Tuesday, June 06, 2006

If the UK knew Ireland better the Iraq invasion might not have happened

George Monbiot is prompted by the UK media's bashing of Ken Loach's latest film (despite these critics not having seen it) to conclude that if the British "knew more about Ireland, we might never have invaded Iraq" I haven't seen it either so can't comment on the film other than to say it won the Palme d'Or at Cannes. Monbiot says:

"There is no question that the IRA also killed ruthlessly - not just police and soldiers but also people they deemed to be informers and collaborators. But Loach shows this too. (I have seen the film.) The press hates him because he admits that the people who committed these acts were not evil automata, but human beings capable of grief, anger, love and pity. So too, of course, were the British forces, whose humanity is always emphasised by the newspapers. Ken's crime is to have told the other side of the story.

The other side - whether it concerns Ireland, India, Kenya or Malaya - is always inadmissable. The torture and killing of the colonised is ignored or excused, while their violent responses to occupation are never forgotten. The only aggressors permitted to exist are those who fight back.

Does it matter what people say about a conflict that took place 85 years ago? It does. For the same one-sided story is being told about the occupation of Iraq. The execution of 24 civilians in Haditha allegedly carried out by US marines in November is being discussed as a disgraceful anomaly: the work of a few "bad apples" or "rogue elements". Donald Rumsfeld claims "we know that 99.9% of our forces conduct themselves in an exemplary manner", and most of the press seems to agree. But if it chose to look, it would find evidence of scores of such massacres...

Why should we be surprised by these events? This is what happens when one country occupies another. When troops are far away from home, exercising power over people that they don't understand, knowing that the population harbours those who would kill them if they could, their anger and fear and frustration turns into a hatred of all "micks" or "gooks" or "hajjis". Occupations brutalise both the occupiers and the occupied. It is our refusal to learn that lesson which allows new colonial adventures to take place. If we knew more about Ireland, the invasion of Iraq might never have happened."

There is an untapped well of ignorance about foreign politics in the UK (I should say this is not unique to the UK, of course) which makes the kind of ill-informed media critiques Monbiot is complaining about potentially quite dangerous, because of the kind of (anti-Irish in this case) xenophobia they can whip up. In the wake of the Birmingham pub bombings in the 1970s my aunt was paying for some goods in a shop. When she said thanks to the lady at the checkout, in her dulcet Irish tones, the man next in line spat in her face and launched into a rant about effing Irish murderers. To this day she doesn't hold a grudge against her assailant, though I wonder if he has lost his hatred of those who are different to him.

And Monbiot is correct. Authorities ignore the atrocities of war and occupation at their own peril and that of future generations. You can't send young people with guns into volatile situations where they believe their lives to be under constant threat and expect them to behave rationally and ethically in all circumstances. That's not seeking to excuse massacres of the type that happened at Haditha allegedly carried out by US marines. There are no clear good guys with white hats and bad guys with black hats in a warzone, just ordinary people who have got caught up in engaging in extraordinary violence to pursue some cause, follow orders, defend themselves and their colleagues or family, purge some hatred, engage in revenge... Soldiers and other ordinary people in such situations have a tough enough job without pretending that they are saints. Ordinary people make mistakes. Unfortunately mistakes and loss of control in a war zone mean people get badly injured or killed.

NHS trusts pay millions in fines to IT suppliers

The NHS IT system is already two years behind schedule and way over budget and to add to the farce, cash strapped NHS trusts are now having to pay the suppliers £millions in fines for failing to second scarce staff to work with the suppliers. A Tory MP, Richard Bacon, on the Public Accounts Committee discovered the situation. He said

""At a time when hard-pressed NHS trusts are having to make painful choices to reduce deficits, they are being forced to pay money they don't have and release staff they can't spare, for something they don't want and which doesn't work ... the NHS is being hit with fines running into tens of millions of pounds, which it simply cannot afford".

Mueller Book on software patents in EU

Florian Mueller has published a book, "No Lobbyists As Such - The War over Software Patents in the European Union" (2M pdf) which is available only in electronic form.

He decided that print publishing wouldn't work too well because his audience would be too geographically dispersed and it is essentially another tool in his award winning campaigning armoury.

" what matters to me more than anything else in this respect is to get my book out to a large audience, especially since the next major war over software patents in Europe will officially break out on July 12 at a hearing to be held by the European Commission in Brussels. The same forces who supported the software patent directive we successfully fought against are now trying to achieve everything they wanted the last time, and even more, by means of the European Patent Litigation Agreement (EPLA). I hope my book will motivate people to take action against the EPLA, an international treaty that would have far worse consequences than the software patent directive would have had."

The NSA Phone Call Database: The European Perspective

Professor Francesca Bignami of Duke Law School, guest blogging at Concurring Opinions, wonders "Had a European government, instead of the Bush administration, created the NSA’s call database, would that government be in violation of European privacy law?" She believes they would and goes on to explain why in a really interesting post covering the divergence in the US and EU approaches to regulating privacy since the 1970s.

Prof. Bignami follows this up with a very informative post about the ECJ decision invalidating the EU-US agreement on airline passenger data (PNR) transfers, one of the most useful facets of which is a nice explaination of the EU's constitutional structure.

"To explain the Court’s logic, I must get into some basic EU law. The European Union has a bizarre constitutional structure that comes out of the fact that it used to be an international organization, now is a quasi-federal polity. It has three “Pillars.” The First Pillar governs the regulation of the common market—things like the rules that apply when a plane takes off from Rome and lands in Munich. This is not an area that goes to the core of national sovereignty, and so the European Union (actually “European Community” when we’re talking about First Pillar) has acquired a lot of power in the First Pillar—and the Member States have lost a lot of power. In the PNR episode, the European institutions acted under the First Pillar: the Commission based its decision on the Data Protection Directive (a market-regulating, First Pillar law) and the Council based its decision on the Data Protection Directive, together with its more general First Pillar powers.

By contrast, the Second and the Third Pillars apply to matters that do go to the core of national sovereignty: defense and other types of foreign policy (Second Pillar) and fighting crime and protecting against internal security threats like terrorism (Third Pillar). The European Union has powers in these areas, but it is hamstrung in various ways by Member States anxious to preserve national sovereignty.

Since the PNR agreement involved private, commercial European air carriers, the Commission and the Council thought they could act under the First Pillar. But the Court of Justice disagreed—essentially the Court said that the European Union would have to act under the Third Pillar or not at all. Here I’m simplifying slightly."

Basically the ECJ said Commission and the Council chose the wrong rules - those dealing with markets (1st pillar) rather than those dealing with terrorism (3rd pillar) - to justify the agreement to give the US authorities the passenger data. Not surprisingly they chose the first pillar route because there were fewer procedural obstacles. Now if they are going to prolong the aggreement beyond the Court's deadline of September this year they'll have to choose an alternative route.

Monday, June 05, 2006

APIG Report on DRM Published

The All Party Internet Group inquiry into DRM has now produced a report with a number of sensible recommendations:

"Summary of Recommendations

#65 We recommend that the Government consider granting a much wider-ranging
exemption to the anti-circumvention measures in the CDPA for genuine
academic research.

#86 We recommend that when the advice from the Legal Deposit Advisory Panel has
been received, the Department for Culture, Media and Sport hold a formal
public consultation, not only on the technical details, but also on the general
principles that have been established.

#92 We recommend that the Department for Culture, Media and Sport review the
level of funding for pilot projects that address access to eBooks by those with
visual disabilities; and that action is taken if they are failing to achieve positive
results.

#105 We recommend that the Office of Fair Trading (OFT) bring forward
appropriate labelling regulations so that it will become crystal clear to
consumers what they will and will not be able to do with digital content that they
purchase.

#113 We recommend that the OFT labelling regulations we proposed, in #105 above,
should ensure that the risks are clearly spelled out, at the point of purchase,
whenever consumers could lose access to digital content if systems are
discontinued, or devices fail, or players are replaced by systems from a different
manufacturer.

#118 We recommend that OFCOM publish guidance to make it clear that companies
distributing TPM systems in the UK would, if they have features such as those in
Sony-BMG’s MediaMax and XCP systems, run a significant risk of being
prosecuted for criminal actions.

#132 We recommend that the Department of Trade and Industry investigate the
single-market issues that have been raised with us, with a view to addressing the
issue at the European level. We accept the argument that other industries may
soon find their markets distorted by DRM systems and so we recommend rapid
development of the principles by which the single market can continue to
operate effectively.

#135 We recommend that the government do NOT legislate to make DRM systems
mandatory.

#147 We recommend that the Department of Trade and Industry revisit the results of
their review into their moribund “IP Advisory Committee” and reconstitute it as
several more focused forums. One of these should be a “UK Stakeholders
Group” to be chaired by the British Library. It should specifically address the
complex issues surrounding DRM, not just from the point of view of experts on
the technology, but with a wide-ranging membership that includes
representatives of consumers, libraries and the creators of content – as well as
the ‘usual suspects’ from the rights holders and content distribution industries."

The numbers refer to the paragraphs in the report where the recommendations are originally made. The 'CDPA' is the Copyright, Designs and Patents Act, including its various amendments incorporating EU directives. A thirty page report is never going to be able to cover all the issues with DRM but this is a good start. I believe Cory Doctorow will be writing a book on drm over the next year or so and expect that will become the standard text.

Schneier on the NSA's base rate fallacy

Bruce Schneier has published another version of his perennial essay on data mining to look for terrorists and the base rate fallacy.

"Data mining works best when you're searching for a well-defined profile, a reasonable number of attacks per year, and a low cost of false alarms. Credit-card fraud is one of data mining's success stories: All credit-card companies mine their transaction databases for data for spending patterns that indicate a stolen card...

Terrorist plots are different; there is no well-defined profile and attacks are very rare. This means that data-mining systems won't uncover any terrorist plots until they are very accurate, and that even very accurate systems will be so flooded with false alarms that they will be useless."

He uses his usual example to examine the numbers. Even assuming you could build an accurate system (no modern technology comes anywhere close), it leads to the police having to investigate tens of millions of potential terrorist plots every day to have a chance of finding one real plot every month. Totally unrealistic. As Bruce says, finding terrorist plots is a needle in a haystack problem and you don't make it any easier to find the needle by throwing more hay on the stack.

Private infringer

There's a new IP blog on the scene, The Continuing Adventures of Private Infringer

"Private Infringer isn't a super hero like Captain Copyright of course. He is just a lowly private who wants to know why everybody keeps trying to tell him what to do, even in the privacy of his own home..."

My favorite character is General Intelligence.

"General Intelligence turned around and slowly started walking back to his jeep by himself. He didn't mind. He was actually getting use to being by himself. Most people, he we was beginning to think, simply did not want Intelligence. And he could live with that."

(Thanks to Seth Johnson on the A2K list for the link)

Just Calling so the NSA could listen

Via the ORG list, there's a lovely animation about the NSA wiretapping controversy at Newsday.

Sunday, June 04, 2006

Felten on wiretapping without specific suspects

Ed Felten has posted the latest in his series about 21st century wiretapping and makes the interesting point that there is a case for blanket wiretapping if human access to specific elements of those communications is only triggered by narrow algorithms that identify a specific suspect's voice pattern or

"some predetermined dialog that is extremely unlikely to occur naturally. Like this, for instance:

First Speaker: The Pirates will win the World Series this year.
Second Speaker: Yes, and Da Vinci Code is the best movie ever made.

The police ask us for permission to run automated voice recognition algorithms on all phone conversations, and to record all conversations that contain this verbal handshake. Is it reasonable to give permission?If the voice recognition is sufficiently accurate, this could be reasonable — even though the wiretapping is not based on advance suspicion of any particular individual. Suspicion is based not on the identity of the individuals speaking, but on the content of the communication...

Obviously we wouldn’t give the police carte blanche to use any kind of content-based suspicion whenever they wanted. What makes this hypothetical different is that the suspicion, though content-based, is narrowly aimed and is based on specific evidence. We have good reason to believe that we’ll be capturing some criminal conversations, and that we won’t be capturing many noncriminal ones. This, I think, is the general principle: intercepted communications may only be made known to a human based on narrowly defined triggers (whether individual-based or content-based), and those triggers must be justified based on specific evidence that they will be fruitful but not overbroad.

You might argue that if the individualized suspicion principle has been good enough for the past [insert large number] years, it should be good enough for the future too. But I think this argument misses an important consequence of changing technology.

Technology raises the possibility that automated algorithms can implement triggering rules, so that content-based triggers become possible — in theory at least.

Given that content-based triggering was infeasible in the past, the fact that traditional rules don’t make provision for it does not, in itself, end the argument. This is the kind of situation that needs to be evaluated anew, with proper respect for traditional principles, but also with an open mind about how those principles might apply to our changed circumstances."

It's what Larry Lessig might call a latent ambiguity. Ed's right - the technology does potentially offer new possibilities for law enforcement but only if the content filtering technology can be sufficiently refined. At the moment it is so crude as to be useless, offering so many false leads that the resources to chase down all of them just don't exist, not to mention the civil liberties implications of such an approach. The temptations for police and intelligence services to trawl (theoretically) legally no-go data warehouses, other than with specific narrow grounds of suspicion (unique content or individually targetted), especially under pressure of simplistic targets to produce results, would be too great to ignore. As Cardinal Richelieu said, give him six lines written by the most honest man and he'll find the evidence there to have him hanged - the data warehouses proposed will always contain enough to metaphorically hang someone. But the data smog gives the real bad guys so much more room for manoeuvre.

Baker & McKenzie's Pre-Emptive World Cup C&Ds

Baker & McKenzie have apparently been sending out blanket pre-emptive cease and desist letters to lots of websites to warn them that they will be monitoring the web for any unauthorised streaming of World Cup activity. Hilariously they've sent one to the folks at BoingBoing who don't even like sports. I detest this kind of cast-the-net-wide-and-who-cares-if-we-scare-the- innocents tactics. The theory is that it keeps honest folks honest which is baloney. It has absolutely no effect whatsoever on genuine organised commercial scale copyright infringement. And they don't really care about tweaking the noses of a few civil rights activists because they have strong PR connections to spin any responses from that direction. It's basically obnoxious behaviour. They should instead focus their considerable resources on tackling real problems in the best interests of their clients as necessary.

Friday, June 02, 2006

Rolling Stone Allege Bush Stole 2004 Election

Robert F. Kennedy Jr. in Rolling Stone magazine alleges that George W. Bush stole the 2004 election.

It's a loooong story, (possibly about 30 pages of standard A4 though I don't know how many pages it took up in the print version of the magazine), filled with statistics and analysis, focussed on anomalies in the key state of Ohio.

The gist of the allegations are that the Republican Party orchestrated a campaign to
  • purge thousands of Democrat-leaning eligible voters from the electoral rolls
  • block the processing of registrations generated by Democratic voter drives
  • provide too few voting machines to Democrat-leaning districts and more than enough to Republican areas, leading to longer waiting times for mainly Democratic voters
  • illegally fix a recount that could have given Kerry the presidency
  • illegally alter paper and electronic ballots, switching votes for Kerry to favour Bush
  • intimidate and aggressively challenge the right of Democratic voters to vote, at the polling stations on election day
  • illegally destroy "provisional ballots" of Democratic voters
"A review of the available data reveals that in Ohio alone, at least 357,000 voters, the overwhelming majority of them Democratic, were prevented from casting ballots or did not have their votes counted in 2004(12) -- more than enough to shift the results of an election decided by 118,601 votes.(13) (See Ohio's Missing Votes) In what may be the single most astounding fact from the election, one in every four Ohio citizens who registered to vote in 2004 showed up at the polls only to discover that they were not listed on the rolls, thanks to GOP efforts to stem the unprecedented flood of Democrats eager to cast ballots.(14) And that doesn't even take into account the troubling evidence of outright fraud, which indicates that upwards of 80,000 votes for Kerry were counted instead for Bush. That alone is a swing of more than 160,000 votes -- enough to have put John Kerry in the White House."

The key figure behind all this was supposedly Kenneth Blackwell, the co-chair of President Bush's re-election committee and also, as Ohio Secretary of State, the man in charge of counting the votes in Ohio. The sheer scale of the alleged fraud, the numbers of people supposedly involved in achieving it and the hundreds of thousands of Ohio voters apparently affected make it pretty unlikely that it could be covered up. Indeed Rep. John Conyers of Michigan and Democratic Members and Staff of the House Judiciary Committee published a report on some of the anomalies in Ohio in January 2005 (edited and released as a book in the Spring of 2005) but as far as I'm aware it did not lead to any further action legal or otherwise in pursuit of alleged perpetrators of fraud.

It's impossible to comment on the credibility of the story without studying it in depth but it would be interesting to find out if the learned folks at E-Voting News and Analysis, from the Experts have been looking any further into the allegations now they have re-surfaced. The key thing for me is that it cannot be right for a partisian official to be in charge of the voting. Even if Mr Blackwell or his counterpart in Florida in 2000, Katharine Harris, didn't break any rules they would not be doing their jobs as top officials in Bush's election campaigns if they didn't push the rules to their limits in order to favour their own candidate. It just does not make any sense for folks, Republican or Democrat, with divided loyalties - ensuring the voting is fair and ensuring their boy wins - to be in charge of the voting process that decides who wins.

Update: Farhad Manjoo at Salon, who has been writing about the problems with electronic voting machines for a couple of years, says Kennedy's article is "is filled with distortions and blatant omissions" and that no, Bush didn't "steal" the 2004 election.

"Whatever his aim, RFK Jr. does not appear intent on fixing the problem. He's more content to take us through a hit parade of the most popular, and the most dismissible, theories purporting to show that John Kerry won Ohio, theories that have been swirling about the blogosphere ever since the race was called. I scoured his Rolling Stone article for some novel story or statistic or theory that would prove, finally, that George W. Bush was not the true victor. But nothing here is new...

If you do read Kennedy's article, be prepared to machete your way through numerous errors of interpretation and his deliberate omission of key bits of data. The first salient omission comes in paragraph 5, when Kennedy writes, "In what may be the single most astounding fact from the election, one in every four Ohio citizens who registered to vote in 2004 showed up at the polls only to discover that they were not listed on the rolls, thanks to GOP efforts to stem the unprecedented flood of Democrats eager to cast ballots." To back up that assertion, Kennedy cites "Democracy at Risk," the report the Democrats released last June.

That report does indeed point out that many people -- 26 percent -- who first registered in 2004 did not find their names on the voter rolls at polling places. What Kennedy doesn't say, though, is that the same study found no significant difference in the share of Kerry voters and Bush voters who came to the polls and didn't find their names listed...

Such techniques are evident throughout Kennedy's article. He presents a barrage of seemingly important, apparently damning data to show that Kerry won the race. It's only when you dig into his claims that you see what thin ice he's on."

Further update (20-6-06): Majoo and Kennedy have had a follow-up discussion on Salon. They both agree that the system is in urgent need of reform but disagree about the extent of the real problems in Ohio in 2004 and therefore what the starting point of the reform should be.
Salon has been widely criticised and lauded in the blogosphere for publishing Majoo's article and have responded to the criticism here.

Kenya to provide free Aids drugs

From the BBC: Kenya to provide free Aids drugs

Intellectual Property, Education and Access to Knowledge in Southern Africa

Intellectual Property, Education and Access to Knowledge in Southern Africa is a terrific paper by Andrew Rens, legal lead of Creative Commons South Africa, Achal Prabhala, coordinator of the Access to Learning Materials Project in Southern Africa and Dick Kawooya, founding member of the Africa Access to Knowledge Alliance formerly Africa Copyright Forum. It runs to 70 pages so the full document is mainly for IP and A2K geeks but the executive summary is just a little over 2 pages long and well worth a read.

"There can be little doubt that education is a cornerstone of social and economic development, or that access to learning materials is a crucial factor in the success of any educational system. In a world which values the production and dissemination of information and knowledge, human capital growth is a serious developmental concern. We live, apparently, in a ‘knowledge economy’, and if so, two processes seem worth noting. First, societies of the global south are struggling with everyday challenges of education and literacy, while their institutions and governments perform the inevitable balancing act between scarce resources and vast needs. Second, producers of knowledge goods, heretofore located in the north, are increasingly global in scope; exporting, with their expansion, an intellectual property rights (IPR) regime that poses current and potential deterrents to learning.

...much of the changes wrought recently in IPR (in the domain of multilateral and bilateral trade negotiations)... pose a potential threat to the learning environment, and curtail opportunities – now and in the future – to institutions and individuals enabled with adequate infrastructure...

The simplest lesson, perhaps, comes from exploring the dichotomy evident in the traditional knowledge good and its alternative equivalent. Books are still largely inaccessible in the south – whether on account of high cost, unsuitability of language and format, or, even more simply, plain unavailability. The open access textbook, on the other hand, costs as much as it does to print and can be available wherever necessary. Even a visible scarcity ... could be alleviated by the permission-free translation choices presented by open access, since access to cultural goods in turn produces producers of cultural goods...

The challenges facing copyright law in relation to access to learning materials need to be prefaced by the international obligations facing the Southern African Customs Union (SACU)... A significant process currently underway in SACU, for instance, is a free trade agreement (FTA) with the US, where the conditions proposed by the US on copyright and related policy are, in general, beyond conditions imposed by obligations to the WTO, especially in the digital domain.

But a focus on global processes, necessary as it is, must also consider local circumstances. In SACU countries, as elsewhere in the global south, the informal economy – knowledge and cultural goods included – plays a key role in bridging access gaps that traditional market mechanisms overlook or exclude... any set of policy solutions that address the problem of access to learning materials in southern Africa will have to consider the informal economy in order to be comprehensive.

It is under such conditions then, local and global, that the importance of making a legitimate claim for access to learning materials becomes important. As past campaigns, such as the loosely federated access to medicines movement have shown, the challenge is not insurmountable. In this case, the current needs and potential benefits of expanding access, combined, present a credible case for serious and urgent intervention."

Swedish Police follow German lead

Just a week after German police filed criminal charges against 3,500 alledged eDonkey users, the Swedes have followed suit in funding the fight against online copyright infringement.

"Swedish police raided 10 different locations in Sweden and seized servers in a massive crackdown on torrent site Piratebay.org...

Reports from a wide range of online Swedish news sources claim that up to 50 police officers were involved in the raids in Stockholm, Gothenburg and several other locations around the country...

Swedish Antipiracy Bureau’s spokesman Henrik Ponten - which represents the music and movie industry in Sweden - applauded the police for finally targeting large scale piracy organisations such as Piratebay.

The Antipiracy Bureau is allegedly also the organisation behind the police raids.

It is unclear if Piratebay has breached the Swedish copyright laws and the charges so far consist of crimes against copyright laws and aiding crimes against copyright laws. Usually, Swedish police would not have got involved in such a direct fashion when it comes to copyright crimes in Sweden due to the relatively low charges involved, which would only merit fines...

Judging from posts on several of the large Swedish newspaper forums, many people are outraged over the raid, not because the Piratebay was closed down, but because of the waste of taxpayers money and police time, when there are other more important crimes to solve."

Yet again music executives will be dancing with glee. There are not enough details to make a judgement call about this. If it is a large scale piracy operation, fair enough. If it's not then they should not be wasting their finite law enforcement resources.

Thursday, June 01, 2006

Supreme Court reduce protections for whistleblowers

On Tuesday the Supreme Court in the US ruled to reduce protections for government workers who blow the whistle on official misconduct in a split 5-4 decision. President Bush's appointments to the court seem to have made the difference as it is likely that had Sandra Day O'Connor still been a sitting justice the decision would have gone the other way.

Justice David H. Souter's wrote a lengthy dissenting opinion saying

"Private and public interests in addressing official wrongdoing and threats to health and safety can outweigh the government's stake in the efficient implementation of policy"

Justice Anthony M. Kennedy wrote the majority opinion

"We reject, however, the notion that the First Amendment shields from discipline the expressions employees make pursuant to their professional duties...Official communications have official consequences, creating a need for substantive consistency and clarity. Supervisors must ensure that their employees' official communications are accurate, demonstrate sound judgment, and promote the employer's mission"

The theory is the government can now take disciplinary action againt employees without the risk of facing frivolous lawsuits. There is no doubting that such lawsuits exist but the vast majority of government employees are sensible, dedicated, hard working public servants. To say as Kennedy does, in the land of the first amendment, that government workers should shut up and do as they are told, pursuant to their professional duties, just doesn't ring true. Not a good day for the Bill of Rights.

Wednesday, May 31, 2006

CHINESE PIONEER HOLISTIC APPROACH TO PIRACY

IPKat is apoplectic at this.

"To keep a long story short, not content with infringing IP rights on an ad-hoc basis, one or more enterprising Chinese thieves have duplicated an entire business, setting up a counterfeit NEC operation that not only ran its own manufacturing operations but even "licensed" its IP to other local enterprises.

Left: Rest in Peace, industry as we used to know it ...

The IPKat cannot believe that, in a repressive regime in which one can scarcely visit a website without attracting the attention of the authorities, an entire operation of this nature can have been unlawfully duplicated without the knowledge, if not the blessing, of the Chinese government. Everyone seems to be so terrified of offending the Chinese, but they're not the slightest worried about offending us because, it appears, while they are happy to take our technology and our money, they respect neither us nor our culture. To save time and trouble, why don't we just hand over all our technology, all of our know-how and all of our money right now, and then go and liquidate ourselves? Merpel agrees and wants to know, are we the victims of our greed, our naivety or our plain stupidity?"

I hope IPKat doesn't mind me misappropriating his entire post but it was so beautifully done and it is nice to see someone getting passionate about intellectual property, a subject central to the future of our knowledge society, yet far removed from ordinary people's radar.

A report on the state of the National Identity Register, May 2016

A report on the state of the National Identity Register, May 2016 Charlie Stross' Diary.

"The National ID Register has been implemented, and (as No2ID are currently predicting) it was a train-wreck..."

Very clever. Worth reading in full.

Cassandra's last gasp

Action on Rights for Children (ARCH) are becoming very concerned that the chances of doing anything about the Children's Index proposed in the Children Act 2004 are fading rapidly.

"Yesterday, we stumbled across an article that we had forgotten about. Written for the LibDem ‘Liberator’ magazine in 2002, it was chiefly about the Connexions service and voiced our “…gnawing worry that those of us occupied in yelling over the ramparts about e-government, data-sharing and identity cards made one dreadful mistake: we forgot to turn around and notice what was slithering up the back stairs to the nursery.” (The original pdf is difficult to access, but you can see it on our website archives.)

Four years later, and here we are still banging on about children’s databases, except that events have moved on: the number of databases has multiplied and children are, it seems, fair game for any amount of information-sharing. The public has been lulled into accepting this situation by lurid tales of out-of-control youth and neglectful - or downright abusive - parents. The message is that bands of feral young people are prowling the streets, parents couldn’t care less, families are in moral meltdown and only the intervention of ‘experts’ can avert disaster.

The separation of children from adults has allowed the ‘modernisation’ of government to proceed largely unremarked, until the final jigsaw pieces - the Children’s Index and the National Identity Register- were slotted into place. If we accept the Children’s Index without protest, there is little point in protesting about the NIR because the best we can do is to delay the inevitable: within three decades the majority of the population will be databased beyond belief...


Looking back over the last few years, it has been an uphill struggle to get the whole issue of information-sharing about children on to anyone’s agenda: but then, one or two organisations and a small handful of journalists can’t hope to do anything much about this alone.

Please, if you haven’t done so already, take the time to look through the blog since May 2nd and tell other people to do the same. Follow up the links; get a good grasp of what has been going on. We have done our best to make it as simple, factual and accessible as we can, but ask us about anything that isn’t clear.

The public consultation is scheduled for the summer, and then the government will put final regulations before parliament to allow the Children’s Index to go ahead. Unlike most regulations, parliament has to pass a resolution to approve these. Gather enough accurate information to contribute to the consultation and to make sure your MP is well-informed. Tell anyone who will listen about it - trust us, the accusations of insanity and conspiracy-theory are like water off a duck's back after a while. It isn’t too late to halt the Index - but it soon will be."

Tuesday, May 30, 2006

ECJ blocks EU-US airline passenger data transfer

The BBC are reporting that the European Court of justice has ruled in favour of European Data Protection Supervisor and the EU Parliament in their challenge to the EU-US agreement requiring airlines to transfer passenger data to the US authorities. The EU Commission's chief spokesman, Johannes Laitenberger, has said that the Court ruled against them on a legal technicality and that there was nothing wrong with requiring EU airlines to supply this data. Now the EU parliament, the EU Data Protection Supervisor, countless legal experts and civil liberties groups and public officials behind closed doors have all said that this activity is illegal under the EU data protection regime. The ECJ now agrees and Commission and the UK Home Office have both come out in response to the ruling saying there's nothing to worry about, it's a legal techicality and implying that they will try some other mere technical process to legitimise the activity.

This is the first time the European Data Protection Supervisor has ever mounted such a challenge to the Council and the Commission as far as I know. That he should have raised the challenge through the courts is an indication that we are dealing with a potentially serious breach of the law here. That his complaint should be upheld by the ECJ is a solid vindication of his actions. That the Commission respond by saying ok we'll continue doing what we're doing but try and find an official, usable excuse is a further indictment of the Commission's and the Council's lack of respect for the legal process. The ECJ concluded:

"the Court (Grand Chamber) hereby:

1. Annuls Council Decision 2004/496/EC of 17 May 2004 on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection and Commission Decision 2004/535/EC of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States Bureau of Customs and Border Protection;

2. Preserves the effect of Decision 2004/535 until 30 September 2006, but not beyond the date upon which that Agreement comes to an end;

3. Orders the Council of the European Union to pay the costs in Case C-317/04;

4. Orders the Commission of the European Communities to pay the costs in Case C-318/04;

5. Orders the Commission of the European Communities to bear its own costs in Case C-317/04;

6. Orders the United Kingdom of Great Britain and Northern Ireland and the European Data Protection Supervisor to bear their own costs."

The ruling follows the recommendation of the Adocate General Leger in the case made in November last year who stated that:

"I propose that the Court should:

– in Case C?318/04, annul Commission Decision 2004/535/EC of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States Bureau of Customs and Border Protection;

– in Case C-317/04, annul Council Decision 2004/496/EC of 17 May 2004 on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection."

The reponse of the EU authorities and the UK Home Office at the time was similarly dismissive.

Update: I've just been though the decision (Case C-317/04 Judgment 2006-05-30) quickly and the Court essentially orders the Commission and the Council to terminate the agreement with the US to hand over passenger data by 30 September 2006. The Parliament and the EDPS had challenged the Commission on six grounds and the Council on four. The court looked at the first point of dispute in each case and said that was good enough for them. No need to consider the others.

As usual it is a shame that it is only legal and technical geeks who will be really interested in this decision as the wide implications for privacy in the digital age are really quite profound, just as it is the case with the NSA surveillance and ID cards. But the mass surveillance monster rolls on undeterred, damaging both the potential of the security services to do their job more effectively and society more generally.

Update 2: Some EU officials are concerned about the ruling or possibly just spinning it by predicting chaos for air pasengers and the end of the EU "open skies" policy. Privacy Intenational and the ACLU recently raised concerns about the US apparent breach of the agreement with the EU whereby teh Dept for Homeland Security had reached an agreement to to share airline passenger data with the Centers for Disease Control and Prevention (CDC). Thanks to Ian for these links.

Update 3: Comment from EU law blog: "First, the grounds of annulment are very narrow and the reasoning given is brief to the point of being terse. The European Parliament raised a whole series of pleas (on proportionality, breach of fundamental rights etc) which the Court of Justice did not examine. So it is difficult to guess what will be the next practical step taken by the Council and Commission.
Second, the Court, aware of the practical difficulties in relation to transatlantic flights that the annulment will cause has limited the effect of the annulment in time: The current arrangements can continue in force until September 30th 2006 by which time the Council and Commission must have taken steps to comply with the judgment. That's the date the arrangements between the EU and US expire anyway. As a result, there is no need to interrupt the transfer of the data to the US authorities with all the unfortunate consequences that would entail.
Third - and this is the really odd thing - the Court does not refer to Article 13 of the Directive. "

IPKat says
"Given the choice, the IPKat would prefer to know his flight was terrorist-free,even if it meant him ending up on a mailing list which delivered him unwanted advertisements." That smart folks like IPKat should swallow the line that handing flight data to the US authorities automatically makes the flight safer concerns me. But then it is only the tech and legal/privacy geeks that are interested in this... though in fairness to Jeremy he does take a step back from this in the comments.

Update 4: Spy Blog has the list of data items that the airlines provide to the US authorities.

This pernicious mix of big business and busybodies

Henry Porter was spot on as usual about the government's ID card scheme in the Observer on Sunday.

"The British state presents a menace to individual privacy in the 21st century in two ways, as the Information Commissioner, Richard Thomas, demonstrates in his commendably clear report, 'What Price Privacy?'. The first is that under Tony Blair's 'transformational government', the Civil Service is moving to merge all its databases into one network with single entry points, so that someone with the right access could, for example, surf between the tax and customs database, criminal records, vehicle registrations and health and education records in their search for information on an individual.

If you add to this unified system the new National Identity Register (NIR) which, as Thomas points out, will include 'identifying information, residential status, personal reference numbers, registration and ID card history, as well as records of when, what and to whom information from the register has been provided', we will end up with an awesome apparatus of control and surveillance...

The threat of illicit use is as nothing compared to the misuse that it will offer government agencies. For one thing, there will be no knowing when and by whom your personal records are being inspected, so intrusion by the state is likely to become the norm. The other big problem is the phenomenal incompetence of the government when it comes to databases. Remember the fiascos in the Child Support Agency, the immigration service records, the old passport agency and with the benefits card. Only last week, the Criminal Records Bureau admitted that it had wrongly labelled 1,500 innocent people as pornographers, thieves and violent criminals. As a result, some failed in their job applications, which must surely mean they have a very good claim for damages against the government, based on the loss of reputation and earnings.

The Home Office refused to apologise and, instead, excused itself by saying that it had erred on the side of caution when making the checks against criminal records. That reaction is not good enough and it underlines the lack of accountability in government and the arrogance of officialdom when it comes to the reputations of ordinary people. It also raises the question of what might happen if a similar error were to infect the unified system...

I find myself wishing a hearty damnation to Courtney and her business plans, to the unified database of 'transformational government', to the incompetence and arrogance of the Home Office, to any bureaucrat who seeks to define an individual's identity with compulsory biometric measurement backed up by threats. If one thing has become clear in the last few weeks, it is that the government is not fit to be trusted with either setting up the National Identity Register or running it."

(Katherine Courtney is head of business development at the new Identity and Passport Service and was previously head of the ID card programme. She is a US citizen though the UK government have not been prepared to say whether she has taken out UK citizenship).