Friday, April 11, 2014

What do you need to know about the Heartbleed security vulnerability?

Simon Budgen at OpenLearn asked yesterday if I could offer some ordinary-mortal-interpretable thoughts on the Heartbleed OpenSSL security earthquake.

I offered Simon the rambling steam of consciousness below which he kindly edited into a more ordered Q&A here.
There is a lot of panic, misreporting and bad advice going round about Heartbleed as you say. Though there are a few key things it is worth making sure get included in any article.

Include the Heartbleed link http://heartbleed.com/ which outlines  the problem -

" The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users."

That's about as bad as it gets security wise. Security expert Bruce Schneier has described it as “catastrophic” and I wouldn’t disagree with that.

The OpenSSL bug has compromised half a million plus sites from what we're able to tell.

Ordinary internet users should change their passwords on sites affected but generally only after - the companies running the websites concerned have done a security audit to check if they are affected, patched their systems if they are, acquired a new public/private key pair and new SSL certificate, tested the patched systems, informed the user they have done all this and determined the system to be secure (and preferably pro-actively changed passwords that might have been affected). Now the news on the bug is out credible commercial entities are keen to do this in double quick time and many have already done so.

It’s not the best advice to change your password before a website has been patched as that might expose your details to a higher risk of being compromised and will certainly expose your new details/passwords. Some mainstream news media are informing people they should change all passwords immediately – not great advice if it leads you to assume your new credentials are safe when in fact they won’t be, if the site has not been patched yet. People should check with or have confirmation from the company or an independent trustworthy source that they have fixed their systems first. (Though if someone with existing compromised credentials chooses to use those for nefarious ends, in the window between now and the site being patched, then there may be a slight preference in favour of changing passwords temporarily and then changing again once the fix is done. None of this is really straightforward unfortunately).

All the usual advice about choosing strong passwords applies – change them regularly, don’t use the same ones on different sites, don’t use dictionary words or names, make them long, include upper and lower case, numbers and symbols.

If there are several layers of authentication use them for stronger security e.g. pin numbers, passwords, tokens etc.

It may be the time now people begin to realise how many passwords they are actually using, to consider investing in a password manager like LastPass, SplashID or Password Genie – software which does all the heavy lifting on choosing long difficult passwords and managing and “remembering” them for you.

Also note since the bug has been around for a couple of years that it is almost certain that a multitude of organised crime gangs will likely have gathered the encryption keys to all compromised sites, as will intelligence and security services like the NSA and GCHQ. Just to be clear on this – the usernames and passwords used on these sites will likely be in the hands of organised criminal gangs and intelligence services.

The other big issue for ordinary users is to find out exactly what sites have been compromised and where and when they need to go about changing passwords. Various news sites are providing lists of affected sites and those that have been patched but you need to choose your sources of information carefully. Mainstream news sites are not always the best guide. We do know the big guys like Google, Facebook and Yahoo! were compromised and appear to be patched. Apple and eBay we’re not sure, Tumblr yes, big banks apparently not (but don’t quote me on that), Linkedin apparently not, Amazon no, though Amazon cloud services yes. It’s basically taking quite some sorting out.

There are sites that enable you to test whether a service you use has been compromised by Heartbleed eg http://filippo.io/Heartbleed/ or https://www.ssllabs.com/ssltest/ Just enter the url you are concerned about and click the Go!/Submit button. These are not 100% reliable and will generate false positives (alerts on sites that are patched) and occasionally false negatives (giving the all clear to insecure sites). Do be a little careful with these too as there will be false test sites which attempt to mislead people about the security of sites which remain compromised.

If people have not heard from the sites they use, they should actively contact them to ask – if they have done the requisite Heartbleed related security audit, if they have been compromised and if they have patched any vulnerabilities; and don’t stop asking until a definitive answer is forthcoming. Then if necessary change their passwords once the fix is implemented.

Hope that gives you something to start with.
Comments welcome here or over at OpenLearn.

Thursday, April 10, 2014

European Court of Justice annuls 2006 data retention directive

On Tuesday, 8 April, 2014, the Court of Justice of the European Union, (also known as the European Court of Justice) in a scathing indictment of widespread mass surveillance practices, abolished the 2006 EU data retention directive. The Court said the directive was a serious and unjustified interference with the fundamental right to privacy enshrined in Article 7 of the EU Charter of Fundamental Rights.

The directive constituted such a serious interference with the fundamental right to privacy that it had to be annulled - it was an affront to liberty that should never have existed.

TJ McIntyre of Digital Rights Ireland (DRI), the heroic litigants in chief, has made a copy of the full decision available at scribd and it will appear on the Court website in due course. Credit also to the 11,130 Austrian citizens whose case was joined to that of DRI since they had challenged the directive on similar grounds.

For the uninitiated, the data retention directive was the instrument through which the EU required communications service providers, both fixed line and mobile, to store details of everything everyone does on the telephone or internet; for a period of between 6 months and two years. The details of what should be collected are laid out in article 5 of the directive and the only thing not allowed was recording of the content of calls or messages.

It's actually worth spending 5 or 10 minutes looking at that list of things in Article 5 that has been gathered by communications service providers throughout the EU. At first pass it seems a bit legalistic but if you cut through that and think about it – names, addresses, who spoke to whom, where, when, for how long, on what device, how often, websites visited etc. etc. This all paints a very detailed picture and most people don’t know it is going on. The who, where, why, how, what and when of individual lives is all there in this metadata.

With what may be interpreted as half and eye on the Edward Snowden revelations, the Grand Chamber of the Court, effectively condemned pre-emptive, suspicionless, warrantless mass surveillance and consequent "interference with the fundamental rights of practically the entire European population". The case is the first major court decision on mass surveillance since the Snowden stories started to break in June 2013. Though high courts in Romania (2009), Germany (2010), Bulgaria (2010),  the Czech Republic (2011) and Cyprus (2011) have all declared the data retention directive unconstitutional and/or a disproportionate unjustified interference with the fundamental right to privacy, free speech and confidentiality of communications. As recently as 2011 following the national courts' striking down of regulations implementing data retention, the European Commission were hounding Germany and Romania to re-implement the directive. The Commission subsequently sued Romania which went on to pass a widely criticised version of data retention law in 2012, nicknamed "Big Brother". The Commission had also previously sued Greece, the Netherlands, Austria and Sweden for failing to implement the directive by the due date of September 15 2007.

The previous UK Labour government were one of the key driving forces behind the original implementation of the the data retention directive. The current UK government is one of the biggest cheerleaders for and operators of mass surveillance standards and practices. Though the UK government was not involved directly in the case, (and are scrambling madly to find a way to circumvent the decision as, sadly, are the Commission), both the current and the previous administrations' behavior, in the data retention context, is considered so heinous in law that it should never have happened; and the laws facilitating that behavior should never have existed.

Some commentators have also suggested the Court was firing a message not just to the UK but across the pond (2 min 40sec audio) to the effect that US mass surveillance standards are totally unacceptable in an EU context.

I have now managed to read the decision in full (in fits and starts) and will endeavour to post an analysis here at the earliest opportunity. (Aka when grown up admin duties allow and I can construct a sufficiently robust buffer between me and the zombiecrats to take a sustained run at it).

Appelbaum on mass surveillance

Take 5 minutes 33 seconds to listen to Jacob Appelbaum on mass surveillance and the  WePromiseEU 10 point charter for digital rights


Tuesday, April 08, 2014

Daniel Solove: Nothing to Hide, Nothing to Fear?

Nice interview with Daniel Solove (24 minutes) on the nothing to hide meme.



Kafka better captures the modern privacy issues we face. Decisions about our lives are being made on the basis of secret uses of our personal data - look at airline screening for example.

Categories of data which were required to be retained under the data retention directive

The data retention directive, DIRECTIVE 2006/24/EC, thanks to the efforts of a small number of digital rights activists in Ireland and a slightly larger group from Austria has been declared unlawful - a serious and unjustified interference with the fundamental right to privacy enshrined in Article 7 of the EU Charter of Fundamental Rights - by the European Court of Justice today.

I'm hoping to blog about the decision soon but it is worth pointing out the categories of data that this directive required service providers to retain and facilitate crime fighting authorities access to. They are specified exhaustively in article 5 of the directive:
Article 5
Categories of data to be retained
1. Member States shall ensure that the following categories of
data are retained under this Directive:
(a) data necessary to trace and identify the source of a
communication:
(1) concerning fixed network telephony and mobile
telephony:
(i) the calling telephone number;
(ii) the name and address of the subscriber or registered
user;
(2) concerning Internet access, Internet e-mail and Internet
telephony:
(i) the user ID(s) allocated;
(ii) the user ID and telephone number allocated to any
communication entering the public telephone
network;
(iii) the name and address of the subscriber or registered
user to whom an Internet Protocol (IP) address, user
ID or telephone number was allocated at the time of
the communication;
(b) data necessary to identify the destination of a
communication:
(1) concerning fixed network telephony and mobile
telephony:
(i) the number(s) dialled (the telephone number(s)
called), and, in cases involving supplementary services
such as call forwarding or call transfer, the
number or numbers to which the call is routed;
(ii) the name(s) and address(es) of the subscriber(s) or
registered user(s);
13.4.2006 EN Official Journal of the European Union L 105/57
(2) concerning Internet e-mail and Internet telephony:
(i) the user ID or telephone number of the intended
recipient(s) of an Internet telephony call;
(ii) the name(s) and address(es) of the subscriber(s) or
registered user(s) and user ID of the intended recipient
of the communication;
(c) data necessary to identify the date, time and duration of a
communication:
(1) concerning fixed network telephony and mobile telephony,
the date and time of the start and end of the
communication;
(2) concerning Internet access, Internet e-mail and Internet
telephony:
(i) the date and time of the log-in and log-off of the
Internet access service, based on a certain time zone,
together with the IP address, whether dynamic or
static, allocated by the Internet access service provider
to a communication, and the user ID of the
subscriber or registered user;
(ii) the date and time of the log-in and log-off of the
Internet e-mail service or Internet telephony service,
based on a certain time zone;
(d) data necessary to identify the type of communication:
(1) concerning fixed network telephony and mobile telephony:
the telephone service used;
(2) concerning Internet e-mail and Internet telephony: the
Internet service used;
(e) data necessary to identify users’ communication equipment
or what purports to be their equipment:
(1) concerning fixed network telephony, the calling
and called telephone numbers;
(2) concerning mobile telephony:
(i) the calling and called telephone numbers;
(ii) the International Mobile Subscriber Identity (IMSI)
of the calling party;
(iii) the International Mobile Equipment Identity (IMEI)
of the calling party;
(iv) the IMSI of the called party;
(v) the IMEI of the called party;
(vi) in the case of pre-paid anonymous services, the date
and time of the initial activation of the service and
the location label (Cell ID) from which the service
was activated;
(3) concerning Internet access, Internet e-mail and Internet
telephony:
(i) the calling telephone number for dial-up access;
(ii) the digital subscriber line (DSL) or other end point
of the originator of the communication;
(f) data necessary to identify the location of mobile communication
equipment:
(1) the location label (Cell ID) at the start of the
communication;
(2) data identifying the geographic location of cells by reference
to their location labels (Cell ID) during the period
for which communications data are retained.
2. No data revealing the content of the communication may be
retained pursuant to this Directive.
Blanket retention of this data is theoretically now invalid in the EU but it remains astonishing that it was ever lawful in the first place. Seriously. Take a look at that list of metadata and think about what it can tell you about an individual.

Monday, March 31, 2014

ECJ: Intermediaries can be responsible for blocking copyright infringement

The Court of Justice of the EU last week decided Case C‑314/12,

REQUEST for a preliminary ruling under Article 267 TFEU from the Oberster Gerichtshof (Austria), made by decision of 11 May 2012, received at the Court on 29 June 2012, in the proceedings

UPC Telekabel Wien GmbH
v
Constantin Film Verleih GmbH,
Wega Filmproduktionsgesellschaft mbH

A panel of five judges, not unexpectedly given the advice of the Advocate General, decided that ISPs can be required to block access by its customers to a website which infringes copyright.

A first glance at the ruling suggested there might be a conflict here with the earlier decision of the Court in the 2008 Promusicae case, noting that privacy trumps copyright. But the Court carefully steers a route past that earlier decision.

Firstly they conclude, at paragraph 40, that
"Article 8(3) of Directive 2001/29 must be interpreted as meaning that a person who makes protected subject-matter available to the public on a website without the agreement of the rightholder, for the purpose of Article 3(2) of that directive, is using the services of the internet service provider of the persons accessing that subject-matter, which must be regarded as an intermediary within the meaning of Article 8(3) of Directive 2001/29."
ISPs are 3rd parties potentially making copyright infringing materials available to their customers. The preventative proactive copyright protective nature of the 2001 directive means that no proof that an ISP's customers are accessing the alleged copyright materials is required, before said ISP can be required to block an alleged infringing source.

The Court then asks if ordering an ISP to block a website offering infringing works undermines fundamental rights recognised by EU law. They (paragraph 46)  re-emphasise the Promusicae decision that copyright cannot undermine fundamental rights:
"The Court has already ruled that, where several fundamental rights are at issue, the Member States must, when transposing a directive, ensure that they rely on an interpretation of the directive which allows a fair balance to be struck between the applicable fundamental rights protected by the European Union legal order. Then, when implementing the measures transposing that directive, the authorities and courts of the Member States must not only interpret their national law in a manner consistent with that directive but also ensure that they do not rely on an interpretation of it which would be in conflict with those fundamental rights or with the other general principles of EU law, such as the principle of proportionality (see, to that effect, Case C‑275/06 Promusicae [2008] ECR I‑271, paragraph 68)."
and note that court ordered web blocking to negate copyright infringement constitutes:
"a conflict between (i) copyrights and related rights, which are intellectual property and are therefore protected under Article 17(2) of the Charter, (ii) the freedom to conduct a business, which economic agents such as internet service providers enjoy under Article 16 of the Charter, and (iii) the freedom of information of internet users, whose protection is ensured by Article 11 of the Charter."
They go on to say the Court doesn't get to specify the web blocking measures. That decision is in the hands of the ISP. Such injunctions do amount to an interference with an ISP's freedom to conduct a business but this does not involve "unbearable sacrifices". As long as the ISP takes "reasonable measures" to block their customers access to the alleged copyright infringing materials, copyright holders have no cause of direct action against them.

The Court is very vague, however, on what these "reasonable measures" should be. It's for the ISP concerned, not a court, to decide the precise blocking methods (para 52) that should be deployed. Yet the Court are also apparently adamant (para 54) that intermediaries should have legal certainty on the measures they need to take to avoid penalty.

The ISP must also insure the blocking does not interfere with their customers' freedom of information and that the blocking techniques used should be "strictly targeted" to terminate the copyright infringement whilst not undermining fundamental rights. To that end from the the customers' fundamental rights perspective, they should be able to challenge any blocking processes implemented by the ISP in their national courts (para 57):
"It must be possible for national courts to check that that is the case. In the case of an injunction such as that at issue in the main proceedings, the Court notes that, if the internet service provider adopts measures which enable it to achieve the required prohibition, the national courts will not be able to carry out such a review at the stage of the enforcement proceedings if there is no challenge in that regard. Accordingly, in order to prevent the fundamental rights recognised by EU law from precluding the adoption of an injunction such as that at issue in the main proceedings, the national procedural rules must provide a possibility for internet users to assert their rights before the court once the implementing measures taken by the internet service provider are known"
Interestingly enough, though it doesn't appear necessary, at paragraph 61 the Court states -
"The Court notes that there is nothing whatsoever in the wording of Article 17(2) of the Charter to suggest that the right to intellectual property is inviolable and must for that reason be absolutely protected (see, to that effect, Scarlet Extended, paragraph 43)."
Then go on to conclude on the substantive questions before them:
"the Court (Fourth Chamber) hereby rules:
1.      Article 8(3) of Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society must be interpreted as meaning that a person who makes protected subject-matter available to the public on a website without the agreement of the rightholder, for the purpose of Article 3(2) of that directive, is using the services of the internet service provider of the persons accessing that subject-matter, which must be regarded as an intermediary within the meaning of Article 8(3) of Directive 2001/29.
2.      The fundamental rights recognised by EU law must be interpreted as not precluding a court injunction prohibiting an internet service provider from allowing its customers access to a website placing protected subject-matter online without the agreement of the rightholders when that injunction does not specify the measures which that access provider must take and when that access provider can avoid incurring coercive penalties for breach of that injunction by showing that it has taken all reasonable measures, provided that (i) the measures taken do not unnecessarily deprive internet users of the possibility of lawfully accessing the information available and (ii) that those measures have the effect of preventing unauthorised access to the protected subject-matter or, at least, of making it difficult to achieve and of seriously discouraging internet users who are using the services of the addressee of that injunction from accessing the subject-matter that has been made available to them in breach of the intellectual property right, that being a matter for the national authorities and courts to establish."
Whilst I understand why the Court does not want to specify particular blocking or filtering techniques, it seems that copyright owners and ISPs and other internet intermediaries are left in something of a legal limbo.
  • Under Article 8(3) of Directive 2001/29/EC, intermediaries can be ordered by a court to block sites thought to be distributing unauthorised copyright materials
  • It does interfere with intermediaries' freedom to conduct a business to implement such measures but not unbearably so
  • It is for the intermediaries not the Court to decide what specific blocking measures should be taken
  • These measures, however, must - be 1. reasonable 2. strictly targeted 3. effectively protect the copyright holder 4. effectively protect fundamental rights of the ISP's customers
  • Intermediaries have no guidance from the Court on what is meant by "reasonable" blocking measures or how to balance fundamental rights with the (not-inviolable) right to intellectual property
  • If intermediaries don't get their measures sufficiently "reasonable" to make their customers and the requisite copyright holders happy, they leave themselves open to legal challenge from one or other or both
ISPs can be ordered to block but neither they nor the offended copyright holders know what kinds of specific blocking measures can be considered reasonable.  Given such legal uncertainty and the crude nature of software filters, I suspect the ultimate outcome will be that ISPs will tend towards over-blocking, since the risks of being sued by copyright holders for facilitating infringement are significantly higher than those of being sued by individual customers for breaching their fundamental rights.

Friday, March 14, 2014

MP note on Don't Spy on US

My MP, Nicola Blackwood, tells me she has written to William Hague to draw his attention to the Don't Spy on Us campaign.
"Dear Mr Corrigan,

Many thanks for your email about the ‘Don’t Spy on Us’ campaign. I apologise for the delay in my response.

I certainly appreciate that is an issue you feel strongly about, and I have taken the time to read your submission to the Intelligence and Security Committee’s inquiry. I understand your position that there is no balance to be struck between the individual right to privacy and the collective right to security, as privacy and security are not opposites. As discussed in our previous correspondence, I do firmly believe that our intelligence agencies do vital work in tackling terrorism and international crime.

The various levels of checks and balances that exist to hold our security services to account cannot be overstated, and as previously discussed these include oversight mechanisms by  Secretaries of State, the Interception of Communications Commissioner and the Intelligence Services Commissioner, and through Parliament via the Intelligence and Security Committee. One further level of accountability here that I have not discussed with you previously and I feel is worth noting here, is the strict operation of GCHQ within the Regulation of Investigatory Powers Act (RIPA). The Office of Surveillance Commissioners analyse GCHQ’s activity in detail, and also some of the codes of practices that the agencies have in place to ensure their adherence to RIPA.

I know that you have previously been unsatisfied with the response you have received from the Minister on this issue, but I have written to the Secretary of State for Foreign and Commonwealth Affairs, the Rt Hon William Hague MP, to discuss this specific campaign and to ask for a response to the concerns you have raised below. I shall of course pass any response I receive on to you in the usual way.

I will certainly keep your views on this subject in mind when considering the issue again in the future, and of course I intend to follow any further developments on this carefully. I also look forward to further announcements on the progress of the Committee’s inquiry into privacy and security, I understand the next stage will be the provision of oral evidence.

Thank you again for taking the time to contact me on this.

Kind regards
Nicola"
 I've replied.
"Nicola,

Thanks for getting back to me and for taking the time to read my response to the ISC.

As before, I don’t dispute that our intelligence agencies do vital work in tackling terrorism and international crime. However, they will do that work more effectively under a targeted data preservation regime rather than a suspicionless mass surveillance regime. Rather ironically this is one area where government ministers’ mantra of getting more from less actually applies.

We do differ in our relative positions on the checks and balances on the security services. If these had been effective as you have come to believe we would not have evolved the mass surveillance measures now operated by the security and intelligence services. As for RIPA, it’s widely accepted now on all sides to be out of date. You can drive a coach and horses through the loopholes in the RIPA regulations and the intelligence services basically do.

Finally for now, thanks for taking the time to write to William Hague about the Don’t Spy on Us campaign.

Regards,

Ray
On the week of the World Wide Web's 25th anniversary, we've learned  How the NSA Plans to Infect “Millions” of Computers with Malware. A couple of weeks ago it was revealed that GCHQ have been collecting millions of Yahoo webcam images via their OpticNerve system.

The mass surveillance stories flowing from the Snowden revelations keep coming. These are fundamentally, as Cory Doctorow put it so eloquently in his Guardian article earlier this week, matters of public health and societal wellbeing because so much of what we do these days involves the internet. 

The Don't Spy on Us campaign believe -
"Our campaigning is having an impact. The main political parties are edging towards reform of surveillance laws. We can't take anything for granted though. We have to keep pressing for change."
I would add that we need to keep pressing for public understanding and engagement. Concern about mass surveillance is still very much a minority sport in the UK.

Lib Dems conference motion on digital bill of rights

The text of the Liberal Democrats spring conference policy motion on a digital bill of rights is below (c&p from their Spring conference agenda p64-67).
"10.45 Policy motion
Chair: Sal Brinton (Vice Chair, Federal Conference Committee)
Aide: Sandra Gidley
F19 A Digital Bill of Rights
Cambridge
Mover: Tim Farron MP
Summation: Dr Julian Huppert MP (Co-Chair, Parliamentary Party Committee
on Home Affairs, Justice and Equalities)

Conference believes:

i) Monitoring or surveilling people without suspicion is alien to our
traditional British values.
ii) That systematic surveillance of people’s communications and
online activities undermines a number of fundamental human rights,
including the right to respect of private life and correspondence,
freedom of expression, of association, of conscience and of religion;
that these rights are essential in safeguarding the democratic
principles of our society; and that any interference with these rights
must be necessary and proportionate.
iii) That our online communication and behaviour should be treated with
the same respect and legal due process that we expect for our offline
communication and behaviour.
iv) Government-supported filtering of the internet will prevent people
from accessing legitimate information and educational resources,
whilst giving parents a false sense of security.
v) That the indiscriminate harvesting and storage of the communications
and metadata of people without suspicion is incompatible with our
liberal and democratic principles, and has the potential to cast a
chilling effect on free speech and free association.
vi) Whilst there are legitimate concerns surrounding national security,
such concerns must not be invoked simply as a pretext to undertake
blanket surveillance, stifle investigative journalism, or discourage
public debate.
vii) That the work of the intelligence and security services is essential to
the underpinning of a free, fair and open society, and that clear public
agreement as to their remit and the extent of their powers would be to
their benefit as well the country more broadly.

Conference endorses:

A. The International Principles on the Application of Human Rights to
Communications Surveillance, which emphasise that any surveillance
of citizens by the state must be necessary and proportionate.
B. The United Nations General Assembly resolution on the Right to
Privacy in the Digital Age (A/C.3/68/L.45), emphasising that the same
rights that citizens have offline must also be protected online.
C. The Reform Government Surveillance Principles signed by Apple,
Google, Microsoft, Facebook, Yahoo, LinkedIn, Twitter and AOL,
which call for overhaul of the oversight, accountability and laws
governing government surveillance programmes in order to restore
the balance between security and liberty and to restore public trust in
the internet.
D. Existing Liberal Democrat policy that data belongs by default to the
individual to whom it refers; this ownership of data means that the
individual citizen has a right to access all their own data and, where
reasonable, can decide who else has access.
E. The Deputy Prime Minister’s decision to veto the unworkable and
disproportionate Communications Data Bill.

Conference therefore calls for:

1. The annual release of Government Transparency Reports which
publish, as a minimum, the annual number of user data requests
made by law enforcement, the intelligence agencies, and other
authorities, broken down by requesting authority, success rates, types
of data requested and category of crime or event being investigated.
2. The establishment of a commission of experts to review state
surveillance and all recent allegations from the Edward Snowden
leaks, with specific scope to:
a) Scrutinise relevant legislation including the Regulation of
Investigatory Powers Act 2000, the Intelligence Services Act 1994
and section 94 of the Telecommunications Act 1984.
b) Assess the implications for privacy and internet freedoms of
Project Tempora and other programmes revealed by the Snowden
leaks, and consider alternatives to the bulk collection of data.
c) Review powers, scope, appointment and resources of oversight
committees, commissioners and tribunals.
d) Consider the use of judicial involvement and approval for
surveillance and for access to communications data and
metadata likely to reveal sensitive personal data.
e) Publish its findings and recommendations.
3. The Government to define and enshrine the digital rights of the citizen
to protect from overreach by the state, through:
a) Ensuring that powers of surveillance, accessing data, and
accessing new technologies are not extended without
Parliamentary approval.
b) Ensuring that government does not undertake the bulk
collection of data and only accesses the metadata or content
of communications of an individual if there is suspicion of
involvement in unlawful activity.
c) Ensuring that oversight of government surveillance is
independent, informed, transparent and adequate.
d) Supporting a prompt, lawful and transparent framework for data
requests across jurisdictions and between governments.
4. The Government to accelerate and expand the midata project,
to grant citizens access to all their data in an open digital format,
regardless of which business holds that data, by using powers under
the Enterprise and Regulatory Reform Act 2013.

Applicability: Federal.

Mover of motion: 7 minutes; summation: 4 minutes; other speakers: 3 minutes.
For eligibility and procedure for speaking in this debate, see page 15.
In addition to speeches from the platform, conference representatives will be
able to make concise (maximum one-minute) interventions from the floor during
the debate on the motion; see page 14.
The deadline for amendments to this motion is 13.00, Tuesday 4th March;
those selected for debate will be printed in Saturday’s Conference Daily. The
deadline for requests for separate votes is 09.00, Saturday 9th March. See
page 17."
Just one major note. Although it's fine to see the Lib Dems making an effort on this issue it is disappointing to see the dangerously false notion that there is a mythical "balance between security and liberty" trotted out unthinkingly yet again. This time it's done in endorsing (item C) the not-our-fault-guv-if-only-governments-would-stick-their-unwelcome-noses-out-of-our-er-the-surveillance-business-we'd-all-be-ok corporate behemoths that have facilitated the mass surveillance we are all now subjected to.

Mr Farron and Dr Huppert - thanks for making some effort but can you please stop - I cannot emphasize this strongly enough - stop painting security and liberty (or security and privacy) as opposites. They are fundamentally interdependent. Unless that understanding can be embedded in the DNA of the public debate about this stuff, we won't ever get off the starting blocks to address mass surveillance.

Thursday, March 13, 2014

Joe McNamee, EDRi initiates WePromise.eu

Joe McNamee, EDRi initiates WePromise.eu

)

Good idea.

The ten point charter prospective MEPs are being asked to support -

I will oppose any measure that removes the power to make decisions on matters that affect European citizen's fundamental rights from the judiciary or democratically-elected policy-makers, including, but not limited to, any of the points below.

1. I will promote transparency, access to documents and citizen participation 

 

Dear Mr (Branson) Mockridge... about that poor broadband service again...

Open letter to Tom Mockridge, CEO of Virgin Media, (draft originally addressed to Richard Branson before I remembered that Mr Branson sold the company to Liberty Global last year).

Dear Mr Mockridge,

Much though I appreciate the regular opportunity to navigate your Virgin Media broadband service telephone tag maze and engage your stressed call centre staff in friendly conversation, I'm rather busy with other personal and professional things in life at the moment.

Your broadband service which I subscribe to at home has provided a variable wireless connection to my collection of digital devices for several days and has been deteriorating for several months.  Though the connection to the computer directly wired to the Virgin Super Hub has been more or less ok, apart from the odd day or two or threes interruptions to service here and there, the wireless connection to other devices has been erratic and often slow with download speeds slipping below several tenths of a Mbps.

As when I wrote to Richard Branson in October 2012, I'd just like to point out, again, that this is disrupting my family’s work, education, social activities and access to public and commercial services.

Your “check service status” phone line “confirms” that Virgin Media believe/assert “there are no problems” in my area.

Your “check service status” facility on the web - https://my.virginmedia.com/faults/service-status says there is “Good service” in my area.

They are both wrong.

As I believe I explained previously, to Mr Branson when he owned the company, when there are problems it is somewhat irritating if Virgin Media declare/think/pretend there are none.
Your labyrinthine, do-it-yourself (DIY) ‘check and fix your own problems’ approach on the Virgin Media website is quite something.  It assumes customers have the capacity and the skill to hunt down and follow a series of Russian doll like instructions and articles about where you might find instructions which rarely fix anything. This does, however, generate significant angst. I'm at risk of repeating myself here but one of my least favourite activities, when I get home from work, is going through a series of convoluted, difficult to access (via your website or phone helplines) routine processes I know to be futile, in an effort to demonstrate to one of your difficult to access call centre folks that I’ve already tried the stuff on their crib sheet without success.

Your various “helplines” – out of which, these days, positively dance the effusively cheery young woman's recorded voice, seemingly nothing short of delighted to hear from me - are not very helpful. Incidentally the consultants – that advised your people or your people's people that customers, reduced to having to engage in endless telephone tag about a fault, would have their disquietude quelled by an extravagantly high spirited recorded voice – were wrong.

“Press 1 for…” queuing, canned music, notes that staff are busy (me too) and I'll have to stay on hold for x minutes, opportunities to choose the type of canned music I'd like to hear (my kids thought that was hilarious), more of the excessively upbeat recorded female voice and eventually, at the end of a long wait, connect to a member of call centre staff who can’t help. Apparently I'd been routed to cable services instead of national services. So cable services' Jay therefore had to transfer me to another part of your operation which in its turn can't help because I've been misdirected; so will transfer me to someone who they guarantee, absolutely, this time, will be the right person. None of this is conducive to soothing already fragile customer relations. 

I spent about 40 minutes on the phone yesterday evening and after three false starts got through to a senior technician, Anjan, who seemed pretty stressed and worn out himself. I explained the wifi problem and Anjan declared Virgin could not guarantee a stable wifi connection. Not a promising start and something of a contrast to the response I got from a very helpful lady called Shambhavi when I had an equivalent wifi problem in August of 2013.*

In any case Anjan re-booted the super hub and changed the wireless channel. Neither activity helped. (They didn't the last time I tried them either.) So he said the best thing to do would be to send a technician round to physically relocate the super hub. Now given the super hub has not moved and we haven't acquired or run any extra digital technologies in the past week, I'm skeptical that the notion of physically moving the hub will make any appreciable difference to the erratic wifi connection. Nevertheless I accept that Anjan, as he said, was at the end of a telephone line and couldn't see the relative layout of where the wireless devices were in relation to the hub. 

So I await your technician to work his/her magic next Tuesday between 1 and 6pm . The restoration of my wireless connections to something in the realm consistent usability and the banishment particularly of that irritating video buffering circle to the annals of history will be most welcome, if it can be achieved. I will, by the way, have to miss an important meeting to be at home to accommodate this visit.

To any Virgin Media staff who trip across this open note - if you have, thanks for taking the time to read it thus far. To the Virgin Media call centre staff most of whom are doing your best in the face of problems outside your control - thank you for your efforts and your understanding, when you can muster it up, that I did not call to make your life miserable, merely to ask for an operational service.

To Mr Mockridge - as I said to Mr Branson, when there is a problem with my broadband service – it’s slow and/or down and/or erratic and/or there are power fluctuations on the line – I want Virgin Media to know about it, let me know about it in an accessible communiqué, work hard to fix it asap and deliver a reliable service. I don't want to play telephone tag for hours, days or weeks or go on endless, fruitless Virgin Media website mining expeditions, in an effort to find a temporary DIY patch for the prevailing problem to tide me over until the next disruption.

BT write regularly encouraging me to switch broadband provider.  The series of disruptions in Virgin Media services in the past year alone is causing me to wonder whether that alternative would be more consistently reliable, with the additional bonus of access to BT Sport.

Yours sincerely,
Ray Corrigan

* In August 2013 I was having lots of broadband problems including similar persistent wifi problems to those experienced in recent days. I gathered my energy to phone Virgin Media about it on the 31st of the month, one Saturday morning I didn't happen to be out and about on the Open University trail. After lots of phone tag including getting cut off with a promise to call back I had little confidence in, I actually got a very helpful lady called Shambhavi at the other end of the line. 

She listened to my problem carefully, took the time to understand specifically what the issue was and apologised for the disruptions.  She asked me to check connection speeds on each laptop and wireless device. She did some diagnostics and detected power fluctuations on the cable connecting my house and postcode. She had to go away and do some extra checking and system adjustments and also promised to phone me back within half and hour. 

Guess what? She phoned me back within half an hour!

During the time Shambhavi was off the line doing her system adjustments, one of the laptops acquired a usable wireless connection, presumably due to her remote work on the power fluctuations on the cable. The other laptop still had no connection. She asked me to connect that directly by cable to the Virgin Media super hub, took remote control and did some checks (most of which I had done previously but nevertheless kudos to Shambhavi for being thorough). She thought the laptop might need a wireless driver update but discovered it was already installed. Disconnected the cable to the laptop and wireless was still not working, though it could get a very slow intermittent connection to the BBC site but nowhere else. Connected the cable again. Shambhavi then rebooted the laptop in safe mode and did some more checks. This time when I disconnected the cable the machine did have a working wireless connection. A selection of broadband speedtests showed it running 20 - 40 Mbps, a massive improvement.

Shambhavi then asked that I systematically check the wireless performance of each device. All were in working order. I thanked her for a job well done. 1.5 hours after first calling, my wireless devices were now working and the Corrigan household was back online. 

I had intended to write a blogpost about it at the time to thank Shambhavi publicly and it was remiss of me to take so long about it and only now be prompted to record her professional supportive effective approach when running into a less successful attempt to have my latest Virgin Media troubles fixed. Well done and thank you for that particular morning's work on Saturday, August 31st, 2103, Shambhavi.

A final note to Mr Mockridge and/or any of your sharp suited minders who might stumble across this open letter or filter the associated email - easy access to real caring people in your organisation, like Shambhavi, with the capacity and willingness to listen, diagnose and fix service and technical issues, would do wonders for your customer relations. 

Update Friday 14/3/'13: I had a quick response to my email to Mr Mockridge from Marina, CEO Case Manager at Virgin Media's Chief Executive Office. My email went at 13.38 yesterday and the time stamp on the response is 14.42. I also had a very helpful phone call from Ian in the Virgin Media complaints office this morning (Friday). He suggested that instead of sending out a technician to physically relocate the Virgin Media super hub, since I was skeptical about the efficacy of such an action, that he arrange to send a new generation hub with a better wireless performance. I'll need to install it myself but he said it comes with straightforward instructions. Thanks to Marina for your rapid response and handing the case to Ian. Thanks to Ian for the care you've taken to read and understand my missive, investigate my Virgin Media problems and your all round helpful approach to date. Hopefully the new hub will connect seamlessly and cure the wifi issues we've been experiencing.

Wednesday, March 12, 2014

NSA QUANTUMHAND - NSA disguises itself as a fake Facebook server

The Intercept has published the latest set of NSA documents leaked by Edward Snowden. The story is time is How the NSA Plans to Infect “Millions” of Computers with Malware. To the Facebook users out there who don't really care about this stuff, take a look at this short video:

How the NSA Secretly Masqueraded as Facebook to Hack Computers for Surveillance from First Look Media on Vimeo.

It's a man on the side attack. As Glenn Greenwald and Ryan Gallagher say in the article:
"In one man-on-the-side technique, codenamed QUANTUMHAND, the agency disguises itself as a fake Facebook server. When a target attempts to log in to the social media site, the NSA transmits malicious data packets that trick the target’s computer into thinking they are being sent from the real Facebook. By concealing its malware within what looks like an ordinary Facebook page, the NSA is able to hack into the targeted computer and covertly siphon out data from its hard drive. A top-secret animation demonstrates the tactic in action.
The documents show that QUANTUMHAND became operational in October 2010, after being successfully tested by the NSA against about a dozen targets.
According to Matt Blaze, a surveillance and cryptography expert at the University of Pennsylvania, it appears that the QUANTUMHAND technique is aimed at targeting specific individuals. But he expresses concerns about how it has been covertly integrated within Internet networks as part of the NSA’s automated TURBINE system.
“As soon as you put this capability in the backbone infrastructure, the software and security engineer in me says that’s terrifying,” Blaze says.
“Forget about how the NSA is intending to use it. How do we know it is working correctly and only targeting who the NSA wants? And even if it does work correctly, which is itself a really dubious assumption, how is it controlled?”"
When asked to comment Facebook said had "no evidence" of QUANTUMHAND activity.

Tuesday, March 11, 2014

Twitter's locked me out again

Twitter has locked me out again. Just as I was about to link to 2 Guardian stories - one each by Cory Doctorow and Christopher Soghoian on Edward Snowden's appearance at SXSW.

Monday, March 03, 2014

Submission to the EU copyright rules consultation

Draft submission to the EU copyright rules consultation below. Please excuse the formatting - I've been trying to use the odf form supplied by the Commission.

Update: this draft has now been submitted.

It's long and probably tedious in places and superficial in others but I'd still appreciate comments on any errors or omissions, from any suitably interested in copyright folks with an opportunity to scan it.

Public Consultation
on the review of the EU copyright rules
Please identify yourself:
Name:
Ray Corrigan
Senior Lecturer in Maths Computing & Technology, The Open University, UK
(This submission is in a personal capacity and not on behalf of my employer) …………………………………………………………………………………………………..
Type of respondent (Please underline the appropriate):
  • End user/consumer (e.g. internet user, reader, subscriber to music or audiovisual service, researcher, student)
for the purposes of this questionnaire normally referred to in questions as "end users/consumers"
  • Author
  • Other (Please explain):
Academic author and educator with interest in copyright


  1. Rights and the functioning of the Single Market

Why is it not possible to access many online content services from anywhere in Europe?

A. [The territorial scope of the rights involved in digital transmissions and the segmentation of the market through licensing agreements]

  1. [In particular if you are an end user/consumer:] Have you faced problems when trying to access online services in an EU Member State other than the one in which you live?
YES
Yes. Receiving Irish public broadcasts e.g. from RTE radio and television in the UK. I've also had problems getting Polish books in Ireland and the UK. The lack of access to content in their native language is a particular issue for the large number of migrants all across the EU.
  1. [In particular if you are a service provider:] Have you faced problems when seeking to provide online services across borders in the EU?
I'm not a service provider but my academic blog at http://b2fxxx.blogspot.co.uk/ is often censored or mis-categorised by software filters; sometimes making it awkward for people not just around the EU but also in the UK to access. Notably the Orange mobile network has in the past blocked my access to my own blog as have a number of other corporate software filters. For several years Yahoo! search tagged my blog with a “warning: dangerous downloads” label.
  1. [In particular if you are a right holder or a collective management organisation:] How often are you asked to grant multi-territorial licences? Please indicate, if possible, the number of requests per year and provide examples indicating the Member State, the sector and the type of content concerned.
[Open question]
N/A
  1. If you have identified problems in the answers to any of the questions above – what would be the best way to tackle them?
[Open question]
There are three main parties with a stake in the copyright pie:
  • Creators
  • Agents (and I use the term in the economic sense here to cover all the commercial entities involved in the copyright arena e.g. music, film, software, media companies, publishers etc.)
  • And society as a whole (also known as the general public or consumers)

Each of the three sets of stakeholders overlap to some degree and will have within them a massive range of different kinds of creators, businesses or consumers – all of which will have their own demands of the copyright system – but for simplicity sake I am just going to look at the three groups.
Whatever commercial, regulatory and technical systems are put in place to evolve copyright in a way that increases the cross-border availability of content services, they must take account of the diverse interests of all three sets of generic stakeholders. Balancing the needs of these diverse groups is a complex calculus, too often neglected. The historical result has been badly designed regulations, falsely promoted as protecting the interests of creators but in reality tailored to the desires of existing large commercial players in the content industries. The periodically repeated extension of copyright term is the classic example in the EU but particularly in the US.
Copyright is too often shaped as a tool for an elite group of powerful economic agents (industry players) to extract all the available commercial value from creative works, even when that means uses previously deemed legal are handed over to the control of these agents. Yet the function of copyright is not purely to provide economic rent for commercial intermediaries but also to provide an economic incentive to creators and to contribute to the welfare of society as a whole.
The problem is that there is very little empirical evidence available on copyright and intellectual property policy-making more generally to inform such regulation. And the studies that are available are often contradictory. So before we make any more rules written or shaped by the best funded industry lobbyists we must start gathering a sound empirical evidence base. The kind of work being done by the UK Research Council's CREATe initiative in partnership with the UK Intellectual Property Office, amongst others.1 Too often copyright regulations are shaped by what dominant incumbent industries want rather than the balanced interests of creators, economic agents and society as a whole, based on empirical evidence. You can argue about the relative importance of the three different sets of stakeholders but the needs of all three must be accounted for.


  1. [In particular if you are a right holder or a collective management organisation:] Are there reasons why, even in cases where you hold all the necessary rights for all the territories in question, you would still find it necessary or justified to impose territorial restrictions on a service provider (in order, for instance, to ensure that access to certain content is not possible in certain European countries)?
NO
  1. [In particular if you are e.g. a broadcaster or a service provider:] Are there reasons why, even in cases where you have acquired all the necessary rights for all the territories in question, you would still find it necessary or justified to impose territorial restrictions on the service recipient (in order for instance, to redirect the consumer to a different website than the one he is trying to access)?
NO
  1. Do you think that further measures (legislative or non-legislative, including market-led solutions) are needed at EU level to increase the cross-border availability of content services in the Single Market, while ensuring an adequate level of protection for right holders?
YES
See my answer to question 4 above and note the needs of the 3 sets of stakeholders – creators, economic agents and society as a whole.
As to what these measures should be, we are woefully short of the sound empirical evidence we need to figure this out and need vastly more investment in gathering, researching and analysing such evidence.
I would suggest that given the dominant position of large oligopolies controlling intellectual property rights based on territorial licensing of popular sports, for example, that the current regulatory regime, coupled with a purely market led approach, is unsatisfactory. It leads to a few winners – the richest sports stars and/teams and economic agents like BSkyB – and other stakeholders – sports people, other creators, other economic agents who would like to provide wider access to sports, and consumers, the public and society as a whole – losing out relatively speaking.
Consider the breaking down of territorial barriers to facilitate increased cross border availability of cross border content services or expanding copyright exceptions more generally. Consider the case of the sale of a new work, whether music, film, software or other creative work. The economic damage to creators or agents that own the copyright from an increase in copyright exceptions or easier cross-border availability must come from:
a) a reduction in revenue of the specific work, either now or in the future
and, if this is positive,
b) a ‘dynamic effect’ whereby the lost sales now affect the ability to generate new work in the future and thereby revenues in the future.

It is clear that only if a) occurs that b) can have validity. Also, criterion a) is solely concerned with how current and future revenue is influenced by copyright exceptions.
Some commentators define an additional type of ‘economic damage’ that
relates to previous sales of copyrighted goods . The argument here is that improvements in technology (e.g. the iPod) allow consumers to gain more value from their existing purchases of music, films, etc. However, labelling this as ‘economic damage’ is a shift away from
normal economic analysis and the normal functioning of markets. Whilst retrospective compensation is commonplace in the copyright system, for example with retrospective term extensions, the market system does not generally provide for retrospective compensation based on how technology has enabled new uses.

Some commentators also note that increasing copyright exceptions may not have only detrimental effects. For example, it is sometimes suggested that format-shifting may allow others to hear, see or play the work. This may, in turn, generate more revenue either now or in the future. Similarly, the wider exposure that format-shifting, parody or user-generated content creates may also increase sales. Increased sales can come from either primary sales of the work, or so-called secondary sales (such as tickets for live concerns, merchandise, etc). And in the case of cross-border access the societal value eg of migrants having access to copyrighted content from their home territories is incalculable.

In general, when a consumer buys a CD, or any product, we assume they include in their valuation an estimate of the entire benefits derived from the CD. This includes listening to the CD now, next week and next year, as well as listening to it with friends and family, format-shifting (if legal) and benefits from new technologies in the future.

At any point in time, any specific product will receive a wide range of ‘valuations’, as consumers are heterogeneous. Economists summarise these valuations into a demand curve, as for a specific product. The market price is determined by a variety of factors, including the
competition in the market for the specific product (e.g. the price of similar music or software).
A key result of the standard analysis of demand is that the value of copyright exceptions and extra consumer territorial access rights will be embedded into a demand curve. Hence, there is an argument that agents and creators automatically extract value from copyright exceptions and cross border rights. Similarly, if the extent of exceptions or cross border rights is changed then the demand curve will automatically shift to reflect these. Prices go up if copyright exceptions are increased (as consumers are assumed to gain, hence their valuations increase), and down if exceptions are reduced.2



B. Is there a need for more clarity as regards the scope of what needs to be authorised (or not) in digital transmissions?

1. The act of “making available”
  1. Is the scope of the “making available” right in cross-border situations – i.e. when content is disseminated across borders – sufficiently clear?
Yes and no but mostly no. Copyright laws are ridiculously complicated and inaccessible to ordinary mortals. The right may be clear to copyright experts but not to ordinary people.
  1. [In particular if you are a right holder:] Could a clarification of the territorial scope of the “making available” right have an effect on the recognition of your rights (e.g. whether you are considered to be an author or not, whether you are considered to have transferred your rights or not), on your remuneration, or on the enforcement of rights (including the availability of injunctive relief3)?
I don't know. I don't have the empirical evidence to answer such a question.

2. Two rights involved in a single act of exploitation

  1. [In particular if you a service provider or a right holder:] Does the application of two rights to a single act of economic exploitation in the online environment (e.g. a download) create problems for you?
NO
I don't think this should a major issue though some large copyright holders have been working on ways to extract extra economic rent from the issue since the internet hit public consciousness in the mid 1990s (and probably before).4 There is indeed the complication associated with the two rights being held by different agents – a hint of the unnecessary complexity of copyright law. However, the default assumption that any potential new revenues flowing from technological or other innovations should automatically flow to the copyright holder is flawed.
Suppose someone buys a sofa and subsequently a large flat screen TV that enhances the experience of sitting on the sofa. The furniture seller is not entitled to extra revenue because their customer, as a result of a separate purchase is now deriving extra benefit from their sofa.
The unstated assumption that there is necessarily economic harm to copyright holders when new technology enables new revenue flows is false.

3. Linking and browsing

  1. Should the provision of a hyperlink leading to a work or other subject matter protected under copyright, either in general or under specific circumstances, be subject to the authorisation of the rightholder?
NO – Categorically not. Rights holders should have no right to veto links. Such a restriction on linking would break the internet for ordinary users, for businesses, governments, NGOs, educational establishments; and would be largely unworkable in practice.
As the consultation notes, a number hyperlinks cases have been referred to the CJEU. As a hyperlink is just a pointer to where content can be found, like a reference in an index, “the provision on a website of clickable links to works freely available on another website does not constitute an ‘act of communication to the public’”, as noted in the recent Svensson case (C-466 / 12).
Rights holders would continue to have access to redress through the courts in relation to the large scale systematic provision of links designed to lead to infringing content. There were a number of UK cases in this area in 2013.

  1. Should the viewing of a web-page where this implies the temporary reproduction of a work or other subject matter protected under copyright on the screen and in the cache memory of the user’s computer, either in general or under specific circumstances, be subject to the authorisation of the rightholder?
NO – Categorically not. This temporary reproduction is a function of the technology of browsing the world wide web. The applicability of the temporary copying exception to internet browsing is being considered by the CJEU but it would seem sensible given the nature of the technology that temporary reproduction during browsing should fall within the exception.
It is, however, critical to be clear about this. As recently as the 1990s large entertainment industries attempted, in the US, to leverage this function of the technology and copyright's exclusive right to reproduce copies of protected works, to increase their control of the market and revenues for copyrighted works. They argued that any part of a copyright work being copied even temporarily in a computer's random access memory was an unauthorised reproduction. The US copyright law (from the 1970s) allowed no exceptions for internet related processes or uses. So industry lobbyists claimed they should be entitled to charge for all these extra digital copies and part copies that were a side effect of the way digital technology worked. And they succeeded in getting the Digital Millenium Copyright Act passed in 1998, largely based on this pay-per-view/pay-per-copy/pay-per-use view of the world. The EU followed on with our very own version of the DMCA and it's anti circumvention provisions in the copyright and related rights directive of 2001, 3 years later.
Yet think about this from a different perspective. If every time an electronic version of a copyrighted work appears in temporary cache or random access memory of a computer it constitutes the making of an chargeable copy, we are providing copyright holders with substantial control of even the consumption of their works; not just the copying, reproduction and other traditional rights associated with copyright.
It would be anathema to the public interest to provide such additional rights to copyright holder when there are vastly less socially damaging options available such as putting their works behind a pay wall. Such regulations would additionally be unworkable in practice and bring the law into disrepute.
4. Download to own digital content
  1. [In particular if you are an end user/consumer:] Have you faced restrictions when trying to resell digital files that you have purchased (e.g. mp3 file, e-book)?
YES
It's not just a question of resale but transfer of legally acquired content between my own devices and/or from old failing equipment to newer replacements.
  1. [In particular if you are a right holder or a service provider:] What would be the consequences of providing a legal framework enabling the resale of previously purchased digital content? Please specify per market (type of content) concerned.
[Open question]
Economics suggests secondary market sales can be accounted for when setting initial sales price. It's more complicated with digital content transfers due to the “forward and delete” point mentioned by the consultation. I'm sure the Research Council UK's CREATe initiative and numerous other IP centres round the EU would be happy to be commissioned to do some research on this. The UK's Intellectual Property Office has a team of economists who could also probably offer some advice.

C. Registration of works and other subject matter – is it a good idea?

  1. Would the creation of a registration system at EU level help in the identification and licensing of works and other subject matter?
YES
On balance a voluntary registration system could be beneficial for the long term identification of copyright ownership history and facilitation of licensing. See the UK Hargreaves Review recommendations on a copyright hub. A large reduction in the term of copyright would ease the potential need for such a registration system however.


  1. What would be the possible advantages of such a system?
[Open question]
Clarity of copyright control and easier facilitation of licensing.
  1. What would be the possible disadvantages of such a system?
[Open question]
Costly and potentially cumbersome; plus open to control by the more powerful economic actors.
  1. What incentives for registration by rightholders could be envisaged?
[Open question]
Entirely dependent on the specific systems, processes and infrastructure used to facilitate registration.

D. How to improve the use and interoperability of identifiers

  1. What should be the role of the EU in promoting the adoption of identifiers in the content sector, and in promoting the development and interoperability of rights ownership and permissions databases?
[Open question]
I'm not sure the EU has a role here other than to encourage the adoption of open standards and interoperability. It's also likely the EU can influence this more through the purchasing processes of the EU's institutions – economic influence – rather than through regulatory approaches.


E. Term of protection – is it appropriate?

  1. Are the current terms of copyright protection still appropriate in the digital environment?
NO
No. The current terms are too long even if we didn't live in a digital world. Patent terms are generally 20 years. How have we arrived at a situation where copyright terms are the life of the author plus 50 years (Berne) or 70 years (EU, US and others) or 100 years (Mexico) or 70 years after first publication of music (EU)?
In the case of long copyright terms our three sets of stakeholders -
  • Creators
  • Economic agents
  • Society
mostly lose. The only winners are the few wealthy creators and economic agents with the small number of copyrighted works with long commercially successful lives; which would otherwise fall into the public domain many decades earlier.
Only about 4% of copyright works older than 20 years are commercially available, so 96% remain locked up for the rest of the creator's life plus 70 years even though no one is selling them. The public therefore lose out, as do other creators and economic agents who would like to build on or commercially exploit those works (and the 4%).
Systemically long copyright terms are a bad deal for most stakeholders. In recent years, the EU, as the consultation notes, increased the term of copyright in sound recordings from 50 to 70 years. If we do some basic discounted cash flow calculations, we discover the real present value factor of the increase in economic incentive of a term extension of 20 years is surprisingly small. The present value (therefore specific differential economic incentive at the time of recording) of the extra 20 years on top of the original 50 years would be:
1/(1+r)51 + 1/(1+r)52 + … + 1/(1+r)70
- Where r is the equivalent of a standard rate of inflation (expressed as a decimal) for the 20 years. In fact with the help of some neat mathematical manipulation we can derive a formula for the present value of a constant income (C) for a particular copyright term:
Present value = C(1-e-rt)/r
Where e is Euler’s number, a universal mathematical constant (and the base number for natural logarithms)
r is the percentage annual discount rate expressed as a decimal,
and t is the copyright term in years.
So for a term t of 50 years and a discount rate of 10%, the present value of an income stream C of £1000 per annum would be £9933, approximately. That sounds like a decent income. Now compare it with the present value of an equivalent yearly income if the copyright term were 70 years (just change the t in the calculation from 50 to 70), which turns out to be £9991.
The extra present value of the 20 year term extension was just £58 or 0.6%.
In fact if the copyright term were to last forever, the present value of the same annual income stream would be £10,000. (Present value of an infinite income flow at a constant discount rate =C/r, where C is the annual income and r the discount rate)
A 70 year term of copyright is worth 99.9%, in present value terms, of the value of a copyright that lasted forever. In economic terms current terms of copyright are effectively infinite.
A copyright term that lasts the life of the creator plus 70 years makes no economic sense whatsoever, whether we live in a digital age or not.
We can repeat these calculations for different discount rates and income streams and demonstrate that the differential in real present value terms or the economic incentive provided by long copyright terms provides no effective incentive to creators.5
As Thomas Babbington Macaulay said in 1841 in the House of Commons debate on copyright:
I will take an example. Dr Johnson died fifty-six years ago. If the law were what my honourable and learned friend wishes to make it, somebody would now have the monopoly of Dr Johnson's works. Who that somebody would be it is impossible to say; but we may venture to guess. I guess, then, that it would have been some bookseller, who was the assign of another bookseller, who was the grandson of a third bookseller, who had bought the copyright from Black Frank, the doctor's servant and residuary legatee, in 1785 or 1786. Now, would the knowledge that this copyright would exist in 1841 have been a source of gratification to Johnson? Would it have stimulated his exertions? Would it have once drawn him out of his bed before noon? Would it have once cheered him under a fit of the spleen? Would it have induced him to give us one more allegory, one more life of a poet, one more imitation of Juvenal? I firmly believe not. I firmly believe that a hundred years ago, when he was writing our debates for the Gentleman's Magazine, he would very much rather have had twopence to buy a plate of shin of beef at a cook's shop underground. Considered as a reward to him, the difference between a twenty years' and sixty years' term of posthumous copyright would have been nothing or next to nothing. But is the difference nothing to us? I can buy Rasselas for sixpence; I might have had to give five shillings for it. I can buy the Dictionary, the entire genuine Dictionary, for two guineas, perhaps for less; I might have had to give five or six guineas for it. Do I grudge this to a man like Dr Johnson? Not at all. Show me that the prospect of this boon roused him to any vigorous effort, or sustained his spirits under depressing circumstances, and I am quite willing to pay the price of such an object, heavy as that price is. But what I do complain of is that my circumstances are to be worse, and Johnson's none the better; that I am to give five pounds for what to him was not worth a farthing.


So clearly we need to be extremely sceptical of arguments declaring that the only way intellectual property owners (creators and/or agents) are going to derive an appropriate income from their creative assets is by retaining or extending already excessively long copyright terms.
Copyright terms are already demonstrably excessive and I say that as a published author, as much as an academic, reader or plain member of the public. I would further suggest the need for detailed empirical research to provide a sound evidence to inform policy makers (worldwide, not just in the EU) in setting a more appropriate copyright term. This may lead as now to terms being tailored to the particular type of copyrighted work but in all cases the simple economics suggest these terms would be significantly shorter.


    III. Limitations and exceptions in the Single Market
  1. Are there problems arising from the fact that most limitations and exceptions provided in the EU copyright directives are optional for the Member States?
YES
Hugenholtz, P. B. and Senftleben, Martin, Fair Use in Europe: In Search of Flexibilities (November 14, 2011). http://ssrn.com/abstract=1959554 explain this better than I can:
There appear to be good reasons and ample opportunity to (re)introduce a measure of flexibility in the national copyright systems of Europe. The need for more openness in copyright law is almost self-evident in this information society of highly dynamic and unpredictable change. A historic perspective also suggests that copyright law, particularly in the civil law jurisdictions of Europe, has lost much of its flexibility in the course of the past century. By contrast, with the accelerating pace of technological change in the 21st Century, and in view of the complex process of law making in the EU, the need for flexible copyright norms both at the EU and the national level is now greater than ever.

Against this background, the authors argue that the EU copyright acquis leaves considerably more room for flexibilities than its closed list of permitted limitations and exceptions suggests. In the first place, the enumerated provisions are in many cases categorically worded prototypes rather than precisely circumscribed exceptions, thus leaving the Member States broad margins of implementation. In the second place, the EU acquis leaves ample unregulated space with regard to the right of adaptation that has so far remained largely unharmonized. A Member State desiring to take full advantage of all policy space available under the Information Society Directive, might achieve this by literally transposing the Directive’s entire catalogue of exception prototypes into national law. In combination with the three-step test, this would effectively lead to a semi-open norm almost as flexible as the fair use rule of the United States. Less ambitious Member States seeking to enhance flexibility while keeping its existing structure of limitations and exceptions largely intact, can explore the policy space left by distinct exception prototypes. In addition, the unharmonized status of the adaptation right would leave Member States free to provide for limitations and exceptions permitting, for example, fair transformative uses in the context of producing and disseminating user-generated content.


  1. Should some/all of the exceptions be made mandatory and, if so, is there a need for a higher level of harmonisation of such exceptions?
YES
    23. Should any new limitations and exceptions be added to or removed from the existing catalogue? Please explain by referring to specific cases.
[Open question]
From my work with Mark Rogers and Joshua Tomalin in 2010 (Rogers, Mark; Corrigan, Ray and Tomalin, Joshua (2010). The economic impact of consumer copyright
exceptions: a literature review. Consumer Focus, London, UK.) http://oro.open.ac.uk/25604/5/The_economics_of_consumer_copyright_exceptions_final.pdf:

Investigating potential economic damage to rights-holders requires an
analysis of how consumer copyright exception could affect the demand for the
original creative work. The processes via which consumer copyright
exceptions influence the demand curve for original creative work can be
complicated. This said, a standard analysis of the demand for creative works
must assume that consumers incorporate the benefit of copyright exceptions
into their demand. A consumer’s decision to purchase is based on the benefits
of the product, including – in the case of creative work – the value of any
copyright exception. In this sense, it can be argued that a creator
automatically extracts value from copyright exceptions, since these directly
influence the demand for the original creative work.
In our review, the two most commonly cited ‘economic’ studies into the effects
of Private Copying Remuneration (PCR) systems – Econlaw (2007) and
Nathan Associates (2006) – do not provide any useful evidence that
consumer copyright exceptions cause economic damage to rights-holders, or
that a copyright levy is justified on these grounds.
• The Econlaw study incorrectly equates economic damage with
consumer value and does not contain a formal discussion of the
demand for copyrighted works.
• The Nathan Associates study does not make a necessary
distinction between ‘damage to consumers and producers’ and
‘damage to society as a whole’. It likely overstates the economic
damage caused by PCR. It also uses estimates for demand
elasticities that do not come from formal economic analysis.
The economic evidence that format-shifting, parody and user-generated
content cause any kind of economic damage to rights-holders simply does not
exist. Arguments that support tighter copyright law, or support PCR systems,
tend to confuse economic damage with consumer value. Any future analysis
on this issue needs to investigate the conditions under which the proposed
consumer copyright exceptions would have any impact on demand for
creative work.
The complications associated with the application of limitations and exceptions could be greatly eased by the universal and drastic reduction in copyright terms. In this innovative age, the need for creators and inventors to have to consult a lawyer to get a definitive opinion on whether their work is permitted by existing rights holders or limitations and exceptions built into a very complex law, is somewhat anomalous.

That said I wonder whether there should be a wider recognition perhaps formal sanctioning of non commercial sharing of copies of copyrighted works. By non commercial I'm referring to that proportion the widespread sharing that currently occurs that would not happen if those participating were obliged to pay-per-copy. So e.g. teens or those on low incomes who might not have access to the economic means to pay for such material; or sharers getting access to works no longer commercially available; or those sharing materials released under open or creative commons licences. So in terms of the three generic stakeholders it would be economically neutral for creators and agents but nevertheless have a positive effect on the welfare of society.
    24. Independently from the questions above, is there a need to provide for a greater degree of flexibility in the EU regulatory framework for limitations and exceptions?
That's a complicated question that requires robust empirical study and again the question would be greatly eased by a significant reduction in copyright terms.
    25. If yes, what would be the best approach to provide for flexibility? (e.g. interpretation by national courts and the ECJ, periodic revisions of the directives, interpretations by the Commission, built-in flexibility, e.g. in the form of a fair-use or fair dealing provision / open norm, etc.)? Please explain indicating what would be the relative advantages and disadvantages of such an approach as well as its possible effects on the functioning of the Internal Market.
[Open question]
There's no “best approach” but there could be a better informed approach if the EU, member state governments and industry were to commit to funding a great deal more empirical research.
    26. Does the territoriality of limitations and exceptions, in your experience, constitute a problem?
YES
    27. In the event that limitations and exceptions established at national level were to have cross-border effect, how should the question of “fair compensation” be addressed, when such compensation is part of the exception? (e.g. who pays whom, where?)
[Open question]
This is another question requiring empirical research.

A. Access to content in libraries and archives

1. Preservation and archiving
    28. (a) [In particular if you are an institutional user:] Have you experienced specific problems when trying to use an exception to preserve and archive specific works or other subject matter in your collection?
(b) [In particular if you are a right holder:] Have you experienced problems with the use by libraries, educational establishments, museum or archives of the preservation exception?
YES


    29. If there are problems, how would they best be solved?
[Open question]
Libraries and archives have long been under threat in from UK government funding cuts and in the face of the more powerful economic agents' constant drive to increase their industries' control of copyrighted content. Carefully-defined preservation exceptions have clear benefits, enabling libraries to maintain and facilitate access to our cultural heritage for the enjoyment of present and future generations. The cultural and societal welfare associated with this work is incalculable.
    30. If your view is that a legislative solution is needed, what would be its main elements? Which activities of the beneficiary institutions should be covered and under which conditions?
[Open question]
Library experts are better placed to answer this question but it is another area where sound empirical research is required. Libraries, museums and archives serve the public good and require exceptional protections legislative, political and economic.
    31. If your view is that a different solution is needed, what would it be?
[Open question]
Libraries and archives are exceptionally important and require special protections even more so in our digital age.
In The Public Domain: Enclosing the Commons of the Mind, James Boyle eloquently and passionately argues that our culture, science and democracy depend on a delicate balance between ideas that are controlled by intellectual property and those that are freely available in the public domain. He tells a terrific series of engaging stories about, for example, why the building blocks of synthetic biology, business methods, pairs of musical notes are now owned, why blues, jazz or soul music would probably be illegal if it were invented today, why most of 20th century culture is legally unavailable to us, and why the World Wide Web would, most likely, have been killed at birth if lawyers, commerce and policy-makers could have reacted quickly enough.

This all adds up to what Boyle calls a 'second enclosure movement' – except that on this occasion we’re not facing an enclosure of the grassy commons of olde Englande but rather an enclosure of the 'commons of the mind' and a serious erosion of the public domain, a state of affairs future generations will rightly condemn us for allowing to happen; at the very point that we have the technical and economic capacity to facilitate universal access to recorded human knowledge, a digital library of Alexandria.

The book, destined to become the standard text in the area, also serves as the Silent Spring of the information society – a clarion call to understand and protect the public domain through scholarship, communication, articulation and recognition of shared interests and values that allow that notion - the public domain - to come into public consciousness and a diverse ecology of activism to support all this. A kind of "environmentalism for information" and the public domain.
Libraries, museums and archives are at the coalface of this environmentalism for information and the public domain and require, in addition to legal protections, public substantive or at the very least sufficient public funding to enable them to engage effectively in such work.

2. Off-premises access to library collections

    32. (a) [In particular if you are an institutional user:] Have you experienced specific problems when trying to negotiate agreements with rights holders that enable you to provide remote access, including across borders, to your collections (or parts thereof) for purposes of research and private study?
(b) [In particular if you are an end user/consumer:] Have you experienced specific problems when trying to consult, including across borders, works and other subject-matter held in the collections of institutions such as universities and national libraries when you are not on the premises of the institutions in question?
(c) [In particular if you are a right holder:] Have you negotiated agreements with institutional users that enable those institutions to provide remote access, including across borders, to the works or other subject-matter in their collections, for purposes of research and private study?
[Open question]
I have often experienced problems when trying to consult works when not on the premises or in the territory of the institution in question.

    33. If there are problems, how would they best be solved?
[Open question]
Through an open universally deployed high speed neutral technical infrastructure and a permissive intellectual property regime for libraries and archives.

    34. If your view is that a legislative solution is needed, what would be its main elements? Which activities of the beneficiary institutions should be covered and under which conditions?
[Open question]
Special copyright exceptions for non-commercial use of library and archive materials.

    35. If your view is that a different solution is needed, what would it be?
[Open question]
Deployment of investment to enable construction of technical infrastructure to facilitate digital archiving and connecting all libraries and archives to the backbone of a neutral internet.

3. E – lending

    36. (a) [In particular if you are a library:] Have you experienced specific problems when trying to negotiate agreements to enable the electronic lending (e-lending), including across borders, of books or other materials held in your collection?
(b) [In particular if you are an end user/consumer:] Have you experienced specific problems when trying to borrow books or other materials electronically (e-lending), including across borders, from institutions such as public libraries?
(c) [In particular if you are a right holder:] Have you negotiated agreements with libraries to enable them to lend books or other materials electronically, including across borders?
YES

    37. If there are problems, how would they best be solved?
[Open question]
In the first instance revoke the legal instruments which make the circumvention of and communication of the weaknesses in digital rights management (DRM) technologies unlawful.
DRM largely doesn't fulfil it's industry-stated intended purpose of protecting rights-holders rights but does undermine the security of the whole population of end users. Cory Doctorow explained this nicely in a recent article in the Guardian6:
“DRM is designed on the presumption that users don't want it, and if they could turn it off, they would. You only need DRM to stop users from doing things they're trying to do and want to do. If the thing the DRM restricts is something no one wants to do anyway, you don't need the DRM. You don't need a lock on a door that no one ever wants to open.
DRM assumes that the computer's owner is its adversary. For DRM to work, there has to be no obvious way to remove, interrupt or fool it. For DRM to work, it has to reside in a computer whose operating system is designed to obfuscate some of its files and processes: to deliberately hoodwink the computer's owner about what the computer is doing. If you ask your computer to list all the running programs, it has to hide the DRM program from you. If you ask it to show you the files, it has to hide the DRM files from you. Anything less and you, as the computer's owner, would kill the program and delete its associated files at the first sign of trouble.
An increase in the security of the companies you buy your media from means a decrease in your own security. When your computer is designed to treat you as an untrusted party, you are at serious risk: anyone who can put malicious software on your computer has only to take advantage of your computer's intentional capacity to disguise its operation from you in order to make it much harder for you to know when and how you've been compromised.”
It is also important in relation to e-lending to encourage the development of neutral open standards and interoperability.


    38. [In particular if you are an institutional user:] What differences do you see in the management of physical and online collections, including providing access to your subscribers? What problems have you encountered?
[Open question]
I have no answer to this question.
    39. [In particular if you are a right holder:] What difference do you see between libraries’ traditional activities such as on-premises consultation or public lending and activities such as off-premises (online, at a distance) consultation and e-lending? What problems have you encountered?
[Open question]
I have no answer to this question.

4. Mass digitisation

    40. [In particular if you are an institutional user, engaging or wanting to engage in mass digitisation projects, a right holder, a collective management organisation:] Would it be necessary in your country to enact legislation to ensure that the results of the 2011 MoU (i.e. the agreements concluded between libraries and collecting societies) have a cross-border effect so that out of commerce works can be accessed across the EU?
YES
I believe so. I understand the UK Intellectual Property Office is currently also working on updating the UK's library and archive preservation exceptions to permit preservation copying of all types of media.
    41. Would it be necessary to develop mechanisms, beyond those already agreed for other types of content (e.g. for audio- or audio-visual collections, broadcasters’ archives)?
YES
Most likely.

B. Teaching

    42. (a) [In particular if you are an end user/consumer or an institutional user:] Have you experienced specific problems when trying to use works or other subject-matter for illustration for teaching, including across borders?
(b) [In particular if you are a right holder:] Have you experienced specific problems resulting from the way in which works or other subject-matter are used for illustration for teaching, including across borders?
YES

    43. If there are problems, how would they best be solved?
[Open question]
Reducing the exorbitant cost of textbooks and licences to access copyrighted materials.
    44. What mechanisms exist in the market place to facilitate the use of content for illustration for teaching purposes? How successful are they?
[Open question]
There are a variety of market mechanisms but they are failing as evident from the exorbitant cost of textbooks and licences to access copyrighted materials.
    45. If your view is that a legislative solution is needed, what would be its main elements? Which activities of the beneficiary institutions should be covered and under what conditions?
[Open question]
Universal legislation to incentivise free and 'green' open access (green open access, under which authors self-archive their published papers in open-access repositories) publishing of all publicly funded research and teaching.
    46. If your view is that a different solution is needed, what would it be?
[Open question]
Legislation plus investment in infrastructure of 'green' open access publishing. Careful thought will need to be given to the kinds of sustainable funding/business models needed to support this. But it is possible to imagine a cross-border licencing regime whereby member state governments or private/public partnerships funding open access repositories could charge a license for access to users in other jurisdictions. The evolution of sustainable commerce and government funding models to facilitate access for teaching will be a non trivial exercise.

C. Research

    47. (a) [In particular if you are an end user/consumer or an institutional user:] Have you experienced specific problems when trying to use works or other subject matter in the context of research projects/activities, including across borders?
(b) [In particular if you are a right holder:] Have you experienced specific problems resulting from the way in which works or other subject-matter are used in the context of research projects/activities, including across borders?
YES


    48. If there are problems, how would they best be solved?
[Open question]
The issues are similar as for teaching access.

    49. What mechanisms exist in the Member States to facilitate the use of content for research purposes? How successful are they?
[Open question]
I'm not going to offer an answer to this question.

D. Disabilities


    50. (a) [In particular if you are a person with a disability or an organisation representing persons with disabilities:] Have you experienced problems with accessibility to content, including across borders, arising from Member States’ implementation of this exception?
(b) [In particular if you are an organisation providing services for persons with disabilities:] Have you experienced problems when distributing/communicating works published in special formats across the EU?
(c) [In particular if you are a right holder:] Have you experienced specific problems resulting from the application of limitations or exceptions allowing for the distribution/communication of works published in special formats, including across borders?
YES


    51. If there are problems, what could be done to improve accessibility?
[Open question]
WIPO's agreement on the Marrakesh Treaty last year to facilitate access to published works by visually impaired persons and persons with print disabilities was a minor miracle few who had been fighting for it for so long ever believed would come to pass.
It remains to be seen what impact it will have in practice on visually impaired persons' and persons with print disabilities' actual access to published works. The treaty is supposed to address the “book famine” suffered by blind, visually disabled and those with print disabilities by requiring its contracting parties to adopt national law provisions that permit the reproduction, distribution and making available of published works in accessible formats through limitations and exceptions to the rights of copyright rights-holders.


    52. What mechanisms exist in the market place to facilitate accessibility to content? How successful are they?
[Open question]
The marker place has been failing dismally given the now widespread agreement on the existence of the book famine.

E. Text and data mining

    53. (a) [In particular if you are an end user/consumer or an institutional user:] Have you experienced obstacles, linked to copyright, when trying to use text or data mining methods, including across borders?
(b) [In particular if you are a service provider:] Have you experienced obstacles, linked to copyright, when providing services based on text or data mining methods, including across borders?
(c) [In particular if you are a right holder:] Have you experienced specific problems resulting from the use of text and data mining in relation to copyright protected content, including across borders?
YES
Text and data mining is not my area of academic expertise.
    54. If there are problems, how would they best be solved?
[Open question]
Text and data mining for scientific and technological development purposes offer significant potential benefits. Yet it often requires the negotiation of complex contracts or licences between researchers and rights-holders. Some of the transaction costs involved could be eased through the development of more standardised and open and in some instances compulsory licensing models.
    55. If your view is that a legislative solution is needed, what would be its main elements? Which activities should be covered and under what conditions?
[Open question]
I don't have access to sufficient empirical evidence to suggest a legislative solution but again it comes back to the complex calculus of the relative interests of the three generic sets of stakeholders; in this instance
  • researchers & creators/originators
  • economic agents & rights-holders
  • society
I understand the UK intends to introduce a specific copyright exception to encourage the use of text and data mining techniques in research, within the scope of Article 5(3)(a) of the Infosoc Directive. There may be a case to expand the scope of such an exception to teaching, private and non-commercial uses.

    56. If your view is that a different solution is needed, what would it be?
[Open question]
There is something to be said for the Google book project approach here, except perhaps in this instance it should be a publicly funded version. Prominent academic institutions would make their collections available for scanning into interoperable text & data mining friendly standard open formats.
As per teaching and research contexts, work is required on working out sustainable funding and business models to support this kind of infrastructure on an ongoing basis.
    57. Are there other issues, unrelated to copyright, that constitute barriers to the use of text or data mining methods?
[Open question]
Text and data mining experts are better placed to provide an informed response on this question.

F. User-generated content

    58. (a) [In particular if you are an end user/consumer:] Have you experienced problems when trying to use pre-existing works or other subject matter to disseminate new content on the Internet, including across borders?
(b) [In particular if you are a service provider:] Have you experienced problems when users publish/disseminate new content based on the pre-existing works or other subject-matter through your service, including across borders?
(c) [In particular if you are a right holder:] Have you experienced problems resulting from the way the users are using pre-existing works or other subject-matter to disseminate new content on the Internet, including across borders?
YES


    59. (a) [In particular if you are an end user/consumer or a right holder:] Have you experienced problems when trying to ensure that the work you have created (on the basis of pre-existing works) is properly identified for online use? Are proprietary systems sufficient in this context?
(b) [In particular if you are a service provider:] Do you provide possibilities for users that are publishing/disseminating the works they have created (on the basis of pre-existing works) through your service to properly identify these works for online use?
I'm not sure I fully understand what question 58 is getting at.


    60. (a) [In particular if you are an end user/consumer or a right holder):] Have you experienced problems when trying to be remunerated for the use of the work you have created (on the basis of pre-existing works)?
YES
    61. If there are problems, how would they best be solved?
[Open question]
I don't have an answer to this question


    62. If your view is that a legislative solution is needed, what would be its main elements? Which activities should be covered and under what conditions?
[Open question]
I don't have an answer to this question.

    63. If your view is that a different solution is needed, what would it be?
[Open question]
I don't have an answer to this question.
    IV. Private copying and reprography
    64. In your view, is there a need to clarify at the EU level the scope and application of the private copying and reprography exceptions7 in the digital environment?
YES

    65. Should digital copies made by end users for private purposes in the context of a service that has been licensed by rightholders, and where the harm to the rightholder is minimal, be subject to private copying levies?8
NO
The two most commonly cited economic studies into the effects of private copying remuneration (PCR) systems – Econlaw (2007)9 and Nathan Associates (2006)10 – do not provide any useful evidence that consumer copyright exceptions cause economic damage to rights-holders, or that a copyright levy is justified on these grounds.
• The Econlaw study incorrectly equates economic damage with consumer value and does not contain a formal discussion of the demand for copyrighted works.
• The Nathan Associates study does not make a necessary distinction between ‘damage to consumers and producers’ and ‘damage to society as a whole’. It likely overstates the economic damage caused by PCR. It also uses estimates for demand elasticities that do not come from formal economic analysis.

The empirical economic evidence that format-shifting, private and user-generated content cause any kind of economic damage to rights-holders does not appear to exist. Arguments that support tighter copyright law, or support PCR systems, tend to confuse economic damage with consumer value.
    66. How would changes in levies with respect to the application to online services (e.g. services based on cloud computing allowing, for instance, users to have copies on different devices) impact the development and functioning of new business models on the one hand and rightholders’ revenue on the other?
[Open question]
Any future analysis on this issue needs to investigate the conditions under which the proposed consumer copyright exceptions would have any impact on demand for
creative work.


    67. Would you see an added value in making levies visible on the invoices for products subject to levies?11
YES
As stated above there is no economic case to be made for levies. However, if there is an insistence on having them for other reasons e.g. in the interests of certain economic agents, then transparency on the proportion of the product price due to the levies would be appropriate.


    68. Have you experienced a situation where a cross-border transaction resulted in undue levy payments, or duplicate payments of the same levy, or other obstacles to the free movement of goods or services?
I don't have an answer to that question.

    69. What percentage of products subject to a levy is sold to persons other than natural persons for purposes clearly unrelated to private copying? Do any of those transactions result in undue payments? Please explain in detail the example you provide (type of products, type of transaction, stakeholders, etc.).
[Open question]
I don't have an answer to that question.
    70. Where such undue payments arise, what percentage of trade do they affect? To what extent could a priori exemptions and/or ex post reimbursement schemes existing in some Member States help to remedy the situation?
[Open question]
I don't have the empirical evidence to answer that question.

    71. If you have identified specific problems with the current functioning of the levy system, how would these problems best be solved?
[Open question]
Scrap levies since there is no economic case to be made for them.
……………………………………………………………………………………………….
    V. Fair remuneration of authors and performers
    72. [In particular if you are an author/performer:] What is the best mechanism (or combination of mechanisms) to ensure that you receive an adequate remuneration for the exploitation of your works and performances?
[Open question]
There is no one best mechanism. There are a variety of revenue flow models which can work either through direct sales or through intermediaries e.g. economic agents such as publishers and collecting societies dealing on fair and reasonable terms with authors/performers. Easy, widespread (and sometimes open and/or creative commons) access to authors/performers' work at a reasonable cost is the key.

    73. Is there a need to act at the EU level (for instance to prohibit certain clauses in contracts)?
YES
I'd recommend reading Diane Rappaport, The Recording Artist as an Indentured Servant -
Steve Albini, The Problem with Music -
and Courtney Love, Courtney Love Does the Math -
on the exploitative nature of music industry contracting with performing artists. The performers need stronger legal protections.

    74. If you consider that the current rules are not effective, what would you suggest to address the shortcomings you identify?
[Open question]
The application of a generic unfair contract terms principle to recording industries' contracts with performers would be a start. The prosecution of entertainment industries for fraud in cases of the manipulation of accounts to avoid paying fair recompense to performers and creators would be another approach. Currently performers and creators lose out in these cases or are obliged to pursue expensive civil legal proceedings e.g. for copyright infringement, declaratory relief, breach of contract etc. to fight for a fair share of the revenues arising from the sales of their creative works and derivatives.
There is quite a lot of scope for EU action to address iniquities in relation to the remuneration of performers and authors.
But I would agree with the UK IPO, that consideration of this issue should be based on a clear understanding of the nature of the problem and its scale and the extent to which the problem is unique to copyright contracts. In other words there is further need for robust empirical research on the scale and scope of the issue.


    VI. Respect for rights
    75. Should the civil enforcement system in the EU be rendered more efficient for infringements of copyright committed with a commercial purpose?
It entirely depends on what is meant by rendering the system “more efficient.” Too often this kind of argument is used as an excuse to trample on fundamental rights. So it may be appropriate to remind those involved in collating this consultation of the opinion of the Court of Justice of the European Union on this point in Case C-275/06
Productores de Música de España (Promusicae) v Telefónica de España SAU (2008).
The dispute was between Spanish music rights holders' association Promusicae and Spain's top telecommunications operator, Telefonica.
Telefonica argued that, under a national law based on EU rules, it had to disclose the name of an Internet subscriber only for criminal actions, not civil ones.
"Community law does not require the member states, in order to ensure the effective protection of copyright, to lay down an obligation to disclose personal data in the context of civil proceedings," the court said in a statement."
The court said:

"There are several community directives whose purpose is that the member states should ensure, especially in the information society, effective protection of industrial property, in particular copyright.

Such protection cannot, however, affect the requirements of the protection of personal data. The directives on the protection of personal data also allow the member states to provide for exceptions to the obligation to guarantee the confidentiality of traffic data"


In other words, the ECJ concluded that privacy trumps copyright protection and the judgement was expected since the ECJ's Advocate General, Juliane Kokott, in advising the court in August of last year, basically said the same thing.
In other words, the ECJ concluded that privacy trumps copyright protection and the judgement was expected since the ECJ's Advocate General, Juliane Kokott, in advising the court in August of last year, basically said the same thing. The Court press release relating to the judgement stated:
29 January 2008
Judgment of the Court of Justice in Case C-275/06
Productores de Música de España (Promusicae) v Telefónica de España SAU
THE COURT RULES ON THE PROTECTION OF INTELLECTUAL PROPERTY RIGHTS IN THE INFORMATION SOCIETY
Community law does not require the Member States, in order to ensure the effective protection of copyright, to lay down an obligation to disclose personal data in the context of civil proceedings
There are several Community directives 1 whose purpose is that the Member States should ensure, especially in the information society, effective protection of industrial property, in particular copyright. Such protection cannot, however, affect the requirements of the protection of personal data. The directives on the protection of personal data 2 also allow the Member States to provide for exceptions to the obligation to guarantee the confidentiality of traffic data.
Promusicae is a Spanish non-profit-making organisation of producers and publishers of musical and audiovisual recordings. It applied to the Spanish courts for an order that Telefónica should disclose the identities and physical addresses of certain persons whom it provided with internet access services, whose IP address and date and time of connection were known. According to Promusicae, those persons were using the KaZaA file exchange program (peer-to-peer or P2P) and providing access in shared files of personal computers to phonograms in which members of Promusicae held the exploitation rights. It therefore sought disclosure of the above information in order to be able to bring civil proceedings against the persons concerned.
Telefónica argued that, under Spanish law,3 the communication of the data sought by Promusicae was authorised only in a criminal investigation or for the purpose of safeguarding public security and national defence.
The Spanish court asks the Court of Justice of the European Communities whether Community law requires the Member States to lay down, in order to ensure effective protection of copyright, an obligation to communicate personal data in the context of civil proceedings.
The Court of Justice notes that the exceptions permitted by the directives on the protection of personal data include the measures necessary for the protection of the rights and freedoms of others. As the directive on privacy and electronic communications does not specify the rights and freedoms concerned by that exception, it must be interpreted as expressing the Community legislature’s intention not to exclude from its scope the protection of the right to property or situations in which authors seek to obtain that protection in civil proceedings. It does not therefore preclude the possibility for the Member States of laying down an obligation to disclose personal data in the context of civil proceedings. However, it does not compel the Member States to lay down such an obligation.
As to the directives on intellectual property, the Court of Justice finds that they too do not require the Member States to lay down, in order to ensure effective protection of copyright, an obligation to communicate personal data in the context of civil proceedings.
That being so, the Court points out that the present reference for a preliminary ruling raises the question of the need to reconcile the requirements of the protection of different fundamental rights, namely the right to respect for private life on the one hand and the rights to protection of property and to an effective remedy on the other.
The Court concludes that the Member States must, when transposing the directives on intellectual property and the protection of personal data, rely on an interpretation of those directives which allows a fair balance to be struck between the various fundamental rights protected by the Community legal order. Further, when implementing the measures transposing those directives, the authorities and courts of the Member States must not only interpret their national law in a manner consistent with the directives but also make sure that they do not rely on an interpretation of them which would be in conflict with those fundamental rights or with the other general principles of Community law, such as the principle of proportionality.
The full judgment is available at the ECJ website. It is a technical judgment looking at the details of a collection of EU directives and how they interact; and how to achieve a balance between the right to protect personal data and the right to protect property but the key parts of the decision in my opinion are paragraphs 61 to 70:
"Fundamental rights
61 The national court refers in its order for reference to Articles 17 and 47 of the Charter, the first of which concerns the protection of the right to property, including intellectual property, and the second of which concerns the right to an effective remedy. By so doing, that court must be regarded as seeking to know whether an interpretation of those directives to the effect that the Member States are not obliged to lay down, in order to ensure the effective protection of copyright, an obligation to communicate personal data in the context of civil proceedings leads to an infringement of the fundamental right to property and the fundamental right to effective judicial protection.
62 It should be recalled that the fundamental right to property, which includes intellectual property rights such as copyright (see, to that effect, Case C 479/04 Laserdisken [2006] ECR I 8089, paragraph 65), and the fundamental right to effective judicial protection constitute general principles of Community law (see respectively, to that effect, Joined Cases C 154/04 and C 155/04 Alliance for Natural Health and Others [2005] ECR I 6451, paragraph 126 and the case-law cited, and Case C 432/05 Unibet [2007] ECR I 2271, paragraph 37 and the case-law cited).
63 However, the situation in respect of which the national court puts that question involves, in addition to those two rights, a further fundamental right, namely the right that guarantees protection of personal data and hence of private life.
64 According to recital 2 in the preamble to Directive 2002/58, the directive seeks to respect the fundamental rights and observes the principles recognised in particular by the Charter. In particular, the directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of that Charter. Article 7 substantially reproduces Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms signed at Rome on 4 November 1950, which guarantees the right to respect for private life, and Article 8 of the Charter expressly proclaims the right to protection of personal data.
65 The present reference for a preliminary ruling thus raises the question of the need to reconcile the requirements of the protection of different fundamental rights, namely the right to respect for private life on the one hand and the rights to protection of property and to an effective remedy on the other.
66 The mechanisms allowing those different rights and interests to be balanced are contained, first, in Directive 2002/58 itself, in that it provides for rules which determine in what circumstances and to what extent the processing of personal data is lawful and what safeguards must be provided for, and in the three directives mentioned by the national court, which reserve the cases in which the measures adopted to protect the rights they regulate affect the protection of personal data. Second, they result from the adoption by the Member States of national provisions transposing those directives and their application by the national authorities (see, to that effect, with reference to Directive 95/46, Lindqvist, paragraph 82).
67 As to those directives, their provisions are relatively general, since they have to be applied to a large number of different situations which may arise in any of the Member States. They therefore logically include rules which leave the Member States with the necessary discretion to define transposition measures which may be adapted to the various situations possible (see, to that effect, Lindqvist, paragraph 84).
68 That being so, the Member States must, when transposing the directives mentioned above, take care to rely on an interpretation of the directives which allows a fair balance to be struck between the various fundamental rights protected by the Community legal order. Further, when implementing the measures transposing those directives, the authorities and courts of the Member States must not only interpret their national law in a manner consistent with those directives but also make sure that they do not rely on an interpretation of them which would be in conflict with those fundamental rights or with the other general principles of Community law, such as the principle of proportionality (see, to that effect, Lindqvist, paragraph 87, and Case C 305/05 Ordre des barreaux francophones et germanophone and Others [2007] ECR I 0000, paragraph 28).
69 Moreover, it should be recalled here that the Community legislature expressly required, in accordance with Article 15(1) of Directive 2002/58, that the measures referred to in that paragraph be adopted by the Member States in compliance with the general principles of Community law, including those mentioned in Article 6(1) and (2) EU.
70 In the light of all the foregoing, the answer to the national court’s question must be that Directives 2000/31, 2001/29, 2004/48 and 2002/58 do not require the Member States to lay down, in a situation such as that in the main proceedings, an obligation to communicate personal data in order to ensure effective protection of copyright in the context of civil proceedings. However, Community law requires that, when transposing those directives, the Member States take care to rely on an interpretation of them which allows a fair balance to be struck between the various fundamental rights protected by the Community legal order. Further, when implementing the measures transposing those directives, the authorities and courts of the Member States must not only interpret their national law in a manner consistent with those directives but also make sure that they do not rely on an interpretation of them which would be in conflict with those fundamental rights or with the other general principles of Community law, such as the principle of proportionality."
And they then conclude:
On those grounds, the Court (Grand Chamber) hereby rules:
Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society, Directive 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on the enforcement of intellectual property rights, and Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) do not require the Member States to lay down, in a situation such as that in the main proceedings, an obligation to communicate personal data in order to ensure effective protection of copyright in the context of civil proceedings. However, Community law requires that, when transposing those directives, the Member States take care to rely on an interpretation of them which allows a fair balance to be struck between the various fundamental rights protected by the Community legal order. Further, when implementing the measures transposing those directives, the authorities and courts of the Member States must not only interpret their national law in a manner consistent with those directives but also make sure that they do not rely on an interpretation of them which would be in conflict with those fundamental rights or with the other general principles of Community law, such as the principle of proportionality.


    76. In particular, is the current legal framework clear enough to allow for sufficient involvement of intermediaries (such as Internet service providers, advertising brokers, payment service providers, domain name registrars, etc.) in inhibiting online copyright infringements with a commercial purpose? If not, what measures would be useful to foster the cooperation of intermediaries?
[Open question]
It should be no part of the function of intermediaries such as ISPs or domain name registrars to act as copyright police. The fact that many jurisdictions approach to the widespread copyright infringement on peer-to-peer services on the internet is to introduce three-strikes regimes (e.g. France) implemented through ISP policing is to be lamented.
If intermediaries are to be liable for policing potentially infringing content on the Internet, that has a significant commercial cost and consequent downstream consumer and societal welfare cost. E.g. is it truly proportionate for someone to lose access to the internet for infringing copyright? It is unlikely these costs are outweighed by the benefit to rights-holders derived from such ISP policing but it could be put to an empirical test through robust empirical research.
The internet is effectively controlled by private sector intermediaries. How, therefore, do you ensure the private sector not only respects but also upholds the rights of users? These private companies are not equipped to do so. They cannot be expected to make subtle human rights judgements. They are in business to make money so neither are they motivated to protect the rights of users. If commercial or legal pressure says they should block access to certain websites or throttle a customer's internet service for copyright reasons then that is the route that will be taken, regardless of the individual rights that may be infringed. In many online contexts punishment is arbitrary, lacks transparency, lacks due process, with limited access to remedies or appeals. Arguably this is the case with the 3 strikes process in France or the 6 strikes process in the US. That is not an environment in which human rights will be respected and so intermediaries like the telecoms companies and ISPs need support in protecting fundamental rights if they are to be obliged to be copyright police.
    77. Does the current civil enforcement framework ensure that the right balance is achieved between the right to have one’s copyright respected and other rights such as the protection of private life and protection of personal data?
NO
    VII. A single EU Copyright Title
    78. Should the EU pursue the establishment of a single EU Copyright Title, as a means of establishing a consistent framework for rights and exceptions to copyright across the EU, as well as a single framework for enforcement?
Probably not. Copyright regulations are incredibly complicated. It would be impossible to predict the consequences of getting from the current chaotic multi-jurisdictional approach to a single EU copyright title for
  • creators
  • economic agents
  • society
As an old friend of mine would say, if I was going there I wouldn't start from here. I would not dismiss the idea entirely, given the potential to simplify copyright regulations generally. However, there are a vast number of complex and contentious issues relating to copyright that it may prove necessary to address before attempting such a move.
    79. Should this be the next step in the development of copyright in the EU? Does the current level of difference among the Member State legislation mean that this is a longer term project?
[Open question]
Almost certainly a longer term project if the case can be made.
    VIII. Other issues
    80. Are there any other important matters related to the EU legal framework for copyright? Please explain and indicate how such matters should be addressed.
[Open question]
I don't have anything further to add at the moment. Given the shortness of time I have not provided a comprehensive list of references for all of my answers above but would be happy to do so at a later date if required.
Thanks for the opportunity to contribute to this consultation and for your attention if you have managed to get through all or even just some my comments.


1CREATe is the RCUK centre for copyright and new business models in the creative economy. http://www.create.ac.uk/
2See Rogers, M; Corrigan, R and Tomalin, J (2010). The economic impact of consumer copyright
exceptions: a literature review. Consumer Focus, London, UK. For a more in depth analysis of copyright exceptions impact weighing consumer value and economic damage to copyright holders.
3 Injunctive relief is a temporary or permanent remedy allowing the right holder to stop or prevent an infringement of his/her right.
4See Rogers, M; Corrigan, R and Tomalin, J (2010). The economic impact of consumer copyright
exceptions: a literature review. Consumer Focus, London, UK.
5If we use a rate of 5% for example, an infinite term of copyright is worth £20,000, 95 years is worth £19,827 and 50 years £18,358. So the 95 year term is worth 99.1% of an infinite term using a 5% discount rate to allow for the time value of money. A 50 year term would be worth 91.8% of an infinite term or 92% of a 95 year term. See also Posner, Richard A. and William M. Landes. 2003. The Economic Structure of Intellectual Property Law. Harvard University Press. Cambridge. Pp210 – 253.

A.6What happens with digital rights management in the real world? http://www.theguardian.com/technology/blog/2014/feb/05/digital-rights-management

7 Art. 5.2(a) and 5.2(b) of Directive 2001/29/EC.
8 This issue was also addressed in the recommendations of Mr Antonio Vitorino resulting from the mediation on private copying and reprography levies
9EconLaw (2007). Economic Analysis of Private Copy Remuneration, Report to
Groupement Européen des Sociétés d’Auteurs et Compositeurs (GESAC).
10Nathan Associates Study (2006) ‘Private Copying Levies on Digital Equipment
and Media: Direct Effects on Consumers and Producers and Indirect Effects
on Sales of Online Music and Ringtones’.
11 This issue was also addressed in the recommendations of Mr Antonio Vitorino resulting from the mediation on private copying and reprography levies.