Something completely different

As a break from all this changing the world, the wonderful Lex Ferenda has drawn my attention to this:

. when is a crisp not a crisp? When it's a Pringles!

No this isn't IPKat

See Procter & Gamble v HMRC [2008] EWHC 1558 (Ch) and in particular the glorious write up here.

Food gets a 0% VAT rate. But potato chips and potato crisps get 17.5% VAT food as "snack food", the case explains. Where do Pringles fall? According to Pringles, they are zero rated, because unlike crisps, they come in a tin and contain potato flour as well as potatoes! ((And also unlike crisps, are horrible and smell, says Pangloss - but without prejudice..)

This might make you think, says Daithi, that that " the intention was to classify food like potato crisps as non-zero for policy reasons. But the judge says (perhaps with tongue in junk-filled cheek), in dismissing Revenue’s policy arguments (that the idea of denying the zero rate to potato crisps was an anti-junk food policy):

[The Tribunal below accepted] that in general the intention of Parliament was to standard-rate food that was not purchased primarily for the purpose of nutrition. However, one must be very careful about reading too much into the statutory provisions. It cannot, in my view, be said that the legislation shows a clear policy to tax “junk food”. What difference, one might ask, is there between a turnip crisp and a potato crisp in terms of its “junkiness” or otherwise? One might think that the answer is very little and yet the former is zero-rated and the latter standard rated. It is not difficult to multiply examples of that sort. There are plenty of “junk foods” which do not fall within any of the exceptions from zero-rating for food; there are also examples of healthy foods which are standard rated, for instance freshly squeezed orange juice available in supermarkets which falls within excepted item 4.

Indeed, extracted from the judgement (summarised by me, actual listing in appendix to judgement), we can see that Pringle-buyers are also likely to buy other zero-rated products such as KP Skips (no longer with potato ingredients), Doritos, Quaker Snack-a-Jacks, Jacobs Twiglets and Mini Cheddars (biscuits) or standard-rated products such as Monster Munch (no potatoes but content made from “swelling cereal” which attracts standard rate); McCoys (conventional potato crisps); KP Hula Hoops (because of potato flour); Walkers’ Quavers (potato flour); Walkers’ Potato Heads (with actual potato)."

Daithi is of course, Irish and thus inherently pro-potatoes. He is also emerging as the Charlie Brooker of IT law:-)

More Stealth News

The story has now been picked up by The Register quoting La Quadrature de Net.

The comments contain one from someone who wrote to Malcolm Harbour as his MEP and received a form response on the amendments in question. The relevant part is below:

"Amendment H2 asks national regulatory authorities to promote - not force - cooperation, as appropriate, regarding protection and promotion of lawful content. It is entirely independent of "flexible response" and does not prescribe the outcome of any such cooperation.

As opposed to the text proposed by the Commission, amendment H3 shifts the burden of explaining the law from the ISPs to the appropriate national authorities. It also broadens the concept so that any type of unlawful activities are covered, not only copyright infringement. Such other activities could be for example child pornography. This public interest information would be prepared by the relevant national authority and then simply distributed by the ISP to all their customers. It involves no monitoring of individual customer usage of the internet. [italics added]

None of the amendments have been drafted by any outside lobbying organisation."

This may all be accurate in Mr Harbour's view although I would suggest that amended recital 12c actually speaks against the part I have italicised. However ,Pangloss sticks by her legal analysis in posts below - H2 and H3 can indeed be read in a benign way, but they can also be interpreted widely enough, in my opinion, to allow a national legislature to install a "3 strikes and you're out" type regime. That would be a matter for debate in each member state, of course, but this would certainly be a useful place to start, given the opposition even Sarkozy has aroused in France.

One is reminded of the Data Retention Directive: see Judith Rauhofer's excellent analysis of how when Tony Blair ran into troubles getting the data retention provisions he wanted through Parliament, he simply shifted his ground to the EP (where the UK then held the EU presidency) and won there. The resemblance to this battle ground is startling. Technollama has also pointed out that there is recent history of unpopular laws being buried in unlikely European legislation to get it through - the software patent provisions, which were in fact eventually defeated, were at one point proposed via a fisheries committee.

If MEPs have been criticised for acting in good faith, that is very unfortunate, but these amendments remain highly worrying from the perspective of human rights, clarity of lawmaking, and the rule of law.

EDIT: same views expressed in ZedNet by self and others -
See aso excellent piece by Bill Thompson on BBC tech blog .

Stopping legislation by stealth: the fight back

Further to my last post on possible stealth attempts to introduce 3 strikes and you're out - or some equivalent - across Europe, with key votes on Monday July 7 (the final MEP vote will be Sept 7) - Hugh Hancock of Strange Company, the UK's premier machinima outfit, has done really amazing stuff - all while I drove to Cambridge and went to a BBQ, convinced I had done all I could in the tiny amount of time available.

Hugh now has a campaign page up . PLease have a look, and please link to it, and disseminate it.

It has a clear message, a very simple and effective animation (machinima! natch!) and a link to an easy way to mail your MEP asking them not to vote for this legislation without examining it. Please use it. I just did it and it only took minutes. Feel free to refer to my previous blog post if you want too.

Oh and there's a Facebook group at http://www.facebook.com/n/?event.php&eid=24462369438 too.

Thanks. I am really heartened at the geek ability to mobilise :)

Three strikes and you're, er, confused..?

This is long. Get a cup of tea. Sit down and put some chill out music on. But there's a surprise at the end, I promise :)

The story so far: long ago in a galaxy far away in , ooh, March 08, a rumour swept the land that UK ISPs were going to be co-opted by the content/music/movies industry rightsholder groups to apply a doctrine originating from France, and known as "graduated response" or colloquially, "3 strikes and you're out", as part of the continuing battle against the Forces of Evil, namely illegal downloaders/fileswappers.

Under a "3 strikes law", ISPs must warn a detected uploader (or possibly downloader) if they appear to be breaking copyright law. On the third such warning, access to the ISP is disconnected. If such a doctrine is applied by law (or as a voluntary agreement by all ISPs, as "soft law" to fend off "hard law" regulation, then effectively the price of filesharing becomes banishment from access to the Internet.

Pangloss gave a talk on this at the LSE which was reasonably well received in which I asserted that such a step would be illegal under EC law, both because of the hosting and mere conduit exemption from liability for third parties applicable to ISPs under Art 13-15 of the ECD; and because the "penalty" would be disproportionate to the "offence", and thus fall foul of various human rights guarantees in both the ECHR and the EC Charter of Rights.

In particular, access to the Internet for all members of a household might be suspended even if only one person the household had file-shared - or perhaps even a mere friend , guest or user of an unsecured wi fi network. This is because filesharing can only be detected as connected to a particular IP address; and IP addresses identify only a particular computer, not the person using it. A final problem might also be that home machines are often compromised by malware nowadays: how would some one prove it was not them but a remote zombie master who was using their machine to upload or download?

Adjudication and fairness problems also exist: how does the ISP know that an IP address passed to them by the content industry is truely of an illegal file sharer? Difficult grey areas exist of fair dealing and private use, and it can by no means in this our day of the iViewer be assumed that all P2P use is likely to be copyright-infringing.

So far, so bad. After that things went quiet. BERR, the former DTI, said they were bringing foward a consultation paper about "3 strikes and you're out" in the spring but seemed rather unenthusiastic about it with the latest word in June being that the consultation would be delayed till next year (Now why would that be? read on..).

MEPs in the European Parliament voted against it. Even the major ISP, Talk Talk/Carphone Warehouse came out publicly against notice and disconnection despite near-threats from the BPI. A reported attempt by the ISPA, the ISP's own trade asociation to broker a 3 strikes and you're out equivalent prgramme for video/movies, also appeared to die the death. In France, opposition also mounted against the proposed law, but the bill was proposed anyway. Was this the end for 3 strikes or not?

In the UK, developments seemed to take a different turn. First Virgin, one of the "big 3" ISPs , agreed to go in with the BPI on 9 June on a so-called campaign to "educate" users. Users would be warned that they had been detected swapping infringing tracks and to stop, but apparently no actual proposed sanction was included in the letter.

When the first letters arrived c 3 July to 800 Virgin users, all hell broke loose. Students and others (alerted like Pangloss, by that fine news organ , Radio 1 Newsbeat) complained that file sharing was their god given right and anyway, they'd been accused of downloading Amy Winehouse whom they didn't even like (what poor taste, says Pangloss. ) It couldn't have been them; must have been someone using their wi fi network, or a slumber party guest, or a big boy who ran away.

Virgin, stung by information in the latest polls that 63% of their potential subscriber audience had admitted to filesharing, backpeddled and plead that there was "absolutely no possibility" of Virgin taking legal action or banning internet users as part of a campaign against illegal file-sharing on its broadband network. This despite the fact that , embarassingly, "the letters came in an envelope marked: "Important. If you don't read this, your broadband could be disconnected." ." (Bit of a giveaway.)

Interestingly the music industry itself - before the storm broke - presented this not as a one off but as a first stage in attempts to "reach a voluntary agreement with [implicitly, all] ISPs over illegal file-sharing".

Meanwhile, BT the other of the big 3 UK ISPs which unlike TalkTalk had not already publicly rejected "3 strikes", was found in a rather good Register scoop, to have been sending individual letters to suspected filesharers, this time overtly threatening disconnection on further "strike". "If further evidence is obtained of infringement via your internet connection," it writes, "then further action is likely to be taken against you. That action may include litigation against you, as well as the suspension by BT of your internet connection." (This time perhaps deserved as the victim - er infringer - had been caught listening to Girls Aloud. Mon dieu.)

What was an impoverished student in need of a JayZ fix to do? The answer was obvious: leave Virgin and BT and join Talk Talk (or one of the 100s of other ISPs who wanted well out of all this politics and legal risk.) One conspiracy theory Pangloss rather likes, may have been that Virgin were in fact quite keen to lose major downloaders and uploaders: as the current charging model for broadband simply does not reflect the market costs of high usage: it has been said that for some users the real cost of Mbs used would be c £200 a month, not the more normal £10-£20.

But did even Virgin and BT want to lose 63% of their clientele? Probably not. And could all the other ISPs, including TalkTalk be argued into forming a cartel all offering the same policy? Again, probably not. But look!... like the cavalry coming over the virtual hill to the rescue, or the carrot coming to join forces with the stick, the music industry then revealed their ace in the hole on 26 June : stop filesharing illegally and we'll let you go on using P2P but as a legal service, administered via ISPs, with users paying a flat monthly fee added on to their broadband charges, which would then be divvied up back to the rights holders. And aha! this was why the government had been dragging their feet on the 3 strikes consultation, right, because they were brokering this deal? Surely so!

Wonderful, said Pangloss. The answer to all this insane cat and mouse luddism-vs-technological innovation lose:lose scenario we've been dealing with now for, what, nearly a decade? Pangloss has long been a supporter of flatrate levy schemes to finance the correct royalty payments to record companies and artists - ever since she first came across such as scheme back in as promoted by the very clever William Fisher of the Berkman Institute, Harvard, in his book Promises to Keep.

But the music industry has generally not been keen on them, since in theory more profit can be made by a market-driven digitised distribution system such as iTunes, where the industry can still decide how high a price it thinks it can get pers ong or per video, not just what the levy gives it. But hey, any profits are better than no profits right? Or better than 37% of profits anyway. For the average user it would be marvellous: all you can eat Napster, not for nothing but for a reasonable monthly fee. 80% of punters said they'd be happy with that, in the music industry's own poll. It seemed that sanity was at last beginning to prevail.

OK. Deep breath. With me so far?

Menawhile in a galaxy far away.. oh yeh done that bit .. at the European Union we find the reform of the Telecoms law framework underway - known as la Quadrature because it involves reform of (at least) 4 Directives.

Pardon you say. What does telecoms have to do with copyright and P2P?

Well not much, except that both involve Internet access and regulation, yes? The Telecoms reform work is massive, complex, detailed and inpenetrable even to most EC law anoraks. And taking place in the dog days of summer, just before the MEPs go home, and when the academics are already mostly on holiday and the IT journalists want to watch Wimbledon and the Dr Who finale. And over the US Fourth July weekend. The perfect time to bury a copyright bomb.

I have been helpfully given a briefing document by Monica Horten, PhD researcher at the University of Westminster and part of La Quadrature du Net, anti 3-strikes civil society body, which is difficult but alarming reading. Monica has made a close study of someof the proposed amendments to the Telecoms reform package, which have in the main been pushed through committees by industry lobbying and are scheduled to come up for voting on July 7. Yes - in 3 days time. There are 800 amendments and only a handful concern copyright. This is a legislative needle in a haystack. I have seen no publicity for these very important amendments except one report in EDRI-gram: the general press seems unaware. I have checked the amendments myself , but it has to be said however, that interpretation of what exactly they mean is in many cases difficult. Full details can be found in Monica's brief and at the Quadrature de Net page.

Monica suggests that the amendments promoted by copyright interests will, if passed on July 7:

1. Impose an obligation on ISPs to "co-operate" with the content industry in removing filesharers from the Web. In EC speak , this is almost certainly a euphemism for being required to put in place a system akin to a 3-strikes regime and is certainly capable of being interpreted that widely in implementing legislation.

The Internal Market committee report (IMCO) amendment, promoted by UK Conservative MEP Malcolm Harbour, specifies that

"national regulatory authorities and other relevant authorities shall also as far as appropriate promote cooperation between undertakings providing electronic communications networks and/or services and the sectors interested in the protection and promotion of lawful content in electronic communication networks and services. These co-operation mechanisms may also include coordination of the public interest information to be made available as set out in Article 21(4a) and Article 20(2).

The reference here is to another amendment to the same Directive, which would require ISPs to regularly distribute "public interest information" to all users including "the most common uses of electronic communications services to carry out unlawful activities or to disseminate harmful content ". This could be interpreted as narrowly as basic information on copyright (arguably, fine); or it could be clear information from the ISP that a user had been accused of illegal filesharing by a rights holder (a "strike"). The use of the word "also" (enlarged by Pangloss) suggest that the co-operation envisaged is certainly more than just the mere provision of information/warnings.

Interestingly also, proposed recital 12c provides that "Such public interest information should be produced either as a preventative measure or in response to particular problems". This is I would argue clearly wide enough to cover the "strike" interpretation as well as the "general info" interpretation.

This , as French commentators have recognised, thus potentially puts in place all the groundwork of warnings, and legal requirements, for 3 strikes to become law throughout Europe, or at least in whichever of the national legislatures chooses to adopt the wider interpretation (s).

In conclusion, I am worried . Worried at the lack of consideration for what the public wants; the lack of balance between legitimate protection of IPRs, and vital interests such as the access of students and workers to the Net, as well as of the families of alleged filesharers; the apparent disregard for privacy and the personal data safeguards of the data protection laws; the apparent washing away of the E-Commerce Directive immunities; but more than that, aghast at this blatant attempt to sneak through vital changes to the law without proper notice or debate, across Europe, in the Trojan horse of a giant and extraordinarily hard to understand reform exercise.

Hence this rather long post :(

NOTE: this post was edited on 6 July 2008 to make clearer and explicit reference to the exact text of the amendments proposed.

The sweet smell of success

OUT-Law reports (inter alia) that perfume seller LVMH has won its action against eBay for allowing resales of its luxury prfume brands:

"Online auction site eBay has been fined £31.5 million and ordered to forbid the sale of some luxury perfumes in a French court order designed to battle the sale of counterfeit luxury goods.
Handbag, clothing and perfume company Louis Vuitton Moët Hennessy (LVMH) sued eBay in the French courts, claiming that the company did not do enough to combat the sale of counterfeits of its goods.

EBay claims that it cannot police all the sales through its site and that it makes no guarantee that goods are genuine, and that it suspends counterfeit auctions when notified of them.

The French court, though, found "serious faults" in eBay's processes [the VeRo procedure] that led to auctions of counterfeit goods going ahead. By allowing the sales, it said, eBay had damaged the reputation of luxury brands such as Louis Vuitton and Christian Dior.
EBay said that it would appeal the verdict."

As Pangloss has noted many times before, this is yet another strike against the once prevalent assumption that eBay would be a host under Art 14 of the EC E-Commerce Directive and thus not liable for content related infringements of the law where others were the authors. At the moment eBay are required to remove listings only upon actual notice; what Louis Vuitton, and Tiffany and all the rest want is for eBay to do the work of filtering out those listings in advance, by filters or however.

Combined with the "3 (1?) strikes and you're out - well, we told you so" campaign (see next) and the anti-child porn brigade, it has to be said that the ECD immunities of Art 13-15 - including the requirement that the state not ask ISPs or hosts to proactively monitor or filter in Art 15 - look increasingly like dead ducks.

Things look to be going the same way in the US as well, with both the CDA s 230c immunity under fire in the US Tiffany litigation, and DMCA immunity attacked in the ongoing Viacom v You Tube battle, which seems to have re awakened into violent life. Wow. Interesting times. This combination of factors is what Chris Marsden of Essex has insightfully been calling the "perfect storm" which is sooner rather than later going to overwhelm the 2000 consensus on immunity for online intermediaries, as well as net neutrality (plug - see chapter in upcoming 3rd edn Law and the Internet!).

Perhaps the debate should start to be not about what Art 14 means, but about what is to replace it when as expected proposals for reform of the ECD start to appear in the autumn. The content industries wil have all their arguments marshalled already: those of us who worry about freedom of expression, surveillance by DRM, loss of private data and promotion of innovation should start thinking about ours too. Judging by the Telecoms Framework Dirctive amedndments (see next), significant EU reform may arrive when we least expect it with little time for debate.

Good god

Pangloss has just discovered that apparently way back in April she was nominated as one of the best IT law/governance blogs in the Computer Weekly blog awards. Good lord!! However my bet is that Technollama will win - sigh I should never have passed him that Dr Who story:-P

Apparently I'm meant to display this:

VOTE FOR ME!

in Law Blogs

Despite this obviously being a thinly disguised attempt to boost the hit count on CW's website, er, vote me! Or I'll make you read my latest poem, er sorry, 14,000 word data protection chapter..

Actual content coming very shortly actually. With a SCOOP! and FREE GIFT! and NEKKID GIRLS! Well, the first bit was true, actually..

ICANN'T becomes ICANN?

While I'm here a quick comment on the big news of the week, namely ICANN's rather unexpected decision to open up the top level domain name (TLd) space to auction.

"A complete overhaul of the way in which people navigate the internet has been given the go-ahead in Paris. The net's regulator, Icann, voted unanimously to relax the strict rules on so-called "top-level" domain names, such as .com or .uk.

The decision means that companies could turn brands into web addresses, while individuals could use their names. A second proposal, to introduce domain names written in Asian, Arabic or other scripts, was also approved. "

Reaction to this is as ever on the Internet wonderfully polarised. The bloggerverse and the academics have mostly gone "whoopee!". If I want to bid to set up a .pangloss Tld and I can convince ICANN I can make money out of it by subletting the domain to my many fans :) , why not? The same attitude to internationalised domain names can be seen - not surprising as these do seem fantastically sensible given that , as Emily Taylor of Nominet puts it, ""At the moment, there are one-and-a-half billion people online and four-and-a-half billion people for whom the Roman script just means nothing."

However a rather different set of responses can be detected from lawyers responsible for policing company brands online. To them this just means that instead of buying up - say - nike.com, .co.uk, .biz etc etc - and buying it in English, Cyrillic and Mandarin kanji - they now have to think of buying up unlimited nos of possible permutations, with the possibility of more coming along everyday.

Pangloss thinks the corporate lawyers need to adapt to the new world and that ICANN have got it right. We don't live in the world anymore where the fact that someone has got nike.pangloss tarnishes the brand. We do live in a world where people invariably use Google to look up brands rather than merely typing in imagined URLs (and if a brand doesn't have its legit site at the top of the Google search list then it ought to be sacking some of its brand protection team.).
Furthermore mightn't it be easier once Nike has (as they will) set up their own Tld, for the few non-Google users to to guess us.nike rather than nike.com (or .us or .org or .biz??)

Yes cybersquatting, typosquatting etc still will matter in the "established" Tlds, notably .com and the relevant national country codes. But the whole point of massively expanding the "real estate" of the domain name space should be to create more opportunity for everyone - which in itself should diminish the need for "legitimate" domain name overlap, leaving the field free for the URDP to dispose of the unabashed non-legitimate cyber squatters.

Facebook and privacy

You might be interested to know that my chapter on Facebook, social networking sites and privacy (with Ian Brown of the OII) is now available as a pre print on SSRN. This pretty much crystallises many of the talks on SNSs and facebook etc I've done in the last year or so.

See
Edwards, Lilian and Brown, Ian, "Data Control and Social Networking: Irreconcilable Ideas?" (June, 20 2008). Law and the Future of Data Control Available at SSRN: http://ssrn.com/abstract=1148732

THis chapter will appear in Matwyshwn A ed Harboring Data: Information Security, Law and the Corporation (Stanford University Press, 2009).

Apologies for lack of meaty comment - afraid all my efforts are currently going in to the 3rd edition of Law and the Internet which will deo volente be with you in the autumn.

Also, remeber to get in your GikIII 3 submissions!! We've already had some wonderful abstracts involving virtual worlds and games theory, Dr Who and IP rights, autonomous agents as slaves in Roman law etc etc - but we need more!!

The Blip Attention Effect

Is Google making us stupid? Good question, it seems to me..

(Vuia Ray Corrigan)

Stephen Fry on the BC

Cor. Absolutely spiffing essay fromStephen Fry on the future of public sector broadcasting in a digital world.

I do rather love this introductory para on Fry's longtime affection for the BBC.

"The week before we moved, the BBC started a new drama, starring William Hartnell. An old man, whose name appeared to be Grandfather or the Doctor, had a police phone box of the kind we saw in the street all the time in those days. It turned out to be a magical and unimaginably wonderful time machine. My brother and I watched this drama in complete amazement. The first ever episode of Doctor Who. I had never been so excited in all my life. A whole week to wait to watch the next instalment. Never have seven days crawled so slowly by, for all that they involved a complicated house move from Buckinghamshire to Norfolk. A week later, in that new house, my brother and I turned on the good old television set in its new sitting room, ready to watch Episode 2. The TV had been damaged in transit and was never to work again. We missed that episode and nothing that has transpired in my life since has ever, or could ever, make up for that terrible, terrible disappointment. There is an empty space inside me that can never be filled. It is amazing neither of us were turned into psychopathic serial killers from that moment."

Norms for Social Networking :)

Rhodri Marsden of the Independent's CyberClinic has posted his own rather amusing take on Debrett's advice on the etiquette of social networking and where they get it wrong. I agree almost wholly, especially re not mixing business and pleasure (she says, looking ruefully at her Facebook profile which mixes the likes of Lessig and Zittrain with lots of skiffy weirdos and her 21 year old niece currently training to join the Israeli army. Hmmm... )

It's amazing..

.. what you see on TV these days.

The local news just had this story about a shopping mall in Portsmouth where mobile tracking technology by Path Engineering has been installed - which I have tracked to this story from the Register.

"By installing receivers around a shopping centre the company can pick up communication between handsets and base stations, enabling them to track shoppers to within a metre or two - enough to spot the order in which shops are visited. Two UK shopping centres are already using the tech, with three more deploying in the next few months."

As far as one can tell, the tracking is completely non-identifying ; the shopping centre and path both do not know personal mobile phone numbers nor corresponding user names. The TV report showed predictable reactions: why weren't we told; I don't like it; I've got nothing to hide; etc.

So what do people think? Despite the obvious knee jerk reaction, as the info is completely non attributable to identified individuals, I really can't see a problem. You could get exactly the same results (at greater cost) by posting tellers at each shop or destination in the shopping centre to do counts all day, every day - would anyone object to that on privacy grounds?

(Hmm - I suppose yes, if they could identify the shoppers. Technology actually has the privacy advantage here of being blind. Here we're pre supposing CCTV isn't used in some way to identify the mobile shoppers - which despite what El Reg suggests would be extremely difficult to arrange in real time.)

I think it's important here to seperate technophobic squeamishness from real privacy concerns. (This is also not like Phorm where anonymity had been artificially imposed and could easily be "broken". Here the mobile tracking system simply doesn't know your personal phone number or your name.)

Of course you need to seperate it too from a consent-based tracking system which can be abused by forced or mistaken consent to reval significant personal data, like Sniff. Which I'm sure everyone else has blogged enough about by now.


And completely off-topic, in the Guardian today, I nearly choked on my post-swim coffee at the ostensible discovery that gay men and heterosexual women (and straight men and lesbians)apparently have similar shaped brains. If true this could destroy several decades of careful academic work on cultural construction :)

And now Newsnight is trying to tell me that Obama will be made or broken by Internet bloggers. Possibly time to turn off the TV and write some more of the third edition of Law and the Internet instead :)

GikIII 3 is Go!

Via Technollama, I'm very happy to announce..

GIKIII
Oxford Internet Institute
September 24-25, 2008

We are glad to announce the third edition of GikII (appropriately renamed GikIII), which will take place 24-25 September 2008 at the Oxford Internet Institute in, errr... Oxford!

GikII is so cutting edge that it is the nano-blade of workshops, so expect all sorts of challenging papers, tenuous legal connections, l33t powerpoint and keynote skillz, uber-geekery, and a healthy dose of lolcatz. Previous GikIIs explored Facebook privacy settings before privacy had become fashionable; it looked at the legal issues in Harry Potter and the Order of the Phoenix, anime, lolcatz, fandom, virtual property and tattoos.

The call for papers

If you would like to participate, email your abstract of no more than 500 words. This should be sent to either l.edwards@soton.ac.uk or a.guadamuz@ed.ac.uk by July 15 2008. We will confirm acceptances by August 1. Abstracts may be accepted after this date depending on whether the workshop is full. Numbers will be limited so book now!

No n00bs allowed.

The Strange Case of the Moral Panic That Didn't Bark

.. or tae see ourselves as others see us..

Via my colleague Mark Telford, this abstract from Philip Jenkins, a criminologist.


Why Do Some Social Issues Fail to Detonate Moral Panics?
Philip Jenkins*
* Department of History and Religious Studies, Pennsylvania State University, 407 Weaver, University Park, PA 16802, USA; jpj1@psu.edu

Abstract
A ‘moral panic’ is characterized by such themes as the novelty of a particular menace, its sudden explosive growth, and the menace it poses both to accepted moral standards and to vulnerable groups and individuals. Some problems, however, apparently have all the features that would generate a self-feeding media frenzy, and, yet, they do not do so. I will explain this absence of panic by examining the issue of internet child pornography. The failure to construct the problem in ‘panic’ terms reflects the technological shortcomings of law-enforcement agencies, which force them to interpret available data according to familiar forms of knowledge, rather than comprehending or publicizing new forms of deviant organization. This lack of awareness then conditions the nature of political investigation and media coverage.
http://bjc.oxfordjournals.org/cgi/content/abstract/azn016

Does anyone on this list NOT think there has been a moral panic over child pornography? In the US, the Time cover of 96, the CDA, the COPA, et al.... are we and the criminologists on different planets??

Facebook app privacy meltdown deja vu

..or beware! that Facebook app you just downloaded might be stealing your data and all of your friends!

Is this really still news? PG has said it at at least a dozen talks by now (most recently to Ofcom and the OxII).. however the BBC has helpfully written an app to prove the point, and it is a nice clip. Here's their clip.

Lessig 2.0

Pangloss had a highly enjoyable night out last night (indeed she has not totally yet recovered :) to see The Great Lawrence Lessig, who is apparently in Blighty for a few weeks, perform at the IET, giving the annual lecture of the Society for Computers and Law, on "Corruption 2.0". There was a slightly sparser attendance than one might have expected - perhaps because the august members of the SCL weren't too clear what the connection of corruption to cyberlaw, er, was. Neither was Pangloss (though like all true devotees of Larry, she knew of this volte face already because it had been announced on his blog) ; but any opportunity to see Our Greatest Living Forehead perform in his (not patented, but no doubt creative commons licensed) style of matching speech cadences to single word ppts, is too good to miss. Most of London's IT law royalty seem to have agreed, as they were out in force, with everyone to gossip to from Richard Susskind to Chris Reed to blog king Geeklawyer, and Lessig's own anointed heir Jonathan Zittrain (resting for a moment from his own current perpetual whirlwind of booklaunches.)

But enough of the court circular, what of the lecture itself? Well, lo, it turns out that Corruption 2.0 is not that distant a step from Cyberlaw 1.0 after all. Clearly, losing out on the US copyright term extension battle not only to ill informed Congressmen and greenback-handed lobbyists, but also to the presumably (?) better informed and less venal Supreme Court, has irritated Larry more than a little. His thesis is now that whereas Corruption 1.0 - old fashioned bribery - was down to self-interest taking precedence over good policies, Corruption 2.0 is more about ignorance than interest. Today's legislators don't make the right laws, says Lessig, not primarily because of lobbyists and campaign contributions - but because they simply don't understand the technologies well enough to get the law right to govern it. But if there is hope, it must lie, not with the proles as in 1984, but the geeks. Since Corruption 2.0 depends on political ignorance, the answer must be for the geeks - sorry, the digerati? the slashdotii? the technocracy? - to take to the political w0rld.

Now I'm sure this is just the campaigning tip of the iceberg of a much bigger plan, because Pangloss can see a few flaws in this analysis. For a start, in the US election on right now, it is pretty plain that the OTHER great cyberlaw issue of the day (after digital copyright) is indeed likely to be decided by oldfashioned er Patronage 1.0. It doesn't take a political expert to notice that one likely candidate in the election to come is backed financially by the telcos and has no truck with net neutrality - while the other doesn't, and has.

A second problem is that geeks in Pangloss's experience, love yakking about politics but rarely if ever seek office (or even a senior management job.) Nor are they natural baby-kissers and flesh-pressers, especially at the more Aspergers spectrum end of things. Geeks on the whole exercise influence as academics and industry CEOs, rather more than as political animals (in this country, Profs Ross Anderson and Richard Clayton come to mind. ) Perhaps this is really what Lessig actually meant - certainly he was very pleased with the UK Gower Report on IP. which was heavily influenced by academic "friends" and consultees, both before and after the initial consultation was published. The field of law and security - which Lessig also touched on - in the UK, has also recently benefited hugely from academic influence - it is well known the HL Report on Personal Internet Securityof last year owed a great debt to Richard Clayton (but has it actually made it to forming government policy? sadly, not yet). And Richard Susskind's work on courts automation and public sector data reuse has also been, though perhaps less obviously, influential.

At the root of Lessig's fascinating lecture was an unspoken, rather 50s scientificational question - who should rule us, the democratically elected, however foolish or easily lead, or the current meritocratic elite? Of course the situation is never that clear - if the choice is of rule by money, or rule by smarts, Pangloss knows which she takes. Interestingly, Hugh Beale, former English Law Commissioner and now again Prof of Law at Warwick,who gave the Bond Pearce lecture on the Draft European CFR at Southampton I wrote up a week or so back, mentioned in the course of questions, that in his view, an academic article, at just the right time, can make as much policy impact as a Law Commission report. Should we academics stay in our ivory towers and hope for our traditional delivery routes to influence Westminster, or should we storm it ourselves, as advisers if not representatives? So anyway, much food for thought (especially as London votes today on Red Ken vs Boris) and I'm sure the IT law blogosphere is full of consequent buzz today :)-

When all about are losing their's..

This is wonderful. Many moons ago Pangloss gave a paper, loosely on virtual property in online worlds, and used some analogies from personality rights cases featuring unauthorised uses of celebrity images. One fortunate synchronicity was that at the same time, Wendy Grossman, the tech journalist about town, asked her for some advice on the theft of - get this - a life size AI-equipped, animatronic head of Philip K Dick - the reality-bending deceased sf author - which had been programmed with the entirety of PKD's works in the hope it could give answers PKD himself might have while alive. My paper ended up being called, snazzily I thought : "Bring Me the Head of Philip K. Dick: New Forms of Virtual Property"

The head disappeared when its creator, David Hanson, accidentally left it on the overhead rack on an America West plane. Hanson subsequently sued AW for the loss of the head, worth c $350,000. Boing-Boing reports that the suit has just been dismissed in no uncertain manner in a hilarious judgment which is itself intensely self referential.

Am I time travelling, insane or just still in a coma? : ) Reality bites!

Ps this ties up rather well with advertising that I'll be giving an updated version of this talk in Exeter in May at the rather groovy looking Workshop on Virtual Worlds, May 20th, 2008 University of Exeter..
For further information, please contact: A.Harcourt@ex.ac.uk

The European Draft Common Frame of Reference (CFR)

Panloss went to a very interesting lecture yesterday by Hugh Beale of Warwick and formerly the English Law Commission on the publication of the first part of the European CFR project - namely the Draft CFR on Contract (CFRC).

What is the CRC and why should you care? This is a grand plan, which has in various forms been gathering momentum for many years, to distill principles out of the whole of European private law - as derived from the now 27 members of the EU - and create a kind of codified version of those principles. Naturally, given the differences not only between common (England, Ireland) and civil law (everyone else) not to mention linguistic, political and economic differences (the arrival of the Access countries has kind of complicated things:-) this has not been an easy task. One can tell how pleased Hugh Beale and his colleagues (including Eric Clive at Edinburgh, whom Pangloss also saw talking about this a few weeks back - and was very pleased to be given a copy of the Draft CFRC) are to finally show off the first fruit of their labours.

Is this going to impose a European Civil Law Code on you, me and my mum? No, in no uncertain terms. Although aspirational academic work on such a code is ongoing, it is recognised to be politically and probably legally impossible for the EC to take such a supranational stance. Instead the CFR will be used as a "toolbox" which can be explored for stuff like common EU definitions of key legal terms (like "damages" or "termination"); as a kind of model law which EC member states might adopt when reforming their law; and more controversially, as a model the EC might look to when it reforms its law. In many ways, the spur for the completion of this particular part of the CFR has been the EC's ongoing attampts to reform and modernise its consumer law - the so called Acquis, which is currently found in a multitude of Directives.

Still wondering why IT lawyers should be interested? Well one possible thing that might happen next is that the acdemic CFR may be turned into a more limited "political" CFR - espoused officially by the European Commission - which might become available (via an "optional instrument") as a kind of new extra legal system. Rather in the way that a contract cane be governed by, or arbitration can currently be decided under the "the law of the Vienna Convention", say, a business - Amazon say - might sell to all the inhabitants of the EC with the contract, and any dispute arising, governed by the "law of the CFR".

THis is where it gets exciting. At present, one of the big problems about cross border selling is having to worry about the consumer protection laws of every country you sell to. In Europe, Rome 1 (now a Regulation) , on choice of law, dictates that even if Amazon UK (say) dictate that the law of the contract shall be English law, if they're selling to a French (or Finnish or Latvian) person they have to take the risk that if there is a dispute. the "mandatory rules of consumer protection" of France (or Finland or Latvia) will still apply, and over-ride the law they know and had calculated their insurance premiums upon (English).

Sounds a very academic point but businesses , especially SMEs and one-man outfits are highly risk averse. Facing unquantifiable risk, they'll choose to sell at home and not to France or Latvia or Finland. None of this is good for the dream of the low cost, high choice, competitive Single Market for consumers. And in real life the Commission has already noticed that even big players like iTunes (who can afford Finnish and Latvian lawyers) are choosing to sell to some parts of the EU (usually the safer better known Western members) and not to the full 27.

But the "law of the CFR" will be specifically drafted to already include what is seen as at least the minimum EU-wide consumer protection - possibly more than that. So there's no policy reason why Amazon or iTunes shouldn't be able to select "the law of the CFR" as the governing law and NOT have to worry about the law of France, or Finland, or Latvia or whoever next joins the EU.

What about the consumer? Well the idea is also that the consumer will get a choice. When making a contract with Amazon, they'll be presented with the option to accept "the law of the CFR" - or to demand their home consumer law applies. The "CFR" choice will be a Blue Button - so the scheme is the "Blue Button" plan.

Panglos wonders what the point is of presenting the consumer with an option. No consumer she has ever known has rejected a sale because of the governing law - only because it wasn't cheap enough or good enouigh in quality. Consumers will never know enough to make an informed choice about giving up their home law protections. And from the retailer end, the smart money is they won't offer a real choice anyway, but will simply say , if the consumer refuses "the law of the CFR" that they won't accept their order - and we're back to the status quo of partition of markets.

But the "Blue Button" choice apart, the concept of a "law of the EU" as a choice of law seems a brilliant solution to the current Single e-Market impasse - my congratulations to whosever stroke of inspiration this was.

Finally the CFR folks (academic version) very much want feedback on their draft CFRC. It is I believe available at http://www.law-net.eu/ . One piece of feedback Pangloss has already delivered is that she would very much like to see this "toolbox" feed into the review of the Electronic Commerce Directive which has started about now. As every e-commerce lawyer knows, the provisions on when and how an e-contract can be made in the ECD Art 11 are a complete mess, for the simple reason that the ECD drafters were unable politically to harmionise EC basic formation of contract law. The CFRC might provide a way out of this dilemma. Let's hope someone passes the good news on :)

Incitement to terrorism becomes an EU crime?

According to Michael Geist's BNA reports of 21 April 08..

"European Union justice ministers have agreed that using the Internet to publish bomb recipes or call for acts of terrorism to be committed should count as a criminal offence. The 27 member states agreed on Friday to introduce as new offences "public provocation to commit a terrorist offence, recruitment, and training for terrorism" which would be punishable "also when committed through the Internet." [Deutsche Welle]"

The German source adds

"The 27 member states agreed on Friday, April 18, to introduce as new offences "public provocation to commit a terrorist offence, recruitment, and training for terrorism" which would be punishable "also when committed through the Internet."

People found guilty of "disseminating terrorist propaganda and bomb-making expertise through the Internet can therefore be prosecuted and sentenced to prison," the justice ministers said in a joint statement.

The commission's proposal would also allow EU law-enforcement agencies to demand cooperation from Internet providers in order to identify the people making such calls and to ensure that the offending material is taken off-line."

Interesting last para. This echoes what the UK government has already done with The Electronic Commerce Directive (Terrorism Act 2006) Regulations . These apply a 2 day strict notice and take down period under the ECD where the police can ask for take down of pro-terrorist material and ISPs must comply on pain of being seen as endorsing the hosted material.

But the Internet does not stop at the English Channel or even at Turkey. What is the position going to be of an apparently US hosted site like Bombs for Beginners , or this site providing downloads of the Anarchist's Cookbook (which itself recommends instead http://www.pyronfo.com/ for homemade bombmaking, and does not seem to admit where it is hosted?) (And am I committing an offense by linking to either of these??)

The current UK guidance on how the Regulations apply the s 3 notice provisions of the Terroriosm Act 2006 says thusly:

"38. Section 17 [of the 2006 Act] confers extra-territorial jurisdiction in relation to the section
1 offence (encouragement of terrorism), but not to the section 2 offence
(dissemination of terrorist publications). Extra-territoriality is only conferred
in relation to the section 1 offence as it relates to encouragement to
commit Convention offences. These offences are listed in Schedule 1 to
the 2006 Act."

Schedule 1 does not however seem to contain any offences relating to encouragement of terrorism either, by publication of propaganda or educational instructions about bomb making alike. One assumes therefore the UK LEAs cannot issue a take down notice to Wikipedia (or to Le Monde's website in France either.) Is the future new EU legislation intended to allow intra-EU take down notices in the terrorism area? The French may go along with this (zut alors) but one doubts somehow that the US will agree to allow EU police to issue take down notices against their own US-hosted websites though? (What of the First Amendment and the good old Yahoo! case?)

Pangloss is not an expert in the anti-terorism area and would appreciate any helpful comments.
>>>>>>>>>>>>>>>>>>>>>>>>

Pangloss has also been informed about Information Security Week 2008 which runs week from 21st April 2008. Some events look quite interesting for Internet Lawyers -- notably

23rd April Debate on the need for an e-crime unit in the UK with Charlie McMurdie, Detective Superintendent, Police Central e-Crime Unit Project ; Philip Virgo, Secretary General, EURIM; Tony Neate, Managing Director , Get Safe Online; Dr David King, Chair, Information Security Awareness Forum (ISAF).

and

22nd April Launch of the PwC Department for Business, Enterprise and Regulatory Reform Information Security Breaches Survey 2008.

Googleopoly

No particular point to make here except this may certainly enhance a few powerpoints:)

Nation of Daleks

Pangloss is far too much of a geek not to mention the Daleks IP case in the High Court even though she has nothing to add to the excellent write up on the IP Kat here. The IP Kat write up also features a link to an adorable video of a cat completely ignoring a toy dalek :)

Internet Libel (not "liable") or Who's the Daddy(place)?

A story I meant to mention from last week - the Telegraph reported what is being called the largest ever Internet libel settlement in the UK, in relation to allegations on a site called "Dadsplace" about Gentoo, a housing development company.

"Gentoo Ltd, formerly the Sunderland Housing Group, became the subject of an attack by "a seriously defamatory, abusive and scurrilous anonymous website at dadsplace.co.uk", according to a statement read in court by the organisation's counsel, Hugh Tomlinson QC, before Mr Justice Eady today."

Eventually after some two years of malicious attacks downloaded "millions" of times, "John Finn, the owner of rival housing firm Pallion and a former local council candidate in Sunderland ...admitted his involvement, agreeing at the time to pay £125,000 towards Gentoo’s legal costs and a total of £21,000 in compensation.. he and Pallion [then] agreed to pay Mr Walls damages of £100,000 to settle his claim for libel and harassment."

The webmasters of Dadsplace were also made subject to injunctions not to repeat the offending statements but do not seem to have been sued for actual damages.

Now interestingly the solicitors for Gentoo - Olswangs - have commented publicly on why they think the settlement was so high. Factors seem to include:
- the length of the slandering campaign - two years
- the quantity of defamatory allegations - made almost daily
- the "extensive steps to publicise the Web site and their other publications" made by Dadspace - so the damage caused to the reputation was very extensive.

They also indicate how difficult it is to investigate a campaign of anonymous libel eg on a bulletin board or mailing list site, involving "months of painstaking investigation involving a combination of high-tech computer forensic work and old-fashioned evidence gathering".

Finally there are some interesting thoughts on Internet libel from Ashley Hurst the Olswang lawyer involved:

"This raises the question of whether reform is required to give the Internet the same badge of respectability that is enjoyed by other forms of media, including the press (regulated by the PCC) and television companies (regulated by Ofcom). However, the Internet is of course an entirely different medium and the answer is far from straightforward, particularly given the global reach of the Internet and the many different foreign laws that can apply. Would extending the remit of Ofcom or the PCC, or developing a voluntary code of conduct, make any difference?"

Pangloss gets an awful lot of requests to provide advice on Internet libel, though she is uncertain if this is because there is so much of it, or because her article on Net defamation (from 2000!!) comes up first in Google UK if you put in "Internet libel". (Bored students may be glad to know this piece will finally be updated in the 3rd edn of Law and the Internet upcoming.)

But most the people who contact her (unike Olswangs, perhaps, who charge :-) are not the alleged victims of libel, but are websites or hosts of some kind (often charitable or one-man outfits) who suddenly receive take down notices out the blue making vague threats of legal action, and then have no idea what their legal risks are. In an Internet culture where flaming is still fairly prevalent, these hosts often feel they have no alternative but to take down, even where they have no idea what if anything illegal or actionable has been said. This is not good for freedom of speech, democracy or indeed the morale of the voluntary/charitable sector. Sabre rattling and fear of legal risk , it seems, often overwhelms common sense and resilience.

Helpfully, the SCL website as well as providing the Olswang interview, also provides some hints to websites as to when they are liable for content posted on their site by third parties.

Pangloss doesn't disagree that a voluntary code relating to offensive content on websites might be of some use for the victims of malicious allegations (though how would it be policed? the PCC model, both of jurisdiction and sanctions, does not readily transfer, she feels, and that's before we come to the fact that web content is just as likely to be uploaded abroad as in the UK.)

But she also wonders if we do not also need to do more to protect individuals and small unincorporated associations who run or host the websites from random take down notices from anyone who is a wee bit disgruntled or wants to stifle perfectly reasonable criticism or debate.

At the very least it would be good to see a responsible body - the CABxs ? ISPA? BERR? - providing some plain language guidance on line, perhaps an advice hotline, and perhaps even an adaptable form response to takedown notices which do not meet the requirements of regulation 22 of the ECD regulations. Some take down notices do not even sometims specify what ( or where) the alleged libel IS. (The title of this piece comes from one just like this Pangloss saw yesterday - where the aggrieved sender of the take down notice knew so little he had spelt "libel" as "liable".)

As`my gift to the world Pangloss may post her own typical response letter tomorrow. After I've checked it's in no way libellous:)

Stamping out child abuse image websites?

Interesting report on the Beeb about how the IWF have identified how many sites trade such images and concluded there are 2,755 such sites worldwide.

"Of these, 80% are judged to be fully commercial operations.

The IWF said this "manageable" number could be eliminated if net firms, governments and police worked together".

A laudable aim and if achieved, quite amazing. It doesn't of course take into account the anecdotally well known fact that serious organised pedophile rings now mainly obtain and swap their wares via closed P2p nets - "darknets" - and that penetrating these is getting ever harder since the arrival of easily used encrypted P2P.

However perhaps this isn't the time to be too cynical (what me?) and as the IWF imply, closing down commercial websites would at least cut off the feed from those not already inducted into the "inner circles" of darknets.

Then perhaps we could start putting more resources into actual child abuse in this country and less into the shadowy scare figure of the online pedophile :)

E-harmony??

A week or so back I mentioned an interesting report from Bill Dutton and associates at the Oxford Internet Institute on married couples who met online and how they behaved online towards each other. The report was sponsored by e-harmony.com, a dating site who promote making better marriages on line.

I just wonder what they think of this :)

OK back to the dissertation salt mines.

Aha! One last insight into the glories of Pangloss's work life - thanks to the good offices of Cory Doctorow I have now received permission from the godlike Randall Munroe of XKCD so that this - my favourite web cartoon evah - will be the cover of the 3rd edition of Law and Internet, coming to you in autumn 08 :) I am very very pleased :) Thanks to both Randall and Cory!

Stupid Idea of the Month

(Thanks to Ian Sorensen for the tip off.) News from way back on April 4th 2008 -

"Registered child sex offenders will have to provide their email addresses to police in a move to stop them using social networking Web sites, the Home Office announced on Friday

Police will pass the addresses on to the sites which will then be expected to monitor usage or stop offenders logging on. Sex offenders will face up to five years in prison if they fail to hand over the details or provide a false email.

The proposal is one of a series of measures announced by Home Secretary Jacqui Smith to make it harder for child sex offenders to meet children online."

Oh come on, Jeremy. Anyone heard of hotmail, yahoo, gmail, a 1000 other ISPs? Your average pedophile is at least smart enough to realise that even if conscientiously and truthfully hands over (one? all?) of his email address (es), it doesn't take long to get another.

This really is a bad case of "having to be seen to do something, anything". I feel actually embarrassed for our poor polis who'll have to implement this piss-stupid idea.

The wider question again, is how legitimate is it to ban someone from the Internet (all of it? some of it? is tere any realistically any halfway house?) just because their past or future potential crimes might use the Internet. We` routinely allocate ASBOs and domestic injunctions barring certain persons from eg schools, shopping centres or the homes of ex-spouses, but these are in general (a) limited in geographical area (b) proportionate to the crime and (c) enforceable, in that there is very likely someone who has reason to take note if the area restriction is broken.

Arguably, none of these justifications apply to a total Internet ban. But who cares, it's clear`that considerations of civil liberties simply melt away compared to the votes that can be won by name-dropping the "will no one think of the children line". And not mentioning that by far `and away the majority of the sbuse is by someone known to the child and usually resident in their own home, not by stranger online pedophiles. At least in the US there appears to be a debate about the constitutionality of Internet band - Pangloss has seen little or no sign of this in the UK.

Hell, they could simply plant 3 downloads on the pedophile's hard disc and that'll be them banned from the Net for life shortly :)

Future Strategy of the ICO

As the final part of Pangloss's catch up of vital reports on privacy and DP that all seem to have emerged while I was on holiday (sigh), the ICO's own report on its future strategy on DP enforcement needs read. I refer you in the meantime to cogent comments at Naked Law.

Very broadly, the ICO propose that they "will not focus on enforcement, but on reducing the risk to UK residents of misuse of personal information about them. " This may of course however be all subject to change given the expectation that the current Commisioner Richard Thomas will retire in the not too far distant future.

Thanks also to IMPACT blog who (inter alia) drew to my attention to the large ICO survey on attitudes to privacy which preceded the issue of the strategy paper and came out March 19 08. It's all go :) One of the most remarkable and yet not unexpected findings is that after the HMRC data scandal the British public has officially lost faith in the public sector: "The ICO poll of 1,000 people found that 53% of those asked no longer had confidence in the way banks, local authorities and government departments handled personal information." See Beeb summary here.

More on 3 Strikes & Phorm: the ISP Strikes Back, but still true to Phorm

3 Strikes, semper passim :)

Technollama has a good post on Carphone Warehouse's opposition (in its guise as ISP TalkTalk) to the idea of "3 strikes and you're out", and the BPI's response of threatening court action. According to the Telegraph, CW received the following warning by fax from the BPI:

""... unless we receive your agreement in writing that within 14 days Carphone Warehouse will implement procedures set out above [bold added], we reserve our right to apply to court for injunctions and other relief without further notice to protect our members' rights."

Which leaves one wondering: WHAT procedures? Last Pangloss heard, negotiations were going on between the ISPA and the MPA as to a protocol for "progressive" discouragement of filesharing by eventual disconnection, but no agreement had been struck; certainly if the BPI has fomed a binding contract or even voluntary code of practice on similar lines with some or all UK ISPs, this is something the public should know about surely?

If, as seems more likely, no agreement exists, the BPI seem to be making some wrong assumptions about the remedies available to them. As it stand the common consensus is that ISPs are protected from liability for the actionable or illegal activity of their users unless they are shown to have actual or constructive knowledge of material they host fo rnusers (E Commerce Directive, Art 14). If the liability relates to the ISP's role as a mere conduit (Art 12) then ISP's are immune whether or not they receive notice. In all other circumstances, the BPI are limited merely to seeking an injunction against the ISP; although they are of course free to sue the actual users. "Other relief" - which can surely only be construed as implying either the imposotion of a filtering obligation or damages - does not prima facie seem to be available.

Of course in Ireland, also in apparent contradiction to both Arts 14 and 15 of the ECD, the music industry are currently attempting to impose an obligation to filter out pirate tracks on Ireland's biggest ISP, Eircom.Various Irish legal commentators notably TJ Macintyre and the unpronounceable Daithi McSigh have already pointed out the major policy and legal objections to such a claim. But it appears to be saber rattling season on both sides of the Irish Sea, presumably in anticipation of the consultation paper on 3 Strikes we are promised by BERR sometime between now and the autumn.

Phorm

Talk Talk/CW themselves should not be regarded too quickly as heroes of the hour though. Remember Talk Talk is one of the ISPs already signed up for the currently rather controversial Phorm system. Since it seems unlikely UK ISPs are going to go down the 3 Strikes route without legislation, CW/TT have good PR to gain, and nothing much to lose, by speaking out against the BPI :)

On Phorm, matters currently appear to be running against the pioneering or invasive new ISP-level adware system (depending on your side of the fence.) The ICO amended their postition on Phorm yesterday after considerable pressure by inter alia, ORG and FIPR:

"Ad-targeting system Phorm must be "opt in" when it is rolled out, says the Information Commissioner Office (ICO)

European data protection laws demand that users must choose to enrol in the controversial system, said the ICO in an amended statement.

The decision could be a blow to Phorm which before now has said it would operate on an "opt out" basis.

The ICO will monitor the trials and commercial rollout of Phorm to ensure data protection laws are observed."

EDIT: there is a rather sensible comment on the Beeb site about the likely implications of opt-in for Phorm.

This statement, interestingly, still leaves untouched the question of whether Phorm is not only potentially in breach of DP law but an illegal interception of communications under RIPA. The ICO of course has an interest in surveillance, but does not oversee it; interception is technically supervised by the Interception of Communications Commissioner . Home Office communications have indicated they think Phorm legal in this respect, but other commentators such as Nicholas Bohm, differ.

MEPs condemn 3 strikes and you're out

Via Ray Corrigan and Cory Doctorow:

" Danny sez, "Last year, Euro Boing Boing readers wrote and called their MEPs to complain about European Union proposals advocating Internet filtering and blocking on behalf of the music industry. Not only were the amendments voted down, but now ninety MEPs from across the political spectrum have tabled a new text which condemns IFPI's plans to exile from the Net anyone they accuse three times of file-sharing:"

Calls on the Commission and the Member States to recognise that the Internet is a vast platform for cultural expression, access to knowledge, and democratic participation in European creativity, bringing generations together through the information society; calls on the Commission and the Member States, therefore, to avoid adopting measures conflicting with civil liberties and human rights and with the principles of proportionality, effectiveness and dissuasiveness, such as the interruption of Internet access.

(Translations into other EU languages here.)

"Among the advocates of the new language is Michel Rochard, the former Prime Minister of France. That's significant because present French PM Sarkozy is the only Euro leader currently seriously considering implementing IFPI's three strikes plan. With this kind of opposition, it looks like France might remain an anomaly, if it doesn't abandon the plans entirely.""

DP law and search engines

There is a truely remarkable amount happening right now on what one might very loosely call the "Web 2.0" privacy front. On top of the UK Byron report and the Ofcom report dealt with in last two posts to this blog, we also now have the EC Article 29 working party opinion on data protection issues related to search engines.

Very roughly, this report takes the long -expected, but not uncontroversial (especially if you're Google) stance that IP addresses are (mostly) personal data. This follows the view taken previously by the Art 29 WP in its WP 136 that"… unless the Internet Service Provider is in a position to distinguish with absolute certainty that the data correspond to users that cannot be identified, it will have to treat all IP information as personal data, to be on the safe side". Basically even dynamic IP addresses can be connected to particular users given the cooperation of log-keeping ISPs. As such potentially all IP addresses must be viewed as "personal data".

It also argues that:

- the Data Retention Directive (2006/24/EC) is clearly highlighted as not applicable to search engine providers. This is because Article 2 sub c of the Framework Directive (2002/21/EC), which contains some of
the general definitions for the regulatory framework over "electronic communications services", explicitly excludes services providing or exercising editorial control over content. Notably, earch engines both filter out illegal content, provide safe search, and respect no-robots text tags on sites, all functions search engines should continue to exercise.

Search engine providers must thus delete or irreversibly anonymise personal data once they no longer serve the specified and legitimate purpose they were collected for, and be capable of justifying retention and the longevity of cookies deployed at all times. The DRD is NOT an excuse to retain data for longer (as Google have previously claimed.) The WP recommended retention for no more than 6 months. Similarly, if search engine providers use cookies, their lifetime should be no longer than demonstrably necessary.

- the DPD does however clearly apply to search engines which deposit cookies on the machines of EU resident users, even if the search engine is based economically or physically outside the EU eg the USA. European data
protection law also applies to search engines in specific situations, for example if they offer a caching service or specialise in building profiles of individuals based in the EU.

- on DP law, search engines generally fail to say exactly for what purposes they gather personal data of users. If it is used for purposes users might not reasonably have anticipated eg building profiles of users for advertisers, the search industry may be breaking DP law.

The WP also considered the new so-called "people search engines " such as PIPL and Rapleaf, which draw on data from a wide range of sites, often including blogs and SNSs as well as the general Web, to form indexed profiles of individuals. Such profiling may both reveal unexpected data, and throw up misleading correlations, and some have already drawn adverse comment. The WP emphasised that these sites "must have a legitimate ground for processing, such as consent, and meet all other requirements of the Data Protection Directive, such as the obligation to guarantee the quality of data and fairness of processing."

Pangloss is pleased to see this issue adressed: it provides a compulsory legal basis for what is emerging as good industry practice, namely (a) email the data subject whose profile is published (b) allow them to remove or correct or make private the data published. Of course we still need to make sites not based in the EU take notice of EU law. Eventually, what we desprately need is a technical fix, namely better multiple identity control - roll on the research into distributed identity management.

Updates : OxII Social Networking Conference, and Phorm

Pangloss had an interesting time at the OxII /Ofcom conference on Social Networking on Monday (7 April 08). I believe powerpoints and presentations will shortly be available on that site. The conference launched the Ofcom report on social networking which was partly produced to feed into the Byron report (see previous post on this blog). The report confirms with empirical evidence a number of common regulatory and legal assumptions about social networking - notable that "From Ofcom’s qualitative research it appears that concerns about privacy and safety are not ‘top of mind’ for most users" and "all users, even those who were confident with ICT found the [privacy] settings on most of the major social networking sites difficult to understand and manipulate."

What was slightly less predictable was that almost equal numbers of children and adults would equally fail (or not care enough to) use any privacy settings to safeguard their personal data (41% of children aged 8-17 who had a visible profile had their profile set so that it was visible to anyone, as compared to 44% of adults). Also interestingly, the report admits that while many respondents cited potential for abusive use of data revealed on SNSs, few examples of actual harm were in fact reported.

Pangloss's own view is that the report supports the view that protection of users - especially young users - on SNs s cannot be achieved solely by education of users - or "media literacy" - alone. Too many drivers - popularity, peer pressure, ignorance, inertia, technophobia, lack of incentive for SNS sites themselves to protect privacy, because advertising revenue is derived primarily from disclosure - drive SNS users towards unthinking disclosure, rather than rational protection of their personal data. In Pangloss's view , education of users needs supported by regulation (perhaps co-regulation) of SNS sites, in the form of code regulation that would minimise privacy harms. This will form the subject of a Pangloss paper coming real soon now :)

One of the prevalent themes of the conference (rather than the report) was how people use SNSs to further intimate relationships (oo er vicar). Apparently 6% of married Internet users first met their partners online. This seemed high to Pangloss, but it also includes people who met through chatrooms, IM and presumably, blog sites, although these were not name checked, as well as conventional dating sites. 20% of married Internet users admit to checking their partner's emails and 13% to having checked their browser history. Partners seemed to extrend similar levels of surveillance to each other. Pangloss wonders how many have worked out how to use passwords and Clear History commands.. (indeed how many couples share passwords - almost more intimate than sharing a joint bank account these days..)

Pangloss however had to take a pinch of salt at the persuasive man from Match.com who insisted on line dating was no different from off line dating, merely more effective. I felt forced to point out the clear difference is that there is a great deal more lying at the start of on line relationships than is possible in the real world..

Meanwhile in the world of commercial rather than interpersonal stalking, Simon Davies of 80: 20 passes this info on.

"80/20 Thinking is holding a Town Hall meeting on Phorm this coming Tuesday, 15th April, between 18.30 and 20.30 at the Brunei Gallery lecture theatre, SOAS, University of London.

Details are at http://www.8020thinking.com/events

Please do spread the word as much as possible. The meeting is open and free, but we ask people to notify us if they want to come so we can keep track of numbers. Again, those details are on the 80/20 page."

Sadly I can't go but I look forward to hearing about what emerges.

Someone Has Thought Of the Children, Honest..

Cogent post by Technollama on the insatiable hunger of the UK press for scare stories about the horrors of the Internet, especially re Facebook, MySpace, chatrooms, child porn etcetera.

All this furore has of course been partly whipped up most recently by the publication of the much-awaited Byron Report. Pangloss has not had time to read the Byron Report in full yet but was initially relieved that it seemed to have concentrated on "having a national strategy for child internet safety which involves better self-regulation and better provision of information and education for children and families" and not on further extension of the invisible upstream censorship model pioneered by the IWF and BT Cleanfeed to, eg, sites like Social networking sites SNSs), or online games; or types of content which are arguably harmful to children, but not illegal, such as adult sexual content (although read on for discussion of existing upstream filtering in schools and local libraries, and the consideration of extending a "child-safe" Internet to everyone, children and adults alike).

The main features of the Byron Report , beyond the usual calls for parental involvement, understanding that children know more about the net than parents, integration of e-safety into the school curriculum, and consumer and teacher education, seem to be:

(a) "better" ie more granular, classification of video, console and on-line games;
(b) refinement of our understanding of how offline laws apply to online content eg are suicide websites illegal?, and
(c) the creation of a one-stop shop for regulation child safety on the Internet issues, to be named the (slightly Orwellian) UK Council on Child Internet Safety, and run by Home Office and DCFS with help from DCMS, which will "lead the development of a strategy with two core elements: better regulation – in the form, wherever possible, of voluntary codes of practice that industry can sign up to – and better information and education, where the role of government, law enforcement, schools and children’s services will be key".

Reading further on gives us some idea of the key tasklist the Council is meant to undertake. This is a long and interesting list but these are a few items that stood out to me.

- making sure home computers are sold already loaded up with kitemarked parental control software (but not by default already switched on and fully functional - see 4.72)
- making sure search engines offer clear indications if safe search is on, and that these can be "locked on" by parents
- making sure 100% of schools and local services (computers in libraries and museums eg) to children have Becta accredited filtering services
- working with user generated content hosts (eg Facebook) to establish an independently monitored voluntary code of practice for the moderation of user generated content.

Despite all this the executive summary concludes with the following quote ;

"“Kids don’t need protection we need guidance. If you protect us you are making us
weaker we don’t go through all the trial and error necessary to learn what we need
to survive on our own…don’t fight our battles for us just give us assistance when we
need it.”

I feel, in my slightly confused position as a former specialist in child law and nowadays a specialist in Internet law, that we are getting mixed messages here. How are children going to go through "trial and error to learn" when they inhabit a world where parents can defer any parenting discussions on adult content to a kitemarked filter they don't understand enough to alter? Where school , library and museum access is 100% filtered? (And I have an acquaintance who runs the filters for a certain Scottish local authority 's schools - and I was mildly appalled by how far it filters beyond what is legally proscribed content.) Where their own version of their own real life on their own UGC sites is potentially censored? (As if they need to go to the Internet anyway to see teens engaged in nudity, sex, drugs and unsafe behaviour - they can just watch Skins .)

Less controversially, there is an interesting suggestion at 4.19 about how UGC or social networking sites might handle the tricky issue of moderation of content and legal liability. Many SNSs, hosts and ISPs have long argued that they cannot monitor/moderate illegal content and remove some, because they are then "on notice" for the whole site's contents, and will be liable for any illegal content they have let slip past (see Art 14 of the Electronic Commerce Directive and the ghost of the Prodigy doctrine.) Byron rather smartly observes that such risks might be minimised if a third party was used to audit the site and give notice to the host site only about material which definitely breaches the law, and which could then be removed, and adds a recommendation that "the Council explores the possibility of developing such arrangements to minimise the risks of liability for companies that take steps to make their products safer for children". Who PAYS for such third party auditing is not discussed :)

Byron also recommends that sites be encouraged to sign up to specific public commitments on take down times, which sites currently tend to avoid for fear of being deemed in breach of contract if they do not take down in time ; Facebook, eg, has already publicly guaranteed to take down on complaint, content containing "nudity, pornography,harassment or unwelcome contact" within 24 hours. This Pangloss approves of, having seen in her own empirical research, the very wide variation in take down times from hosts and ISPs according to variables such as size of organisation, type of content and type of organisation, and the uncertainty this can cause both hosts and users (MumsNet were reportedly forced into settlment re liability for allegedly libellous UGC , by not being sure if they had taken down "expeditiously").

Overall though, despite the odd mention (and I emphasise again my not having read whole report fully yet) there is a definite air about the report , as Jonathan Zittrain once put it, of it being "so 2005". What use will filtering requirements on schools , and parental control software be, when as will be true in about 5 Internet minutes, every child routinely accesses Facebook or Bebo on their way to school via their smart mobile phone?. The report itself admits that 37% of 11-16 year-olds already have access to the internet via a mobile (ChildWise 2008). Even if mobile phone operators are corralled as upstream supervisors as well (a voluntary code of concuce for mobile operators has existed since 2004, but Byron admits "it is difficult to establish the effectiveness of work in this area" - 4.109) what about wi fi accessed via their smartphones, IPod Touch or equivalent, on the school bus, in cafes, at friends' houses and at clubs? These issues are actually, praiseworthily, raised, with research commissioned to examine access outside the home (4.69) but in the end there is no solid recommendation of any serious way of how to deal with these impossibly difficult problems (4.106, 4.116,4.117).

There also seems to be a rather worrying supposition that SNSs are the domain solely of children. Bebo may be, but many are not. Recent research showed, rather amazingly, that in the UK as of September 07, the median age of a Facebook user was 34! (Pangloss herself is an FB user and er rather over that age :( Should a 34 year old be subject to a UGC moderation code which refuses to let him publish a tasteful non-illegal erotica picture of his girlfriend? I am not really sure. We are getting dangerously close to the famous ACLU v Reno No 1 case which asserted that , even in the interests of children, the whole of the Internet should not be reduced to the level of a "children's reading room".

Putting the job of censorship on to ISPs, host and SNSs rather than directly exercised by the state, does not make it any less censorship - it just makes it less transparent and less accountable. There is a slightly chilling discussion at 4.54ff of the idea of network (ISP) level blocking of all unwelcome content - ie blocking non illegal but non child friendly content to ALL USERS , by all UK ISPs - with the onus on, or choice by, over-18s to opt out of this blocking. The Report chooses to not go down this route for large numbers of very sensible reasons, but adds somewhat worryingly "this may need to be reviewed if the other measures recommended in this report fail to have an impact on the number and frequency of children coming across harmful or inappropriate content online." (4.60) This puts Technollama's suggestion that next we will see regulation of social networking sites positively in the shade..

In short, the Byron Report is a brave and largely non-tabloid-scare-oriented attempt to deal with a difficult problem. Much of the child developmental information in the first two chapters is excellent and it is very valuable to have it in one place in front of policy makers and lawyers' noses. But as far as as solutions go, one does have a feeling that it is perhaps not looking far enough ahead; because "far" on the Internet is usually not that far at all.