Showing posts sorted by relevance for query 3 strikes. Sort by date Show all posts
Showing posts sorted by relevance for query 3 strikes. Sort by date Show all posts

Friday, July 04, 2008

Three strikes and you're, er, confused..?

This is long. Get a cup of tea. Sit down and put some chill out music on. But there's a surprise at the end, I promise :)

The story so far: long ago in a galaxy far away in , ooh, March 08, a rumour swept the land that UK ISPs were going to be co-opted by the content/music/movies industry rightsholder groups to apply a doctrine originating from France, and known as "graduated response" or colloquially, "3 strikes and you're out", as part of the continuing battle against the Forces of Evil, namely illegal downloaders/fileswappers.

Under a "3 strikes law", ISPs must warn a detected uploader (or possibly downloader) if they appear to be breaking copyright law. On the third such warning, access to the ISP is disconnected. If such a doctrine is applied by law (or as a voluntary agreement by all ISPs, as "soft law" to fend off "hard law" regulation, then effectively the price of filesharing becomes banishment from access to the Internet.

Pangloss gave a talk on this at the LSE which was reasonably well received in which I asserted that such a step would be illegal under EC law, both because of the hosting and mere conduit exemption from liability for third parties applicable to ISPs under Art 13-15 of the ECD; and because the "penalty" would be disproportionate to the "offence", and thus fall foul of various human rights guarantees in both the ECHR and the EC Charter of Rights.

In particular, access to the Internet for all members of a household might be suspended even if only one person the household had file-shared - or perhaps even a mere friend , guest or user of an unsecured wi fi network. This is because filesharing can only be detected as connected to a particular IP address; and IP addresses identify only a particular computer, not the person using it. A final problem might also be that home machines are often compromised by malware nowadays: how would some one prove it was not them but a remote zombie master who was using their machine to upload or download?

Adjudication and fairness problems also exist: how does the ISP know that an IP address passed to them by the content industry is truely of an illegal file sharer? Difficult grey areas exist of fair dealing and private use, and it can by no means in this our day of the iViewer be assumed that all P2P use is likely to be copyright-infringing.

So far, so bad. After that things went quiet. BERR, the former DTI, said they were bringing foward a consultation paper about "3 strikes and you're out" in the spring but seemed rather unenthusiastic about it with the latest word in June being that the consultation would be delayed till next year (Now why would that be? read on..).

MEPs in the European Parliament voted against it. Even the major ISP, Talk Talk/Carphone Warehouse came out publicly against notice and disconnection despite near-threats from the BPI. A reported attempt by the ISPA, the ISP's own trade asociation to broker a 3 strikes and you're out equivalent prgramme for video/movies, also appeared to die the death. In France, opposition also mounted against the proposed law, but the bill was proposed anyway. Was this the end for 3 strikes or not?

In the UK, developments seemed to take a different turn. First Virgin, one of the "big 3" ISPs , agreed to go in with the BPI on 9 June on a so-called campaign to "educate" users. Users would be warned that they had been detected swapping infringing tracks and to stop, but apparently no actual proposed sanction was included in the letter.

When the first letters arrived c 3 July to 800 Virgin users, all hell broke loose. Students and others (alerted like Pangloss, by that fine news organ , Radio 1 Newsbeat) complained that file sharing was their god given right and anyway, they'd been accused of downloading Amy Winehouse whom they didn't even like (what poor taste, says Pangloss. ) It couldn't have been them; must have been someone using their wi fi network, or a slumber party guest, or a big boy who ran away.

Virgin, stung by information in the latest polls that 63% of their potential subscriber audience had admitted to filesharing, backpeddled and plead that there was "absolutely no possibility" of Virgin taking legal action or banning internet users as part of a campaign against illegal file-sharing on its broadband network. This despite the fact that , embarassingly, "the letters came in an envelope marked: "Important. If you don't read this, your broadband could be disconnected." ." (Bit of a giveaway.)

Interestingly the music industry itself - before the storm broke - presented this not as a one off but as a first stage in attempts to "reach a voluntary agreement with [implicitly, all] ISPs over illegal file-sharing".

Meanwhile, BT the other of the big 3 UK ISPs which unlike TalkTalk had not already publicly rejected "3 strikes", was found in a rather good Register scoop, to have been sending individual letters to suspected filesharers, this time overtly threatening disconnection on further "strike". "If further evidence is obtained of infringement via your internet connection," it writes, "then further action is likely to be taken against you. That action may include litigation against you, as well as the suspension by BT of your internet connection." (This time perhaps deserved as the victim - er infringer - had been caught listening to Girls Aloud. Mon dieu.)

What was an impoverished student in need of a JayZ fix to do? The answer was obvious: leave Virgin and BT and join Talk Talk (or one of the 100s of other ISPs who wanted well out of all this politics and legal risk.) One conspiracy theory Pangloss rather likes, may have been that Virgin were in fact quite keen to lose major downloaders and uploaders: as the current charging model for broadband simply does not reflect the market costs of high usage: it has been said that for some users the real cost of Mbs used would be c £200 a month, not the more normal £10-£20.

But did even Virgin and BT want to lose 63% of their clientele? Probably not. And could all the other ISPs, including TalkTalk be argued into forming a cartel all offering the same policy? Again, probably not. But look!... like the cavalry coming over the virtual hill to the rescue, or the carrot coming to join forces with the stick, the music industry then revealed their ace in the hole on 26 June : stop filesharing illegally and we'll let you go on using P2P but as a legal service, administered via ISPs, with users paying a flat monthly fee added on to their broadband charges, which would then be divvied up back to the rights holders. And aha! this was why the government had been dragging their feet on the 3 strikes consultation, right, because they were brokering this deal? Surely so!

Wonderful, said Pangloss. The answer to all this insane cat and mouse luddism-vs-technological innovation lose:lose scenario we've been dealing with now for, what, nearly a decade? Pangloss has long been a supporter of flatrate levy schemes to finance the correct royalty payments to record companies and artists - ever since she first came across such as scheme back in as promoted by the very clever William Fisher of the Berkman Institute, Harvard, in his book Promises to Keep.

But the music industry has generally not been keen on them, since in theory more profit can be made by a market-driven digitised distribution system such as iTunes, where the industry can still decide how high a price it thinks it can get pers ong or per video, not just what the levy gives it. But hey, any profits are better than no profits right? Or better than 37% of profits anyway. For the average user it would be marvellous: all you can eat Napster, not for nothing but for a reasonable monthly fee. 80% of punters said they'd be happy with that, in the music industry's own poll. It seemed that sanity was at last beginning to prevail.

OK. Deep breath. With me so far?

Menawhile in a galaxy far away.. oh yeh done that bit .. at the European Union we find the reform of the Telecoms law framework underway - known as la Quadrature because it involves reform of (at least) 4 Directives.

Pardon you say. What does telecoms have to do with copyright and P2P?

Well not much, except that both involve Internet access and regulation, yes? The Telecoms reform work is massive, complex, detailed and inpenetrable even to most EC law anoraks. And taking place in the dog days of summer, just before the MEPs go home, and when the academics are already mostly on holiday and the IT journalists want to watch Wimbledon and the Dr Who finale. And over the US Fourth July weekend. The perfect time to bury a copyright bomb.

I have been helpfully given a briefing document by Monica Horten, PhD researcher at the University of Westminster and part of La Quadrature du Net, anti 3-strikes civil society body, which is difficult but alarming reading. Monica has made a close study of someof the proposed amendments to the Telecoms reform package, which have in the main been pushed through committees by industry lobbying and are scheduled to come up for voting on July 7. Yes - in 3 days time. There are 800 amendments and only a handful concern copyright. This is a legislative needle in a haystack. I have seen no publicity for these very important amendments except one report in EDRI-gram: the general press seems unaware. I have checked the amendments myself , but it has to be said however, that interpretation of what exactly they mean is in many cases difficult. Full details can be found in Monica's brief and at the Quadrature de Net page.

Monica suggests that the amendments promoted by copyright interests will, if passed on July 7:

1. Impose an obligation on ISPs to "co-operate" with the content industry in removing filesharers from the Web. In EC speak , this is almost certainly a euphemism for being required to put in place a system akin to a 3-strikes regime and is certainly capable of being interpreted that widely in implementing legislation.

The Internal Market committee report (IMCO) amendment, promoted by UK Conservative MEP Malcolm Harbour, specifies that

"national regulatory authorities and other relevant authorities shall also as far as appropriate promote cooperation between undertakings providing electronic communications networks and/or services and the sectors interested in the protection and promotion of lawful content in electronic communication networks and services. These co-operation mechanisms may also include coordination of the public interest information to be made available as set out in Article 21(4a) and Article 20(2).

The reference here is to another amendment to the same Directive, which would require ISPs to regularly distribute "public interest information" to all users including "the most common uses of electronic communications services to carry out unlawful activities or to disseminate harmful content ". This could be interpreted as narrowly as basic information on copyright (arguably, fine); or it could be clear information from the ISP that a user had been accused of illegal filesharing by a rights holder (a "strike"). The use of the word "also" (enlarged by Pangloss) suggest that the co-operation envisaged is certainly more than just the mere provision of information/warnings.

Interestingly also, proposed recital 12c provides that "Such public interest information should be produced either as a preventative measure or in response to particular problems". This is I would argue clearly wide enough to cover the "strike" interpretation as well as the "general info" interpretation.

This , as French commentators have recognised, thus potentially puts in place all the groundwork of warnings, and legal requirements, for 3 strikes to become law throughout Europe, or at least in whichever of the national legislatures chooses to adopt the wider interpretation (s).

In conclusion, I am worried . Worried at the lack of consideration for what the public wants; the lack of balance between legitimate protection of IPRs, and vital interests such as the access of students and workers to the Net, as well as of the families of alleged filesharers; the apparent disregard for privacy and the personal data safeguards of the data protection laws; the apparent washing away of the E-Commerce Directive immunities; but more than that, aghast at this blatant attempt to sneak through vital changes to the law without proper notice or debate, across Europe, in the Trojan horse of a giant and extraordinarily hard to understand reform exercise.

Hence this rather long post :(

NOTE: this post was edited on 6 July 2008 to make clearer and explicit reference to the exact text of the amendments proposed.

Thursday, April 10, 2008

More on 3 Strikes & Phorm: the ISP Strikes Back, but still true to Phorm

3 Strikes, semper passim :)

Technollama has a good post on Carphone Warehouse's opposition (in its guise as ISP TalkTalk) to the idea of "3 strikes and you're out", and the BPI's response of threatening court action. According to the Telegraph, CW received the following warning by fax from the BPI:

""... unless we receive your agreement in writing that within 14 days Carphone Warehouse will implement procedures set out above [bold added], we reserve our right to apply to court for injunctions and other relief without further notice to protect our members' rights."

Which leaves one wondering: WHAT procedures? Last Pangloss heard, negotiations were going on between the ISPA and the MPA as to a protocol for "progressive" discouragement of filesharing by eventual disconnection, but no agreement had been struck; certainly if the BPI has fomed a binding contract or even voluntary code of practice on similar lines with some or all UK ISPs, this is something the public should know about surely?

If, as seems more likely, no agreement exists, the BPI seem to be making some wrong assumptions about the remedies available to them. As it stand the common consensus is that ISPs are protected from liability for the actionable or illegal activity of their users unless they are shown to have actual or constructive knowledge of material they host fo rnusers (E Commerce Directive, Art 14). If the liability relates to the ISP's role as a mere conduit (Art 12) then ISP's are immune whether or not they receive notice. In all other circumstances, the BPI are limited merely to seeking an injunction against the ISP; although they are of course free to sue the actual users. "Other relief" - which can surely only be construed as implying either the imposotion of a filtering obligation or damages - does not prima facie seem to be available.

Of course in Ireland, also in apparent contradiction to both Arts 14 and 15 of the ECD, the music industry are currently attempting to impose an obligation to filter out pirate tracks on Ireland's biggest ISP, Eircom.Various Irish legal commentators notably TJ Macintyre and the unpronounceable Daithi McSigh have already pointed out the major policy and legal objections to such a claim. But it appears to be saber rattling season on both sides of the Irish Sea, presumably in anticipation of the consultation paper on 3 Strikes we are promised by BERR sometime between now and the autumn.

Phorm

Talk Talk/CW themselves should not be regarded too quickly as heroes of the hour though. Remember Talk Talk is one of the ISPs already signed up for the currently rather controversial Phorm system. Since it seems unlikely UK ISPs are going to go down the 3 Strikes route without legislation, CW/TT have good PR to gain, and nothing much to lose, by speaking out against the BPI :)

On Phorm, matters currently appear to be running against the pioneering or invasive new ISP-level adware system (depending on your side of the fence.) The ICO amended their postition on Phorm yesterday after considerable pressure by inter alia, ORG and FIPR:

"Ad-targeting system Phorm must be "opt in" when it is rolled out, says the Information Commissioner Office (ICO)

European data protection laws demand that users must choose to enrol in the controversial system, said the ICO in an amended statement.

The decision could be a blow to Phorm which before now has said it would operate on an "opt out" basis.

The ICO will monitor the trials and commercial rollout of Phorm to ensure data protection laws are observed."

EDIT: there is a rather sensible comment on the Beeb site about the likely implications of opt-in for Phorm.

This statement, interestingly, still leaves untouched the question of whether Phorm is not only potentially in breach of DP law but an illegal interception of communications under RIPA. The ICO of course has an interest in surveillance, but does not oversee it; interception is technically supervised by the Interception of Communications Commissioner . Home Office communications have indicated they think Phorm legal in this respect, but other commentators such as Nicholas Bohm, differ.

Tuesday, March 25, 2008

3 Strikes And You're Out talk from LSE conference

Ray Corrigan, one of the finest IT law bloggers on the block, has, incredibly helpfully, while I frolicked for the long Easter weekend, written up an account of my talk on the dubious legality of the posited "3 strikes and you're out" legislation which, if passed, would mandate disconnection of repeat filesharers in the UK from the Internet.

See http://b2fxxx.blogspot.com/2008/03/3-strikes-copyright.html (thanks Ray.)

There is also a third ground of possible illegality of any proposed "notice and disconnection" regime, , other than its transgression of due process and lack of propartionality with respect to human rights. I did not have time to get to this at the conference so Ray has not mentioned it - namely that in order to prevent an "it wasnae me" defense (as we say in Glasgow), legislation might also require the mandating of secured wi-fi for every user who maintains a wireless router. Without such a rule, every uploader could theoreticaly claim it was not them but a wi-fi piggy-backer who committed the "offence".

Currently, users are usually advised to make their wi-fi network secure, and most ISP T & Cs theoretically demand it, but many prominent security experts, notably including Bruce Schneier, deliberately keep their networks open (while maintaining high quality virus checking ware and firewalls for the security of their own data). they do son mainly on the grounds that the mobile Internet ought to be a public resource for those in transit or in public areas, like toilets or water fountains. Breach of a term imposing secure wi-fi only by an ISP may currently be a breach of contract which might conceivably lead the particular ISP in question to , legitimately, disconnect the user; but it would not, as "3 strikes" would, mean that user is then sent to Internet Coventry by every ISP in the country.

Cutting off the choice of providing public wi-fi to the user on pain of banishment from the Internet, raises obvious issues itself of infringement of freedom of expression and association. Avaiability of unsecured wi-fi in public areas, say, in parks or on streets or at emergencies, is also arguably , as Schneier and co believe, a public good. Given that, it should be asked whether a proper balance is being maintained if we legislate to ban an asset of general public interest, in order to protect the legitimate property interests of one narrow commercial sector. It also raises the question of whether a wi-fi operator might be a "mere conduit" under the E-Commerce Directive, Art 12, and if so whether, in effect, strict liability for other people's misdeeds can be imposed on such operators without infringing EC law.

This point is dealt with in my powerpoint which I believe will be soon up on the relevant website along with other slides from the day. Will add URL shortly.

I think the best point raised during the day which I had not really considered at all before, was how long a general ban or disconnection after notice would last. (I think this came from Michelle Childs, but I am not totally sure.) Does a foolish upload or two by a teenager in your house mean that dad and/or mum is banned from the Internet forever? Even when we talk of true criminal sanctions (and copyright is at root a civil matter), jail terms (bar "life means life" for murder) have to be of defined length. Do we want a world where ISPs are ordered by the content industry to patrol indefinite lifetime bans from the Internet? Would legislation include provisions for appeals after a certain time and has anyone thought through the due process ramifications? The more you think about it, the more damningly flawed the whole idea is.

In France, at least, the whole process is going to be under the supervision of an independent tribunal given directions by a judge. If we do end up going down this route in legislation, the French system should be the minimum starting point for transparency and due process. I hope instead however that the UK government and BERR will, after due consideration, decide this approach, with all its capacity for disproportionate human right infringement and errors in proof and process, is not a suitable way to police filesharing, when so many other routes exist.

Thursday, November 13, 2008

Analysing the European Telecoms Package: Even More About Three Strikes and You're Out

Back in July, Pangloss readers were alerted to the stealth tactics surrounding the European revision of the Telecoms Package: a vast programme of EC law reform involving five Directives and primarily to do with regulation of the telecoms framework (duh) and nothing to do with content regulation or copyright - allegedly.

However as I reported then, there was serious concern (raised by La Quadrature de Net and Monica Horten at IPIntegrity) that some interest groups (in the main, it seems, the French Sarkozy government, and the global content industry lobby) were using this complex law reform exercise as a Trojan horse to pass through some fairly bland looking proposals, which when looked at more closely proved to lay what might well be a framework for European legitimisation of Sarkozy's "3 strikes and you're out law".

This law - whose basic idea is that alleged repeat filesharers should be summarily disconnected from the Internet without the intervention or supervision of the courts, on the say so of the content industry - had already been rejected in principle by the European Parliament as a breach of due process and fundamental rights such as privacy and freedom of expression.

As a result of publicity and a write in campaign to MEPs, these issues became better known, and safeguards were inserted into the Telecoms Package at the European Parliament reading stage. However these were subsequently removed (with little or no) publicity in the leaked Council of Ministers proposed amended version. Opaque waters were further muddied when a week or so ago the Commission came back with their (official) proposed version, which attempted to address some , but not all, of the worriesome issues in the Package. At this point I was asked, along with trainee barrister, blogger and IT law expert Simon Bradshaw, to have a look and say just what there was (if anything) still to worry about in the Telecoms Package as of right now, since its level of incomprehensibility had already reached beyond 11 on a scale of 1 to 10, for anyone except trained combat Internet lawyers (and we were struggling too:-).

After much burning of midnight oil and pixels, these are our conclusions. We hope they are useful to all participants in the European democracy and legislative process; in particular we hope they inform both the public and the politicians during the current vital period when the future of the Telecoms Package and whether it will go to a second reading in the EUP are being decided behind closed doors.

Here is the top level summary; the whole report can be downloaded here.

"The central issue discussed here relates to the current state of the Telecoms Package and
the extent to which it allows or does not allow (or requires, or does not require) the
disconnection of alleged filesharers from the Internet, without the involvement of courts to
assess the evidence for the possibility of error, and to provide protection for due process and
fundamental rights . It is indubitable that the Telecoms Package also provides many important
consumer friendly guarantees, but these are not the topic of this brief.

In particular, we wanted to find out if the Telecoms Package, at its latest stage, still provides a potential guarantee of legality for the “3 strikes and you’re out” legislation currently being implemented in France and of interest in some other member states such as, notably, the UK. The key parts of the argument above have been emboldened.

On the basis of our analysis it is clear that the package does, or at least can, provide a
mandatory basis for the “warnings” part of a French-style connection sanctions law (the
“strikes”) (see para 12 of brief), and also potentially provides a means by which public CSPs
(ISPs and the like) can be compelled by the national regulator to work with (“promoting
cooperation”) rightsholders to implement a disconnection scheme (the “you’re out” – see para
19 of brief). Wording in various places of the latest version seems to confirm that this “cooperation” is a more extensive obligation than simply providing copyright related
public interest information.

This is a crucial set of obligations, about to be imposed on all of Europe’s ISPs and telcos,
which should be debated in the open, not passed under cover of stealth in the context of a
vast and incomprehensible package of telecoms regulation. It seems, on careful legal
examination by independent experts, more than possible that such a deliberate stealth
exercise is indeed going on. When passed, these obligations will provide Europelevel
authority for France’s current “3 strikes” legislation, even though this has already been
denounced as against fundamental rights by the European Parliament, when it was made
clear to them what they were voting for or against.

Importantly, two amendments originally inserted by the EUP did provide protection against
nonjudicial imposition of disconnection and other sanctions against alleged filesharers,
in particular Art.32a of the Universal Service Directive (see para 35 of brief) and Art.8(4)(ga) of
the Framework Directive (see para 28 ). However, both of these provisions were deleted by
the CoM, and did not appear in the CoM’s proposed final text.

Somewhat unexpectedly, however, one of these “safeguard” provisions, Art 8(4) (ga) ,was in
fact reinstated by the Commission in the latest version. Why both Amendments 166 and 138
were not so reinstated is unknown, but may relate to “horse trading” between the Commission,
the Council of Ministers and the European Parliament to get the package passed during the
Sarkozy Presidency of the EU. Whether (ga) will survive to the final version of the Telecoms
Package is anyone’s guess, but it is clearly a key defence for civil liberties and against “3
strikes”, as it explicitly protects both the right to due process and the right to private life. This
brief commends its re-inclusion and suggests that Amendment 166 also be reinstated...

...Finally we reiterate that this brief has been prepared to give a legal, rather than a lobbying,
perspective upon the telecoms package. Good European law cannot be made when sectoral
agendas are hidden within nested sets of amendments, obscure definitions by reference, and
overly wide and vague terminology. The purpose of this brief has been to open up these
obfuscated agendas to the light of day. The brief is based on the Telecoms Package state of
play as at 12 November 2008. It will be updated as developments occur. "

Finally, thanks for help with this relating to European policy and process from the ever-helpful Judith Rauhofer, Research Fellow at UCLAN.

Thursday, June 11, 2009

French Courts Strike Down 3 Strikes..

.. which leaves you wondering what next? 4 Strikes? 3 Strikes and a Baby?

Pangloss is in HK with limited Internet so for now merely a quote from excellent Guardian piece on the story:

" Internet users around the world should be cheering the news that French judges have struck down the country's proposed 'three strikes' law for alleged filesharers - and not just because they declared that access to online communications is a human right.

Ever since the French law was first proposed in November 2007, six months after Nicolas Sarkozy took presidential power in France, governments around the world have been building a house of cards surrounding the concept.

Everybody's considered the same law: Britain, New Zealand, Ireland and even America are among the countries that have proposed their own version of three strikes - the idea that anyone thought to have illegally shared files online will get two warnings, before having their broadband connection cut off on the third accusation.

But here's the problem: each proposal has a disturbing tendency to point back to the others in an attempt to shore up its case. I've had conversations with various officials, and read documents from most of the major initiatives, that reference the French law as a precedent, or point out that the British are considering a similar rule."

Legally, if the French courts have truely held that Internet access is a human right, this may be enormously significant, both to EU law as well as to domestic French law and to other areas than sanctions against filesharing. I looks forward to (hopefully?) seeing an English translation of the opinion soon.

EDIT: more comment from Technollama here.



Tuesday, August 25, 2009

Harry Mandelson and the 3 Strikes of Doom

As numerous bloggers are reporting today, first the Guardian and now the Beeb have reported that the Dept for Business under the proud thrusting leadership of Peter Mandelson, has done a volte face and done exactly what they stated in the Digital Britain consultation in June they would not do - added the possibility of 3 Strikes - disconnection as sanction for filesharing - into the melting pot of the UK's endless file-sharing consultations. This notwithstanding that without substantial judicial control of disconections, about which we have zero detail, both the the European Parliament and the French Constitutional Court have indicated that such a policy would probably contravene human rights.

Best of all, this change of heart is not even vaguely democratic or considered. Instead, as the Guardian put it, "The surprise move will intensify speculation that Lord Mandelson reached a secret deal to protect the film and music industries with Hollywood mogul David Geffen earlier this month." Ho bloody ho for public "consultation".

There had also been whispers for some time that the industry was unhappy with the speed at which the Digital Britain consultation was moving, ie, would anything get done before the current government was voted out and the whole farce had to start again. So now we have proposals for a fast track procedure for 3 strikes which will not only breach European law but have arrived mid-consultation, when many organisations and individuals may already have responded, making a simple mockery of consultative democracy and exposing the government's business leaders as mere lackeys to the dying throes of the music industry's last attempts to protect anti-competitive and antiquated business models.

As ORG point out:

"Yet again, we see knee-jerk reactions and policy swerves, this time in direct contravention of the government’s own consultation guidelines. Those guidelines are there for a reason: to make sure government policy is balanced and considered. We will be making a formal complaint."

Some regular readers may wonder why Pangloss has focused so much on this issue over the last few years, and sometimes I do too. I am not primarily an IP expert. I have no great love for filesharers and my own life is reasonably complete without free access to the complete works of Michael Jackson. The reason I have become so involved in this single issue is because throughout, a single industry sector has shown complete contempt both for democratic procedures, the public interest and for basic and fundamental human rights, all in the name of extracting the last cent of their own, still not inconsiderable, profits.

Ok, companies exist to make profits. But worst of all, our own elected democratic governments, though very well aware of all these points, have gone along like sheep, far more willing to disproportionately criminalise a generation and remove access from students, the unemployed et al to the most essential facility we have ever developed, for minor civil infringements (no one is talking about commercial criminal piracy here) than consider the public balance of interests.

Is this because rock and film stars are sexy? or because the content industry has spent so much on lobbyists there must now be one per MP at least? - I do not know. And of course it is mid August , the height of the sleepy season when many influential newsmakers and commentators might be hoped to be somewhere near Tuscany or at least the Edinburgh Fringe rather than a keyboard:) Perhaps when the first UK Pirate Party MP or MEP is elected the government will wake up to the startling wrongheadedness of the current approach.

So this is why I continue to care about this topic, and why you should too. Read the ORG blog; write to your MP and MEP; complain.

Tuesday, November 18, 2008

Fighting 3 Strikes, the French way?

If you have been following the 3 strikes in Europe saga thus far on this blog, you may be interested in taking part in the campaign La Quadrature du Net has now launched to preserve Amendment 138, the amendment to the Telecoms Package which expressly preserves both the right of due process and the right to fundamental liberties such as privacy, in any extra-judicial process designed to impose sanction on filesharers.

It is dfficult to see how any democratic organisation could object to such values being embedded in any type of dispute resolution process, and indeed the Amendment was passed by 88% of European MEPs and endorsed in the Commission report; however the Council of Ministers removed it from their draft proposal, and will almost certainly be continuing this opposition when the Telecoms Package comes to its next major vote on Nov 27th.

The right to due process, if preserved, will indubitably strike a significant blow against Sarkozy's plans to introduce a 3 strikes law and thus this vote is of particular importance to the French.

However it is significant in many other European countries too, notably our very own United Kingdom of GB, where the result of the current (now closed) consultation on the BERR-sponsored Memorandum of Understanding might well be the introduction of a similar process a similar process compelling ISPs to clamp down on alleged filesharers, and similarly lacking safeguards of impartialitry, exaination of evidence and opportunity for legal assistance in the UK. Indeed the UK process might turn out to be more damgerous, since while the French law primarily contemplates outright disconnection, the UK process might include less transparent and more obscured sanctions such as traffic slowing and filtering. Opponents of covert censorship thus have an agends here as well.

If you are worried, check out the La Quad site and see what you can do.

If you want to read more about this and see more legal backing for these claims, see the brief prepared by Simon Bradshaw and myself on interpreting the Telecoms Package.

If you want to see a video of a Swedish MEP explaining what he sees as at stake here, see here.

Friday, November 28, 2008

3 Strikes and the Telecoms Package: What's Going On?

I've been unable to keep up with the latest machinations following the pre vote leak earlier this week and the actual vote on Thursday, due to utter deadline crises, but brave LawClanger and Monica Horten are still right in there, keeping us informed. ORG will also no doubt continue to cover the story. A "historical" version of the tale is also likely to appear from Simon and myself in SCRIPT-ed in December.

Chaos reigns still, but the upshot seems to be that the CoM have , as expected, excluded the European Parliament , Commission-backed amendments (especially 138) which might have protected due process and human rights (bad news); but on the other hand, the CoM itself seems to have succumbed to pressure to seperate content from conduit regulation, and has removed or watered down some of the provisions which appeared to provide an EC foundation for Sarkozy's 3 Strikes law (good news). Indeed, La Quadrature du Net are claiming Sarkozy now faces an uphill struggle in bringing his law in even in France.

Pangloss is, frankly, confused and without the time to find out more. Off to Israel Sunday to speak on social networks and privacy at the University of Tel Aviv! (And also to visit my niece :-)

Will be back in London to promote the global launch on Dec 9th of the 2008 McAfee Virtual Criminology Report!! Watch this space for our phishy, financial and other findings this year (it's a co-production by myself and Ian Brown of the OII.) I wonder if we can top last year when the Chinese government called a press confernce to rebut our acusations of Chinese cyber terrorism!

Saturday, November 08, 2008

Blogs are what happen when....


I long to debate the exciting things that are happening: the Google Library settlement, the Telecoms Framework latest Commission compromise position, the French passing 3 Strikes and You're Out, data retention , Internet libel cases in the UK courts, and how to deal with regulating the security of wi fi - but too busy actually doing things that relate to these to have time. Ag! I seem to have made a F austian bargain of my own - surrounded by a panoply of interesting legal developmnets, but noooo time to chat about them. Sigh.

Things wot I have done instead:

helped (a bit ) with the ORG response to the BERR filesharing consultaion;

helped (a bit more) with the ORG response to the UK consultation on implementing the Internet data part of the Data Retention Directive (link to follow)

supervised the preparation of an excellent brief by Simon Bradshaw on how the Telecoms Framework , having now been through the European Parliament, the Council of Ministers and the Commission report stages, still contains provisions which may well enable and legalise a France style "3 strikes" regime throughout Europe. We (Simon, ORG and myself) hope to publish this brief in the next few days. Thanks also to Monica Horten for invaluable assistance on this project.



So instead, meanwhile here's the latest XKCD cartoon, which as usual is superb :-)

Monday, July 07, 2008

Result of IMCO vote

For those who have been following this saga, the pretty much expected news was that all the amendments went through. They now get voted on with the rest of the package on I think Sept 7.

The good news, as far as Pangloss is concerned, is that the drafter, Malcolm Harbour, got interviewed at same time as me by the Beeb, and reiterated, as he had in return emails to voters throughout the day, that it was absolutely not the intention of the amendments to lay the foundations for legitimising member states introduction of "3 strikes and you're out". Pangloss is relieved to hear this.

Harbour added that if the amendments could be so interpreted, were too wide basically, then he'd be happy to accept other amendments making it clear this wasn't intended to be the case.
Pangloss thinks this an excellent way to proceed, and hopes there is an opportunity in the remaining legislative process to tighten these provisions up in a way that retains their public interest intent (eg public education about child pornography) but could not be subsequently misinterpreted as legitimising 3 strikes legislation.

Harbour and I may be on R4 later depending what else happens in the news - it will definitely apparently be on Radio 5Live later, and online, and a full version of the interviews may be on iPM , the online version of the Radio 4 show which podcasts on Saturday.

It's been an interesting couple of days. I am now going to back to writing Law and the Internet!

UPDATE: You can hear the debate between Malcolm Harbour MEP and myself here, including his concession re future amendments.

Thursday, October 29, 2009

TalkTalk vs Mandy??

Two days ago Pangloss, commenting on Mandelson's newly elaborated plans to introduce a UK "3 Strikes", added;
Interesting thought from Twitter: "if my business was cut off for allegedly downloading illegally I'd be looking for someone to sue". Will any legislation have an immunity in it for ISPs a la the US DMCA? If not, start lobbying NOW, ISPs.."

This thought (which turns out to have originated from the helpful @futureidentity, aka Robin Wliton) seems to have occurred fairly swiftly to others too... According to the Grauniad, today:

TalkTalk, the second largest internet service provider in the UK, has threatened to launch legal action if business secretary Peter Mandelson follows through with his plan to cut off persistent illegal filesharers' internet connections.

Carphone Warehouse-owned TalkTalk, which has more than 4 million ISP customers and owns the Tiscali and AOL brands, claimed the government's plan was based on filesharers being "guilty until proven innocent" and constituted an infringement of human rights.

"The approach is based on the principle of 'guilty until proven innocent' and substitutes proper judicial process for a kangaroo court," said Andrew Heaney, the executive director of strategy and regulation at TalkTalk. "We know this approach will lead to wrongful accusations."

While the liberal blogosphere has on the whole greeted this news with unrestrained enthusiasm (Twitter is full of it), Pangloss is a litle sceptical as to whether it is any more than self-seeking good-PR sabre-rattling.

Firstly, what exactly is TalkTalk's title to sue here? Surely not anything mentioned in the interview above. The breach of human rights, if any, will surely be of the subscribers, not the ISP. Any wrongful accusations without due process will similarly be directed at users, not the conduit.

TalkTalk's (or any other ISP's) real worries seem obvious :

(a) the threat of being sued by aggrieved users for everything from breach of confidence, to acessory to false accusation, to co-publisher of a libel, as well as of course for breach of the actual contract for Internet services; and

(b) the costs of being involved in Mandy's Great Scheme, both in terms of actual money and loss of customer goodwill. The Guardian also usefully reports today that according to BT and Carphone Warehouse (ie TalkTalk) , Mandy's scheme might costs £420m pa, to be shared evenly between rightsholders and ISPs (and, incidentally, to solve an estimated loss to the music industry of half that - c £200m pa.)

These figures make it clear the latter is the real issue, not human rights, nor liability to customers. In fact, most ISPs will have extensive exclusion from liability clauses in their subscriber contracts already - although these may well be subject to challenge under the Unfair Terms Regulations and /or UCTA and thus unenforceable.

So what would be the ISP's actual grounds for an action? No one has a right in this country simply to dispute a statute because they don't like it. Victims of a human rights violation - an unlawful act under s 7 of the HRA 98 - may indeed question the validity of a statute in any domestic proceedings, though under HRA 98, no UK court has the right to strike down legislation, merely to make a declaration of incompatibility, leaving it to the governement then to sort out what the hell to do.

Is TalkTalk itself a victim of any ECHR or HRA human rights violation? I don't see how. (Indeed it was once controversial if a juristic person could suffer a human rights violation - though this now seems to be accepted in some cases.) What they might argue is the rather muzzy domestic law tort that the government has interfered with their business contracts. This would be controversial (doesn't a government have the right to do exactly that? case law mainly concerns dirty practice by commercial competitors) and would attract considerably less public sympathy of course.

Another more plausible line of attack would be that any legislation was in breach of EC law forbidding ISPs from being required to generally monitor the public under art 15 of the E-Commerce Directive - although this has not stopped the French passing HADOPI - twice :-)

Pangloss is glad to see ISPs like TalkTalk, whom she has always regarded as being stuck between a rock and a hard place in this matter, coming out firmly against Mandelson's proposals and even gladder to see them endorse her own arguments that 3 strikes is likely to be in breach of ECHR guarantees of due process and privacy. But frankly - sue Mandelson? Oh come on, as someone else might say...

Monday, April 03, 2006

The DOS wars: Blogscript strikes back

Blogscript sadly fell beneath the waves of overwork at rather the wrong time to make a dent in the amendment process to the Police and Justice Bill revisions of the CMA 1990. Well, inspired by general waves of self congratulation from everyone form the APIG to the BCS, I feel inclined to remark in curmudgeonly way that I'm still not at all happy that the CMA amendments will do anything to water-tightly criminalise DOS in the UK. See my previous blog post at http://blogscript.blogspot.com/2006/01/denial-of-service-i-told-you-so-part.html .

If the latest version of the PJB is as at http://www.publications.parliament.uk/pa/cm200506/cmbills/119/06119.27-33.html, which I *think* it is, then it seems the amendments made have changed nothing useful (in cl 34 - cl 35 has been improved).

The crucial point is that in cl 34 it now reads:(I paraphrase)

S 3(1)CMA90 is amended to say

"A person is guilty of an offence if—
(a) he does any unauthorised act in relation to a computer;
AND (emphasis added)
(b) at the time when he does the act he has the requisite intent and
the requisite knowledge."

It doesn't help to define the intent required by s 3(1)(b) to include intent to impair* if s 3(1)(a) can't be established. You need both pre conditions for a conviction. And as things stand, post last year's DOS acquittal, someone who sends ordinary email or page requests etc to an open website is still not "unauthorised".

What is needed is to re-define or clarify "unauthorised". One easy way might be something like "The owner or operator of a website or server is rebuttably presumed not to give authorisation to the sending of data or traffic to that site where it is sent for the primary purpose of [insert the terms from s 3(2)]*".

I can't see any attempt to clarify "unauthorised" in the PJB. Worse still, we stil have s 3(4) declaring that "For the purposes of subsection (1)(b) above the requisite knowledge is knowledge that the act in question is unauthorised".
I sincerely hope I've missed something. Pah. Why do we expect MPs to draft legislation? We don't expect them to perform heart surgery or build bridges. Why is drafting law, a difficult and skilled task, treated as amateur hour?

* s 3(2) CMA 1990: " (a)to impair the operation of any computer,
(b) to prevent or hinder access to any program or data held in any
computer, or
(c) to impair the operation of any such program or the reliability of any such data,
whether permanently or temporarily."

Wednesday, February 17, 2010

Filtering round up: French filtering, Ireland backs off, UK sidesteps?

Bit of a round up here on some interesting stories of last few weeks on aspects of filtering that I've been accumulating.

Increasingly, stories as to filtering out illegal content such as child porn; blocking infringing downloads of copyright material by deep packet inspection and disconnection; and filtering to fight the "war on terror" are converging. For all of these, the same issues come up again and again: privacy; proof, transparency and other aspects of due process; and scope creep. These 3 stories illustrate this well. For my own recent take on the issue of Net filtering, as I said before, see my Internet pornograohy chapter on SSRN, which suggests the need for a Free Speech Impact Assessment before non transparent stateNet filtering schemes are introduced, for whatever purpose.

Filtering of illegal content in France

Thanks to @clarinette on Twitter (whose real name I am not absolutely sure of!!) for pointing me to another important European move towards non transparent Internet filtering - this time in France. From La Quadrature de Net:

Paris, February 11th, 2010 - During the debate over the French security bill (LOPPSI), the government opposed all the amendments seeking to minimize the risks attached to filtering Internet sites. The refusal to make this measure experimental and temporary shows that the executive could not care less about its effectivity to tackle online child pornography or about its disastrous consequences. This measure will allow the French government to take control of the Internet, as the door is now open to the extension of Net filtering.

The refusal to enact Net filtering as an experimental measure is a proof of the ill-intended objective of the government. Making Net filtering a temporary measure would have shown that it is uneffective to fight child pornography.

As the recent move1 of the German government shows, only measures tackling the problem at its roots (by deleting the incriminated content from the servers; by attacking financial flows) and the reinforcement of the means of police investigators can combat child pornography.

Moreover, whereas the effectivity of the Net filtering provision cannot be proven, the French government refuses to take into account the fact that over-blocking - i.e the "collateral censorship" of perfectly lawful websites - is inevitable2. Net filtering can now be extended to other areas, as President Sarkozy promised to the pro-HADOPI ("Three-Strikes" law) industries3."

LQN are never exactly ones to mince their words:-) so the strong nature of this statement should perhas be taken with some care - but Pangloss intends to go investigate this story further.

Ireland, Eirecom, disconnection and DP

Meanwhile in a surprising twist, Eirecom have apparently pulled out of the negotiated settlement they reached in January 2009 to disconnect subscribers "repeatedly" using P2P for (alleged) illicit downloading. This was the result of the Irish court case brought against them by various parts of the music industry for hosting illegal downloads, and appeared to open up a route to "voluntary" notice and disconnection schemes on the part of the ISP industry; a worrying trend both for advocates of free speech, privacy, due process, ISP immunity and net neutrality.

Now however according to the Times:

As part of the agreement, Irma said it would use piracy-tracking software to trace IP addresses, which can identify the location of an internet user, and pass this information to Eircom. The company would then use the details to identify its customer, and take action.

But the office of the Data Protection Commissioner (DPC) has indicated that using customers’ IP addresses to cut off their internet connection as a punishment for illegal downloading does not constitute “fair use” of personal information. Irma and Eircom have asked the High Court to rule on whether these data-protection concerns mean the 2009 settlement cannot be enforced.

This is very, very interesting. A court case on this might settle a number of outstanding DP legal issues: whether IP addresses are "always" personal data (on which see also a recent EU study demonstarting the disharmny across Europe on this) and if not, when; what the scope of the exemmptions for preventing and investigating crime are; and what"fair" means in the whole context of the DP principles, purpose limitation and notice for processing.

Not only that but as the Times indicate, the human rights issues which have been repeatedly aired in debate around "three strikes" generally, would also come into play as well, as the straight DP law. Is use of a customer's personal data to cut them off from the Internet a proportionate response to a minor civil infringement? Does it breach a fundamantal right of freedom of expression or association? Does it breach due process? This could be the DP case of the decade. Pangloss is geekily excited. If anyone out there is involved in this case, do let me know.

UK cops don't terrorise the IWF?

Finally , as widely reported, the UK Home Office has introduced a website hotline for the public to report suspected terrorist or hate speech sites. Reports are then vetted by ACPO, the Association of Chief Police Officers, who it appears can then take action, not only by investigating in normal way, but also by asking the relevant host site to take down. The official press release notes : "If a website meets the threshold for illegal content, officers can exercise powers under section 3 of the Terrorism Act 2006 to take it down." Indeed on serving such a notice, the host only has 2 days to take down or loss immunity under the UK ECD Regs.

As TJ McIntyre also notes, this is a rather significant development, not just in itself but for sidestepping use of the Internet Watch Foundation (IWF). There have been persistent rumours since and before then-Home Sec Jacqui Smith's famous speech in Jan 2008, that theUK government was attempting to pressurise the IWF into adding reports of hate speech/terror to its block- or black-list; and that the IWF was as strongly resisting this, hate speech being a somewhat more ambiguous and controversial matter than adjudicating on child sexual imagery.

It seems then that the IWF has held fast and the Home Office have backed off and created their own scheme, which embraces only take down in the UK, not access blocking to sites abroad (?). Whether this is ideal remains to be seen. The IWF, at least until recently had the services of esteemed law prof Ian Walden as well as a lot of accumulated experience, and may have been a better informal legal tribunal, than a bunch of chief constables, to decide on the illegality of sites under terror legislation. Who knows. On the other hand , adding alleged terror URLs to an invisible, encrypted, non public blocklist defeats every concept of transparency and public debate regarding restrictions on freedom of political speech, and Pangloss is glad to see it avoided.

Pangloss's view remains that such difficult non-objective issues are best decided by the body long set up to deal with questions of hazy legal interpretation: namely, the courts. The definition of "terrorist" material for the urposes of s 3 of the 2006 Act is as follows (s 3(7)):

"(a) something that is likely to be understood, by any one or more of the persons to whom it has or may become available, as a direct or indirect encouragement or other inducement to the commission, preparation or instigation of acts of terrorism or Convention offences; or

(b) information which—

(i) is likely to be useful to any one or more of those persons in the commission or preparation of such acts; and

(ii) is in a form or context in which it is likely to be understood by any one or more of those persons as being wholly or mainly for the purpose of being so useful."

Well I hope that clears everything up :-) Still confused? Try s 3(8)).
"(8) The reference in subsection (7) to something that is likely to be understood as an indirect encouragement to the commission or preparation of acts of terrorism or Convention offences includes anything which is likely to be understood as—

(a) the glorification of the commission or preparation (whether in the past, in the future or generally) of such acts or such offences; and

(b) a suggestion that what is being glorified is being glorified as conduct that should be emulated in existing circumstances."

Er give me that last line again?

As with previous contested IWF rulings, the same questions come up again: what is the appeal from a take down notice under s 3 to the regular courts? What notice if any is given to the site owner and the public of therfact of and reasons for take down? What safeguards are there for freedom of speech? None of these are mentioned in ss 1-4 of the 2006 Act. Nor does there seem to be a general provision in the Act for Part 1 or the whole of the 2006 Act for appeals or review. Since the police are a public body however, one imagines that judicial review might be competent. EDIT However I am helpfully informed that ACPO is a company limited by giuarantee and regards itself as not a public body at least for the purpose of FOI requests. Clarity on this would be very desirable. And as noted above record keeping of take down for terror reasons seems to be poor due to voluntary compliance by ISPs.

Finally why introduce these powers if they are to be circumvented anyway? The Register reported on 12 November 2009 that so far no notices had been issued under s 3 anyway, because the UK ISPs involved had agreed to take down voluntarily, and no record has been kept of how many sites this involved. Furthermore if a site is taken down in the UK it won't be hard to resurrect it in a foreign country, where most extremist sites will be based anyway: El Reg reports that one site the police allegedly have their eye on, al-Fateh, a Hamas anti-Jewish kids site, is in fact hosted in Russia. One imagines this will continue to increase pressure on the IWF to expand the block list despite the latest moves.


Thursday, July 24, 2008

3 Strikes and You're Um Crawling to a Halt??

Pangloss hates to seem so one track minded on this, but well, things just keep happening. In this case, potentially pretty bad things.

After months of rumours, behind the scene talks, stealth tactics at the European Parliament (maybe), and denials that the UK and indeed, Carphone Warehouse would ever ever have anything to do with nasty French stuff like 3 strikes and you're out, today we have two somewhat interesting developments: a voluntary, and so far, rather worryingly vague, Memorandum of Understanding between the music industry, BERR and the 6 leading UK ISPs which between them account for 90% of UK traffic : BT, Tiscali, Virgin ("absolutely no possibility of disconnection"), Orange, BSkyB and oh suprise, Carphone Warehouse :)

Plus a consultation on what primary legislation should be brought in by BERR as a "backstop": the idea being presumably that if the other 10% of ISPs don't fall into line with the MoU - or if some of the above 6 pull out depending on how bad the PR fall out is and what the MoU actually compells them to do - they can then all be compelled still to "do something" about file sharing.

So what does the MoU say? Well basically for 3 months, the industry aided by the 6 ISPs involved are going to send out letters to suspected filesharers. Lots and lots of letters. 80,000 or so over 12 weeks. But hang on. If 67% of the UK have admitted to filesharing - even only once - that's 35 million letters that need sending out. Quite a bit of scaling up there to be done after the pilot. Eco-wise let's hope they're all emails:)

But letters is only stage 1 (after all the BPI could have sent them themselves, tho this way they do aparently get ISPs to pay for half of them.) Stage 2 is what do you do next, when presumably they compare them all on a big spreadsheet, and find that eg Mr A of Aberystwyth got 220 letters from 5 ISPs? What gets done to persuade Mr A to abandon his bad ways if the shock of 220 letters isn't enough?

Here the MoU gets vaguer. There will be discussion of "technical measures", for "repeat" or "the worst" offenders. This seems to involves three possible sanctions:
  • traffic management (slowing the offender's email til it's too slow to downlaod an MP3);
  • filtering out tagged-as-copyright traffic to that offender's IP address;
  • and possibly, maybe, not quite stated-as-such, disconnection??

Pangloss doesn't want to restate the (very tired and flat) wheel but this raises all the same problems I've gone though before plus more.

What will happen if the repeat offender is a child and the whole household loses access or has it slowed to unacceptable levels? "Traffic slowing" to an accountholder sounds better than disconnection, but I cannot see, having asked some tech experts, how it is substantially less damaging.

This is about music remember, not, so far, films. Supposed Little Johnny downloads several hundred tracks, and as a result the account to their home is restricted to a crawl. (It's likely to happen automatically after the account's bandwidth limit is reached.) If you can't manage to get a fast enough connection to download an MP3, or even 12 constituting an album, can Johnny still manage to download his course reading materials from the uni or school website?? can Mum run her small business? can Dad tele commute? can Sis run her small business on eBay? can ma and pa even manage to download programmes from iViewer, their legal right as a BBC license payer! It seems unlikely.

What if the infringer is really someone using your wi fi , or visiting your house, or a crook who's zombified your machine unbeknownst to you?

What if the music people have just got the IP address or look up to real life ID wrong? (well we should at least get to see the correct target hit rate - or the failure`rate - over the next three months.

What if you're making fair use of coyright materials eg review, journalism, education?

All these crucial points of evidence and standard of proof and exceptions remain right now (a) vague and (b) aparently to be determined and adjudicated by industry and ISPs - not courts, judges or even policemen.

The good news here is that the regulator Ofcom is to be involved in drafting codes with industry relating to "evidence .. repeat offenders..incorrect allegations... routes of appeal" (p 48).

Good. Very good even. But it will still be the music industry as prosecutor and judge and the ISP as cop and enforcer, with the onus on the consumer to challenge after the sanction has already been ordered: Pangloss still feels deeply unhappy about all this.

There is a better alternative though, and it's option A3 in the BERR consulation. (p 35).

"Rights holders would identify infringing IP addresses and pass evidence and
details to a 3rd party body, which would take responsibility for assessing the evidence that file-sharing of copyright material had taken place. If the evidence was judged sufficiently robust, the body would then direct the ISP to take appropriate action or do so itself. Such a body would also be able to hear appeals and complaints from
consumers and may also be responsible for developing and administering or overseeing
any required code of practice for ISPs and rights holders."

This is a win win solution. It could meet ECHR and UK standards of fairness, due process and transparency, while still cutting down on actual piracy (as is right and proper, we should not forget this).

It might also be seen as slow and expensive and the industry will not like it. But it doesn't have to be.

We already have a model , in the IP world, of a speedy cheap and effective, yet legally rigorous tribunal for on line wrong doing. It's the ICANN UDR dispute resolution procedure for dealing with cybersquatters - people who register domain names in apparent disregard of the rights of trademark holders. It works, it's seen 1000s of cases over a number of years and broadly industry - and the IP industry - has found it effective and satisfactory. In previous work for the EU, myself and my colleague Caroline Wilson held up the UDRP as a possible model for resolution of online consumer-related disputes. It can involve lawyers or technologists or even musicians so long as they are trained as arbiters who actually understand the relevant law, technology and business. It need not have the kind of time and cost constraints of the courts. Cases could mainly be conducted online, with electronic written pleadings, again already a tried and tested standard approach in the UDRP.

It could make the UK look like a world leader in dealing with the consumer piracy problem, as opposed to the freakshow of Europe.

What other alternatives does BERR suggest?
A1 suggests that ISPs be required to automatically reveal the personal identity of an alleged filesharer identified by IP address to music industry, on demand, with no need to go to court.

Currently ISPs refuse to do this because it would be breach of data protection law and also a breach of confidentiality to custoner without court order. It would, one imagines, be disastrous for ISP customer relations, but as US already has it in DMCA, it is likely to appeal to BERR as already working.

The problem is really how far this can be used to invade personal provacy and make groundless threats (as in so-called cyber-slapp libel litigation.) People are however extremely touchy about personal data revelation without consent right now, post HMRC. so Panlgoss suspects this one is likely to go down like a lead balloon.

A4, finally, (no there is no A2 - well not really) suggests that if we are all very very bad boys indeed, then ISps will be asked _ sorry ordered - to install filtering. THis would probably mean that the rightsholder would say "here is the list of tracks we hold cooyright in" and if Mr A in Aberystwth was detected downloading or uploading one of them, it would be filtered out (and he would no doubt get a letter too).

Secueity and technical experts say this is so unlikely to work correctly across all traffic, all users and all ISps, that it's like believing in fairies. How do you tell a Lily Allen track that's been illegally copied from a P2P site from one that's been legally downloaded as part of a BBC TV show from iViewer or one that's freely available on MySpaced as apromo? It's the same track.

It is also a blank ticket for unrestricted censorship with no public accountability or transparency. It's the kind of tactic which has been declared an unconstututional interference with the free expression rights of adults repeatedly in the US courts. Filtering might - just - be aceptable to stamp out child porn downloading - but not in the context of music where many people have quite legitimate rights to listen to much oif the material.

This is more than a hammer to crack a nut - it's an imaginary hammer cracking all the fruit in the world as well as the nut. (Yeh maybe the metaphors are getting out of hand.)

Think about it. If you like A3, do write to BERR (or do anyway) - the consultation closes on October 30.

Write to Michael Klym / Adrian Brazier
Communications & Content Industries
Department for Business, Enterprise & Regulatory Reform
UG28-30
1 Victoria Street
London SW1H 0ET
Tel: 020 7215 4165 / 1295 Fax: 020 7215 5442
Email: mike.klym@berr.gsi.gov.uk / adrian.brazier@berr.gsi.gov.uk

Monday, January 19, 2009

BERR, the music industry and file sharing: also stupid porn law ideas

Sorry for long silence. A bit of a catch up here of some recent very important stories..

Ray Corrigan helpfully reminds me that the Department for Business Enterprise & Regulatory Reform has published the responses to their P2P filesharing consultation.

"None of the options highlighted in the consultation won widespread support. Rather there was a marked polarisation of views between the rights holder community and consumers and the ISPs over what action should be taken.

A number of key issues were identified by respondents including copyright protection, protections afforded under eCommerce legislation and the impact on the wider economy. Consumers (individuals and consumer organisations) in particular highlighted concerns over data protection and privacy. The role of technology was addressed by most respondents, however there were conflicting views as to whether it could offer all or part of any solution. For almost all the options, questions were raised as to their legality under the existing legal frameworks and again, views varied.

There was a degree of consensus that any solution must involve the provision of new legal sources of attractive content and the need for education on the importance of copyright in the wider economy.

A number of replies suggested alternative models to those options proposed. Copies of all non-confidential responses received have been placed on the BERR website."



Meanwhile documents leaked to the Financial Times apparently show that BERR is planning in the wake of this to introduce an "ISP tax scheme":

"Ministers intend to pass regulations on internet piracy requiring service providers to tell customers they suspect of illegally downloading films and music that they are breaking the law, says the draft report by Lord Carter.

It would also make them collect data on serious and repeated infringers of copyright law, which would then be made available to music companies or other rights-holders who can produce a court order for them to be handed over.

With the creation of a body called the Rights Agency to be paid for by a small levy from the internet service providers and rights-holding organisations, these measures would form the spine of a new code of conduct for the internet industry. The draft report says the code would be overseen by Ofcom, the broadcasting regulator, according to people who have read it.

The guiding philosophy of the report is that the internet and music industries have failed to sort out the problems of illegal downloading between them, and the government sees this as its preferred solution."



As others have commented, that last sentence is posibly accurate :-)

Until we get details it doesn't seem worth commenting much on this. First impression is that it is certainly preferable to either the compulsory filtering of allegedly copyright content out, or the "3 strikes and you're out" type scheme we have feared since March 2008. On the other hand the privacy implications of this scheme are still not good.

Why for heavens sake if we are going to start imposing taxes , can't we simply do the sane thing and install a tax/levy system on broadband use, which would pay for all music to be downloaded "free"? (A: because the music industry don't want it that way. Well, hello.)

According to Becky at ORG,

"The official government response to the consultation will be published as part of the interim Digital Britain report, which is expected at the end of this month."

In other news, DRM is dead. Well for music. I mean if iTunes has decided it isn't worth using, who the hell else is going to?

In still other news, turning from music IP to Net porn, Burnham talks Bollocks. Well, so no change there. I won't address this one in detail here either, because I just have in the (very heavily) revised version of my chapter on pornography, censorship and the Internet which will be appearing in the 3rd edition of Edwards and Waelde Law and the Internet, hopefully soon..

(This bit isn't so bad though. According to the Telegraph "
Mr Burnham also wants new industry-wide “take down times”. This means that if websites such as YouTube or Facebook are alerted to offensive or harmful content they will have to remove it within a specified time once it is brought to their attention." The vague definition of "expedient" in the E Commerce Directive Art 14 has long been unhelpful to both hosts and ISPs, so Pangloss approves of this as long as it is practicable.)

Here's a taster of my views , in the new section on the global rise in compulsory top-down invisible Internet content filtering..

"
Effectiveness. Web filtering can be easily avoided by those who really want to, and any government wishing to install it must consider the impact of this on effectiveness. Depending on how filtering is achieved, blocking can often be evaded by a proscribed site changing its URL, or merely its underlying IP address. Users in turn can simply use a foreign proxy server site to anonymise their surfing destinations[1]. Steps can be taken to inhibit avoidance, but they are likely to result in serious over-blocking – for example, the EFA paper on the Australian scheme notes that a serious web filtering system would also need to block the Google cache, the Way Back Machine[2], and numerous other Internet archive sites where content is mirrored. It can be argued that child porn web filtering systems merely inhibit the ignorant or lazy or those who stumble on illegal material by accident[3], and do not stop for a minute those who are ostensibly the real targets of the efforts involved – serious paedophiles who may go on to commit actual abuse.

A key anti-avoidance issue is whether filtering is only to be imposed on websites or on other types of digital content, such as Internet newsgroups[4], P2P filesharing systems, instant messaging (IM) and email, as well as mobile phone traffic. As we have discussed above, illegal content is now known to be more commonly swapped in encrypted P2P “darknets” than on the open Web, which begs the question, why bother to filter the Web at all? In response to such criticisms, the Australians have claimed they intend to extend their reach to cover material traded via the P2P protocol BitTorrent and the EC has instructed research into P2P content blocking[5]. Such research is still likely to prove useless in the face of modern evolving encrypted P2P systems. At present such systems (eg Tor and Freenet) are rarely used by the average EU or US citizen because they are user-unfriendly and slow – but in go-ahead Japan, the leading P2P systems, enabled by their fast next generation consumer broadband networks, are both encrypted and consumer-popular. It will not be long before such systems make the leap to Europe and the US as home broadband networks are upgraded here too. At that point only the most foolish pedophile would attempt to access child porn using the open Web.

A slightly easier target is mobile content. In Europe, many mobile operators already provide filtering software and filtered content for children, and UK operators since 2004 have voluntarily signed up to Ofcom-brokered codes of conduct requiring filtering of content to under 18s and labeling of over 18 content on their servers[6]. Reliably imposing these restrictions on children given cheap anonymous pay as you go phones, may however be a harder than foreseen task.

Resources. Even if we only look at filtering the Web, realistically, classifying the
ever-expanding billions of Internet pages manually as “illegal”, “inappropriate”
or whatever will cost billions of dollars and be an
ever moving target
[7].This has not however stopped the Culture Minister Andy
Burnham recently suggesting exactly this for the UK
[8].)

The IWF avoids this problem by being complaint-driven - which
means its list is,of course, very partial
[9] and thus of questionable success. In reality,
blocklists in commercial filters are
usually generated partly by automated and partly
by manual means, which as the ONI note, means they are
inevitably prone to both
over- and under-blocking.



[2] Interestingly, the Register has also reported that the IWF had added images on the Wayback Machine to its block list, which had lead to some ISPs banning the entire 85 million web page archive. Details were not given as to what images had been banned and ISPs involved gave 404 “page not found errors”. See “IWF confirms Wayback machine porn blacklisting” ,The Register, 14 January 2009.

[3] Mike Galvin of BT, one of the creators of the IWF “cleanfeed” system, admitted in an interview with the Guardian on 26 May 2005, that Cleanfeed “won’t stop the hardened pedophile” and went on to say that its main aim was to stop accidental access by users following links such as those in spam emails.

[4] Internet newsgroups have largely fallen out of common use but are still extensively used for porn trafficking: see January 2009 report of USA conviction of 7 paedophiles following the bust of a well organised network that used Internet newgroups to distribute illegal items to its members over a two year period. See “Child porn in the age of teenage “sexting” “, The Register, 16 January 2009.

[7] The EFA pages (supra n XX) estimate that even if a 1000 people were employed full time for a year , they would fail to categorise more than 0.1% of all the pages on the Web , and at the end of that year the list would be hopelessly out of date.

[8] See BBC report, 27 December 2008 , at http://news.bbc.co.uk/1/hi/uk/7800846.stm .

[9] Testing of the IWF Cleanfeed system for use in New Zealand found that their list contains probably only only about 10-15% of offending websites (statistic cited in EFA pages, op cit supra n XX)