Mandy and Me: some thoughts on the Digital Economy Bill

So, once more unto the breach, dear friends, once more, where the breach is of copyright of course. First a brief summary of the terrain.

Clauses 4-17 of the Digital Economy Bill introduce an “initial obligations” regime for ISPs, whereby subscribers accused of filesharing by rightsholders will be sent warnings of alleged copyright infringements, or “strikes”, by their ISPs; and a “technical measures” phase, to be green-lit only after evidence has been amassed that warnings do not work (but see below), which will allow sufficiently warned offenders who still seem not to have seen the error of their ways to be disconnected from the Internet. Traffic slowing and banning of access to certain sites eg the Pirate Bay, may also become available measures.

The Bill also, almost as an after thought, adds a “Henry VIII” clause, which allows the relevant Secretary of State (currently Lord Mandelson of Mordor sorry BIS) to make new copyright law in any area of Parts 1 and 7 of the Copyright, Design and Patents Act 1988 (CDPA), by statutory instrument (SI) not primary legislation, if justified by speed of technological developments (even ones that haven’t happened yet – see proposed new s 302A of the CDPA.) So essentially, new and important copyright laws (not exclusively to do with filesharing – DRM, fair dealing and user rights might all be affected) are to be made under the public radar, and without proper Parliamentary scrutiny. anytime, anywhere (hereafter, the “Martini clause”).

There has been a great deal of coverage of these matters – see eg here and here – so I will only point out a few matters of detail which have struck me as particularly worrying, on top of my, er, well-ventilated previous concerns about the principle of a regime of “three strikes” at all. Most of the press attention has focused on the posited disconnection regime, since of course the sanction is so far reaching. But the warnings regime, which if the Bill passes is likely to be of more immediate concern, is also staggeringly poorly drafted, and this is where my focus will lie.

Accusations and evidence

In the outline scheme we have, warnings are to be sent to subscribers solely on the say so of rightsholders. All a rightsholder need do, as presently laid out, is provide an IP address and time stamp of an alleged infringer to an ISP, and say that “ it appears to [them that ] a subscriber .. has infringed the owner’s copyright”. There is no requirement this belief be objectively reasonable. Nor is there any apparent sanction for malicious, or even simply careless or reckless allegations. Recent experience with the RIAA and BPI has shown that allegations made after IP address tracking at P2P sites often turn out to be wrong and that collecting IP addresses from P2P honeypots is a non-trivial exercise ; so the issue of liability for erroneous accusations is an important one. Libel, malicious falsehood and data protection laws may offer remedies for the falsely accused; but there is no mention of such in the Bill itself (so far), nor of any reasonable duty of care. In other words, all the power is given to rightsholders, and none of the responsibility.

“Allowing infringement”

The Bill also makes it clear that an infringement may be notified by a rightsholder if the subscriber “allowed another person to use the service and that other person has infringed”. What does “allowed” mean here? It seems clear it is intended to cover the case where an Internet service is used to download by any member of the household other than the subscriber eg by partners, children, flatmates and lodgers – but what of casual visitors, friends of children? Should such persons be routinely policed by the subscriber fearful of liability, their rooms and computers searched, guests interrogated about their laptops and smartphones? What of Art 8 ECHR guarantees of privacy (which, let us remember, apply to children as well as adults, especially in their own bedrooms)? This is however only the start. What of the school or university or business which gives access to the Internet to hundreds or thousands of people? These warnings will come to roost at their doors, or rather their IP addresses. Will we then see IBM, Oxford University and Standard Life (just say) subsequently banned from the Internet? Is it really feasible to expect such organisations to stamp out downloading among all their employees or attendees (especially given most already do their best to try) or to spend the resources on internally trying to attribute the warnings to individual employees etc?

The end of unsecured wi fi?

A connected issue Pangloss has raised before relates to wi fi. At present it is a subscriber’s choice whether to secure their wireless network or not. Despite the public panic about paedophile use etc, many still think leaving wi fi unsecured is a public service (see on this Daithi McSithigh’s excellent piece). Yet one can easily see that leaving a network unsecured will count as “allowing” another’s infringement (and note the mandatory requirement to notify alleged infringers about how to protect their wi fi in proposed new s 124(5)(f)). What we see therefore is constructive prohibition of unsecured wi fi by the back door, for both consumers, corporations and the public sector (think of the impact on digital inclusion?); a decision of huge significance, which itself deserves a major public debate.

Appeals

Appeals against allegations untested in court and based on evidence solely of one interested party, are vital. At the warnings stage, a single appeal is to be allowed, it seems, not to a full tribunal but merely to a “named person” who will be an arbiter of some type, independent of ISPs and rights holders, though not of OFCOM. Such an appeal is also vital to ensuring that this process meets the requirement of a “fair and impartial” hearing, under what was Amendment 138 to the now finalised Telecoms Package. But no grounds are named in the Bill for an appeal against an erroneous warning to be allowed (there are some in relation to the better drafted and seperate appeal against disconnection) , nor is it stated what disposal the “person” could make if an error was found to have been made. Strangely, there is not even any requirement for alleged infringers to be told of this right of appeal, even though they are required to be given an enormous number of other pieces of educational “information”. This is wholly unsatisfactory, especially in relation to Amendment 138.

Notification of warning

Finally on this part, note (see proposed s 124A (7)) that warnings are to be deemed “notified” if sent to “the electronic or postal address” held by the ISP. As someone who never uses or checks their nominal ISP-provided email address (mailto:something@virgin.net I guess) , I would strongly suggest this be altered to “and” rather than “or”. Of course this would cost substantially more to the rightsholders and ISPs, so possibly some midway solution should be found where an ISP is required to obtain a current used email address from its subscribers.

ISP liability?

ISPs hold an unfortunate piggy-in-the-middle position in all this, forced by the threat of a fine of up to £250,000 to co-operate with rightsholders, even though they gain nothing from the process but overheads and customer ill-will. I have said elsewhere that I do not think it is just or sensible to enrol ISPs as “copyright cops”, but if they are to be, they need strong protection from liability, ideally in the form of an indemnity from the rightsholders who actually plan to benefit from this whole stramash. ISPs face potential liability for sending out libellous allegations to subscribers, and again for disconnecting the wrong person on erroneous evidence, and in breach of contract, However currently all ISPs get by way of protection is the feather-light provision that an indemnity may – not must – be provided by the Code to be drafted (again, no further details now– see new s 124J(4)(b). If I were an ISP, I’d be going out now to price a shedload of legal liability insurance J - or to check out moving offshore.

The disconnection regime

Finally (gentle reader wipes brow), the present government has made a great deal of the assertion that the “disconnection” stage is a “nuclear deterrent” option – only to be implemented if all else has failed. One wonders why, three months before an election the current incumbents are likely to lose, it was not then simply left to the discretion of the next government whether to bring forward legislation, once the evidence was in. As it stands, the “disconnection” regime is supposed to be brought in, it has been widely reported, if a review by OFCOM shows (to some very vague timetable) that the “warnings and passing of ID details” approach is not working. However if you go and look, what s 124H(1)(b) actually says is that the Secretary of State may order that the “technical measures” stage may go ahead as appropriate in view of such a report OR “any other consideration”. In other words, you can forget evidence based policy making if times are tough, and donations from rightsholders are needed? Again Pangloss’s suggestion would be for that last sub-clause to go.

I could go on – for most of a PhD length thesis I suspect – but enough is enough. This legislation bears every hallmark of having been drafted in haste on the back of an envelope on a wet Tuesday. It’s so like The Thick Of It. Only without the jokes .

Ps if you are unhappy with any of the above, can I politely direct you towards http://petitions.number10.gov.uk/dontdisconnectus/ ?

Incredulity

.. is my new middle name.

The Digital Economy Bill will be released at 7.30am tomorrow and will, it seems, include not only the anticipated disconnection provisions, but also a clause to allow the Secretary of State to basically change copyright law at will in order to stop filesharing, without primary legislation and without proper public debate and democratic oversight.

Why is this?

It's reflecting the fact that technology is changing very fast," said Timms. "The existing [method] is quite cumbersome. We might need something else in the future."

So clearly every time things happen fast and the law might struggle to keep up with them, in future, well we should just junk ordinary democratic safeguards before anyone notices, and bow instead to the partisan interests who pay lobbyists the most to shout the loudest? I expect to see similar legislation introduced shortly so that SIs can be whipped out and shoved through to deal with every fast moving situation from Afghanistan to floods in Essex, banker bonuses in December and tone deaf twins winning X-Factor. Hey, democratic debate is for wimps. SOOOO last millennium.

The best thing one could say about this legislation is that it is so outrageous, it is hard to believe it could seriously have been included in the Queen's Speech if the current sadpack on the way out thought there was a real chance of getting it through before the election.

I could say a great deal more about this but I won't : Instead I'll quote in full the funniest thing on the Internet today by novelist Nick Harkaway.

"News I Made Up Which Would Arguably Be Less Bad Than The Actual News. (2)

The Business Secretary, Lord Mandelson, today announced the creation of a new post to deal with the nuanced and difficult issue of copyright in the digital era. The Batshit Tsar will have a mandate to seek out anyone, anywhere who does anything using a computer and set them on fire.

Candidates for the post include Lord Duckhouse of Cobbham, Baroness Fishwicket (formerly BPI President Martin Cleep) and Brian Dubblehand-Pryce, Witchfinder General to the Court of James I & VIth, although there is some doubt over the availability of Mr Dubblehand-Pryce, as he is believed to have been dead for four hundred years.

Civil liberties campaigners have expressed alarm at the plan to make an offense of ‘downloading copyright material’. It is unclear how anyone will be able to use the internet ever again without committing a crime. A Department of Health spokesman said this would have the positive effect of getting people out in the open air.

“The Internet is a middle class, elitist phenomenon which is ruining our atomised society with a sense of community and cooperation,” he said. “This will put a stop to that, and to the development of the nascent public sphere which has given us so much trouble recently.”

The much-debated ‘three strikes’ policy will require a massive monitoring operation, trawling through the logs of anyone who uses a high-bandwidth connection to get large amounts of data to see if they are doing anything wrong. This sort of ‘fishing expedition’ is generally considered inadmissible in court, but since there will be no court for this sort of crime, the government is confident the issue will not arise.

“If we don’t do this,” the spokesman said, “we’ll almost certainly have an outbreak of witches by Christmas. There will be rains of frogs and giant panthers in Surrey, and even my tinfoil hat will not protect me from the brainwaves of Satan which are transmitted down the tubes of the Internet by demonic monkeys. The public has to be protected.”

Lorrie Fingerhubble, of the British Association of Giant Nocturnal Lizards, welcomed the news.

“I think this is absolutely splendid,” Ms Fingerhubble said enthusiastically from her secret undersea base in Regent’s Park. “It’s ideal for the government to be able to make arbitrary, draconian changes to the law which won’t work, will cost money, and will criminalise everyone. It’s a traditional approach to law in the UK: we make a rule no one can hope to obey and then prosecute people when we want to but not otherwise, creating a sense of lurking guilt and suspicion at all times!”

Asked whether the law might conceivably be misused to stifle democratic debate or to spy on people, the government spokesman said:

“Antelopes.”

here we go, here we go..

The Digital Economy Bill is nigh:

"Digital economy bill

Ensuring a world-class digital future following the Digital Britain White Paper , published on 16 June 2009, setting out the Government's ambition to secure the UK's position as one of the world's leading digital knowledge economies and take forward a new, more active industrial policy to maximise the benefits from the digital revolution by:

• delivering a universally available broadband in the UK by 2012 through a public fund, including funds released from the digital television switchover help scheme;
• giving the sectoral regulator, Ofcom, two new duties: first, to promote investment in infrastructure and content alongside its duties to promote competition; and second, to carry out a full assessment of the UK's communications infrastructure every two years; to ensure that the UK has a first class and resilient communications infrastructure;
• establishing the necessary enabling powers for new commissioning bodies providing strong multi media news in the Nations, regionally and locally and update the Channel 4 Corporation's remit. This would help create the environment for continued investment in, and creation of, high quality and innovative content, including necessary changes in relation to public service broadcasting;
• ensuring that all national broadcast radio stations are digital from the end of 2015, by making changes to the existing radio licensing regime to enable digital coverage to be extended, encourage investment by the commercial sector, alongside the BBC, in new digital content, and revise the existing regulatory and multiplex licences;
• creating a robust legal and regulatory framework to combat illegal file sharing and other forms of online copyright infringement and give Ofcom a specific new responsibility to significantly reduce this practice, including two specific obligations on Internet Service Providers: the notification of unlawful activity and, for alleged serial-infringers, collation of data to allow rights holders to obtain court orders to force the release of personal details, enabling legal action to be taken against them;
• implementing the recommendations of the Byron Review published in June 2008, to put age ratings of computer games on a statutory footing for ratings of 12 years and above. This will be achieved through the adoption of a new and strengthened system of classification for boxed video games with a strong UK based statutory layer of regulation, ensuring protection for children."

Well, hmm. .. see the emboldened section.. and no third obligation, to disconnect repeat offenders? I very much doubt it's been dropped - but it's interesting not to see it there..

Pangloss sees no full text of the Bill via Google - if it is out there, could somone point me at it?

Now we wait to see which happens first, the end if the world by Holywood apocalypse or the end of New Labour by election :-)

Privacy and Facebook, IGF style

My esteemed colleague Ian Brown of the OII has been off presenting our joint research on privacy and saocial networking sites at the IGF in Egypt (lucky dog!)

The updated powerpoint can be found here.

New DP blog

Another useful discovery - DP Thinker - Pangloss isn't sure to whom we owe the pleasure though. Of course it's clearly a matter of privacy :-) but anyone want to own up?

Lisbon Treaty We Salute You

I almost thought I would never live to see the day but yes the Lisbon Treaty has cleared its final hurdle and will become European law possibly in December 2009.

It's all rather a damp squib for a UK privacy lawyer though. (Even one who is healthily sceptical that the Tories can get us out of this one, even when they do get in.) Pangloss's main interest was in wondering if the EU Charter's explicit addition of a right to protection of personal data as well as the well known right to respect for private life (cf Art 8, ECHR) might make a difference and if so, in what way. However for we delicate flowers of the UK and Poland, there will be no change on the human rights front: see Art 1 -

In particular, and for the avoidance of doubt, nothing in Title IV of the Charter creates justiciable rights applicable to Poland or the United Kingdom except in so far as Poland or the United Kingdom has provided for such rights in its national law.

Pangloss is sadly no EU law nerd, and would welcome comment from any such out there as to whether this means we are in any way likely to receive less comprehensive privacy protection than the rest of the EU? Examples? This seems particularly relevant given the general feeling that the UK is implementing EC DP law at the minimum or below : see the EU's continuing efforts to persuade the UK to buck up over Phorm, not to mention long-simmering confusion or dismay over (a) Durant v FSA and (b) relatedly, our lack of sync with the Art 29 WP as to when and if to treat IP addresses as personal data.

It also of course means the UK remains unbound, at least in theory, by Article 36 of the Charter of Rights on Access to services of general economic interest. So no danger of the UK fast following in the footsteps of Finland and declaring access to broadband a human right? Surprising, that :-)

However before we Anglo-Saxons despair, we should remember the guidance from the ECJ in Promusicae which indicated that whether signatories or not and whether (as seemed uncertain at the time) the Lisbon Treaty ever became binding, the principles of the Charter of Rights are still likely to be regarded as part of EC law in the guise of underlying "general principles of Community law".

Death, assets and virtual worlds

I'm briefly quoted in this timely article in the New York Times on virtual assets and what to do with them after death.

TalkTalk vs Mandy??

Two days ago Pangloss, commenting on Mandelson's newly elaborated plans to introduce a UK "3 Strikes", added;

Interesting thought from Twitter: "if my business was cut off for allegedly downloading illegally I'd be looking for someone to sue". Will any legislation have an immunity in it for ISPs a la the US DMCA? If not, start lobbying NOW, ISPs.."

This thought (which turns out to have originated from the helpful @futureidentity, aka Robin Wliton) seems to have occurred fairly swiftly to others too... According to the Grauniad, today:

TalkTalk, the second largest internet service provider in the UK, has threatened to launch legal action if business secretary Peter Mandelson follows through with his plan to cut off persistent illegal filesharers' internet connections.

Carphone Warehouse-owned TalkTalk, which has more than 4 million ISP customers and owns the Tiscali and AOL brands, claimed the government's plan was based on filesharers being "guilty until proven innocent" and constituted an infringement of human rights.

"The approach is based on the principle of 'guilty until proven innocent' and substitutes proper judicial process for a kangaroo court," said Andrew Heaney, the executive director of strategy and regulation at TalkTalk. "We know this approach will lead to wrongful accusations."

While the liberal blogosphere has on the whole greeted this news with unrestrained enthusiasm (Twitter is full of it), Pangloss is a litle sceptical as to whether it is any more than self-seeking good-PR sabre-rattling.

Firstly, what exactly is TalkTalk's title to sue here? Surely not anything mentioned in the interview above. The breach of human rights, if any, will surely be of the subscribers, not the ISP. Any wrongful accusations without due process will similarly be directed at users, not the conduit.

TalkTalk's (or any other ISP's) real worries seem obvious :

(a) the threat of being sued by aggrieved users for everything from breach of confidence, to acessory to false accusation, to co-publisher of a libel, as well as of course for breach of the actual contract for Internet services; and

(b) the costs of being involved in Mandy's Great Scheme, both in terms of actual money and loss of customer goodwill. The Guardian also usefully reports today that according to BT and Carphone Warehouse (ie TalkTalk) , Mandy's scheme might costs £420m pa, to be shared evenly between rightsholders and ISPs (and, incidentally, to solve an estimated loss to the music industry of half that - c £200m pa.)

These figures make it clear the latter is the real issue, not human rights, nor liability to customers. In fact, most ISPs will have extensive exclusion from liability clauses in their subscriber contracts already - although these may well be subject to challenge under the Unfair Terms Regulations and /or UCTA and thus unenforceable.

So what would be the ISP's actual grounds for an action? No one has a right in this country simply to dispute a statute because they don't like it. Victims of a human rights violation - an unlawful act under s 7 of the HRA 98 - may indeed question the validity of a statute in any domestic proceedings, though under HRA 98, no UK court has the right to strike down legislation, merely to make a declaration of incompatibility, leaving it to the governement then to sort out what the hell to do.

Is TalkTalk itself a victim of any ECHR or HRA human rights violation? I don't see how. (Indeed it was once controversial if a juristic person could suffer a human rights violation - though this now seems to be accepted in some cases.) What they might argue is the rather muzzy domestic law tort that the government has interfered with their business contracts. This would be controversial (doesn't a government have the right to do exactly that? case law mainly concerns dirty practice by commercial competitors) and would attract considerably less public sympathy of course.

Another more plausible line of attack would be that any legislation was in breach of EC law forbidding ISPs from being required to generally monitor the public under art 15 of the E-Commerce Directive - although this has not stopped the French passing HADOPI - twice :-)

Pangloss is glad to see ISPs like TalkTalk, whom she has always regarded as being stuck between a rock and a hard place in this matter, coming out firmly against Mandelson's proposals and even gladder to see them endorse her own arguments that 3 strikes is likely to be in breach of ECHR guarantees of due process and privacy. But frankly - sue Mandelson? Oh come on, as someone else might say...

Google Street View

Just discovered this wonderful Pixar-esque video of how Google Street View protects privacy. If only life was really like this!!

Mandelson ploughs on

Pangloss feels compelled to report on yesterday's doings at the C&binet meeting (stupid name..)

The Beeb reports Mandelson as follows:

"

I have no expectation of mass suspensions. People will receive two notifications and if it reaches the point [of cutting them off] they will have the opportunity to appeal," he told the audience at the C&binet Forum, a talking shop set up by government to debate the issues facing the creative industries.

The pay-off for tough penalties against persistent file-sharers would be a more relaxed copyright regime, Mr Mandelson said.

The details of it would need to be hammered out at European level but it would take account of the use of copyright material "at home and between friends", he said."

So to state the bleeding-edge obvious:

- 3 strikes will be rubber stamped quickly by Parliament (it'll need to to avoid the end of the Labour regime); getting changes through the EC on fair use/fair dealing will take 2-6 years - if it happens at all. Some trade off.
- Still no detail on whether disconnection will require judicial oversight let alone a court order. Silence plus the enforced clamp down in the European Parliament on Amendment 138 would rather indicate not. It will be administarative fiat to cut off, with the onus placed on consumers, probably without legal aid, to appeal to the courts. This is so not natural justice.

As`Jim Killock of ORG noted:

"Even MI5 disagree with Mr Mandelson - they are convinced we will see a rise of a 'Dark Net' of infringers. Nobody at C&binet from an online music service, as opposed to an old media company, thought that peer-to-peer [file-sharing] was a threat to their businesses."

Same old same old..

Interesting thought from Twitter: "if my business was cut off for allegedly downloading illegally I'd be looking for someone to sue". Will any legislation have an immunity in it for ISPs a la the US DMCA? If not, start lobbying NOW, ISPs..

Pangloss has a lodger who for all she knows downloads night and day on the house wi fi. Will it become my responsibility to interrogate her and if necessary demand access to her computer? Hello DDR..

Death and Facebook

Ok back to business as usual..

Pangloss is always pleased to see things she's been lecturing about for a year turn into reality, and here comes one again. Facebook have decided to formalise the procedures they already, to some extent had, for "memorialising" the profiles of users who have become deceased. The Grauniad reports:

"When someone leaves us, they don't leave our memories or our social network. To reflect that reality, we created the idea of 'memorialised' profiles as a place where people can save and share their memories of those who've passed," explained Max Kelly, Facebook head of security, on the company's blog.

But what does it mean, that an account gets "memorialised"? The contact information and status updates are removed, and the profile is set private. No one can log into it any more. Only Facebook friends can locate the profile via search and leave posts on the wall for remembrance."

Although neither the Guardian nor Facebook mention it, it seems likely this too is a response to the recent demand by the Canadian Privacy Commissioner that FB put their house in order. But is this really the best option, or the only alternative (as it has been presented) to deletion by default?

As Pangloss has suggested before, is it not really up to the user themselves if they wish to see their site "memorialised", or if they feel this might be mawkish and upsetting? Would it not be better and indeed simpler for FB to provide a preference switch for the user to say in advance what they want, rather than relying on the impetus of the family to make a choice on death? And what if the user leaves a wish in their will which conflicts with what the family say to FB - will anyone have an interest to intervene?

Another problem, which the Guardian has also spotted, is that FB has simultaneously rolled out a "Reconnect" feature which encourages users to get back in touch with friends they've lost touch with. From FB's company blog, one user comment exposes the problem:

"hey i don't know if you read all of these, but facebook has suggested that i "reconnect" with two friends in the last two days, both of whom died over 18 months ago. please, please, please stop this as it is disturbing and creepy."

Er, yes. Oops?

Pangloss wonders bye the bye if is coincidental these changes have been made fairly shortly after the Jewish New Year and the Day of Atonement (Yom Kippur) when one remembers the dead and gone .. a connection recently made by Jewish Week who interviewed Pangloss a month back on this exact matter. The idea floated there that eulogy posts on FB memorialised profiles are a sort of collective post death mourning in these godless times, is an interesting and slightly scarey one. How long before FB goes 3D and starts offering an optional virtual funeral with avatars of deceased and friends? (And what adverts would they sell alongside??)

Pangloss herself is laid up right now with a bad back, by the way, and definitely feels after all this like she has one foot in the web 2.0 grave..

A sad but True Tale of Non-Honest Non-Chartered Accountants

This is a bit of a departure from normal practice. But what after all is the point of running something as self indulgent a waste of time as a blog if you can't use it (a) to vent a bit and (b) to provide public service information? :)

Pangloss is not unbusy - perhaps a mere gnat by comparison to the Masters of the Universe of Olswangs and Clifford Chance and perhaps even Queen Mary, but, even so, kinda busy you know. So for a number of years her practice has been to pay someone to prepare her self assessment tax return in January. Many moons ago, she noticed a quiet but well appointed outfit called Gillespies Accountants conveniently situated on Edinburgh's Lothian Road which boldly advertised flat rate self assessment. Inside was an aged retainer who revealed to Pangloss (who actually had a first career as a tax editor but it was mainly about CTT which had more or less been abolished so no bloody use) the glories of capital allowances, taking off money for the home office, and generally managing to secure far more in tax savings than he cost. Pangloss was entranced and became a regular. The procedure was simple: dump an envelope of receipts and invoices on his desk, come back in a couple days, and write a cheque to the IR , left to be sent who knows where, and a cheque to Gillespies. Short, swift and satisfying.

Several years later, Pangloss re arrives in Auld Reekie and around the post festive time, searches out her benefactor. Alas, he has gone to the great accounting firm in the sky. But lo, Gillespies still exists, albeit in far less convenenient premises in the middle of the giant hole in the road formerly known as Haymarket. Miracle! she breathes, and hastens thereto (performing several illegal left turns). The place is a post festive Marie Celeste, inhabited by one young and extremely distracted looking accountant called Campbell Walker who is a bit like the manic depresive insane patient David Tennant played in his very first role in Taking Over The Asylum. But ne'er mind, looks aren't everything right? And they'rer still (fairly) cheap.

So receipts are unbundled all over the desk and Pangloss flees merrily unburdened before her car is towed away, and then comes back again, braving icy weather, bagpipers and lost haunted buses, to sign the forms, and sign a cheque to HMRC and Gillespies and escape again. Phew.

Now imagine her surprise when some eight months later (because the post is decrepit and at least one letter had clearly never made it to her new temporary address with its communal postie area) she discovers that (a) her tax was never paid and (b) the HMRC are now charging a hefty surcharge for late payment with threats of sending the boys round. Imagine her surprise at having thought professional accountants she had paid to do this might have managed to send off a cheque in time. Imagine her not surprise at discovering Gillespies have nonethless long banked the cheque she wrote them. Imagine her not surprise redoubled at discovering that no cheque had indeed been processed by HMRC at the right time. Imagine also her consternation at not having kept her old cheque book because come on guys, cheque factories are closing down all over Britain they're so twentieth century and Pangloss looks everything up on RBS's very efficient online direct banking these days.

And imagine further her surprise on ringing Gillespies, and after ooh, only a two week wait on an urgent enquiry, being directed to the Eminence Grise Senior Partner (think Wolfram and Hart here) receiving not an apology, not an explanation, and certainly not an offer to pay the surcharge, but instead a denial of all knowledge of any cheque, or having lost one , or having not asked for one when one was needed, and a thinly disguised accusation (by someone who's very clearly seen too many cop shows) of it all being NOT ONLY some kind of elaborate fraud to gain a princely sum of about £200, BUT ALSO, ABSOLUTELY, HER OWN FAULT for being one of the people who dared to get their self assessment done - for money - at the last minute.

Pangloss was so perplexed she almost didn't manage to point out that THIS WAS HOW GILLESPIES M ADE MOST THEIR MONEY.

And so to the Web. Strangely Gillespies have no website so Pangloss cannot name and shame the Senior Partner she spoke to. Let's call him CrackerPot. Nor, it turns out, are they chartered accountants. or members of ICAS. Which means they have no regulator to report them to. Unlike lawyers, you can call youself "accountant" it seems and not be part of any professional body. In fact, they are in fact as duely accredited as any other self respecting homeopath, clairvoyant or witch doctor.

Pangloss feels very stupid. But if I didn't know this stuff, how in **'s name is an ordinary member of the public meant to? And is it not some kind of major failing in the 8 million, 342,000 consumer protection laws we have now that calling yourself "Accountants" involves no professional regulation of any kind?

Would anyone out there like to do some pro bono work in professional negliegence for grateful academic? :-) Alternately just pass this on, and if you live in or nearabouts Edinburgh please do NOT risk the attitude I befell - choose life, don't choose Gillespies. Please pass on!

Oh dear

Via b2fxxx. comes the news that the Council has indeed shoved through the deeply unsatisfactory compromise version of Amendment 138 to the Telecoms Package over the , well not quite dead but fatally wounded body of the European Parliament. Sez Ray:

"La Quadrature du Net are unhappy with the revised version of amendment 138 to the telecoms package agreed by the Council and representatives of the EU parliament.

"Yesterday, representatives of the European Parliament, an institution that ordinarily prides itself for protecting human rights at home and abroad, decided to surrender to the pressure exerted by Member States. The Parliament gave up on amendment 138, a provision adopted on two occasions by an 88% majority of the plenary assembly, and which aims at protecting citizens' freedom in the online world. Instead of ensuring that no restriction to Internet access would be imposed without the prior ruling of a judge, amendment 138 will instead be replaced by a weak provision1, that does not carry any new important safeguard for citizen's freedoms.

The European Parliament, who regularly boasts itself about its credentials in the field of human rights, has endorsed the false idea that it had no power in protecting their constituents' rights under current rules. This decision was taken consciously by rapporteur Catherine Trautmann, in order not to risk a confrontation with the Council of EU and to quickly finish with the Telecoms Package. She, along with the rest of the Parliament delegation deliberately ignored existing texts and case law pointing to the fact that it had the competence to adopt the core principles of amendment 1382. They didn't even try to reword the original amendment in order to preserve its initial objective."

Thanks Ray for the update. This is depressing but largely expected. Sigh.

The new text reads as follows, according to La Quadrature:

"3a. Measures taken by Member States regarding end-users' access to or use of services and applications through electronic communications networks shall respect the fundamental rights and freedoms of natural persons, as guaranteed by the European Convention for the Protection of Human Rights and Fundamental Freedoms and general principles of Community law.

Any such measures liable to restrict those fundamental rights or freedoms may only be taken in exceptional circumstances and imposed if they are necessary, appopriate and proportionate within a democratic society, and shall be subject to adequate procedural safeguards in conformity with the European Convention for the Protection of Human Rights and Fundamental Freedoms and with general principles of Community law, including effective judicial protection and due process. In particular, any measures may only be adopted as a result of a prior, fair and impartial procedure ensuring inter alia that the principle of presumption of innocence and the right to be heard of the person or persons concerned be fully respected. Furthermore, the right to an effective and timely judicial review shall be guaranteed.

This shall not affect the competence of a Member State, in conformity with its own constitutional order and with fundamental rights, to establish a requirement of a judicial decision authorising the measures to be taken."

This is at least slightly better than one earlier version of the compromise amendment Pangloss saw (which may explain the cave) . But the sting in the tail is the last para. Clearly by implication for some member states , of a certain constitutional tradition (which, one wonders? could it include France? and perhaps the UK?), a "proper" judicial decision will not be necessary before disconnection, no matter how much flannel is in the previous para.

"Effective judicial review" at end para 2 also makes it clear that any right to a prior court order before disconnection has vanished, leaving only post factum appeal (which in light of consumer ignorance, and inertia, and the costs of proving someone messed up on IP identification is an almost meaningless remedy for the masses).

Oddly the Register today merely reports that the Telecoms package has to be settled before end year or fall entirely, which left six weeks to negotiate, and suggests

"The Council and Parliament are [still] in disagreement over a clause in a Commission-proposed reform package for telecoms regulation which would stop internet users being cut off for alleged file-sharing without a court's authority."

Can someone confirm the Quadrature de Net version of events?

EDIT: the all-knowing Monica Horten also seems to report confusion as to whether this text has actually been accepted.

EDIT 2: Surely there is a Downfall mashup out there about amendment 138 by now? This has to be the last days in the bunker..

Security theatre FTW

I must try this en route to the RUSI CyberSecurity Conference I'm speaking at on Thursday:)

New UK Internet Libel case coming?

Thanks for the heads up from @loveandgarbage (c/o Twitter) for the following news from David Osler, author of Dave's Part, who is facing libel action from Tower Hamlets Tory activist Johanna Kaschke, following a post on this blog in 2007. She is also (says Dave) suing two other Labour Party members, Alex Hilton and John Gray, over related issues.

"The uncontested facts here are that Ms Kaschke, as a student and member of the centre-left SPD in her native Germany in the 1970s, helped to organised a benefit concert for Rote Hilfe, an organisation officially designated left-extremist, designed to raise funds for the legal fees of Baader-Meinhof Gang suspects; that she was herself subsequently arrested on suspicion of terrorism; and that she spent several months on remand, after which she was released and compensated for unfair imprisonment.

It is further uncontested that Ms Kaschke nominated herself as Labour candidate for Bethnal Green & Bow in 2007; that she received just one vote; that shortly thereafter she defected to George Galloway's Respect party; shortly after that, she joined an as-yet-unspecified Communist Party; and that shortly after that, she became a Conservative. She was, in other words, a member of four political parties in 12 months.

Interestingly, the jury will be asked to rule on whether or not it is libellous to call somebody 'one cherry short of a Schwarzwalderkirschtorte'. Not my words, but those of a reader, left in the comments box. If I lose on that point, the consequences for internet freedom of speech are clearly considerable."

Remarkable, and not just for the linguistics (German cookery experts are invited to elucidate me on the exact translation).

Sites such as the BBC , Yahoo! etc have of course long worried about the liability implications of comment sections on "live" blogs whether moderated or unmoderated. It seems well settled that a host site owner can be liable for publishing the defamatory remarks of commenters. It is equally well settled however that under both Defamation Act 1996 s 1 and the EC E-Commerce Directive Arts 14 and 5, defences are open to hosts in respect of content posted by another.

The interesting point here is I think about the quality of the quoted comment. The English courts have so far, rather admirably, taken a fairly robust attitude towards too quickly attributing the quality of libel to remarks made in the typical hasty cut and thrusts of Internet babble. Most notably in Sheffield Wednesday v Hargreaves [2007] EWHC 2375: particularly

It seems to me that some of the postings which concern the Claimants border on the trivial, and I do not think that it would be right to make an order for the disclosure of the identities of users who have posted messages which are barely defamatory or little more than abusive or likely to be understood as jokes. That, it seems to me, would be disproportionate and unjustifiably intrusive. The postings which in my judgment fall into this category are those numbered 4 ("xdanielx"), which is only capable of being argued to be defamatory by devising a frankly implausible meaning, 7 ("Foot04"), which is barely if at all defamatory of the Second Claimant, 8 ("southy") and 14 ("cbrbob"), both which in my view are plainly intended as jokes and would have been unlikely to be taken seriously, let alone understood in the senses for which Mr Eardley argued, and 10 and 11 ("paulrs") which I regard as no more than saloon-bar moanings about the way in which the club is managed, rather than a serious indictment of grave mismanagement. In my view the same is true of 6 ("Auckland Owl") and 12 ("danksy"), which add to the mix a smidgeon of personal abuse of a kind which I would have thought most unlikely to be taken seriously. I take a similar view of the posting numbered 2 ("DJ Mortimer"), which is no more than mildly abusive and is fairly plainly comment.

1. The postings which I regard as more serious are those which may reasonably be understood to allege greed, selfishness, untrustworthiness and dishonest behaviour on the part of the Claimants. In the case of those postings, the Claimants' entitlement to take action to protect their right to reputation outweighs, in my judgment, the right of the authors to maintain their anonymity and their right to express themselves freely,

Thuis was of course however an action for discloure of the identity of the commenters by Norwhich Pharmacal orders , not an actual action on liability.

But see also Smith v ADFN , misreported as Adven in Edwards and Waelde 3rd ed, oh dear.

Here Eady J took possibly the firmest imaginable stance in discouraging libel actions re mere "vulgar abuse " (eg a description of plaintiff in comments as "a destructuive twerp")

The question on which I need to focus next is whether there has been persistence with regard to claims that can properly be characterised as "totally without merit". If so, I could come to the corresponding conclusion that his present application to lift the stays would to that extent also be totally without merit. I have rehearsed above a number of examples where claims have been made in respect of postings which are so obviously, in their context, either mere vulgar abuse or fair comment (sometimes both). There are also examples of a converse and corresponding interest in the subject-matter, for various reasons, such as to give rise to occasions of qualified privilege.

1. I referred to common themes in the postings, such as that of "bullying" other users and making "threatening demands" for money. That is classic fair comment territory and, in the light of the modern authorities, it is inconceivable that a jury would find any of those who expressed such a view "malicious" – let alone all of them. Opinions may be expressed in exaggerated and strident terms; the only requirement is that they be honestly held. It is fanciful to suppose that any of these people did not believe what they were saying. Even if they reached their conclusions in haste, or on incomplete information, or irrationally, the defence would still avail them. It would be wasteful to let proceedings go forward merely on the footing of a series of formulaic assertions to the effect that the individual concerned did not honestly believe what he was saying. There is accordingly no realistic prospect of any such claims achieving the only legitimate goal of vindicating reputation.
2. I would not suggest for a moment that blogging cannot ever form the basis of a legitimate libel claim. I am focusing only on these particular circumstances. It does seem to me appropriate to characterise these claims as totally without merit. I will therefore make an extended civil restraint order, which means that Mr Smith cannot launch any further libel proceedings arising out of the Langbar matter based upon bulletin board blogs without obtaining my written permission."

These remarks are technically obiter in relation to Osler's case as the issue in Smith was the maintenance of injunctions rather than a finding of libel. However in relation to the comment post in particular, in short, I do not think Mr Osler has much to worry about :-)

What Twitter is For # 102

Via Matthias Klang:

Phishing Continues to Soar

Via OUT-Law and Future Identity

"The number of phishing attacks on online banking systems has risen by 26% in the first half of this year. Phishing is the technique that was used to uncover the tens of thousands of Hotmail, Google Mail and Yahoo! Mail passwords revealed this week.

Phishing is the practice of creating fake versions of websites and asking users to enter their login details. Those details are then stored so that they can be used on the real sites.

It was revealed last week that more than 10,000 users of Microsoft's Hotmail service had had their details harvested by phishing attacks. They were then published online. It emerged this week that a similar problem had emerged in relation to the details of users of other web mail services such as Google Mail and Yahoo! Mail."

Pangloss has long predicted that rises in phishing will inexorably lead to banks becoming more and more reluctant to pick up the can , and instead imposing fault based filters on recompense. Should regulation in this area more effective than the current Banking Code not be part of the general reconsideration right now of the duties as well as profits of banks? Hmm. It will be interetsing also to see what constraints the new Payments Directive imposes. AS Future Identity points out, banks gain at least as much from a working and trustworthy online banking system as they lose, given the rundown in high street banking services.

Oh Lily, Don't be Silly

(via Boing Boing) This open letter to Lily Allen, set to the tune if one of her own songs is rather endearing. I don't agree with this all-out anti all music IP stance, but I can imagine this being fun to kick start a debate with my students in a few weeks time, as it's surprisingly well argued..



ps I like Lily Allen's work too and own actual copies of both her CDs to date..

.. and the unbearable addictiveness of data

This piece from the Guardian about information overload addiction is so relevant to I suspect 105% of my audience I'm just going to quote most of it (originality is so last millennium):

"...In case you got sidetracked and didn't get a chance to read the rest, here are the cold, hard facts:

• A study found that once workers were interrupted by an email it took on average 24 minutes to return to the suspended task.

• 2,300 employees judged nearly one third of the emails they receive to be unnecessary, but spend two hours a day processing them.

• Research reported that the IQ scores of people distracted by email and phone calls fell from their normal level by an average of 10 points – twice the decline recorded for those smoking marijuana.

To be honest I had to go and sit in a dark corner without the ring of a phone in earshot or flash of a computer screen in sight in order to concentrate for long enough to bring you this blogpost, and even then it was tough. How we get anything done is a miracle.

But before your attention wanders elsewhere, please confess the tendencies you have noticed in yourself that may be symptoms of this very modern malady. Perhaps you are raising a BlackBerry orphan, or can't remember the last time you finished reading a novel."

Right I'm of to re-check Facebook, Blogger, Twitter, Out-Law and LiveJournal :-)

The Unbearable Cynicism of Being

One strange side effect of Law and the Internet 3rd edn coming out has been that the geeks have noticed a law book has an XKCD cartoon on the cover. I was pretty pleased when a friend of that persuasion passed me a link to Reddit.com where someone had kindly started a thread called "Probably the best front cover for a law book you wil ever see.. xkcd!"

I was less pleased though when reading down I found a bunch of people had independently assumed we had stolen the cover, ie used it without permission from Randall Munroe, the creator of XKCD. It seemed the joy of imagining a law book containing chapters on copyright on the Internet had pointedly ripped off an actual IP creator, outweighed the inherent utter unlikeliness of such a tactic. The fact that I'd written here in easily Googleable form about how delighted I was that we'd been given permission also didn't stop some doubters (though to be fair, a minority).

So when I posted to say that yes, actually we had permssion, and Randall had given us it for free, what a sweetheart! I thought everyone would be relieved. No, that merely provoked A`N Other geek, no doubt pissed off a losing sight of an easy target, to post under my own name, ("theRealLilian Edwards") saying I'd lied about this in public. Meanwhile someone else posted, after I had made my correction, asserting that the legality was still in doubt. (EDIT: now amended, ta.)

It's this sort of thing writ large that gives geekdom and the blogosphere the bad reputation it has with people as diverse as the Daily Mail and my mum. I know on the scale of things this hardly compares to being pursued by dubious paparazzi making up lies about one's love life, but it left a bad taste in my mouth. I am, as I usually say, at least part-geek myself, and this cover was in a way my gift to myself and the geek community. It has thrilled me to use it. I was hurt people could think we could be so stupid and malevolent as to use it without consent.

Andres Guadamuz spoke eloquently about technophobia at GikII Amsterdam , one of his prevailing themes. The usual reasons that get cited as to why people react to a technological society badly are a combination of ignorance, fear of change and media manipulation. To these I would add that geek culture - and much of web 2.0 culture - is a product to a large extent of the Asperger's spectrum and leans towards the tactless, rude and pointlessly combative. This is fun when you're in your teens and twenties, less later on when life is already too full of the stresses of work, mortgages and parking fines to want to get a blast out of a right-on hardcore flame war in your leisure time. Politeness and forethought become the new anti-authoritarianism.

Matthias Klang says on Twitter he's writing a chapter on web 2.0 and integrity. I'm beginning to be tempted to write something on web 2.0 and social dysfunction myself..

Google 1: Luxury Brands 0!

Pangloss is pretty bushed after the excellent SCL Policy Forum (thanks to co-chairs Chris Reed, Judith Rauhofer, and gracious hosts Herbert Smith) but just has to bring this breaking news; the Advocate General's opinion has come out (via Joris Hoboken), in the hotly awaited ECJ reference in Luxury Brands plc (OK, see real parties below) vs Google, on whether Google is liable for trademark infringement as a result of its keyword based "AdWords" service. The meat of the opinion is that Google is not liable for selling keywords to advertisers which correspond to trade marks owned by others, since the use of the TM, such as it is, is restricted to the relationship between Google and the advertiser, and is not aimed "outwards" at the user, thus not causing customer confusion.

TM lawyers will have plenty to say on that part but for Pangloss, the real excitement is what this says about search engines as immune or liable intermediaries under the EC Electronic Commerce Directive. The AG opinion (available in full now, since I started writing!) is not binding on the court but often predicts the likely result :

Advocate General’s Opinion in Joined Cases C-236/08, C-237/08 and C-238/08
Google France & Google Inc. v Louis Vuitton Malletier, Google France v Viaticum & Luteciel and Google France v CNRRH, Pierre-Alexis Thonet, Bruno Raboin & Tiger, franchisée Unicis

"..Mr. Poiares Maduro also rejects the notion that Google's actual or potential contribution to a trade mark infringement by a third party should constitute an infringement in itself. He opines that instead of being able to prevent, through trade mark protection, any possible use – including many lawful and even desirable uses –, trade mark owners would have to point to specific instances giving rise to Google’s liability in the context of illegal damage to their trade marks. [bold added]

In this context, the Advocate General finds that both Google's search engine and AdWords constitute information society services. He adds that service providers seeking to benefit from a liability exemption under the E-Commerce Directive should remain neutral as regards the information they carry or host.[bold added]

However, whilst the search engine is a neutral information vehicle applying objective criteria in order to generate the most relevant sites to the keywords entered, that is not the case with Adwords where Google has a direct pecuniary interest in internet users clicking on the ads' links.

Accordingly, the liability exemption for hosts provided for in the E-Commerce Directive should not apply to the content featured in AdWords."

Pangloss Sez: Wow that is interesting. So, it seems we have a clear and defiant rejection of the content industry-lead idea that IP holders can command online intermediaries - or just search engines? - to undertake prior blanket filtering to prevent alleged infringement of their rights. The context of AdWords is very different from that of Viacom v YouTube (for example) of course, but does this point to how we may see an upcoming ECJ reference panning out on liability of web 2.0 sites, like eBay, and in particular, whether they can be compelled by the likes of LVM to proactively filter out content, rather than run, as now, on a post factum notice and take down paradigm? See discusion of conflicting cases in US, Continental Europe and recently England on this controversial point, here.

On the other hand we also have a clear steer from the AG that where ISSPs like Google make money out of their "neutral" activities in hosting or linking to content by monetising them via connected advertising, they remain ISSPs but nonetheless become fair game for liability, and are no longer "neutral intermediaries". Would this mean that YouTube, who perhaps occasionally host IP infringing user generated content :-) and monetise this hosting via ads, could be commandedby a court to filter proactively, as opposed to simply wait for NTD; while, par contraire, eBay, who also sometimes host infringing content, but make their money from unconnected user commissions, not ads, would not be so susceptible and could continue to depend on expedient NTD to retain immunity?

Oh this is going to be fun :-)

Facebook and privacy

Via Andrea Matwyshyn - after the Canadian reforms and this, what next?

"A Look at the Facebook Privacy Class Action (Beacon) Settlement

Facebook announced on Friday that it settled the class action challenging its "Beacon" advertising program. [Inside Facebook; h/t Jim McCullagh on Twitter] You can access the key docs here: [pdf] (Settlement Agreement; Motion for Preliminary Approval).

Net result? Facebook establishes a privacy foundation funded with $9.5 million (or what's left of this amount after attorneys' fees, costs, and class claims are deducted). "

Unlikely Events..

The much spoken off here book actually came out on its pre announced publication date , and I got my copy today!
Many thanks to all the contributors and the staff at Hart who worked against all odds to achieve this miracle :-)
Thanks to Randall Munroe at XKCD for the delish cover.

And to the rest of you - hey, 700 pp for £30! Never mind the quality , feel the width! Hmm, Perhaps this is not the best way to market an academic text? Ah, everyone's a critic :)

Next GikII, SCL and start of term. I may be some time ...

Wow, NOT a File Sharing Consultation..

.. and not three strikes!

Instead the EU with remarkable common sense has issued a Communication suggesting some non legislative ways to (additionally) crack down on filesharing and counterfeit sales on the Internet.

"The Commission aims to ensure a highly efficient, proportionate and predictable system of enforcement of intellectual property rights, both within and outside the internal market. The current legal framework provides the tools to enforce intellectual property rights in a fair, effective and proportionate way.

Complementing legislation, the actions in this Communication aim to:

• support enforcement through a new EU Observatory on counterfeiting and piracy which will bring together national representatives, private sector experts and consumers to work to collect data on and analyse the scope and scale of the problem, share information, promote best practices and strategies, raise awareness and propose solutions to key problems;

• foster administrative cooperation across Europe by developing coordination to ensure that more effective exchanges of information and mutual assistance can take place. As a result, Member States are called to designate National Coordinators. An electronic network for information sharing will also need to be available .

• build coalitions between stakeholders to overcome conflicts and disputes, by developing collaborative voluntary arrangements that focus on concrete problems, such as the sale of counterfeit goods over the internet, and are capable to adapt quickly to changing markets and technology. Such agreements can also be more easily extended beyond the EU and become the foundation for best practice at global level.

The Communication results from the Commission's IPR Strategy for Europe adopted last year and builds upon the recent Council Resolution on a comprehensive European anti-counterfeiting and anti-piracy plan."

Naturally, content industry unimpressed:-)

(via Michael Geist)

EDIT: Meanwhile however one asks of course, but what of the Telecoms Package and when is the conciliation process taking place, after the failure of the second reading procedure?

Helpfully , the new EDRI-gram tells us :

"Preparations are being made in the EU institutions for the expected third
reading of the Telecom Package. The timescale for the remainder of the
legislative process will be determined by the official communication of the
Council Common Positions to the Parliament. In theory, this can happen as
late as mid-October, meaning that the final agreement could happen as late
as the end of November or early December.

..The Member States can be expected to push for as much of the Common
Position as possible to be retained and to push again for the
"compromise" that was agreed with the Parliament negotiators on
Amendment 138 in the first reading (but not adopted). "

Watch this space!

A Very Peculiar Scottish Practice & fin de Festival muscellany

Pangloss is in Estonia where she hopes to blog more tomorrow, but in meanwhile, while desperately trying to catch up post far too much Edin Festival indulgence, was delighted to see this tartan trivia below on Lawrence Eastham's excellent blog for the Society for Computers and Law:

"Solicitors on YouTube

Are Scottish solicitors Inksters the first firm to have a dedicated YouTube channel?

The Glasgow-based firm Inksters hope to ‘keep ahead of the legal technology curve with the launch of a YouTube channel’. The channel contains an initial five films which are also available at inksters.com. These include films on The Home Report, one about windfarming on croft land and another on the House of Lords case: Moncrieff v Jamieson (featuring SSCL Chair Iain G Mitchell QC). Brian Inkster said ‘putting these films on YouTube will bring them to a wider audience. It is a natural extension of the Web 2.0 policy we have been pursuing at Inksters. We were the first Scottish law firm to Twitter earlier this year and we are perhaps now the first Scottish law firm with a dedicated YouTube channel’.

The YouTube videos are at www.youtube.com/inksterssolicitors

Not only that but I *think* I've scooped venerable Scots Law News here! Drag your eyes away from Ally Megrahi (that well known footballer), team.. (Opps EDIT: no! See here.)

I've also very belatedly updated my blog roll a little to include a few excellent newer blogs including Datonomy, on personal data with a stellar UK practitioner line up, and Simon Deane-Johns's useful round up of consumer law,Pragmatist, including some very pithy comments on the seemingly endles revision of EC online consumer law.

From Datonomy, I learn that the UK ICO rather quietly commissioned research in August to price a business case for businesses to invest in privacy; effectively aiming to find out how much businesses might save by proactively investing in privacy rather than waiting for the security breach headlines to hit the fan. How interesting, and how topical, but it certainly seems to move us a long way from privacy-as-a-human-right to commodified privacy-as-property doesn't it?

Oddly enough Pangloss will be speaking on this very topic at the upcoming special-value one-time-only credit crunch SCL Policy Forum in September (fee payable with 6 months 0% credit - no not really) , so if anyone else wants to comment or has interesting worked examples (please show figures:-) of the (alleged) value of privacy to either consumers or businesses, please do comment!

So for me upcoming on the intergalactic talk schedule (just call me Cyber Wogan), it's Estonia for cyberwar, Amsterdam for death (2.0 variety), and London for poverty and privacy. The Three Horsemen of the IT Law Apocalypse. What does that leave? Rains of frogs I suppose..

Anti 3 Strikes Petition

Via 38 degrees and ORG:

"Pressure is building today on Lord Mandelson to stop rushing through his plans to cut the internet connection of anyone that downloads copyrighted material. Today, a coalition of musicians, songwriters and producers spoke out calling his plans, "Expensive, illogical and extraordinarily negative". [1]

Since we launched our petition last week, hundreds of us have signed up to ask Mandelson to stop rushing through new rules. Now, if we all work together and ask our friends to sign, we can quickly make the petition grow even bigger. Please can you forward this email and ask your friends to sign by clicking this link?

http://38degrees.org.uk/message2mandy

The artists which include Sir Paul McCartney, Sir Elton John and Damon Albarn said in their statement today that "We vehemently oppose the proposals being made and suggest that the stick is now in danger of being way out of proportion to the carrot." Meanwhile, internet service providers and consumer groups, including BT and Which?, today warned that these plans will create a Kangaroo court which would "place serious limits on freedom of expression" in the UK. [2]

Only in June this year the government had ruled out draconian measures like these but it appears Mandelson decided to change government policy just days after a dinner with an industry executive in Corfu.

If enough of us take action, Mandelson will have to back down. Recently, he had to give up on his plan to privatise the post office after a popular outcry. Please help by asking your friends to sign the petition by clicking this link:

http://38degrees.org.uk/message2mandy


Thanks for getting involved,

Hannah, David, Nina, Johnny, Warren, and the 38 Degrees Team



[1] See for example here: http://www.guardian.co.uk/technology/2009/sep/03/youtube-prs-deal-file-sharing

[2] See for example here http://www.timesonline.co.uk/tol/comment/letters/article6819093.ece "

Pangloss: Do I need to comment further?

How to Make InGame Ads work

Intriguing piece on research going on into how to make placed in-gane adverts work and not upset the punters:

"Television is a problematic market for advertising to certain demographics, and it's no secret that magazines are in trouble. Online destinations are just starting to come into their own. So where does that leave opportunities for advertising? Video games. A new study, attractively titled "Eye-tracking Analysis as a Means to Visualise the Effects of In-Game Advertising" by 11 Prozent Communication and the University of Offenberg shows that marketing to gamers can be very effective... if you follow the rules.

The first challenge is to make sure the ads fit into the game world. "Advertisements that do not fit into the context or do not provide more realism to the setting of the game or even obstruct the game’s flow, might ruin the whole effort and generate irreparable damage," the study stated. Sports games and racing games are easy in this regard; we're used to being deluged by ads at both types events in real life... why should gaming be any different?"

Pangloss has been intrigued ever since she discovered in 2007 that Google hadfiled a patent for extending their targeted advertising model into advertising presented in games, using information collected in games , via both networked consoles and/or online games. Google have since said they have not followed up that patent but if in-game advertising is the next big thing someone, somewhere, will surely design a Phorm for online games?? After all people play these things for DAYS. Who could resist such a fertile source of personalising data??

Which really does make you wince because think of the information that would be collected - "hmm , this guy regularly tortures, kills and buys virtual genitalia. Oh and he's a junior civil servant with 3 kids (we got that from Doubleclick) but in the game he's a green alien called Grrrarg who despises all females . . Quick, advertise an extreme porn cable channel to him!" Hmm....

Canada Forces Facebook to make Privacy Changes

(via Ian Brown)

In a remarkable turn of events, Facebook has agreed to add significant new privacy safeguards and make other changes in response to the Privacy Commissioner of Canada’s recent investigation into the popular social networking site’s privacy policies and practices.

"The following is an overview of key issues raised during the investigation and Facebook’s response:

1. Third-party Application Developers

Issue: The sharing of personal information with third-party developers creating Facebook applications such as games and quizzes raises serious privacy risks. With more than one million developers around the globe, the Commissioner is concerned about a lack of adequate safeguards to effectively restrict those developers from accessing users’ personal information, along with information about their online “friends.”

Response: Facebook has agreed to retrofit its application platform in a way that will prevent any application from accessing information until it obtains express consent for each category of personal information it wishes to access. Under this new permissions model, users adding an application will be advised that the application wants access to specific categories of information. The user will be able to control which categories of information an application is permitted to access. There will also be a link to a statement by the developer to explain how it will use the data.

This change will require significant technological changes. Developers using the platform will also need to adapt their applications and Facebook expects the entire process to take one year to implement.

2. Deactivation of Accounts

Issue: Facebook provides confusing information about the distinction between account deactivation – whereby personal information is held in digital storage – and deletion – whereby personal information is actually erased from Facebook servers. As well, Facebook should implement a retention policy under which the personal information of users who have deactivated their accounts will be deleted from the site’s servers after a reasonable length of time.

Response: Facebook has agreed to make it clear to users that they have the option of either deactivating their account or deleting their account. This distinction will be explained in Facebook’s privacy policy and users will receive a notice about the delete option during the deactivation process.

While we asked for a retention policy, we looked at the issue again and considered what Facebook was proposing. We determined the company’s approach – providing clarity about the options, offering a clear choice, and alleviating the confusion – is acceptable because it will allow users to make informed decisions about how their personal information is to be handled.

....

4. Accounts of Deceased Users

Issue: People should have a better way to provide meaningful consent to have their account “memorialized” after their death. As such, Facebook should be clear in its privacy policy that it will keep a user’s profile online after death so that friends can post comments and pay tribute.

Response: Facebook agreed to change the wording in its privacy policy to explain what will happen in the event of a user’s death."

Pangloss is mildly amused that only two years after she, Ian Brown and Chris Marsden presented a paper highlighting the privacy and security issues around the use of third party apps on Facebook, changes are finally being made.

The interesting issue will be if these changes are only made for Facebook in Canada or applied worldwide; similar legal pressure has not, it seems, being exerted in other jurisdictions such as the UK and the US - but there has certainly been concern over the repeated use of third party apps as an easy way to collect personal data for fraudulent or criminal purposes, or to spread malware. One might speculate that if FB are investing in developing new more privacy-compliant code it might as well install it system-wide given the PR advantages and the fact that FB's growth appears to have peaked (the rate of growth has been declining since about January 08). Chris Soghoian on Twitter seems to indicate the changes will be worldwide. If so, the Canadians have certainly done us all a favour.

Pangloss is also intrigued by the Canadian concern over Facebook's treatment of profiles on death. While the matter is certainly a pressing one (with 200 million users, not all young, FB profiles are, sadly, often a major concern to relatives after death) in fact FB has been pretty much in the vanguard in the area of transmision of digital assets, in at least providing a clear and accessible way for relatives to ask for profiles to be "memorialised" after death.

Other sites where digital "assets" remain after death (eg eBay, Flickr, et al) are in general much less clear about what rights they offer relativesafter death, have hard to penetrate procedures on the matter, or actively refuse to allow relatives control after death (see the famous Yahoo! case where relatives of a US marine were initially refused access to his emails after death because the privacy policy forbade passing on information to any third party. At least in the US, the privacy policy remains unchanged to date.)

However in my recent talk on this subject, I also suggested that it would be easy for FB in its various preference suggestions to allow users themselves to indicate what they would like done with their profiles after death. Not all want their profiles left open for comments after death ; some would like them closed down; others might like a friend or relatives to make the decision what to do. One size does not fit all and a solution should also consider and balance the interests of both the profile owner and the relatives. However if FB take a lead here under Canadian persuasion, they may well benefit all by becoming a good practice example in a rather under-considered part of the web 2.0 field.

Harry Mandelson and the 3 Strikes of Doom

As numerous bloggers are reporting today, first the Guardian and now the Beeb have reported that the Dept for Business under the proud thrusting leadership of Peter Mandelson, has done a volte face and done exactly what they stated in the Digital Britain consultation in June they would not do - added the possibility of 3 Strikes - disconnection as sanction for filesharing - into the melting pot of the UK's endless file-sharing consultations. This notwithstanding that without substantial judicial control of disconections, about which we have zero detail, both the the European Parliament and the French Constitutional Court have indicated that such a policy would probably contravene human rights.

Best of all, this change of heart is not even vaguely democratic or considered. Instead, as the Guardian put it, "The surprise move will intensify speculation that Lord Mandelson reached a secret deal to protect the film and music industries with Hollywood mogul David Geffen earlier this month." Ho bloody ho for public "consultation".

There had also been whispers for some time that the industry was unhappy with the speed at which the Digital Britain consultation was moving, ie, would anything get done before the current government was voted out and the whole farce had to start again. So now we have proposals for a fast track procedure for 3 strikes which will not only breach European law but have arrived mid-consultation, when many organisations and individuals may already have responded, making a simple mockery of consultative democracy and exposing the government's business leaders as mere lackeys to the dying throes of the music industry's last attempts to protect anti-competitive and antiquated business models.

As ORG point out:

"Yet again, we see knee-jerk reactions and policy swerves, this time in direct contravention of the government’s own consultation guidelines. Those guidelines are there for a reason: to make sure government policy is balanced and considered. We will be making a formal complaint."

Some regular readers may wonder why Pangloss has focused so much on this issue over the last few years, and sometimes I do too. I am not primarily an IP expert. I have no great love for filesharers and my own life is reasonably complete without free access to the complete works of Michael Jackson. The reason I have become so involved in this single issue is because throughout, a single industry sector has shown complete contempt both for democratic procedures, the public interest and for basic and fundamental human rights, all in the name of extracting the last cent of their own, still not inconsiderable, profits.

Ok, companies exist to make profits. But worst of all, our own elected democratic governments, though very well aware of all these points, have gone along like sheep, far more willing to disproportionately criminalise a generation and remove access from students, the unemployed et al to the most essential facility we have ever developed, for minor civil infringements (no one is talking about commercial criminal piracy here) than consider the public balance of interests.

Is this because rock and film stars are sexy? or because the content industry has spent so much on lobbyists there must now be one per MP at least? - I do not know. And of course it is mid August , the height of the sleepy season when many influential newsmakers and commentators might be hoped to be somewhere near Tuscany or at least the Edinburgh Fringe rather than a keyboard:) Perhaps when the first UK Pirate Party MP or MEP is elected the government will wake up to the startling wrongheadedness of the current approach.

So this is why I continue to care about this topic, and why you should too. Read the ORG blog; write to your MP and MEP; complain.

V for Videos

Pangloss is teaching Internet law to undergrads for the first time in a while this academic year coming and was idly wondering if she could spend the first lecture showing videos with which to seduce the suckers , sorry, encourage the freshers to understand how exciting IT law is:-)

These are first thoughts for the curriculum - would anyone else like to suggest their own favourites? In particular, it's not hard to find fun videos on file sharing, privacy and social networking sites (indeed web 2.0 in general) - but I could do with help on less obvious stuff like e-contracting, e-commerce or other aspects of IP??

here's my starting favourites!

Web 2.0

The machine is us - Web 2.0 changes everything

"FriendFace" (IT Crowd) - web 2.0 - social networks and privacy

The Facebook Song

Wikipedia, editing the umlaut - web 2.0 and distributed editing

What is web 2.0? an educationalperspective - intro to web 2.0

Privacy

Big Brother State - privacy & surveillance

The Last Enemy extract - life as an un person in an ID card world

ACLU pizza delivery - private/public data collection and privacy

IP

4chords (Axis of Awesome) - creativity, mash ups, copyright, parody

Filesharing RIAA parody ad (IT Crowd) - filesharing and P2P

3 minute medley on the music wars(from TED)

Content and tubes

The Internet is For Porn - self explanatory

Net Neutrality, Lessig-style - infrastructure

Update on amendment 138

If you were thinking things had gone strangely quiet on this front, well.. (via ORG blog)

"DG Information Society has quietly released its position on the Telecoms Package Second Reading, just as everyone is heading off for the summer holidays. No doubt Commissioner Viviane Reding was hoping no-one would see it. Why? It calls for a “compromise” text which the Council of Ministers was trying to push onto the European Parliament, which could have the effect of giving permission to governments to block access to Internet services and applications.

The so-called “compromise” is the replacement of Amendment 138 ( which seeks to protect users rights on the Internet) with an alternative which was drafted by the Council (sometimes known as the ‘fake 138′). The replacement, when considered in context with other Amendments in the Package, will seal in to the Telecoms Framework a right for governments to implement ‘measures regarding end-users’ access to or use of services and applications through electronic communications networks’.

The so-called “compromise” is positioned in Article 1 of the Framework directive, addressed to Member States. It should be read in conjunction with Amendment 1.2a of the Universal Services and Users Rights directive, which will permit broadband providers to block impose “conditions limiting access to and/or use of services and applications”. In light of T-Mobile blocking Skype, BT throttling peer-to-peer services, and Karoo, a small UK ISP cutting off users, it should now be abundantly clear what this text means. . "

Source: IpTegrity

(without prejudice - Pangloss has not seen the original text yet)

The Economics of Privacy on Social Networks

Pangloss is pleased to see that Joseph Bonneau of the Cambridge Computer lab has now blogged the terrific work his team have done examining the uptake, marketing and impact of privacy tools provided by social networking sites.

Bonneau's team examined 45 sites, collecting over 250 data points about each sites’ privacy policies, privacy controls, data collection practices, and more. The results were fascinating, as presented at the WEIS conference in London. The full paper and complete dataset are available online as well.

For anyone who's ever wondered why the Facebook privacy tools are greyed out on the front page compared to the other menu items, there are revelations:

"The most interesting story we found though was how sites consistently hid any mention of privacy, until we visited the privacy policies where they provided paid privacy seals and strong reassurances about how important privacy is. We developed a novel economic explanation for this: sites appear to craft two different messages for two different populations. Most users care about privacy but don’t think about it in day-to-day life. Sites take care to avoid mentioning privacy to them, because even mentioning privacy positively will cause them to be more cautious about sharing data. This phenomenon is known as “privacy salience” and it makes sites tread very carefully around privacy, because users must be comfortable sharing data for the site to be fun. Instead of mentioning privacy, new users are shown a huge sample of other users posting fun pictures, which encourages them to share as well. For privacy fundamentalists who go looking for privacy by reading the privacy policy, though, it is important to drum up privacy re-assurance."

In other words, as long suspected, privacy is the enemy of the SNS business model and the sites are very well aware of this, despite being having to be seen to pay lip service to increasing numbers of well meaning codes of practice. Indeed the full paper found that SNS which actively marketed themselves as privacy-protective and hence attracted "privacy fundamentalists", tended simply not to do very well (assessed by longevity and growth of audience in the market). What incentive then to make privacy tools easy to see and use for consumers?

This study adds to the weight of evidence that self regulation and consumer education are not ultimately anything like a real solution to the current problems of voluntary and involuntary data disclosure on SNSs. Good to see real empirical evidence like this :)

Also worth noting for security scholars: the papers are in the main now available from Security and Human Behaviour 2009, the "new" conference (following on from the succes of WEIS) on security and how it is affected by psychological and social factors. Hoping to have time to digest these in thenext few weeks, especially as I've been asked to speak myself at the Cyber Conflict Law and Policy Conference at the Cooperative Cyber Defence Centre of Excellence (CCD COE) in Estonia in September. Should be fascinating :-)