How Soon is Now?

.. as The Smiths once said.

I was reminded over the weekend about this post by sf writer Charlie Stross. It's a very interesting read on future gazing and why you're even less likely to predict accurately the near future than ever before. Stross argues that once it took 125 years for world wide acceptance of a technology - now it takes 16 or less. Such speed of change makes attempts by the always-catching-up law to regulate technology in any degree of specificity look ever more doomed. Another vote for Chris Reed's doctrine of creative inertia?

3 Strikes And You're Out talk from LSE conference

Ray Corrigan, one of the finest IT law bloggers on the block, has, incredibly helpfully, while I frolicked for the long Easter weekend, written up an account of my talk on the dubious legality of the posited "3 strikes and you're out" legislation which, if passed, would mandate disconnection of repeat filesharers in the UK from the Internet.

See http://b2fxxx.blogspot.com/2008/03/3-strikes-copyright.html (thanks Ray.)

There is also a third ground of possible illegality of any proposed "notice and disconnection" regime, , other than its transgression of due process and lack of propartionality with respect to human rights. I did not have time to get to this at the conference so Ray has not mentioned it - namely that in order to prevent an "it wasnae me" defense (as we say in Glasgow), legislation might also require the mandating of secured wi-fi for every user who maintains a wireless router. Without such a rule, every uploader could theoreticaly claim it was not them but a wi-fi piggy-backer who committed the "offence".

Currently, users are usually advised to make their wi-fi network secure, and most ISP T & Cs theoretically demand it, but many prominent security experts, notably including Bruce Schneier, deliberately keep their networks open (while maintaining high quality virus checking ware and firewalls for the security of their own data). they do son mainly on the grounds that the mobile Internet ought to be a public resource for those in transit or in public areas, like toilets or water fountains. Breach of a term imposing secure wi-fi only by an ISP may currently be a breach of contract which might conceivably lead the particular ISP in question to , legitimately, disconnect the user; but it would not, as "3 strikes" would, mean that user is then sent to Internet Coventry by every ISP in the country.

Cutting off the choice of providing public wi-fi to the user on pain of banishment from the Internet, raises obvious issues itself of infringement of freedom of expression and association. Avaiability of unsecured wi-fi in public areas, say, in parks or on streets or at emergencies, is also arguably , as Schneier and co believe, a public good. Given that, it should be asked whether a proper balance is being maintained if we legislate to ban an asset of general public interest, in order to protect the legitimate property interests of one narrow commercial sector. It also raises the question of whether a wi-fi operator might be a "mere conduit" under the E-Commerce Directive, Art 12, and if so whether, in effect, strict liability for other people's misdeeds can be imposed on such operators without infringing EC law.

This point is dealt with in my powerpoint which I believe will be soon up on the relevant website along with other slides from the day. Will add URL shortly.

I think the best point raised during the day which I had not really considered at all before, was how long a general ban or disconnection after notice would last. (I think this came from Michelle Childs, but I am not totally sure.) Does a foolish upload or two by a teenager in your house mean that dad and/or mum is banned from the Internet forever? Even when we talk of true criminal sanctions (and copyright is at root a civil matter), jail terms (bar "life means life" for murder) have to be of defined length. Do we want a world where ISPs are ordered by the content industry to patrol indefinite lifetime bans from the Internet? Would legislation include provisions for appeals after a certain time and has anyone thought through the due process ramifications? The more you think about it, the more damningly flawed the whole idea is.

In France, at least, the whole process is going to be under the supervision of an independent tribunal given directions by a judge. If we do end up going down this route in legislation, the French system should be the minimum starting point for transparency and due process. I hope instead however that the UK government and BERR will, after due consideration, decide this approach, with all its capacity for disproportionate human right infringement and errors in proof and process, is not a suitable way to police filesharing, when so many other routes exist.

Phorm an orderly queue

It might easily be said that the British just love creating problens with Phorms..

Here is the press release for the FIPR official letter to the ICO on the current Phorm controversy. It has my full support as a lucid and explanatory response to a pressingly potential worrying incursion into consumer privacy (disclaimer: I am member of FIPR advisory board.)

FIPR Press Release

For Immediate Release: Monday 17th March 2008

Open Letter to the IC on the legality of Phorm's advertising system
-------------------------------------------------------------------

The Foundation for Information Policy Research (FIPR) has today released
the text of an open letter to Richard Thomas, the Information
Commissioner (IC) on the legality of Phorm Inc's proposal to provide
targeted advertising by snooping on Internet users' web browsing.

The controversial Phorm system is to be deployed by three of Britain's
largest ISPs, BT, Talk Talk and Virgin Media. However, in FIPR's view
the system will be processing data illegally:

* It will involve the processing of sensitive personal data: political
opinions, sexual proclivities, religious views, and health -- but it
will not be operated by all of the ISPs on an "opt-in" basis, as is
required by European Data Protection Law.

* Despite the attempts at anonymisation within the system, some people
will remain identifiable because of the nature of their searches and
the sites they choose to visit.

* The system will inevitably be looking at the content of some
people's email, into chat rooms and at social networking activity.
Although well-known sites are said to be excluded, there are tens or
hundreds of thousands of other low volume or semi-private systems.

More significantly, the Phorm system will be "intercepting" traffic
within the meaning of s1 of the Regulation of Investigatory Powers Act
2000 (RIPA). In order for this to be lawful then permission is needed
from not only the person making the web request BUT ALSO from the
operator of the web site involved (and if it is a web-mail system, the
sender of the email as well).

FIPR believes that although in some cases this permission can be
assumed, in many other cases, it is explicitly NOT given -- making the
Phorm system illegal to operate in the UK:

* Many websites require registration, and only make their contents
available to specific people.

* Many websites or particular pages within a website are part of the
"unconnected web" -- their existence is only made known to a small
number of trusted people.

The full text of the open letter can be viewed at:

http://www.fipr.org/080317icoletter.html

QUOTES

Said Nicholas Bohm, General Counsel, FIPR:

"The need for both parties to consent to interception in order for
it to be lawful is an extremely basic principle within the
legislation, and it cannot be lightly ignored or treated as a
technicality. Even when the police are investigating as serious a
crime as kidnapping, for example, and need to listen in to
conversations between a family and the criminals, they must first
obtain an authorisation under the relevant Act of Parliament: the
consent of the family is not by itself sufficient to make their
monitoring lawful."

Said Richard Clayton, Treasurer, FIPR:

"The Phorm system is highly intrusive -- it's like the Post Office
opening all my letters to see what I'm interested in, merely so that
I can be sent a better class of junk mail. Not surprisingly, when
you look closely, this activity turns out to be illegal. We hope
that the Information Commissioner will take careful note of our
analysis when he expresses his opinion upon the scheme."

CONTACTS

Nicholas Bohm
General Counsel, FIPR
01279 870285
nbohm@ernest.net

Richard Clayton
Treasurer, FIPR
01223 763570
07887 794090

NOTES FOR EDITORS

1. The Foundation for Information Policy Research (http://www.fipr.org)
is an independent body that studies the interaction between
information technology and society. Its goal is to identify
technical developments with significant social impact, commission
and undertaken research into public policy alternatives, and promote
public understanding and dialogue between technologists and policy-
makers in the UK and Europe.

2. Phorm (http://www.phorm.com/) claims that their "proprietary,
patent-pending technology revolutionises both audience segmenting
techniques and online user data privacy" and has recently announced
that it has signed agreements with UK Internet service providers BT,
TalkTalk and Virgin Media to offer its new online advertising
platform Open Internet Exchange (OIX) and free consumer Internet
feature Webwise.

3. In a statement released on 3rd March the Information Commissioner's
Office (ICO) said:

"The Information Commissioner's Office has spoken with the
advertising technology company, Phorm, regarding its agreement
with some UK internet service providers. Phorm has informed us
about the product and how it works to provide targeted online
advertising content.

"At our request, Phorm has provided written information to us
about the way in which the company intends to meet privacy
standards. We are currently reviewing this information. We are
also in contact with the ISPs who are working with Phorm and we
are discussing this issue with them.

"We will be in a position to comment further in due course."

-

Reminder of March 19th filesharing conference

From Ian Brown:

Hi all - a reminder that this Wednesday afternoon we have a great
selection of speakers for our free OII/LSE event on music and copyright
(including from the ORG posse Becky Hogge, Richard Clayton, Lilian
Edwards and Wendy Grossman). Come along to find out what the government,
music industry, publishers and independent experts are thinking about
ideas like 3-strikes-and-you're-disconnected; scanning ISP traffic for
copyright works; and notice and takedown regimes.

Full programme at:
http://www.oii.ox.ac.uk/events/details.cfm?id=186

From Pangloss: apologies for radio silence. Giving 6 talks in a month while also teaching and trying to edit a book not best recipe for Constant Blogger :( I have lots to say, believe me..

More March madness , sorry, talks

Wednesday 5 March brings a joint event with the European Law Forum and ILAWS, both centres at the Law School, University of Southampton.

Professors Gerrit Betlem and Lilian Edwards will speak on “Promusicae: Fundamental Rights of File Sharers and the Enforcement of Intellectual Property - EU and IT Perspectives.”

Staff Common Room of the Law Building on Highfield Campus, University of Southampton, 1-2pm. Contact me if you want details. This is an informal seminar but all welcome.

Materials: the ECJ’s judgement in Case C-275/06 of 29 January 2008 and the Opinion of A-G Kokott of 18 July 2007.

Fun, file sharers and the law

Pangloss is off speaking again :

2pm-5.30pm 19 March 2008
The Old Theatre, London School of Economics, Houghton Street, London WC2

Is home downloading killing music? Should Internet Service Providers monitor customers to try and spot copyright infringement, and disconnect downloaders? Do musicians need new laws to benefit from the opportunities of the Internet?

Join us at this FREE event to debate these questions and more with leading copyright thinkers from the music world, government, consumer groups and universities. Confirmed speakers include John Kennedy (CEO of IFPI), Becky Hogge (Open Rights Group), Lilian Edwards (Southampton University), Rufus Pollock (Cambridge University) and Michelle Childs (Knowledge Ecology International). Find out more and register here.

Pangloss is talking about the role of ISPs and other intermediaries in enforcing rules against filesharing and the impact this may have on citizens, users and consumers. THis is rather fun timing given both the Promusicae case discussed here recently and this much-blogged announcement yesterday - so I will save my commentary till March :)

Facebook

Just to document the press's continuing fascination that people are indeed monitoring Facebook, Bebo etc, and that despite this, other people are still stupid enough to leave confidential information there, this piece from the Indy ...

"Just ask the 27 workers at the Automobile Club of Southern California fired for messages about colleagues on their MySpace sites; the Florida sheriff's deputy whose MySpace page revealed his heavy drinking and fascination with female breasts – and swiftly found himself handing in his badge; the Argos worker in Wokingham fired for saying on Facebook that working at the firm was "shit"; the Las Vegas teacher at a Catholic school fired after he declared himself gay on his MySpace page; the staff of an Ottawa grocery chain fired for their "negative comments" on Facebook; the 19 Northampton police officers investigated for Facebook comments; and Kevin Colvin, an intern at Anglo Irish Bank, who told his employers he had a family emergency, but whose Facebook page revealed he had, in reality, been cavorting in drag at a Hallowe'en party."

However the piece does have a new(ish) point, that worries about social network sites may shift from the obvious paedophiles, stalkers and ID thieves t more "civil" observers:

"That something as ubiquitous as social network sites (they have 13.7 million UK users) are exploited by paedophiles and other serious criminals is not surprising. Happily, the numbers affected are small. But the use of personal page content in civil disputes, divorces, employment and legal actions will affect far more of the millions now innocently sharing their thoughts and intimate moments with the online world. "

Pangloss is, as usual, almost finished an article on all this :) Send donations of spare time to allow her to complete it!!

Ps while we're at it, two interesting recent comments on the ongoing facebook/SCrabulous affair - Jonathan Zittrain here and the irrepressible Daithi Mac Sithigh here.

Stokes Law Stokes Trouble for the National ID database

I love this:

"I propose new law, to go alongside Moore's Law and Reed's Law and all of our other useful tools for doing back-of-the-envelope projections of where things will be going in the short- to medium-term. I propose Stoke's Law, which is that

as the amount of data that the government collects grows, so will the number of people who are victims of crimes that were made possible by unauthorised access to government databases.
[From Analysis: Metcalfe's Law + Real ID = more crime, less safety "

So obvious yet so profound!

Also in today's mail - FIPR report an ICM survey that 25% of the UK population now "strongly" opposed to the national ID database - up from 17% last September.

EBay to ban negative feedback by sellers..

.. but not from buyers.

This is an interesting one. A small UK study Ashley Theunissen and I did in 2005/6 seemed to reveal that both sellers and buyers found leaving feedback by far the most useful and widely-used instrument they had at their disposal for resolving and avoiding disputes on eBay. Other options such as eBay's own on line mediation and negotiation procedures or Payer Protection Schemes were by contrast barely used, and both credit card and PayPal guarantee systems were often inappropriate to the dispute in question, either because a credit card was not used or in the case of PayPal, because the many qualifications for the scheme were not met or the account had been emptied.

However much game theory work since has also shown that feedback is highly unreliable as an index of trustworthiness of sellers, at least partly because negative feedback was very rarely given by buyers who were than one time eBay users for fear of retaliation. Feedback can also be gamed by sellers by a multitude of small value transations to build a shiney feedback profile, after which a large value no-delivery fraud is undertaken. Hence the preponderance of both sellers and buyers with 99.99% satisfaction ratings on eBay. eBay has been trying to address the second problem with its "Feedback 2.0" , which allowed a more granular breakdown of how an eBay seller had acquired a certain feedback score over multiple transactions, but clearly this has not been felt to be enough to provide trustworthy guidance to buyers.

Given also the growth of eBay as a site for Power Sellers, quasi professional sellers and the like, trying to turn feedback back into a true index of the trustworthiness of a seller by restricting retaliation tactics seems like a smart move. Sellers however are of course not best pleased, according to the Beeb report. In our small survey, 60% of sellers had left negative feedback, as opposed to 40% of buyers, so this looks like a big change in practice for UK sellers. It will be ve-ry interesting to see how this pans out. is eBay trying to forestall buyers leaving for other auction sites where they feel they are more likely to get good service from buyers, or at least have a better chance of picking a trustworthy merchant?? Or is it truely as reports say trying to provide a better "customer environment"? Pangloss would love to know if anyone has more info.

In the meantime, what we continue to need is a "true" non-gameable index of cross-site reputation - something from the distributed identity stable, perhaps. So far we are at the very early attempts stage in this field - see eg QDOS from the garlik folk, where Pangloss mysteriously finds herself compared to authors, footballers and Eastenders bit actors from time to time. Still, at least it's a start..

Promusicae in the ECJ

Pangloss has just grabbed a few minutes to consider this rather important new decision from the ECJ. Basically, the European court was asked to consider if it was legal for Spanish law to require telecoms providers, ISPs etc to retain traffic data relating to users for security or crime related purposes, but not to allow the use of that law for retrieval of evidence for OTHER (civil law) purposes, most obviously their use by IP rightsholders to uncover the identities of P2P filesharers.

The key provision here is Article 5(1) of Directive 2002/58 (the Privacy and Electronic Communications Directive, amending the Data Protection Directive 1995), which requires states to pass laws to ensure the confidentiality of traffic data. There can be exceptions to this obligation under Art 15(1) , but only where necessary to safeguard national security , defence, public security, or for the prevention, investigation, detection and prosecution of criminal offences - and to prevent "unauthorised use" of the electronic communications system, as referred to in Article 13(1) of Directive 95/46.

There was some dubiety in the ECJ that this last exception covered traffic data collection to get evidence for *civil* litigation - but the court were willing to more or less go along with that one. What they weren't willing to say was that this implied laws MUST be passed requiring disclosure of personal data to safeguard the rights of litigants in civil proceedings - ie, the PECD did NOT require automatic disclosure of P2P traffic data to help out the music industry, though such laws would not violate EC law.(para 56).

Several other IP-related Directives cited generally required states to provide for procedures for disclosure of information relating to pirate goods, after "justified and proportionate" applications by aggrieved rightsholders; however these did not take precedence over the specific obligation in the DPD and PECD to protect personal data.

And most importantly, as Cedric Manara has already mentioned elsewhere, the Court finally held that, turning to fundamental rights in the EC Charter, if the fundamental rights to property, and to privacy (which appear therein, as well as in the ECHR) appear to come into conflict when EC Directived are implemented in national laws , well, then , IP does not take precedence over privacy (or vice versa): instead, national courts must "make sure that they do not rely on an interpretation of [national laws] which which would be in conflict with these rights." (para 68) Put it plainly: IP rights do not trump DP rights, says the ECJ.

In other words also - my interpretation purely, now - although the ECJ have not said that laws requiring automatic disclosure of personal data to rights holders to protect IP rights would be illegal under the PECD, a serious warning has been issued to national legislatures not to be pushed into passing such laws, without considering first if rights of protection of personal data are being taken properly into account.

In the UK, this is serious stuff. The government is currently basically trying to shove through (as per Gower recommendation no 39) a model borrowed from France under which ISPs will disconnect and bar repeat P2P infringers via BCP codes, without ever going near a court. But this is probably only the tip of the iceberg. It is no surprise that the industry would far rather have automatic disclosure via industry codes of practice than, as currently, have to go for Norwich Pharmacal disclosure. This will be a very useful opinion for lobby groups fighting such a legal or "soft law" progression.

I'll be saying more about this at a conference in March :)More details when I have them.

Bloodspell

Blogzilla remins me that if you're interested in machinima you can now listen to Bloodspell director Hugh Hancock discussing his creation with Pangloss, Andres Guadamuz and Ian Brown last November. Thanks to Fernando Barrio (Electromate)for organising the event, and to Robin Scobey for the recording!

Facebook, the holiday romance

A rather nice comment on why Facebook will be a passing fling for 2008, not the love of our life :)

IP Addresses are Personal Data - official

Brief but important note, via the Asociated Press: the EU Art 29 Working Party group working on privacy, DP and Internet search engines (notably Google) has issued an early press release.

"Germany's data protection commissioner, Peter Scharr, leads the EU group preparing a report on how well the privacy policies of Internet search engines operated by Google Inc., Yahoo Inc., Microsoft Corp. and others comply with EU privacy law.

He told a European Parliament hearing on online data protection that when someone is identified by an IP, or Internet protocol, address "then it has to be regarded as personal data." "

Some may think this an obvious conclusion, but in fact a report on Personal Data commissioned by the UK ICO office a year or two back (and very sadly, no longer available on the ICO site) revealed considerable disparity on this across Europe; in many cases whether an IP adress was regarded as "identifying" depended on context, in the view of various Information Commissioners.

The significance is crucial; if IP addresses are personal data, then services which collect IP addresses but not actual names - as Google does when it collects search terms typed in by users from IP adresses - are still regulated by DP law.

Google's privacy chief Peter Fleischer has previously insisted IP addresses are should only be seen as personal data, if it is likely that a person can be identified from an IP address . (Despite this, Google recently caved in to EU pressure and reducing the duration of Google cookies from 30 years to 2 years.) He may now have to think again, at least in Europe. This should be no surprise however, as , as Fleischer himself admits, the ART 29 Working party gave the answer as far back as 2002, that if an IP address can be connected to a person (eg by the person's ISP), then it should be seen as personal data for all purposes, including use by other companies.

The UK's current law , by the way, is in Pangloss's opinion , rather nearer to Fleischer's interpretation than to Scharr's - see s 1 of the DPA 1998. So bad news may be coming not only for Google but for UK drafters and advisers.

EBay gets to the point..

BBC Radio Oxford have kindly informed me of concern by Oxford MEP Nirj Derva about the sale of flick knives on eBay to UK teens.

"Nirj Deva MEP has called on the internet auction site EBay to ban the sale of flick-knives online, following a dramatic increase in street crime in the UK.

...Whilst it is illegal for those under the age of sixteen to buy knives, a five-second search for the word "flick knife" on Ebay.co.uk offers visitors, without any form of background or age check, the chance to buy a range of 3.75 inch Buck Protege serrated flick-knives. All "flick knives" with a blade of in excess of 3 inches are illegal under British law. "

Indeed. Under the Restriction of Offensive Weapons Act 1959, s 1 as amended in fact. It is an offense already to sell, offer for sale or expose for sale flick knives in the UK. So why do we need new laws for eBay?

Well, according to concerned MEP Deva, because although eBay UK have flick knives on their list of banned sale items, in fact you can instantly find these items on ebay.co.uk nonethless. In fact on a cursory glance as of today , 21/1/08, a search on "flick knives" on eBay.co.uk gave a zero result, not surprising as "flick knives" sub nom "switchblade knives" are one of the items banned on ebay.co.uk.

However the page conveniently points you at the bottom to results that CAN be found -on ebay.com in the USA. In fact although only two items were so indicated when Pangloss went to look, a quick direct search on ebay.com reveals many thousands of knives that look prohibitively scarey for sale to rampant UK teens (the US term of art appearing to be more often "buck" knives than "flick" knives).

The real questions which arise out of this latest apparent attempt to hit the headlines are twofold.

First, can the UK effectively legislate for ebay.com in the USA? Basically, no. Well, no, in strict law; but yes the bad PR might have an effect on US ebay prohibited listings rules (though Pangloss doubts it; and in any event US eBay already bans some forms of knives which may or may not correspond directly to UK flick blades but are damn like them - "switchblades" (which are "any knife having a blade which opens automatically (1) by and pressure applied to a button or other device in the handle of the knife, or (2) by operation of inertia, gravity, or both.") and "butterfly knives".) .

We have been here before of course, with Yahoo!, the French government and Nazi memorabilia. (Moral panics have no memory - maybe we need a directory of them, just as we have snopes.com for urban myths?) The end of the Yahoo! saga was that Yahoo! (and in fact ebay) chose to ban the sale of Nazi paraphernalia to restrict bad press, in the US as well as in Europe. But how much of a result is that in more than symbolic terms??

We all know that eBay (.com or .co.uk) "banning" an item effectively means very little. Items can be hidden in more general categories of listings (eg "folding knives") or under synonyms, and eBay does not appear to police its listings other than automatically restricting certain listings under banned categories. Right now, eg, although "flick knives" gets you zero results on ebay.co.uk, "buck knives", the US term, gets you 50 results.

The second real issue underlying here is if duties should be placed on eBay to take pro active policing (or "filtering") action, without which liability will be imposed - or if , as at present, eBay's liability should be restricted to arising only if it fails to take action on notice and take down. See passim on this blog, discussion of the E-Commerce Directive, Arts 12-15 and the puzzling question of their applicability to UGC sites like eBay.

Art 14 of the EC Electronic Commerce Directive as implemented in the UK by the 2002 Regulations of the same name, reg 19 states that:

"Where an information society service is provided which consists of the storage of information provided by a recipient of the service, the service provider (if he otherwise would) shall not be liable for damages or ... for any criminal sanction as a result of that storage where -

(a) the service provider -
(i) does not have actual knowledge of unlawful activity or information and, where a claim for damages is made, is not aware of facts or circumstances from which it would have been apparent to the service provider that the activity or information was unlawful; or
(ii) upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information, and

(b) the recipient of the service was not acting under the authority or the control of the service provider.

Thus as regards criminal liability under the 1959 Act for "sale" or "exposure" of flick knives, eBay cannot it seems , be found liable "for any criminal sanction as a result of that storage" unless it has received actual notice - a reactive NTD paradigm. Whether this is right or not in ethics, it appears to be the law. (a really interesting question might be if a victim of a flick knife attack claimed civil damages against eBay for breach of duty under the 1959 attack. Pangloss does not know enough about the English law of title to sue in statutory duties, let alone causation, to follow that one further..)

A final interesting issue is if eBay is indeed the person doing the "sale" or "exposure for sale" under the 1959 Act. As in the previous contact lens dispute, it might well be argued by eBay that the "person" who should be criminally liable is each individual seller, not eBay the intermediary platform. Again the ethics - as well as the efficacy - if not the strict law of this result may be questioned.

However there would seem to be little Parliament can do about it until and unless the E Commerce Directive is amended in its upcoming review.

Second Life bans virtual banks..

.. reports the Register.

That's only banks practicing only in virtuality - LInden dollar lenders and investors - according to El Reg - "meatspace" licensed banks are allowed to continue to operate. The reason given is that virtual banks were proving unstable due to offering riunous rates of return on invested Linden dollars.

"Since the collapse of Ginko Financial in August 2007, Linden Lab has received complaints about several in-world 'banks' defaulting on their promises. These banks often promise unusually high rates of L$ return, reaching 20, 40, or even 60 percent annualized," wrote Ken D., yesterday.

"Linden Lab isn’t, and can’t start acting as, a banking regulator," he added.

Which is interesting given a question that floated my way over the holidays: are virtual worlds , like Linden Labs, which issue widely used in-game currencies, convertible to and purchasable with real-world currencies, issuers of "electronic money"? And if hould they be regulated as deposit-taking baks are - or alternately do they fall within specialised regulatory schemes like the well-known if under-used EC Electronic Money Issuer Directive?

The EMI Directive was originally clearly intended to regulate "digital cash" issued on stored-value smart cards, as with the MOndex scheme rolled out in the early 2000s. Such schemes have never really caught on (though are arising again in the form of transport stored value cards like Oyster) - but the EMI has since been used to regulate quite different paradigms of electronic money such as the Pay pal business.

One point, as the Register notes, is that Linden Labs themselves clearly do not intend to hold themselves out as an EMI (or in the US perhaps, simply a bank). Their own terms and conditions say:

""Linden Dollars are not money, they are neither funds nor credit for funds. Linden Dollars represent a limited license right to use a feature of the simulated environment. Linden Lab does not offer any right of redemption for any sum of money, or any other guarantee of monetary value, for Linden Dollars."

On the other hand it is a notable feature of both ordinary money and EMIDir "electronic money" that it can be redeemed for face value against the issuer at any time, and this is right ("claim" according to the EMI Dir). For more erasons why 2L is probably not an EMI, see the useful chapter by Guadamuz and Usher in (ahem) Edwards ed The New Legal Framework for e-commerce in Europe.

Pangloss wonders what each virtual bank's T & C say about redemption in the event of the bank being closed down involuntarily by the platform host virtual world. The point of both banking and EMI regulation is at least partially to ensure that in the event of bank failure or closure, capital reserves must be maintained such that users at least get their stakes back. If that matter is left purely to contract however, it might be quite legal for Virtual Bank of Third Life (say) to provide that in the event of closure by platform world, all reserves are void. Or it might simply have run out of money - a run on the banks will no doubt by now already have started - as El Reg add "Linden Labs has requested that the virtual banks settle up with investors by January 22, honoring withdrawals. That should be interesting." Indeed.

If banks do not pay up and Second Life will not intervene to protect their users, relying on their stance that they are neither a money issuer nor a bank regulator - Would real space governments be prepared to get involved ? Eat your heart out, Northern Rock:)

Happy festive dispute-season and a litigational new year..

.. well what DO you wish a bunch of IT lawyers for Xmas?? World peace? An end to spam, malware and windows Vista? But then what would we do for a job??

Panglos is back from Beijing and Thailand but has not yet had time to clear all the yuan and bhat out of her purse, let alone absorb the apparently daily accounts of government departments giving personal data away with ten free gallons of petrol plus Green Shield Stamps.

Meanwhile, exposure to the street markets of Beijing, Bangkok and Phuket has persuaded her that any attempt to assert globalised IP rights against Asia ls a lost cause. Pirate DVDS of every quality from perfect to dodgy sold for c 50-70 baht - less than a pound - including Futurama, not yet out in the UK, and The Golden compass, not yet out on DVD legally ANYWHERE, yet possesed of utterly convincing cover artwork and copy.. Pangloss may have purchased some of these but only with which to thrill her classes, nota bene. Meanwhile knock off designer goods are so commonplace that frankly I came back covetous more of a Tescos set of napkins than a Gucci handbag. Dilution? Yes, I am very diluted:)

Serious Content will resume after Xmas.

In the meantime , have two nice images for the season.

One, a postgraduate class on cybersecurity I taught at the Beijing University of Telecommunications, in English, without translator (only days after producing a report accusing China of being the main player in cyber-terrorism :-). The class, all Mandarin-speaking, were attentive and excited and asked incisive questions. No developing country lag at all there. When we tried to look up something on Wikipedia and found it blocked by the Great Firewall, a student lackadaisically simply punched in a proxy server address. Censorship? What censorship?



Secondly, yesterday I was proud to attend the wedding of my PhD`student Rowena Rodrigues, herself an IT law blogger. Congratulations to Rowena and Jovito, and I hope for a long and happy marriage and bouncing baby PhD thesis in the years to come!

MI5 warn of chinese hacking theat too

Only a day after the McAfee report warned of the possibility of Chinese hackers attacking states around the world including the UK, MI5 has, unconnectedly, sent out a confidential letter warning of exactly that. the Chinese embassy has of course denied the allegations - just as they did in response to the original report.

More over at Blogzilla.

And Pangloss goes to China Tuesday to give a paper entitled "Chinese zombies or Japanese worms? What can the law do about cyber-security?". Synchronicitous times..

Meanwhile on the domestic security front, fall out from the great child benefit disc scandal continues. Contactpoint, the database to combine data on most the country's children for multi-agency communication purposes , has been put on hold for five months.

Shadow Children’s Minister Maria Miller said: "The government should also use this opportunity to see whether it really is necessary to have a database for every single child in the country, accessible to 330,000 people, given the significant amount of concern that this could overload the system and lead to a dumbing down of information.

Pangloss just turned in a somewhat critical chapter on Contactpoint for a book on social work, privacy and confidentiality; perhaps by the time it is printed it will already be a dead letter?

First, Contactpoint: next the ID Database? Watch this space.

Macafee VCR 2007

No, not VCR as in video recorder (how lo tech!) but Macafee Virtual Criminology Report 2007. (Pronounced MAC-afee. I've been getting that wrong all day, while doing 17, count em, SEVENTEEN radio interviews!) And available in English, French, Spanish, German and Italian no less.

Anyway Ian Brown of Blogzilla and myself are happy to announce the launch of a bouncing ten pound report, on a whole loada stuff including the rise of cyber-terrorism since the Estonia attacks in April; the evolving shape of malware and the cut-price cyber-market for phishing, spamming and DDOS tools, complete with customer service and on-line tutorials for budding young Russian mafiosi ; the legality of the exploit market, white and black; and, as they say, much much more..

Producing this has been a real interesting experience. I got to interview some very intriguing people, like Sharon Lemon at E-Crime in SOCA, David Vaile at AUSTLII and andrea Matwyshwn at Wharton/Penn, and security experts at places like iDefense and Carnegie Mellon Japan. I learnt an awful lot. I also got an insight into corporate politics and the PR industry which has DEFINITELY been an eye opener :-)

So have a look. You have to fill in a registration form to download unfortunately, but I'm sure you're all quite capable of unticking boxes as relevant :-p

EDIT: Hmm. China not happy. Pangloss goes to Beijing Tuesday. Pangloss not entirely happy :-)

Post Childbenefitgate - Facebook is still bad for your wealth

While the world continues to fail to comprehend how a government could casually lose the personal data of half its population by putting a DISC in the POST , my colleague Ian Brown (Blogzilla) is right to note that personal data is still just as likely to be compromised by commercial actors as government departments. And we- especially the younger part of our population - just keep giving the stuff away.

In particular the ICO has just issued a warning about the dangers for youth of giving away personal data which might well be used for identity theft on sites like MySpace, Facebook, etc.

"As many as four and a half million* young people (71%) would not want a
college, university or potential employer to conduct an internet search on
them unless they could first remove content from social networking sites,
according to new research by the Information Commissioner’s Office (ICO).
But almost six in 10 have never considered that what they put online now
might be permanent and could be accessed years into the future.

The research findings are unveiled as the ICO launches a new website at
www.ico.gov.uk/youngpeople to help young people understand their
information rights. The first section contains tips and advice on safe social
networking.

As well as not thinking ahead before posting information on the web, the
survey of Britons aged 14-21** also revealed that youngsters’ online
behaviour is a gift to potential fraudsters. Two thirds (eight in 10 girls aged 16-
17) accept people they don’t know as ‘friends’ on social networking sites and
over half leave parts of their profile public specifically to attract new people.
More than seven in 10 are not concerned that their personal profile can be
viewed by strangers and 7% don’t think privacy settings are important and
actively want everyone to see their full profile. "


Meanwhile, back at governmental data leaks, it's worth noting that the ICO was hastily given "stop and search" powers by Gordon Brown to audit government departments dealing with personal data in the immediate wake of Childbenefitgate.

But this really just isn't good enough. We desperately need decent penalty powers for the ICO - the current enforcement notice procedure is simply not adequate - but more than that, we also need mandatory security breach notification, the very measure which was strongly recommended by the House of Lords Personal Internet Security Report, and then rejected by the Government only weeks ago as completely unnecessary. And Richard Thomas, quite rightly, is calling for security breaches of this magnitude to be made a criminal offense.

Tiffany v eBay

A tip off from WOIP blog that the long awaited suit by Tiffany's against eBay for trademark infringement - basically, stocking counterfeit Tiffany goods - is about to kick off.

http://woip.blogspot.com/2007/11/tiffany-versus-ebay.html

Given recent cases in France and Germany which have tentatively pointed towards a trend towards European judges not finding the EC E Commerce Directive Art 14 a complete defense for user generated content sites, this one could be very interesting :)