Friday, January 18, 2013

Corruption, proportionality and the prosecution of Aaron Swartz

Orin Kerr's observations on the proportionality of the prosecution of Aaron Swartz are worth reading. His summary:
"On the first question, I think that some kind of criminal punishment was appropriate in this case. Swartz had announced his commitment to violating the law as a moral imperative in order to effectively nullify existing federal laws on access to information. When someone engages in civil disobedience and intentionally violates a criminal law to achieve such an anti-democratic policy goal through unlawful means — and when there are indications in both words and deeds that he will continue to do so — it is proper for the criminal law to impose a punishment under the law that the individual intentionally violated. (Indeed, usually that is the point of civil disobedience: The entire point is to be punished to draw attention to the law that is deemed unjust.)  As that appears to be the case here, I think some punishment was appropriate.
On the second question, I think the proper level of punishment in this case would be based primarily on the principle of what lawyers call “special deterrence.” In plain English, here’s the key question: What punishment was the minimum necessary to deter Swartz from continuing to try to use unlawful means to achieve his reform goals? I don’t think I know the answer to that question, but that’s the question I would answer to determine the proper level of punishment. The prosecution’s plea offer of 6 months in jail and a felony conviction may have been much more than was needed to persuade Swartz not to engage in unlawful and anti-demoratic means to pursue his policy goals in the future. If so, then I think it was too severe. But it depends on how much punishment was necessary to deter Swartz from using unlawful means to pursue his policy goals. In my view, that’s the question that we need to answer in order to say what punishment was appropriate in Swartz’s case.
On the third question, the issue of who was to blame if the prosecution was too severe, I think it’s important to realize that what happened in the Swartz case happens it lots and lots of federal criminal cases. Yes, the prosecutors tried to force a plea deal by scaring the defendant with arguments that he would be locked away for a long time if he was convicted at trial. Yes, the prosecutors filed a superseding indictment designed to scare Swartz evem more in to pleading guilty (it actually had no effect on the likely sentence, but it’s a powerful scare tactic). Yes, the prosecutors insisted on jail time and a felony conviction as part of a plea. But it is not particularly surprising for federal prosecutors to use those tactics. What’s unusual about the Swartz case is that it involved a highly charismatic defendant with very powerful friends in a position to object to these common practices. That’s not to excuse what happened, but rather to direct the energy that is angry about what happened. If you want to end these tactics, don’t just complain about the Swartz case. Don’t just complain when the defendant happens to be a brilliant guy who went to Stanford and hangs out with Larry Lessig. Instead, complain that this is business as usual in federal criminal cases around the country — mostly with defendants who no one has ever heard of and who get locked up for years without anyone else much caring.
On the fourth issue, yes, the Swartz case does point to a serious problem with the Computer Fraud and Abuse Act. But that problem is not the definition of “unauthorized access,” as some people seem to believe. (That definition is a problem, but with the Nosal case from the Ninth Circuit and likely Supreme Court review in the next year or so, I think the Courts are likely to take care of it.) Rather, the problem raised by the Swartz case is one I’ve been fighting for years: Felony liability under the statute is triggered much too easily. The law needs to draw a distinction between low-level crimes and more serious crimes, and current law does so poorly. I would recommend two changes. First, the felony enhancements for 1030(a)(2) are much too broad. I would significantly narrow them. Second, I would repeal 1030(a)(4), which is redundant as it only a combination of 1030(a)(2) and the wire fraud statute, 18 U.S.C. 1343. It therefore only leads to extra and redundant charges to confuse juries, and is better off repealed."
 Seb Schmoller's essay even more so.
"As we think about what happened to Aaron, we need to recognize that it was not just prosecutorial overreach that killed him. That’s too easy, because that implies it’s one bad apple. We know that’s not true. What killed him was corruption. Corruption isn’t just people profiting from betraying the public interest. It’s also people being punished for upholding the public interest. In our institutions of power, when you do the right thing and challenge abusive power, you end up destroying a job prospect, an economic opportunity, a political or social connection, or an opportunity for media. Or if you are truly dangerous and brilliantly subversive, as Aaron was, you are bankrupted and destroyed. There’s a reason whistleblowers get fired. There’s a reason Bradley Manning is in jail. There’s a reason the only CIA official who has gone to jail for torture is the person – John Kiriako - who told the world it was going on. There’s a reason those who destroyed the financial system “dine at the White House”, as Lawrence Lessig put it. There’s a reason former Senator Russ Feingold is a college professor whereas former Senator Chris Dodd is now a multi-millionaire. There’s a reason DOJ officials do not go after bankers who illegally foreclose, and then get jobs as partners in white collar criminal defense. There’s a reason no one has been held accountable for decisions leading to the financial crisis, or the war in Iraq. This reason is the modern ethic in American society that defines success as climbing up the ladder, consequences be damned. Corrupt self-interest, when it goes systemwide, demands that it protect rentiers from people like Aaron, that it intimidate, co-opt, humiliate, fire, destroy, and/or bankrupt those who stand for justice.
More prosaically, the person who warned about the downside in a meeting gets cut out of the loop, or the former politician who tries to reform an industry sector finds his or her job opportunities sparse and unappealing next to his soon to be millionaire go along get along colleagues. I’ve seen this happen to high level former officials who have done good, and among students who challenge power as their colleagues go to become junior analysts on Wall Street. And now we’ve seen these same forces kill our friend."
I understand and respect Orin Kerr's perspective but I don't agree that Aaron Swartz's efforts to undermine or nullify a federal law can necessarily be characterized as "an anti-democratic policy goal", particularly given the money driven systemic corruption of US politics so passionately articulated by Seb Schmoller.

I do think Prof Kerr is right in his assessment that there is a higher probability that the US Supreme Court will do a better job than Congress of reigning in the abuse of the US Computer Fraud & Abuse Act to prosecute less serious computer related activity which can currently be categorized as crimes. Unfortunately neither Congress nor the Supreme Court have a particularly good understanding of computer technology, so I'd be pessimistic about the chances of either of these venerable forums properly dealing with the overly broad provisions of the Act.

There was one final point I wanted to note in relation to Prof Kerr's careful and thoughtful analysis. He says at one stage:
"I don’t think it would have been right to just let Swartz go ahead with his plan to intentionally violate the law, releasing millions of articles onto file-sharing networks, without the law responding at least in some way. The great tradition of civil disobedience is to intentionally violate the law and proudly bear the consequences in order to change public opinion and eventually change the law, not to violate the law in secret and try to render the law you oppose unenforceable  while avoiding punishment."
I'm no political scientist or philosopher but that seems a very narrow characterization of civil disobedience, even of the variety that involves breaking the law (and I don't recommend the latter). Yes attempting to draw attention to the unjust nature of some laws by breaking them is one tactic of civil disobedience but it's not the only or even the most effective one. One of the other key tactics I believe Thoreau discussed in his essay, On the Duty of Civil Disobedience (original title: Resistance to Civil Government), was to encourage society to behave in ways that made the unjust law or unethical behaviour of government unenforceable.
"If a thousand men were not to pay their tax-bills this year, that would not be a violent and bloody measure, as it would be to pay them, and enable the State to commit violence and shed innocent blood. This is, in fact, the definition of a peaceable revolution, if any such is possible."
He was suggesting people undermine a bad law by ignoring, circumventing or breaking it, encouraging others to do likewise and demonstrating to the public and the government that it is a bad law. Aaron Swartz's close friend Larry Lessig's four forces - law, architecture/environment, social norms and market forces - along with context all have a part to play in whether a law gets enforced.

Not getting caught and jailed or punished in any other way is an important part of such action. The Underground Railroad and the Boston Tea Party are prominent examples in US history that one of Prof Kerr's blog respondents draws attention to. Not only is it an important tactic, Thoreau says we have a moral imperative to engage in such non compliance and there is no inherent assumption that that need require partial martyrdom through deliberately orchestrating personal jail time.

Ghandi's Salt March was another prominent example. Thousand of Indians were brutally beaten and jailed by the British as a result of these protests. The non cooperation of thousands more and worldwide publicity and condemnation of British behavior failed to get the British to change the law but did make them realize their control of India was dependent on the cooperation of the indigenous population.

Whatever the rights and wrongs of the Aaron Swartz case, his death is a personal tragedy for his family, friends and the society that will never again derive the benefits of the passionate commitment of this brilliant young man to social justice.

Update: James Boyle's thoughtful and compelling critique of Orin Kerr's assessment is essential reading.
"I think that much of the rest of Orin’s argument is — very uncharacteristically — rather one-sided.  I think that in his descriptions of the facts,  the issues surrounding prosecutorial discretion, and even sometimes of the law he tends to stress evidence against Aaron and to minimize or ignore facts that might put him in a more favorable light.  Finally, I think Orin’s account lacks sympathy.  What I mean by sympathy is something very particular — something that the humanist discipline of the law neglects at its peril. One kind of sympathy is bad — and that is the kind Orin is writing against. We shouldn’t base prosecutorial decisions on the fact that Aaron knew smart and famous people who can wax eloquent about his virtues, or on the fact that he looked like this. 432px-Aaron_Swartz_profileThat’s the bad kind of sympathy, and Orin rightly warns us against it.  But prosecution is a human act, a humanist art.  Most of the prosecutors I know are humbled by the awesome responsibility of wielding the power of the state.  They are aware that they wield it for people and against people, with all their complexities, their weaknesses, but also their strengths, their nobility, the things they do for good, their connections to others.  They have discretion and they want to wield that discretion with sympathy and judgment — for both victims and alleged perpetrators.  And they want to learn from their mistakes — and there will be mistakes.
I think, in the laudable attempt to avoid the bad kind of sympathy, Orin sometimes loses the good kind.  There is not much, almost nothing in fact, in Orin’s lengthy posts about the good things Aaron did. "
As usual with James, he throws a light on something that had been troubling me about an argument but I hadn't been able to quite work out yet. He highlights particularly poignantly what he considers the lack of sympathy, the one-sided characterization of Aaron Swartz's motives and the radical special deterrence theory of punishment put forward by Prof Kerr. On the latter point he says:
"He argues that Aaron’s announced ideals would lead him to violate the law again and that therefore the prosecutor would be right to ask for a sentence sufficient to stop that hypothetical continued criminal conduct.
Now maybe this is right.  But I think it is a lot more revolutionary than Orin gives it credit for and a lot more contentious than his post suggests.  I return to the Martin Luther King or Rosa Parks examples.  (Or if you prefer, the anti-abortion activist who trespasses on Planned Parenthood in order to spray paint his slogan.)  Legislatures had enacted segregation laws.  If Dr. King trespasses and violates state rules mandating segregation, and announces that he considers these laws wrong and that he will encourage others to do the same in the future, do we really believe that the prosecutor should ramp up the penalty until it would amount to special deterrence?  What would that take?  Death?  Life imprisonment?  Is that then “not disproportionate”?  I would have thought that one of the reasons we treat the protester who acts out of conviction (even conviction we disagree with) more leniently, is that we recognize that this is not mere profit seeking, not mere personal interest, and that in the past, such protesters have eventually changed our minds about the rightness of the actions the law prohibits.  There are limits to leniency, surely.  But there seem few limits on Orin’s special deterrence.  Again, I think his post is more conclusory than is warranted, and again those conclusions run against Aaron."

Monday, January 07, 2013

Digital rights cyberlaw clinics

Thanks to an energetic group of academics including Martin Kretschmer, Lilian Edwards, DaithĂ­ MacSĂ­ghigh, Burkhard Schafer and many others including Tony Clayton at the UK Intellectual Property Office, CREATe, the Research Council's centre for copyright and new business models in the creative economy will be launched at the end of January.
"With an ambitious programme of 40 projects delivered by an interdisciplinary team of academics (law, cultural economics, management, computer science, sociology, psychology, ethnography and critical studies), CREATe is a pioneering academic initiative designed to help the UK cultural and creative industries thrive and become innovation leaders within the global digital economy...
The research programme links seven interrelated themes: (i) Good, Bad and Emergent Business Models; (ii) Openness and Open Business Models; (iii) Regulation and Enforcement; (iv) Creative Practice and the Creative Environment; (v) Intermediaries and Platforms; (vi) User Creation, User Behaviour and Community Norms; and, (vii) Human Rights and the Public Interest."
It's a great research initiative which will hopefully begin to get to the heart of these issues with empirical evidence, so more power to their collective elbows.

The Open Rights Group's Executive Director, Jim Killock is one of eight members of CREATe's governance board. Last year ORG which is run on a shoestring budget, and is one of the few organizations campaigning effectively in the UK on digital rights, had to make special appeals for funds to intervene in the Golden Eye case and to recruit a legal officer. The Golden Eye case is the first in what ORG hope will be a number of legal interventions in the public interest.

Even with a legal officer in place, however, ORG are not going to have the capacity to tackle all the necessary cyberlaw cases. Likewise the Foundation for Information Policy Research, Privacy International, Consumer Focus (soon sadly to be no more), Big Brother Watch or Index on Censorship.

I was half joking with colleagues before Christmas that we should be setting up a pro bono legal clinic to challenge the bad behaviors of the evil empires of the internet and the collective ignorance of parliament about technology. The public interest is vastly under-represented in the evolution of our information society and ORG, brilliant though they undoubtedly are, can only do so much with limited resources.

It is time for the academy to step up to  the plate. There are multiple academic managed and student fueled legal clinics throughout UK academia focused on a range of areas of law. A network of effective ORG pro bono clinics would be a small step in the right direction. Additionally, the direct intervention of groups of academic lawyers in key cases via amicus briefs and/or their direct professional support for ORG in such cases might be a welcome development.

With notable exceptions we're nothing like as well organized or active on this side of the pond as our cyberprof colleagues in the US. ORG has nothing like the resources of US equivalents like the EFF, EPIC or ACLU. If you're an academic with expertise in (ottmh) -
  • Digital rights
  • Anonymity
  • Privacy
  • Data protection
  • Data retention
  • Data management
  • Defamation
  • Identity
  • Biometrics
  • Blogging
  • Constitutional and administrative law
  • Medical privacy
  • Freedom of expression
  • Censorship 
  • Education
  • Environment
  • Employment
  • EU
  • Extradition
  • Extraordinary rendition
  • Freedom of information
  • Immigration
  • Mass surveillance
  • NotW phone hacking
  • Public protest
  • Search and seizure
  • Smart meters
  • State secrets & secret trials
  • Terrorism
  • Torture
  • Travel, PNR, airports, border control, TSA etc
  • Watchlists
  • Web tracking
  • Whistle blowing
  • Wiretapping
  • Surveillance
  • Security
  • Cybercrime
  • Digital forensics
  • E-commerce
  • Economics
  • E-voting
  • Governnance
  • ICANN
  • Intellectual property - copyright, patents, trademarks, 3 strikes, databases, DRM, DMCA, EUCD, P2P, Berne, ACTA, DEA, gene patents, Google book, Hargreaves, image rights, levies, medical diagnostics, pharmaceuticals, publicity, section 301 reports, news-speak, software patents, business method patents, trade negotiations, TPP, CETA, trade secrets, web blocking, WIPO,
  • Intelligence and policing
  • Internediaries
  • Jurisdiction
  • Legal process
  • Libraries
  • Mobiles and tablets
  • International law
  • Net neutrality
  • Online child protection
  • Open access
  • Open source
  • Open data
  • Science and media
  • Search
  • Social networking
  • Statistics
  • Tort
- and short of a new year resolution, offering practical help to ORG and like minded public interest organisations in this way would not be a bad place to start.

The length of the list is illustrative of the challenge and that was just off the top of my head. I broke down the IP point into some constituent issues just to demonstrate how demanding this whole challenge is even if we were only focusing on IP. A nice summary of the Apple/Microsoft/Sony/RIM v Google/Intel bidding battle on the Nortel patents auction from 2011 gives a hint of what's at stake in just the mobiles and tablets wars.

A short review of just the IP story of 2012 I did for a colleague prior to the holidays included:
UK –

Hargreaves is still in play in the UK – the IPO have done an implementation report but the government have not given it a lot of attention Ofcom have done work on the DEA implementation and details of sanctions for suspected infringers.

One department in government has declared the blocking provisions of the DEA are defunct; another has introduced blocking on a protect kids from porn basis;

The Finch report let everyone down going for “gold” standard open access.

Richard Clayton and Consumer Focus published a terrific report on traceability of P2P copyright infringement

Lots of cases – eg DEA fake fine letters, Richard O'Dwyer, Newzbin, Meltwater appeal

Three big deals on EU level –

Commission signed ACTA in the early part of the year then got it rejected by the EU parliament in the summer (the parliamentarians got the idea there might be a problem following mass public protests in Poland). ACTA is reportedly dead but in reality in temporary stasis. At least 2 Commissioners have stated an intention to push it through regardless of what the parliament want. Additionally the new ACTA, “CETA” is now on the table (ACTA+).

EU approved (limited) directive on orphan works.

The Unitary Patent has been endorsed by the Council of Ministers just before Christmas. The theory is there should be a one stop euro patent shop rather than patent applicants having to going through expensive multi-jurisdictional patent application processes. Also proposing a specialist EU patent court so the ECJ would not have to deal with patent cases. The detail of the proposals is widely considered to be shambolic with IP experts almost universally opposed to the specifics as opposed to the overarching ideas.

Lots of interesting EU cases – eg ECJ decision in AstraZeneca v Commission in December (relating to alleged abuse of dominant position by preventing the marketing of generic drugs)

WIPO’s most recent SCCR ended in December. Various developments perhaps the most significant being the EU theoretically supporting a treaty for the blind and visually impaired; for the first time leaving the US isolated in opposing. (Particularly interesting in the light of EU siding with US to block the treaty in the summer and Judge Baer’s decision in the HathiTrust case in October).

The ITU summit on Net governance has a lot of hidden detail – similar to ACTA provisions – related to IP.

Myriad and the BRCA 1 and 2 patents have been in the news again, coming EU side plus a US court decision.
And lots of other interesting cases…
the mobile/tablet wars (Apple, Samsung, Google, Microsoft, Motorola, Nokia etc.) probably being the biggest… (Groklaw is terrific on the Apple v Samsung case)...
Viacom v Youtube (April) on intermediary liability, the silly automated takedowns (e.g. of NASA’s Mars Rover footage, the Hugo Awards and the Michelle Obama’s speech from the Democratic National Convention) and the Golan v Holder US Supreme Court decision from September which was something of a re-run of the Eldred v Ashcroft SCOTUS case in 2003 on copyright term extension. The reductionists had high hopes for Golan but it ultimately went the same way as Eldred (except with a 6-2 rather than a 7-2 majority this time). Rosetta Stone v Google was important on keyword advertising and trademarks in relation to functionality – if used in functional way it’s not infringement (though this will likely be narrowly interpreted) Akami v Limelight arguably expanded the scope of inducing patent infringement or ‘secondary patent infringement’ in US. The Sony v Tenenbaum and Capital v Thomas-Rasset cases were back in court this year on damages for p2p file sharing. Tenenbaum damages $675k upheld; Thomas-Rasset damages of $220k upheld. Plus of course Google wiped the floor with Oracle in the Java APIs copyright case.
And there were lots of interesting small events like the Republican Party issuing a report urging major copyright reform and immediately disowning it after a few heated phone calls from Hollywood executives...

Then there was... the Tobermory Cat dispute; Richard Posner started getting active on the dysfunctionality of the patent system – put himself in the middle of the Apple v Motorola case and threw it out and declared modern patents, especially software patents, restrict competition and creativity excessively; the big US Supreme Court rejection of drugs use patent in Mayo v Prometheus, US six strikes.
A full digital rights review of 2012 would be much longer but would include -
  • the temporary curtailment of SOPA/PIPA in the US
  • similar knocking of ACTA into temporary cryogenic stasis by the EU parliament
  • the conclusion of the Twitter joke trial and a variety of social networking offensive speech prosecutions, 
  • the developments with the horrendous Communications Data Bill (CDB, CCDP), 
  • ICO's siding with UK government on refusing to release 2008 draft of CDB
  • one branch of government's intention to drop the web blocking provisions of the Digital Economy Act followed by another's passion for web blocking with the excuse of protecting children
  • the Education Secretary's touting of open commerical access to the national pupil database
  • export of surveillance technologies to despotic regimes
  • Olympics rights and wrongs
  • Aviation industry's demands that FAA ignore privacy
  • ECJ 1st sale doctrine decision on software
  • EPDS opinion on EU data protection reform proposals
  • Partial conclusion of McKinnon and O'Dwyer extradition cases
  • FTC's instigation of data brokers investigation
  • Further evolution of the airport naked scanners saga
  • Big tech cos tax status
  • multiple cases of large personal data leaks
  • limited Protection of Freedoms Act
  • EU Data Protection agencies ordered Google to take positive steps to improve user privacy following the company's rationalisation of its multiple privacy policies in March
  • a US Presidential Commission on bioethics published "Privacy and Progress in Whole Genome Sequencing."
  • blog censorship by mobile operators
  • international trade negotiations
And again this list is barely scratching the surface of the issues.

In a rather long winded way - apologies for that - this brings me back to the point. There are too many important ongoing developments in digital rights for the excellent Open Rights Group and handful of other public interest actors to fight these battles on their own. So how about some energy from the academy, equivalent to that behind the CREATe programme, to enable the establishment of a network of ORG related digital rights cyberlaw clinics? In addition some active direct professional engagement,  through amicus curiae briefs in key cases would not go amiss, funded, if necessary, via specially targetted research grants.

Wednesday, January 02, 2013

Arsenal ticket prices & a Ticketmaster Q

To get tickets for a match at Arsenal's Emirates Stadium you have to pay an annual subscription to go on a list of members. There are various grades of membership, the higher levels only being available to those who have served their apprenticeship for an (as far as I can tell) indeterminate though lengthy period at the lower levels, with the higher echelons getting the most privileged access to tickets. The wealthy and corporate sponsors get to bypass this scheme.

As a lowly red member supporter I, for the first time, have access to tickets for an Arsenal match against one of the big clubs. In contrast to previous seasons, tickets are still available (behind the goal) less than two weeks before the match.

A seat at the top end of the stand behind the goal for the Arsenal v Manchester City match on 13 January is £72.50. That made me pause for thought. £72.50?! It's no wonder they are still available. It seems that the Silver, Gold and Platinum/Gold members with priority call on these tickets and habitually/routinely engaged in throwing money at the club either cannot afford or are not prepared to shell out that kind of hard earned cash to watch Arsenal any more. That should (but may not) ring some warning bells in the boardroom.

Family enclosure tickets for the same match are (though they are sold out), I'm led to believe, £62 for adults and £23.50 for young gunners.

Tickets for the Liverpool match on 30 January are similarly priced.

Tickets for the Stoke match on 2 February are £42 behind the goal, £35.50 for adults in the family enclosure and £14.50 for young gunners (under 16) in the family enclosure.

Stoke are currently a place above Liverpool in the Premier League.

I had not appreciated that there was a 70%+ premium on ticket prices for the nominally 'bigger' matches.

Also this morning I had an email from Oxford Utd encouraging me to get tickets for their FA Cup 3rd round clash with Sheffield Utd this coming Saturday.  £19 for adults, £11.50 for under 16s. Or premium tickets near the halfway line are £20.50 and £13 respectively.

Both Premier League and Oxford's FA cup tickets are sold through Ticketmaster, the company that had the LOCOG (London Organising Committee of the Olympic and Paralympic Games) contract controlling Olympic ticket sales.

£145 plus a trek into London to see Arsenal v Man City or circa £30 to see Oxford v Sheffield Utd. Which would you choose? 

Ticketmaster Q:

Does anyone have a raw data breakdown of Ticketmaster's pricing structures and the relative revenue flows between the company and the Premier League football clubs?
 
Note: Ticketmaster merged with concert promoter Live Nation in 2010 to become Live Nation Entertainment. The merger went ahead despite some reportedly vocal opposition from such notables as Bruce Springsteen, the Computer & Communications Industry Association (CCIA) and 25,000 who emailed the US Department of Justice to object. The Competition Commission the in UK initially opposed the merger in October of 2009 and then reversed that decision upon further consideration in December 2009.

Wednesday, December 19, 2012

DPP social media prosecution guidelines

The Director of Public Prosecutions has issued an interim set of guidelines on prosecuting cases involving communications sent via social media.

Social Media Dpp

He has also launched a public consultation on these guidelines. Section 36 of the guidelines says:
"Against that background, prosecutors should only proceed with cases under section 1 of the Malicious Communications Act 1988 and section 127 of the Communications Act 2003 where they are satisfied that the communication in question is more than:
  • Offensive, shocking or disturbing; or
  • Satirical, iconoclastic or rude comment; or
  • The expression of unpopular or unfashionable opinion about serious or trivial matters, or banter or humour, even if distasteful to some or painful to those subjected to it.
If so satisfied, prosecutors should go on to consider whether a prosecution is required in the public interest."
There's a lot of sense in the guidelines which suggests that maybe the Paul Chambers case would not have been pursued but what does "more than offensive, shocking..." actually mean? The police and CPS still have to make a judgement call and will still be under media and political pressure to "do something" when the next infamous offensive idiot is given his 15 minutes of fame in the press and broadcasting studios.

Let's just make it simple and get sections 1 & 127 of the Malicious Communications and Communications Acts respectively off the statute books.  And while we're at it, for a bonus, we can bin section 4 of the Public Order Act too. The police and CPS have more than enough to do and should not be making routine judgment calls on what might constitute acceptable speech.

Tuesday, December 11, 2012

Joint Committee declare CDB unworkable

The Draft Communications Data Bill Joint Committee have issued their damning report on the Bill - "the draft Bill pays insufficient attention to the duty to respect the right to privacy"; “too sweeping”; goes “further than it need or should”; Government "have a duty to respect the right of citizens to go about their lawful activities, including their communications, without avoidable intrusions on their privacy."

The committee are particularly critical of the Henry VIII clause 1 of the Bill giving the Secretary of State a blank cheque to change the law how and when s/he feels like it, without any reference to parliament or any checks and balances. The Home Secretary has said we should trust her because she has no intention of using such powers e.g. to issue secret notices to communications service providers (CSPs) requiring them to retain and disclose potentially limitless categories of data. Why on earth would you want to put such powers on the statute books if you had no intention of using them? And even if that intent was sincere [sic] why would you give future governments such freedom to abuse such powers?

Report summary:
"It is the duty of Government to maintain the safety and security of citizens. This is not only in the public interest; it is in the interest of law-abiding members of the public. For this the law enforcement agencies must be given the tools they need. Reasonable access to some communications data is undoubtedly one of those tools. But the Government also have a duty to respect the right of citizens to go about their lawful activities, including their communications, without avoidable intrusions on their privacy. These duties have the potential to conflict.
More than a decade ago the Regulation of Investigatory Powers Act 2000—RIPA—set out the conditions which the law enforcement agencies and others have to satisfy if they wish to access communications data—the details about communications, but not their content. The Act specifies what data can be accessed, by whom, for what purposes, and subject to what conditions. Since 2000, however, methods of communicating have changed, and the volume of communications data potentially available to public authorities has increased very significantly. The draft Bill which we have been considering is the Government's endeavour to bring the law up to date.
We accept that there is a case for legislation which will provide the law enforcement agencies with some further access to communications data, but we believe that the draft Bill pays insufficient attention to the duty to respect the right to privacy, and goes much further than it need or should for the purpose of providing necessary and justifiable official access to communications data. Clause 1 would give the Secretary of State sweeping powers to issue secret notices to communications service providers (CSPs) requiring them to retain and disclose potentially limitless categories of data. We have been told that she has no intention of using the powers in this way. Our main recommendation is therefore that her powers should be limited to those categories of data for which a case can now be made. If in future a case can be made for the power to be increased, this should not be done without effective Parliamentary scrutiny. We recommend the procedure for this.
The same procedure should apply if the power to request communications data is to be given to more authorities than the police, intelligence and security services, SOCA, HMRC, FSA and UKBA. If data is required for wider purposes than at present, this needs primary legislation.
We believe that the current safeguards on the authorisation of applications for access to data are working better than is often thought, but we make recommendations for improving them, and for strengthening the roles of the Interception of Communications Commissioner and the Information Commissioner. We suggest amending the definition of "communications data" which no longer meets current needs. We have looked at jurisdictional problems which will face overseas network providers in particular. We criticise the Government's estimates of the cost of the Bill and the benefits to be derived from it; some of the figures are fanciful and misleading.
We believe our recommendations would result in a Bill which would give the law enforcement agencies the essential tools they need to tackle serious crime and terrorism but at the same time limit the risk of intrusion into the privacy of the vast majority of honest citizens."
It's the top story in the Guardian and over at the BBC.

How can any government that supposedly opposed Nu Labour's appalling ID card scheme actually support this unconstrained federated mass surveillance? It would be hilarious if it was not so serious. Could I finally just emphasise the importance again of the evidence given by Ross Anderson, Peter Sommer, Caspar Bowden and Duncan Campbell and the Information Commissioner, Christopher Graham, to the Joint Committee. From the report it would appear that they have at least taken some of it on board.

Update: Pdf of full report available here. Best Storify analysis of a parliamentary report I've ever read here by Glyn Wintle () and Phil Booth (), plus
 "Bottom line #ccdp bill is over-reaching, poorly drafted, ill-defined, not based on evidence or proper consultation & misleadingly costed... in other words, a dangerous costly disaster waiting to happen."

Friday, December 07, 2012

Russian report on EU record on civil rights

The Russian government has published a Report on the Human Rights Situation in the European Union, seriously criticising the EU's record on human rights. The report reads as though it has been put together by a team of people tasked with trawling the national press in member states. They have included a range of stories critical of each particular jurisdictional authority's behaviour which have a civil rights angle/s. They are  not always accurate in their reporting of the cases - take this at the bottom of page 17:
"On April 2, 2012 a 21-year-old student Liam Stacey from Swansea was sentenced by a British court to the a 56-day imprisonment for his insulting comment on the social network "Twitter" about an exhausted football player who had African roots. In spite of support provided by the Council of Europe Commissioner for Human Rights, Liam Stacey did not manage to appeal the sentence."
The claim that Fabrice Muamba was "exhausted"is a little strange is it not?!

But they have chosen a relevant selection of cases - Stacey, the torture of Omar Awadh, the killing of Baha Mous, MI6 alleged involvement in torture of Abdel-Hakim Abu Qatada, Abu Hamza, Babar Ahmad, Moazzam Begg(former Guantanamo Bay detainee), News International phone hacking, Matthew Woods (jailed for Facebook obscenities about murdered little girl April Jones), alleged untrammeled police surveillance of protesters, and a selection of others on alleged racism, discrimination, immigration, child protection, homophobia and general lack of engagement with several international instruments associated with human rights.

Liam Stacey, for example, behaved like a moron.  But he was not a criminal and should not have been jailed.

Yet this kind of reaction by the British authorities in this and other similar cases and the mass production/implementation/normalisation of rights abusing laws and behaviours by the public and private sectors in the UK act as an absolute gift to governments and regimes with, to Western eyes, nominally less respect for human rights. Civil rights activists have been pointing out for years that it is hypocritical to lecture Russia or anyone else on about the speck in their eye on human rights when the Russians believe they can point our the plank in ours. President Putin would greet with glee the notion that the UK government were driving through a measures like the Communications Data Bill.

The authors devote 6 pages to the UK - more than any other country with Germany being the nearest challengers with 4 - but the cases they choose, at least in the UK context, have raised significant rights questions. So there is little surprise that they are highlighted even if the report is occasionally a bit fuzzy to say the least on the details. So when the government panders to the 'tough' (aka stupid) on crime, stupid on the causes of crime mob, they do substantial damage that extends way beyond the UK's borders.

I can't comment on the detailed cases chosen in a lot of the countries highlighted but I was a little disappointed that my homeland merited a mere half a page in the report:
"In general, the human rights situation in Ireland can be described as satisfactory. At the same time, the following problems exist in this area.
In Ireland, the continued marginalization of the Romani that form an unrecognized ethnic minority is a rather stringent social issue. In spite of the State adaptation policy, in daily life they often face discrimination in employment, medical care and education.
There are some problems for refugees and internally displaced persons, in particular, the excessively long bureaucratic procedures for registration. As a result, persons of that category have to wait for their residence permit for much longer than 6 months provided for by law.
National and international human rights activists pay special attention to the implementation of human rights during the extradition of criminals, including those suspected or accused by the U.S. authorities of belonging to terrorist organizations, from European countries via the airport of the city of Shannon to the United States. The Irish Human Rights Commission has repeatedly proposed to launch its own monitoring of foreign aircrafts to exclude cases of torture and degrading treatment of prisoners. The Irish authorities do not allow it referring to relevant provisions of the national legislation.
The media has repeatedly touched the issue of human rights violation in national prisons. It mainly consists in exceeding the number of prisoners in cells determined by law, inconsistency of places of detention with health and conditions of detention standards.
Since the end of 2008, due to the economic difficulties, the Irish government has conducted a number of budget cuts in the area of activities of public authorities related to human rights implementation in Ireland. For example, the National Consultative Committee on Racism and Interculturalism and the Combat Poverty Agency were disbanded. National human rights activists have expressed serious concern about those actions of the government. According to them, the measures taken caused serious damage to the national human rights institutions and to Ireland’s international image in the human rights sphere."
"Satisfactory"! That's an insult.  I demand a recount.  They really could do with some serious lessons in the history and contemporary politics of the beautiful Emerald Isle.

Tuesday, December 04, 2012

Irish Data Protection Commissioner still a Facebook friend

The Irish Data Protection Commissioner's Information Officer, Stewart Fennell, has responded to my communique of 12 November.
"Dear Mr. Corrigan

Thank you for your email highlighting a concern over items of personal data which you believe were not provided by Facebook Ireland (FB-I) in response to your access request.

The issue of FB-I responding to access requests for personal data was a key focus of the audit carried out by this Office, a report of  which was published in December 2011 (available on our website www.dataprotection.ie ).  In that Report it was indicated that " the key requirement in response to an access request is to ensure that a user has access to their personal data.  Therefore, either the data must be available on the requester’s profile page, their activity log, which is a feature of the new user Timeline, or via the download tool.  From a transparency perspective, it is desirable that most, and ideally all, of a user’s data should be available without having to make a formal request.  FB-I therefore will be implementing a number of enhancements to the activity log to provide users with access to and control over information about them.”  Given the complexity of the engineering task to extract and make available or supply the personal data available to users, the report outlined a detailed schedule specifying when different data sets would be provided.  That process is now complete.  The one exception up to end of October was in relation to metadata associated with uploaded photos to the site.

Facebook has produced detailed help on how to access personal data on the site together with a detailed description of the data that is available either from a user's Activity Log or via the download tool https://www.facebook.com/help/326826564067688.  We have worked extensively with FB-I on this help page.

Based on our audit and follow-up work with FB-I, it is our position that there is no personal data that can be supplied by FB-I that is not now available to users.

We hope that the above comprehensively addresses the matters which you have
raised.   However, if  there are specific items of personal data that you
have not received and believe are retained by Facebook-Ireland,  we would appreciate it if you could give us details so that  we can consider the matter for  further investigation.

Yours Sincerely,

Stewart Fennell
Information Officer
Office of the Data Protection Commissioner Canal House Station Road Portarlington Co. Laois

Ph: 057 868 4800
Fax: 057 868 4757
E: info@dataprotection.ie
www.dataprotection.ie"
He again asks me to give him details of "specific items of personal data" that I "have not received and believe are retained by Facebook-Ireland".

I haven't got the time to provide a considered response today but my first question again is how can I provide him with specific information on data that is not made available by Facebook?

If Facebook is holding “information constituting any personal data of which that individual is the data subject” that  it does not disclose - and it has admitted in its auto-response to my original complaint that this is the case - how do I find out what that data is, so I can tell the Irish Data Protection Commissioner specifically what the company is withholding?

Mr Fennell seems to be suggesting that his office is sympathetic to Facebook and the only way they will order complete disclosure is if someone somehow (legally, I presume) can determine what data Facebook are withholding, either deliberately or because of the technical complexities involved. So the DP Commissioner will consider further investigation, only if I can find out what is being hidden and let them know. This is real chicken and egg stuff. Why would I need the DPC to engage in "further investigation" let alone then consider actually ordering disclosure, if I had already found the data?

Maybe I should consult my favorite data expert...?

Update: It looks like the Europe v Facebook group are planning to tackle the Irish Data Protection Commissioner on this issue through the courts.

Monday, November 26, 2012

Privacy v Convenience/attraction/gratification/access/community/conformity

Thanks to Martyn Thomas via the invaluable FIPR Alerts list for the pointer to the European Network and Information Security Agency (ENISA) report on Privacy considerations of online behavioural tracking published on 14 November.  ENISA have been fairly active on the privacy front this year with four reports, a study on monetising privacy and one on data collection and storage in the EU both published in February, the tracking report from a couple of weeks back and one last week on the right to be forgotten.

The data collection study highlighted "the clear contrast between the importance of the privacy by design principle on the one hand and the reality of lax data protection practices with many online service providers on the other hand" and aimed "to conduct an analysis of the relevant legal framework of European Member States on the principle of minimal disclosure and the minimum duration of the storage of personal data." The authors recommendations, in brief, were:
  • the national Data Protection Authorities should provide clear guidelines to data controllers;
  • the Article 29 Data Protection Working Party, the European Data Protection Supervisor and ENISA should do the same for specific areas of processing of personal data with pan-European impact;
  • the Data Protection Authorities should aim to improve user awareness relating to the rights stemming from the data protection legislation and on the possibilities offered to users by the legal system to exercise these rights, including by complaining in cases of excessive collection and storage of personal data, and
  • the Member States should identify and eliminate conflicting regulatory provisions relating to the collection and storage of persona data."
The monetising privacy report said that the uptake of privacy enhancing technologies is low and there are not many options, possibly because only a small number of people are prepared to pay for them.

The tracking study notes "Internet users are being increasingly tracked and profiled and their personal data are extensively used as currency in exchange for services. It is important that this new reality is better understood by all stakeholders if we are to be able to support and respect the right for privacy." It provides a technical perspective on behavioural tracking, asks "Why are users tracked? What techniques are used? To what extent are we tracked today? What are the trends? What are the risks? What protective measures exist? What could regulators do to help improve user privacy?" and recommends:
"- Development of anti-tracking initiatives and solutions for mobile applications; the users of mobile devices are more exposed as most anti-tracking initiatives are not focusing on mobile devices
- Development of easy-to-use tools for transparency and control; awareness is important but there is a need to enhance transparency tools to allow the users to know how their personal data is collected, managed and transferred
- Enforcement solutions should be deployed to block misbehaving players and to force compliance with rules and regulations regarding personal data protection; mechanisms should be defined by regulatory bodies both for compliance and for monitoring and detection of violation of the rules
- Privacy-by-design should be promoted; regulations have an important role in boosting the adaptation of privacy-preserving solutions, i.e. by enforcing the rules, and by ensuring the existence of complete, compliant, concrete and meaningful privacy policies."
The right to be forgotten paper focuses on technical limitations and challenges when trying to enforce such a right.
"The recommendations of the paper cover multiple aspects:
  • Technical means of assisting the enforcement of the right to be forgotten require a definition of the scope of personal data, a clarification of who has the right to ask for the deletion of personal data under what circumstances, and what are acceptable ways to affect the removal of data. Data Protection Authorities, the Article 29 Data Protection Working Party, the European Data Protection Supervisor, etc. should work together to clarify these issues. Furthermore, when providing the above mentioned definitions, the technical challenges in enforcing the right to be forgotten (and the associated costs) for a given choice of definition should be considered carefully.
  • For any reasonable interpretation of the right to be forgotten, a purely technical and comprehensive solution to enforce the right in the open Internet is generally impossible. An interdisciplinary approach is needed and policy makers should be aware of this fact. 
  • A possible pragmatic approach to assist with the enforcement of the right to be forgotten is to require search engine operators and sharing services within the EU to filter references to forgotten information stored inside and outside the EU region. 
  • Particular care must be taken concerning the deletion of personal data stored on discarded and offline storage devices. 
  • Data controllers should be required to provide users with easy access to the personal data they store and ways to update, rectify, and delete data without undue delay and without cost to the user (to the extent that this does not conflict with other applicable laws). 
  • Research communities, industry, etc. should develop techniques and coordinate initiatives that aim at preventing the unwanted collection and dissemination of information (e.g., robot.txt, do not track, access control).
As mentioned above, this paper is complementing two other recent publications of ENISA in this area. In this broader context, given the findings of this paper, ENISA recommends that policy makers should ensure the use of technologies supporting the principle of minimal disclosure in order to minimize the amount of personal data collected and stored online. We also recommend the use of encryption for the storage and transfer of personal data. Particular attention should be focusing on tracking and profiling online, and enforcement solutions should be deployed to block misbehaving players and to force compliance with rules and regulations regarding personal data protection.

At the same time, Data Protection Authorities, the Article 29 Data Protection Working Party, the European Data Protection Supervisor, etc. should work together to clarify pending definition issues taking into account the practical implementation aspects while Member States should eliminate conflicting regulations."
They are all worthy studies by smart people with sensible recommendations. When reading them I found myself nodding and mumbling "absolutely!" and "couldn't agree more" and "you got that one right - it is impossible"  and "somebody gets it!".

Then, as increasingly with these things, I turn the final page and depressingly ask what difference is this going to make?

We have a fundamental problem with privacy and the human condition. We say, when asked, we care about it - and we do - but we act like we don't. That's down to:
  • attraction - we like the stuff we (non-transparently/invisibly) give up our data for
  • gratification - we enjoy and find useful the stuff we (invisibly) give up our data for and we get at it easily and quickly on the Net
  • access - we get at services and deals on the internet and offline (e.g. supermarket "loyalty" card schemes) that we would not otherwise get without (invisibly) giving up our data
  • community - we get access to communities by (invisibly) giving up our data
  • conformity - we get the chance to fit in by (invisibly) giving up our data
  • convenience (and this one beats everything) - it's easier on the net even if we have to (invisibly) give up our data
The payoff is instant or at least quick and visible. Yet the damage to privacy at an individual, community, regional, national and global level is abstract, invisible, long term and undermines the fabric of our society.

So how do we deal with the pathological calculus that is -
Privacy vs Convenience/attraction/gratification/access/community/conformity/convenience?
Put another way, how can so much be given up by so many for so little so often?

And how do we begin to evolve towards a situation where a significantly greater proportion of the population realise and act according to the exponentially invaluable value of our personal data currency?

Tuesday, November 20, 2012

Irish Data Protection Commissioner Facebook friend

The Information Officer at the Irish Data Protection Commissioner's Office has responded to my complaint about Facebook.
"Dear Mr. Corrigan

Thank you for your email received by our office on the 16th November, 2012.
The provision of personal data by Facebook Ireland either on a user's account, activity log, the download tool and the enhanced archive is considered by this Office to fully meet the requirements of the Data Protection Acts in relation to access.

If you consider that specific data is not available we need specific information from you as to what data in particular you consider was not made available.

Yours Sincerely

Stewart Fennell
Information Officer
Office of the Data Protection Commissioner Canal House Station Road Portarlington Co. Laois

Ph: 057 868 4800
Fax: 057 868 4757
E: info@dataprotection.ie
www.dataprotection.ie"
Interesting trick that.  The Irish Data Protection Commissioner's Office believe Facebook "fully meet the requirements of the Data Protection Acts in relation to access" and require me to detail the specific data that Facebook have about me that they have not made available.

Yet I don't know the data they hold on me and want to find out. If I can borrow from a certain Mr Rumsfeld, this is a known unknown the details of which are unknown to me and therefore unspecifiable by me.

I've replied to Mr Fennell as follows.
"Dear Mr Fennell,


The point of my original data access request was to find out what information Facebook hold on me.

The company has made clear in its automated response, despite your apparent belief to the contrary, that it does not provide all the data it holds on users through its download tools:

"One tool provides the most common data users are seeking when they make data requests. The second tool, called “expanded archive”, contains additional data.  We will continue to add data to your expanded archive over the next few months."

Could you explain how I provide you with specific information on data that is not made available by Facebook, without having any way of finding out the specific data it does not provide through its download tools?

I would remind you again of the plain wording of section 4(a)(iii) of the Data Protection Act which refers to entitlement to “information  constituting any personal data of which that individual is the data subject”,

I fail to see how a link to a couple of data download tools with restrictive licences and an instruction to use these to mine the Facebook site to see what I might find can be considered by the Data Protection Commissioner to “fully meet the requirements of the Data Protection Acts in relation to access.” Could you therefore provide me with evidence of this and details of the Commissioner’s ruling to the effect that these Facebook tools do fulfil the company’s obligations under the Acts and how and why they do so.

Regards,

Ray Corrigan"
Update 21 November 2012:  At 10.10am this morning I got another acknowledgement from the IDC's office identical to the first one they sent - they have not yet categorised my communication as a 'query' or a 'complaint' with the same warning in Irish and English that I should not share it with anyone but they will get back to me within 15 days.

Monday, November 19, 2012

Acknowledgment from Irish Data Protection Commissioner

I've received a boilerplate response from the Irish Data Protection Commissioner's office to my complaint about Facebook. The haven't even looked at it closely enough yet to determine whether it is a "query" or a "formal complaint". This kind of 'we have to respond within x days to meet our target' rule is such a waste of time and energy when it leads to automation of these non-responses.

The non response includes a sign off warning I should not share it with anyone else - in Irish and English. Here it is in full:

"To Whom It May Concern

I acknowledge receipt of your e-mail to the Data Protection Commissioner.
Where your email relates to a query (as distinct from a formal complaint under the Data Protection Acts),  you should be aware that in line with our Customer Service Charter we aim to reply within 15 working days and usually much sooner.
 In doing so, we will communicate clearly, providing you with a full response to your query.

If we are not in a position to issue a reply within that period, we will inform you of its status.Regards

Office of the Data Protection Commissioner Canal House Station Road Portarlington Co. Laois

LoCall: 1890 252 231                         Ph: +353 (0)57 868 4800                 Fax: +353 (0)57
868 47 57


**********************************************************************************
Is le haghaidh an duine nó an eintitis ar a bhfuil sí dírithe, agus le haghaidh an duine nó an eintitis sin amháin, a bheartaítear an fhaisnéis a tarchuireadh agus féadfaidh sé go bhfuil ábhar faoi rún agus/nó faoi phribhléid inti. Toirmisctear aon athbhreithniú, atarchur nó leathadh a dhéanamh ar an bhfaisnéis seo, aon úsáid eile a bhaint aisti nó aon ghníomh a dhéanamh ar a hiontaoibh, ag daoine nó ag eintitis seachas an faighteoir beartaithe. Má fuair tú é seo trí dhearmad, téigh i dteagmháil leis an seoltóir, le do thoil, agus scrios an t-ábhar as aon ríomhaire. Is é beartas na Roinne Dlí agus Cirt agus Comhionannais, na nOifígí agus na nGníomhaireachtaí a úsáideann seirbhísí TF na Roinne seoladh ábhair cholúil a dhícheadú.
Más rud é go measann tú gur ábhar colúil atá san ábhar atá sa teachtaireacht seo is ceart duit dul i dteagmháil leis an seoltóir láithreach agus le mailminder[ag]justice.ie chomh maith.

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.  It is the policy of the Department of Justice and Equality and the Agencies and Offices using its IT services to disallow the sending of offensive material.
Should you consider that the material contained in this message is offensive you should contact the sender immediately and also mailminder[at]justice.ie."
They haven't even bothered to address me by name. Let's see what comes next within 15 days - my guess is an auto acknowledgement that my communication is not a query but a formal complaint which they will be required to address within the requisite time period set out in section 10 of the Irish Data Protection Act.