  • the possible derogation for transferring data to third countries;
  • the excessive powers granted to the Commission in the mechanism designed to ensure
  • consistency among supervisory authorities;
  • the new ground for exceptions to the purpose limitation principle.
As usual with Mr Hustinx it is a thoughtful comprehensive opinion and whereas I don't expect many but privacy anoraks to read and inwardly digest the full 85 pages, the two page executive summary should be compulsory reading for all EU citizens.  Expect the Commission to liberally use and abuse that description of the proposed regulation as "a huge step forward for data protection in Europe" whilst simultaneously ignoring and engaging significant energies to circumvent the serious concerns raised in the opinion.