Monday, September 21, 2009

Facebook and privacy

Via Andrea Matwyshyn - after the Canadian reforms and this, what next?

"A Look at the Facebook Privacy Class Action (Beacon) Settlement

Facebook announced on Friday that it settled the class action challenging its "Beacon" advertising program. [Inside Facebook; h/t Jim McCullagh on Twitter] You can access the key docs here: [pdf] (Settlement Agreement; Motion for Preliminary Approval).

Net result? Facebook establishes a privacy foundation funded with $9.5 million (or what's left of this amount after attorneys' fees, costs, and class claims are deducted). "

Tuesday, September 15, 2009

Unlikely Events..

The much spoken off here book actually came out on its pre announced publication date , and I got my copy today!
Many thanks to all the contributors and the staff at Hart who worked against all odds to achieve this miracle :-)
Thanks to Randall Munroe at XKCD for the delish cover.

And to the rest of you - hey, 700 pp for £30! Never mind the quality , feel the width! Hmm, Perhaps this is not the best way to market an academic text? Ah, everyone's a critic :)

Next GikII, SCL and start of term. I may be some time ...

Monday, September 14, 2009

Wow, NOT a File Sharing Consultation..

.. and not three strikes!

Instead the EU with remarkable common sense has issued a Communication suggesting some non legislative ways to (additionally) crack down on filesharing and counterfeit sales on the Internet.

"The Commission aims to ensure a highly efficient, proportionate and predictable system of enforcement of intellectual property rights, both within and outside the internal market. The current legal framework provides the tools to enforce intellectual property rights in a fair, effective and proportionate way.

Complementing legislation, the actions in this Communication aim to:

  • support enforcement through a new EU Observatory on counterfeiting and piracy which will bring together national representatives, private sector experts and consumers to work to collect data on and analyse the scope and scale of the problem, share information, promote best practices and strategies, raise awareness and propose solutions to key problems;

  • foster administrative cooperation across Europe by developing coordination to ensure that more effective exchanges of information and mutual assistance can take place. As a result, Member States are called to designate National Coordinators. An electronic network for information sharing will also need to be available .

  • build coalitions between stakeholders to overcome conflicts and disputes, by developing collaborative voluntary arrangements that focus on concrete problems, such as the sale of counterfeit goods over the internet, and are capable to adapt quickly to changing markets and technology. Such agreements can also be more easily extended beyond the EU and become the foundation for best practice at global level.

The Communication results from the Commission's IPR Strategy for Europe adopted last year and builds upon the recent Council Resolution on a comprehensive European anti-counterfeiting and anti-piracy plan."

Naturally, content industry unimpressed:-)

(via Michael Geist)


EDIT: Meanwhile however one asks of course, but what of the Telecoms Package and when is the conciliation process taking place, after the failure of the second reading procedure?

Helpfully , the new EDRI-gram tells us :

"Preparations are being made in the EU institutions for the expected third
reading of the Telecom Package. The timescale for the remainder of the
legislative process will be determined by the official communication of the
Council Common Positions to the Parliament. In theory, this can happen as
late as mid-October, meaning that the final agreement could happen as late
as the end of November or early December.

..The Member States can be expected to push for as much of the Common
Position as possible to be retained and to push again for the
"compromise" that was agreed with the Parliament negotiators on
Amendment 138 in the first reading (but not adopted). "

Watch this space!

Tuesday, September 08, 2009

A Very Peculiar Scottish Practice & fin de Festival muscellany

Pangloss is in Estonia where she hopes to blog more tomorrow, but in meanwhile, while desperately trying to catch up post far too much Edin Festival indulgence, was delighted to see this tartan trivia below on Lawrence Eastham's excellent blog for the Society for Computers and Law:

"Solicitors on YouTube

Are Scottish solicitors Inksters the first firm to have a dedicated YouTube channel?

The Glasgow-based firm Inksters hope to ‘keep ahead of the legal technology curve with the launch of a YouTube channel’. The channel contains an initial five films which are also available at inksters.com. These include films on The Home Report, one about windfarming on croft land and another on the House of Lords case: Moncrieff v Jamieson (featuring SSCL Chair Iain G Mitchell QC). Brian Inkster said ‘putting these films on YouTube will bring them to a wider audience. It is a natural extension of the Web 2.0 policy we have been pursuing at Inksters. We were the first Scottish law firm to Twitter earlier this year and we are perhaps now the first Scottish law firm with a dedicated YouTube channel’.

The YouTube videos are at www.youtube.com/inksterssolicitors


Not only that but I *think* I've scooped venerable Scots Law News here! Drag your eyes away from Ally Megrahi (that well known footballer), team.. (Opps EDIT: no! See here.)

I've also very belatedly updated my blog roll a little to include a few excellent newer blogs including Datonomy, on personal data with a stellar UK practitioner line up, and Simon Deane-Johns's useful round up of consumer law,Pragmatist, including some very pithy comments on the seemingly endles revision of EC online consumer law.

From Datonomy, I learn that the UK ICO rather quietly commissioned research in August to price a business case for businesses to invest in privacy; effectively aiming to find out how much businesses might save by proactively investing in privacy rather than waiting for the security breach headlines to hit the fan. How interesting, and how topical, but it certainly seems to move us a long way from privacy-as-a-human-right to commodified privacy-as-property doesn't it?

Oddly enough Pangloss will be speaking on this very topic at the upcoming special-value one-time-only credit crunch SCL Policy Forum in September (fee payable with 6 months 0% credit - no not really) , so if anyone else wants to comment or has interesting worked examples (please show figures:-) of the (alleged) value of privacy to either consumers or businesses, please do comment!

So for me upcoming on the intergalactic talk schedule (just call me Cyber Wogan), it's Estonia for cyberwar, Amsterdam for death (2.0 variety), and London for poverty and privacy. The Three Horsemen of the IT Law Apocalypse. What does that leave? Rains of frogs I suppose..



Thursday, September 03, 2009

Anti 3 Strikes Petition

Via 38 degrees and ORG:


"Pressure is building today on Lord Mandelson to stop rushing through his plans to cut the internet connection of anyone that downloads copyrighted material. Today, a coalition of musicians, songwriters and producers spoke out calling his plans, "Expensive, illogical and extraordinarily negative". [1]

Since we launched our petition last week, hundreds of us have signed up to ask Mandelson to stop rushing through new rules. Now, if we all work together and ask our friends to sign, we can quickly make the petition grow even bigger. Please can you forward this email and ask your friends to sign by clicking this link?

http://38degrees.org.uk/message2mandy

The artists which include Sir Paul McCartney, Sir Elton John and Damon Albarn said in their statement today that "We vehemently oppose the proposals being made and suggest that the stick is now in danger of being way out of proportion to the carrot." Meanwhile, internet service providers and consumer groups, including BT and Which?, today warned that these plans will create a Kangaroo court which would "place serious limits on freedom of expression" in the UK. [2]

Only in June this year the government had ruled out draconian measures like these but it appears Mandelson decided to change government policy just days after a dinner with an industry executive in Corfu.

If enough of us take action, Mandelson will have to back down. Recently, he had to give up on his plan to privatise the post office after a popular outcry. Please help by asking your friends to sign the petition by clicking this link:

http://38degrees.org.uk/message2mandy


Thanks for getting involved,

Hannah, David, Nina, Johnny, Warren, and the 38 Degrees Team



[1] See for example here: http://www.guardian.co.uk/technology/2009/sep/03/youtube-prs-deal-file-sharing

[2] See for example here http://www.timesonline.co.uk/tol/comment/letters/article6819093.ece "


Pangloss: Do I need to comment further?

Wednesday, September 02, 2009

How to Make InGame Ads work

Intriguing piece on research going on into how to make placed in-gane adverts work and not upset the punters:

"Television is a problematic market for advertising to certain demographics, and it's no secret that magazines are in trouble. Online destinations are just starting to come into their own. So where does that leave opportunities for advertising? Video games. A new study, attractively titled "Eye-tracking Analysis as a Means to Visualise the Effects of In-Game Advertising" by 11 Prozent Communication and the University of Offenberg shows that marketing to gamers can be very effective... if you follow the rules.

The first challenge is to make sure the ads fit into the game world. "Advertisements that do not fit into the context or do not provide more realism to the setting of the game or even obstruct the game’s flow, might ruin the whole effort and generate irreparable damage," the study stated. Sports games and racing games are easy in this regard; we're used to being deluged by ads at both types events in real life... why should gaming be any different?"

Pangloss has been intrigued ever since she discovered in 2007 that Google hadfiled a patent for extending their targeted advertising model into advertising presented in games, using information collected in games , via both networked consoles and/or online games. Google have since said they have not followed up that patent but if in-game advertising is the next big thing someone, somewhere, will surely design a Phorm for online games?? After all people play these things for DAYS. Who could resist such a fertile source of personalising data??

Which really does make you wince because think of the information that would be collected - "hmm , this guy regularly tortures, kills and buys virtual genitalia. Oh and he's a junior civil servant with 3 kids (we got that from Doubleclick) but in the game he's a green alien called Grrrarg who despises all females . . Quick, advertise an extreme porn cable channel to him!" Hmm....

Thursday, August 27, 2009

Canada Forces Facebook to make Privacy Changes

(via Ian Brown)

In a remarkable turn of events, Facebook has agreed to add significant new privacy safeguards and make other changes in response to the Privacy Commissioner of Canada’s recent investigation into the popular social networking site’s privacy policies and practices.

"The following is an overview of key issues raised during the investigation and Facebook’s response:

1. Third-party Application Developers

Issue: The sharing of personal information with third-party developers creating Facebook applications such as games and quizzes raises serious privacy risks. With more than one million developers around the globe, the Commissioner is concerned about a lack of adequate safeguards to effectively restrict those developers from accessing users’ personal information, along with information about their online “friends.”

Response: Facebook has agreed to retrofit its application platform in a way that will prevent any application from accessing information until it obtains express consent for each category of personal information it wishes to access. Under this new permissions model, users adding an application will be advised that the application wants access to specific categories of information. The user will be able to control which categories of information an application is permitted to access. There will also be a link to a statement by the developer to explain how it will use the data.

This change will require significant technological changes. Developers using the platform will also need to adapt their applications and Facebook expects the entire process to take one year to implement.

2. Deactivation of Accounts

Issue: Facebook provides confusing information about the distinction between account deactivation – whereby personal information is held in digital storage – and deletion – whereby personal information is actually erased from Facebook servers. As well, Facebook should implement a retention policy under which the personal information of users who have deactivated their accounts will be deleted from the site’s servers after a reasonable length of time.

Response: Facebook has agreed to make it clear to users that they have the option of either deactivating their account or deleting their account. This distinction will be explained in Facebook’s privacy policy and users will receive a notice about the delete option during the deactivation process.

While we asked for a retention policy, we looked at the issue again and considered what Facebook was proposing. We determined the company’s approach – providing clarity about the options, offering a clear choice, and alleviating the confusion – is acceptable because it will allow users to make informed decisions about how their personal information is to be handled.

....

4. Accounts of Deceased Users

Issue: People should have a better way to provide meaningful consent to have their account “memorialized” after their death. As such, Facebook should be clear in its privacy policy that it will keep a user’s profile online after death so that friends can post comments and pay tribute.

Response: Facebook agreed to change the wording in its privacy policy to explain what will happen in the event of a user’s death."

Pangloss is mildly amused that only two years after she, Ian Brown and Chris Marsden presented a paper highlighting the privacy and security issues around the use of third party apps on Facebook, changes are finally being made.

The interesting issue will be if these changes are only made for Facebook in Canada or applied worldwide; similar legal pressure has not, it seems, being exerted in other jurisdictions such as the UK and the US - but there has certainly been concern over the repeated use of third party apps as an easy way to collect personal data for fraudulent or criminal purposes, or to spread malware. One might speculate that if FB are investing in developing new more privacy-compliant code it might as well install it system-wide given the PR advantages and the fact that FB's growth appears to have peaked (the rate of growth has been declining since about January 08). Chris Soghoian on Twitter seems to indicate the changes will be worldwide. If so, the Canadians have certainly done us all a favour.

Pangloss is also intrigued by the Canadian concern over Facebook's treatment of profiles on death. While the matter is certainly a pressing one (with 200 million users, not all young, FB profiles are, sadly, often a major concern to relatives after death) in fact FB has been pretty much in the vanguard in the area of transmision of digital assets, in at least providing a clear and accessible way for relatives to ask for profiles to be "memorialised" after death.

Other sites where digital "assets" remain after death (eg eBay, Flickr, et al) are in general much less clear about what rights they offer relativesafter death, have hard to penetrate procedures on the matter, or actively refuse to allow relatives control after death (see the famous Yahoo! case where relatives of a US marine were initially refused access to his emails after death because the privacy policy forbade passing on information to any third party. At least in the US, the privacy policy remains unchanged to date.)

However in my recent talk on this subject, I also suggested that it would be easy for FB in its various preference suggestions to allow users themselves to indicate what they would like done with their profiles after death. Not all want their profiles left open for comments after death ; some would like them closed down; others might like a friend or relatives to make the decision what to do. One size does not fit all and a solution should also consider and balance the interests of both the profile owner and the relatives. However if FB take a lead here under Canadian persuasion, they may well benefit all by becoming a good practice example in a rather under-considered part of the web 2.0 field.

Tuesday, August 25, 2009

Harry Mandelson and the 3 Strikes of Doom

As numerous bloggers are reporting today, first the Guardian and now the Beeb have reported that the Dept for Business under the proud thrusting leadership of Peter Mandelson, has done a volte face and done exactly what they stated in the Digital Britain consultation in June they would not do - added the possibility of 3 Strikes - disconnection as sanction for filesharing - into the melting pot of the UK's endless file-sharing consultations. This notwithstanding that without substantial judicial control of disconections, about which we have zero detail, both the the European Parliament and the French Constitutional Court have indicated that such a policy would probably contravene human rights.

Best of all, this change of heart is not even vaguely democratic or considered. Instead, as the Guardian put it, "The surprise move will intensify speculation that Lord Mandelson reached a secret deal to protect the film and music industries with Hollywood mogul David Geffen earlier this month." Ho bloody ho for public "consultation".

There had also been whispers for some time that the industry was unhappy with the speed at which the Digital Britain consultation was moving, ie, would anything get done before the current government was voted out and the whole farce had to start again. So now we have proposals for a fast track procedure for 3 strikes which will not only breach European law but have arrived mid-consultation, when many organisations and individuals may already have responded, making a simple mockery of consultative democracy and exposing the government's business leaders as mere lackeys to the dying throes of the music industry's last attempts to protect anti-competitive and antiquated business models.

As ORG point out:

"Yet again, we see knee-jerk reactions and policy swerves, this time in direct contravention of the government’s own consultation guidelines. Those guidelines are there for a reason: to make sure government policy is balanced and considered. We will be making a formal complaint."

Some regular readers may wonder why Pangloss has focused so much on this issue over the last few years, and sometimes I do too. I am not primarily an IP expert. I have no great love for filesharers and my own life is reasonably complete without free access to the complete works of Michael Jackson. The reason I have become so involved in this single issue is because throughout, a single industry sector has shown complete contempt both for democratic procedures, the public interest and for basic and fundamental human rights, all in the name of extracting the last cent of their own, still not inconsiderable, profits.

Ok, companies exist to make profits. But worst of all, our own elected democratic governments, though very well aware of all these points, have gone along like sheep, far more willing to disproportionately criminalise a generation and remove access from students, the unemployed et al to the most essential facility we have ever developed, for minor civil infringements (no one is talking about commercial criminal piracy here) than consider the public balance of interests.

Is this because rock and film stars are sexy? or because the content industry has spent so much on lobbyists there must now be one per MP at least? - I do not know. And of course it is mid August , the height of the sleepy season when many influential newsmakers and commentators might be hoped to be somewhere near Tuscany or at least the Edinburgh Fringe rather than a keyboard:) Perhaps when the first UK Pirate Party MP or MEP is elected the government will wake up to the startling wrongheadedness of the current approach.

So this is why I continue to care about this topic, and why you should too. Read the ORG blog; write to your MP and MEP; complain.

Monday, August 10, 2009

V for Videos

Pangloss is teaching Internet law to undergrads for the first time in a while this academic year coming and was idly wondering if she could spend the first lecture showing videos with which to seduce the suckers , sorry, encourage the freshers to understand how exciting IT law is:-)

These are first thoughts for the curriculum - would anyone else like to suggest their own favourites? In particular, it's not hard to find fun videos on file sharing, privacy and social networking sites (indeed web 2.0 in general) - but I could do with help on less obvious stuff like e-contracting, e-commerce or other aspects of IP??

here's my starting favourites!

Web 2.0

The machine is us - Web 2.0 changes everything

"FriendFace" (IT Crowd) - web 2.0 - social networks and privacy

The Facebook Song

Wikipedia, editing the umlaut - web 2.0 and distributed editing

What is web 2.0? an educationalperspective - intro to web 2.0

Privacy

Big Brother State - privacy & surveillance

The Last Enemy extract - life as an un person in an ID card world

ACLU pizza delivery - private/public data collection and privacy

IP

4chords (Axis of Awesome) - creativity, mash ups, copyright, parody

Filesharing RIAA parody ad (IT Crowd) - filesharing and P2P

3 minute medley on the music wars(from TED)

Content and tubes

The Internet is For Porn - self explanatory

Net Neutrality, Lessig-style - infrastructure

Tuesday, August 04, 2009

Update on amendment 138

If you were thinking things had gone strangely quiet on this front, well.. (via ORG blog)

"DG Information Society has quietly released its position on the Telecoms Package Second Reading, just as everyone is heading off for the summer holidays. No doubt Commissioner Viviane Reding was hoping no-one would see it. Why? It calls for a “compromise” text which the Council of Ministers was trying to push onto the European Parliament, which could have the effect of giving permission to governments to block access to Internet services and applications.

The so-called “compromise” is the replacement of Amendment 138 ( which seeks to protect users rights on the Internet) with an alternative which was drafted by the Council (sometimes known as the ‘fake 138′). The replacement, when considered in context with other Amendments in the Package, will seal in to the Telecoms Framework a right for governments to implement ‘measures regarding end-users’ access to or use of services and applications through electronic communications networks’.

The so-called “compromise” is positioned in Article 1 of the Framework directive, addressed to Member States. It should be read in conjunction with Amendment 1.2a of the Universal Services and Users Rights directive, which will permit broadband providers to block impose “conditions limiting access to and/or use of services and applications”. In light of T-Mobile blocking Skype, BT throttling peer-to-peer services, and Karoo, a small UK ISP cutting off users, it should now be abundantly clear what this text means. . "

Source: IpTegrity

(without prejudice - Pangloss has not seen the original text yet)

Sunday, August 02, 2009

The Economics of Privacy on Social Networks

Pangloss is pleased to see that Joseph Bonneau of the Cambridge Computer lab has now blogged the terrific work his team have done examining the uptake, marketing and impact of privacy tools provided by social networking sites.

Bonneau's team examined 45 sites, collecting over 250 data points about each sites’ privacy policies, privacy controls, data collection practices, and more. The results were fascinating, as presented at the WEIS conference in London. The full paper and complete dataset are available online as well.

For anyone who's ever wondered why the Facebook privacy tools are greyed out on the front page compared to the other menu items, there are revelations:

"The most interesting story we found though was how sites consistently hid any mention of privacy, until we visited the privacy policies where they provided paid privacy seals and strong reassurances about how important privacy is. We developed a novel economic explanation for this: sites appear to craft two different messages for two different populations. Most users care about privacy but don’t think about it in day-to-day life. Sites take care to avoid mentioning privacy to them, because even mentioning privacy positively will cause them to be more cautious about sharing data. This phenomenon is known as “privacy salience” and it makes sites tread very carefully around privacy, because users must be comfortable sharing data for the site to be fun. Instead of mentioning privacy, new users are shown a huge sample of other users posting fun pictures, which encourages them to share as well. For privacy fundamentalists who go looking for privacy by reading the privacy policy, though, it is important to drum up privacy re-assurance."


In other words, as long suspected, privacy is the enemy of the SNS business model and the sites are very well aware of this, despite being having to be seen to pay lip service to increasing numbers of well meaning codes of practice. Indeed the full paper found that SNS which actively marketed themselves as privacy-protective and hence attracted "privacy fundamentalists", tended simply not to do very well (assessed by longevity and growth of audience in the market). What incentive then to make privacy tools easy to see and use for consumers?

This study adds to the weight of evidence that self regulation and consumer education are not ultimately anything like a real solution to the current problems of voluntary and involuntary data disclosure on SNSs. Good to see real empirical evidence like this :)

Also worth noting for security scholars: the papers are in the main now available from Security and Human Behaviour 2009, the "new" conference (following on from the succes of WEIS) on security and how it is affected by psychological and social factors. Hoping to have time to digest these in thenext few weeks, especially as I've been asked to speak myself at the Cyber Conflict Law and Policy Conference at the Cooperative Cyber Defence Centre of Excellence (CCD COE) in Estonia in September. Should be fascinating :-)

Friday, July 17, 2009

Law and the Internet 3rd edn



I'm very happy to announce that the above book is now at proof stage and on schedule to be out for the new academic year. Here is another look at the lovely cover courtesy of Randall Munroe of XKCD :-) Many thanks to all the contributors who worked so hard and waited so long for this. The full list of contents is:

Part I Introduction – Governance

Introduction: International Governance and the Internet
Antony Taubman

Part II Electronic Commerce

1. The Fall and Rise of Intermediary Liability Online
Lilian Edwards
2. The Changing Face of Electronic Consumer Contracts in the Twenty-First Century: Fit for Purpose?
Christine Riefa and Julia Hörnle
3. The Jurisdictional Challenge of the Internet
Julia Hörnle
4. EC regulation of audio-visual content on the Internet
Elizabeth Newman

Part III Intellectual Property

5. ‘Appropriate for the Digital Age’? Copyright and the Internet:
(1) Scope of Copyright
Hector L MacQueen
6. ‘Appropriate for the Digital Age’? Copyright and the Internet:
(2) Exceptions and Licensing
Hector L MacQueen
7. Search engines and copyright: Shaping information markets
Charlotte Waelde
8. Search Engines, Keyword Advertising and Trade Marks: Fair Innovation or Free Riding?
Tobias Bednarz and Charlotte Waelde
9. Domain Names and Trade Marks: an Uncomfortable Inter-relationship.
Caroline Wilson
10. Protection of Computer Software
Arne Kolb
11. Free and Open Source Software
Andrés Guadamuz
12. Scholarly communications and new technologies: open access
Charlotte Waelde
13. Competition, IP and the Internet
Abbe Brown


Part III Privacy, data protection and cyber-crime

14. Privacy & Data Protection1 : The Laws Don’t Work
Lilian Edwards
15. Consumer Privacy Law 1: Online Direct Marketing
Lilian Edwards
16. Consumer Privacy Law 2: Data Collection, Profiling and Targeting
Lilian Edwards
17. Privacy and Surveillance: Legal and Socioeconomic Aspects of State Intrusion into Electronic Communications
Judith Rauhofer
18. The Retention of Communications Data in Europe and the UK
Judith Rauhofer
19. A Criminological Introduction to Cyber-crime
Richard Jones
20. Pornography, Censorship and the Internet
Lilian Edwards
21. Information Security and Cyber-crime
Ian Brown, Lilian Edwards and Chris Marsden




Pending publication, I've uploaded the draft versions of several of the chapters for viewing - please note some or all of these are likely to come down after publication - so if you're interested, go look now!

Pornography, Censorship and the Internet - Liian Edwards

Consumer Privacy Law 2: Data Collection, Profiling and Targeting - Lilian Edwards and Jordan Hatcher

Information Security and Cybercrime - Ian Brown, Lilian Edwards and Chris Marsden

Ps I have also uploaded a couple of my filesharing and three strikes pieces to my SSRN page.

Monday, July 13, 2009

Death 2.0

Thomas Crampton, an Asia-based journalist and blogger, has posted a video he made after I gave a paper in Hong Kong in June 2009 at Peter Yu's Digital Converges Conference, on succession to digital assets , including social network profiles and emails etc, here.



There's also a write up to go with it here.

I'll be giving an updated version of this at GiKii in Amsterdam in September :-)

Saturday, July 04, 2009

Breach of web site terms is NOT the crime of hacking

Via the excellent b2fxx, I hear that the Lori Drew case has been reversed on appeal. The judge has reportedly set aside the earlier jury verdict holding a Missouri woman, Lori Drew, responsible for driving a teenage girl to commit suicide, through exchanges in MySpace.
"A federal judge on Thursday overturned guilty verdicts against Lori Drew, issuing a directed acquittal on three misdemeanor charges.

Drew, 50, was accused of participating in a cyberbullying scheme against 13-year-old Megan Meier who later committed suicide. The case against Drew hinged on the government’s novel argument that violating MySpace’s terms of service was the legal equivalent of computer hacking. But U.S. District Judge George Wu found the premise troubling.

“It basically leaves it up to a website owner to determine what is a crime,” said Wu on Thursday, echoing what critics of the case have been saying for months. “And therefore it criminalizes what would be a breach of contract.”"



This was always likely to be a blip case brought on by a particularly unfortunate set of circumstances. But it's good to see it not being left in place long as any kind of precedent.

Thursday, June 18, 2009

GikII Amsterdam: last call!

Here's a brief and last reminder about GikII 2009, (as some of
you well know) the coolest IT law conference on the block, this year
transmigrated from UK to Amsterdam, by kind generosity of the IViR!

Submission of abstracts deadline is 1 July, tho this can probably slip a few days:-) We are expecting to be over subscribed (honest) so act fast! Acceptance of abstracts wil be announced by August 1. Submissions to vanhoboken@ivir.nl .

As ever, the order of the day is blue skies papers, law/tech/pop
culture/interdisciplinary, numbers capped at 40, preference for space to those
giving papers, especially ones about the Singularity :) no conference fee for speakers or attendees, ppts that could past muster in the next Banksy show, passing mentions of law, and all the LOLcats you can eat:-)

Facebook, DP and Apps

According to this article in the FT, the Art 29 Working party on Data Protection has produced an unpublished opinion which, if I read it correctly, seems to suggest that they way FB shares data with, and encourages its users to share data with, unknown and unpoliced third party "apps", needs stricter DP regulation.

According to FT,

"regulators say tighter rules are needed to protect personal data given to these third-party developers. In particular, they believe developers should be subject to tough European Union privacy and data protection rules, even when the companies concerned are located far from Europe.

At the same time, they argue that many corporate marketers who have turned to new forms of social media as a way to reach consumers should also be subjected to stiffer regulations."


Which is pretty much what Ian Brown and I suggested only two years ago :) (Incidentally that piece is finally seeing the published light of say shortly in Andrea Matwyshwn's great edited collection, Harbouring Data (Stanford U Press).

I'm not finding this opinion on the usual Art 29 page: if anyone has it in advance, I would very much like to see it.

Along with various recent reports suggesting that privacy defaults on social networking sites need tighter attention, for everyone not just children, it does seem the privacy and security risks of SNSs are finally getting the serious attention they deserve. (Is it just a coincidence btw that this happens as the Iranian situation shows more clearly than ever the power wielded by social networks these days??)

Wednesday, June 17, 2009

Digital Britain : a regressive tax

Excellent comment from Charles Arthur at the Guardian

Against that backdrop, it is hardly surprising that the report is not wildly imaginative. It deals with structure and delivery of content, rather than the content itself. It worries about provision of local news, but (with the exception of a potentially interesting proposal on a role for new local news consortiums) decides that the main answer lies with regional TV news. To be sure, Mr Bradshaw is taking a risk in imposing a £6 annual poll tax on all fixed-line phone users to pay for extending the broadband pipe network - but it is the wrong kind of risk. Some will question the fairness of Aunt Agnes in Liverpool paying higher phone bills to enable her teenage nephew in the Scottish Highlands to download games. But there is a bigger problem with this proposal: the public is subsidising private companies to gain greater market access - with no public returns. When the government pumped money into the banks, it took a big chunk of equity for the taxpayer; here it is pumping money into the broadband network and taking nothing in return. There will be no equity stakes (which would at least have been fair), nor is it easy to regulate what goes down those broadband pipes. This amounts to an unconditional transfer of resources from the very poorest to the big technology firms
.

Tuesday, June 16, 2009

Five Strikes And Counting: the Future of Digital Britain/Europe/Canada?

Re Sarkozy's latest revamp of HADOPI, I don't think I can face saying anything except, oh good grief Charlie Brown. Still I suppose judicial oversight IS actually what we want (if it's real and not just rubber stamp)t, so it's kind of good news :) (well we want so much more, like sense, but will we ever get it?)

Oddly, only three days ago, no one less than the multitalented Daniel Gervais reassured me (at the HK conference again, natch) that the French Constitutional Court decision, declaring 3 Strikes an unconstitutional limitation on access to knowledge and speech, was the definite end of HADOPI, for good. Mais non!

This is all the sadder as Daniel himself was at the time outlining a proposal he has developed with the Songwriter's Association of Canada, for a terrific flat rate levy "all you can download" system to be tried out in that country. Long time readers will recall Pangloss has long been a fan of flatrate levies to legitimise filesharing and provide proper creator revenues, removing the need for litigation and sanctions which often threaten human rights: but the brilliance of this scheme is that it is voluntary, but with incentives likely to make it viably near-universal.

Users will be able to opt in to paying a flat rate payment per month (added on to their monthly ISP bill) and then download any amount of music from Canadian-distributing record companies, perfectly legally. If you choose not to opt in, however, this is perfectly Ok but you have to sign a declaration saying you do not fileshare. Any subsequent discovery to the contrary is like to to be judged unkindly by the courts :) and it is likely that (rather as with those who don't pay a TV license fee in the UK) you would go on a "watch carefully" list (though this part was vague in detail yet).

Money collected by ISPs as part of monthly billing is simply handed over to existing collecting societies who distribute it as usual. ISPS are incentivised to take past becauze they save money by providing the digital music access via P2P, a la BBC's iPlayer - thus vastly reducing their bandwidth issues, and removing any need to monitor, filter or "traffic manage".

Simple, sensible, good human rights, good for artists, good for users, and a good combination of carrot and sticks. ISPs too can choose to opt in or out - how different from the acts of our own dear government, still determined to dragoon UK ISPs into propping up a failing business model, alienating their own client base and potentially breaching fundamental rights.

In the UK the nearest we yet have to this scheme among the big ISPs (leaving aside small innovative players like PlayLouder here) has emerged from Virgin's announcement that (from the Beeb) :"

For a monthly fee, Virgin's broadband customers will be able to download or stream as many MP3 files as they want.As part of the deal, Virgin has pledged to aggressively police usage to stop the MP3 tracks turning up on file-sharing networks."

The problem is that Virgin's all you can eat deal only covers Universal artists. Virgin say it is in talks to add other music firms' back catalogues to the service. But are there any prospects of all the major labels coming in, as in the Canadian scheme, to make legal P2P as attractive as the illegal version? Pigs might fly, seems the general gist of the informed response.

Which brings me back to to the newly released final Digital Britain report. Pangloss will have to take this one home, but the Beeb reports as highlights:

"The main points outlined in the report include:

• a three-year plan to boost digital participation

• universal access to broadband by 2012

• fund to invest in next generation broadband

• digital radio upgrade by 2015

• liberalisation of 3G spectrum

• legal and regulatory attack on digital piracy

• support for public service content partnerships

• changed role for Channel 4

• consultation on how to fund local, national and regional news

One of the biggest surprises in the report was the promise to introduce a levy on fixed telephone lines in order to pay for broadband rollout.

It will amount to a 50p a month tax for every household in the country with a fixed phone line."

On filesharing specifically: (para 46)

"...thirdly we aim to provide for a graduated response by rights-holders and ISPs
so that they can use the civil law to the full to deter the hard core of users who
wilfully continue unlawful activity. The Government intends to provide
initially for Ofcom to have a duty to secure a significant reduction in
unlawful file sharing by imposing two specific obligations: notification of unlawful activity and, for repeat-infringers, a court-based process of
identity release and civil action.

The Government is also providing for intermediate technical measures by ISPs, such as bandwidth reduction or protocol blocking, if the two main obligations have been reasonably tried but, against expectations, shown not to have worked within a reasonable but also reasonably brisk period."

Reportedly, the aim will be for these tactics to reduce illegal file sharing by 70%. Quite a target given rough guesses that 90% plus of downloading is currentkly unauthorised.

Same old, same old. So we can, it seems, organise a levy to pay for rural broadband - which every person in the country will have to pay, whether they use it or not and are urban or rural - but are unwilling to contemplate a system like the Canadian voluntary levy, where those who don't want to fileshare simply get to opt out, and those who do, get to pay a sensible amount instead of being slowed down till they can no longer use the Net for useful stuff like jobs, education and social interaction. Sigh. Double sigh. No more: I've said it all before.

One faint piece of good news is that as the Guardian notes:

"The final report does not contain any suggestion of a statutory "rights agency" that would try to reduce copyright infringement online, as was suggested in the interim report released earlier this year – to widespread criticism. Instead, the final report says "we hope that an industry body ... will come into being to draft these codes [of practice for identifying offenders] for Ofcom to approve and we would encourage all rights holders and ISPs to play a role in this."

So we don't have to pay the levy to pay for the SRA anyway. Not yet anyway. Small comfort :-) Note the codes are still to be drafted by the industry and approved by Ofcom , with a thumbs up from ISPs and rightsholders. Where is the consumer voice in all this??? In the words of Chirpy Chirpy Cheep Cheep, apparently far, far away...


Brandjacking and FaceSquatting

Interesting times (as ever) in the social networking sites/personal branding crossover world. One of the most interesting papers from Digital Convergence HK was by Lisa P. Ramsey, University of San Diego School of Law on "brandjacking", on social networks - the increasing practice of grabbing famous personal or corporate names on social networks, even if they're not you (or not exclusively you).

Twitter has had quite a history of this, as the current locus of choice for celebrity blogging - but it is also, less obviously, becoming of enormous commercial significance - just a few days ago Dell proudly announced it had sold c $3m worth of computers through its Twitter shop (though as one commenter wisely says, are these new sales or just diverted from other salespoints??)

To respond to this, Twitter has just announced a verified account process - at first rolled out only for personal, not commercial, usernames and aimed at famous names (eg the likes of Neil Gaiman and Stephen Fry, who have been plagued by imitators/admirers). The new service at the moment merely invites those afflicted to submit their details but not does not give any details of what evidence will be used to ascertain who is who , nor how to distinguish between two worthy competitors for the same name - eg my brother is called Jonathan Edwards and is a consultant IT and office automation lawyer, but there is also Jonathan Edwards the former medal winning triple jumper! Who should get the Twitter space? Neither is exactly Janet Jackson... and arguably though the sport one may be more famous, my brother can make better commercial use of this particular space?? Interestingly anyone can apply to be verified - so Pangloss has, sub nom Lilian Edwards! Let's see if they reply :-)

And even practically as Lisa was speaking, the social network "domainspace" expanded enormously with Facebook's sudden overnight launch of personal usernames. The resulting land grab and predictable accompanying furore of lost and fraudulent claims has been rather wonderfully, named Facesquatting and all kinds of virtual dust is still settling. The Grauniad say "Facebook says 500,000 users grabbed their usernames within 15 minutes of the system going live, with no reports of major squabbles so far."

Lisa suggested that as with domain names, the law of trade marks should be relevant to protect brands, and needs re examining to see if it could meet this kind of challenge. She then canvassed the kinds of problems that may result, familiar to those who've followed the ICANN wars. What about businesses whose name is a generic, like Apple Computers ? Should they get preferential treatment on Twitter or FB when they wouldn't in TM law?

Pangloss checked and on FB, Apple-we-know-and-love has Apple Store and Apple Ipod, but the page "Apple" has actually been registered by, er, a lover of apples. Yes, the green vitamin-loaded things! PG is quietly pleased at this triumph of nature over commerce :)

So should the Cox- lover be deposed by FB, or if they don't play ball, even sued under TM law, or fined under the US Anti CyberSquatting law, or local equivalents? If so, why? And what about Fiona Apple the singer, who sells most her records over the Internet these days, and also has an FB "be a fan" page??

Social networks were originally set up to allow people to be, well, social, not to sell things - and to be fans of things like pop groups, books, movies, comics and er fruit : all extensions of their personality. Yet as the Grauniad wisely suggest, it is likely the SNSs will bend over backwards to make provision to allow remedies against "facesquatting" etc because the businesses and the celebrities are the place where they will, if ever, find a revenue stream more reliable than mere ads. As the Grauniad adds : "

"In truth, though, I think the odd timing shows us something else: that the real target of Facebook usernames aren't users at all, but the companies, brands and high-profile celebrities who can be convinced to pay for services somewhere down the line.

And they've already had their usernames granted to them, regardless of the timing of the launch. Anyone else is just going along for the ride."

Multiple registrations on multiple networks (FaceBook, Twitter, Bebo, whatever) will also be a problem. The brand-owners are already aghast at the prospect of the extension of the URL domain name space to cover internationalised domain names (Kanji, Korean alphabet, etc) because they see this not as an opportunity to brand more effectively to their customer bases , but as creating hundreds of new domain names they'll have to buy up and police to avoid cybersquatting. What should be a blessing has become a curse. Interestingly, PG has been directed to a lovely tool to check whether your name is available on multiple SNSs - reportedly it has been much used in the Facebook username goldrush!!

Pangloss is deeply unsure if some new version of TMs and domain name law should be adapted or invented for the social namespace. For one, there is simply not, or at least not always, the same problem as there is with domain names used as URLs: that there can be only one. There is already more than one Lilian Edwards on Facebook (and I am lucky to have an unusual first name) but there can only be one lilian.facebook.com (and it is not me) or even liianedwards.co.uk.

Is it really helping any to give me yet more opportunities to fight it out with the other Liians ) at least one of whom has her own business, selling elephant drawings!!) ? Isn't the real solution here better granular search facilities on FB and other sites, not giving out and policing unique vanity URLs? There is already substantial evidence the public now overwhelmingly finds sites via Google not via typing in random URLs anyway.

But - as Lisa pointed out - is the issue not actually more of public confusion, than of brand maintenance? If I find a site called Dell on Twitter, will I assume it is the real Dell selling me reputable computers, not some rip-off merchant? Perhaps, but here as noted Twitter is already bringing in its own solutions (and asking businesses to pay for a verified site at some future point doesn't seem too wrong to me either, if it leads to $3m extra sales.).

In the Twitter celebrityspace there is also a rather cute emergent norm, that when a name has been snaffled, the celebrity renames as " -himself" - so eg Neil Gaiman is @neilhimself.

As well as these "norm" solutions, if the problem is public confusion, can't that be better met by enforcing existing public laws on false advertising, fraudulent commercial practices, etc, than by inviting vast swathes of private trade mark litigation, which might in turn need the reinvention of the ICANN UDRP procedure, international treaty negotiation, etc etc, all over again? This seems to me like a place where we should not in knee jerk fashion turn to an IP solution. We don't need more property for companies to fight over here, and given the costs of policing the brand, they possibly don't want it either; all we need are workable solutions for consumers.

Lisa pointed out correctly that most false advertising rules only apply to commercial actors - but this doesn't have to be so. In fact in the UK, it is an offense in advertising law to deceptively hold yourself out as a private person when you are in fact a business ( for more on this and the problem of the emergent hybrid consumer or "prosumer" see Christine Riefa's chapter on e-contracts in the upcoming - guess what - 3rd edn of Edwards and Waelde eds Law and the Internet.)

Let's stop and think a bit before we jump again to create yet more new IP rights, ok?


Pangloss is now at a hotel with a pool and a beach :-)) so she's going to try to take a break from all this intellectual fever!! Bye for now :)

The Revolution Will In Fact Be Twittered

Interesting report from Boing-Boing on the coverage by Iranian bloggers of their situation via Twitter.

I've been noticing retweets from Iran on my own Twitterlist. They do seem to be reaching an unusually diverse selection of people.


"Wagner James Au says,
Iranians around the world are making extraordinary use of Twitter and Twitter APIs to send updates and coordinate the uprising that now disputes Ahmadinejad's election. (Some background from Andrew Sullivan here) Last night Tweets from Iran seemed to go silent for several hours, apparently after Iranian government intervention, but protesters just used TwitterFall.com and other workarounds to keep the information stream going. (As one developer supporter put it, "Open APIs equal freedom.") The mainstream media has been tragically slow to cover what seems to be a major social upheaval fueled by Twitter. "