No, The Public Standing Up For An Open Internet Is Not A Criminal Google Conspiracy

from the the-public-is-not-google dept

Over the past decade, we've talked about music industry lawyer Chris Castle and his bizarre interpretation of reality a few times. He insists that anyone supporting the legal sharing of content via Creative Commons is "self-serving shilling for the self-absorbed on the short con," which I'm sure must have sounded clever in his mind. A key target for Castle and his friends is that Google is the representation of all that is evil in the music industry. It's a convenient foil. Castle and his friends see Google lurking behind anything that's not like the old days, similar to the way that adults freaked out that pinball machines were destroying the minds of the youths in earlier generations.

Castle's latest claim, however, is positively crazy. Not only is he upset about the EU Parliament has agreed to reopen Article 13 of the EU Copyright Directive for discussion, he's decided that the only reason they did so must be due to a criminal conspiracy by Google, for which he is demanding an investigation.

... there have been incredible and probably illegal uses of the Internet to overwhelm elected officials with faux communications that reek of Google-style misinformation and central planning in the hive mind of the Googleplex.

We saw this again with the Article 13 vote in Europe last week with what clearly seems to be a Google-backed attack on the European Parliament for the purpose of policy intimidation. That’s right–an American-based multinational corporation is trying to intimidate the very same European government that is currently investigating them for anticompetitive behavior and is staring down a multi-billion dollar fine.

Vindictive much?

Apparently, the idea that the public might actually speak out when they realize that a terribly written proposal would lead to massive censorship of the internet is unfathomable to him.

And let's be clear here. This entire claim doesn't even pass the slightest laugh test. Google already complies with almost everything in Article 13. The whole point of Article 13 is to try to force nearly every site that hosts user content to install a ContendID like system. Google already has ContentID. Indeed, if anything, Article 13 would cement Google's dominant position by making it nearly impossible for newer, more innovative startups to enter the space without spending the tens of millions of dollars Google spent on ContentID.

The idea that Google would lead some "fake" public protest against Article 13 is ludicrous. But, this Google Derangement Syndrome seems impossible for those in the RIAA set to get rid of. I've mentioned before that just weeks after a massive public protest of SOPA stopped that bill from becoming law, I ended up at a dinner with an RIAA board member, who simply refused to believe that the public even cared one bit about SOPA/PIPA and insisted that the only reason the bill failed was because Google stepped up (in reality, Google was much slower than a ton of internet startups to recognize the threat of SOPA).

Indeed, this same derangement could be found in the tweets of former RIAA top exec Neil Turkewitz, who hilariously responded to the impact of widespread public protests by insisting that it was obviously not the will of the people stating:

Does anyone think the people have spoken? I doubt it. Democracy, freedom of expression & common sense were upended by allowing a Pirate & a fantastically large company w/ something to gain to define the terms of our freedom. A freedom w/o justice. An infant’s version of freedom.

Got that? Democracy, freedom of expression and common sense were upended... by people speaking out about the massive problems with Article 13. This is especially hilarious coming from Turkewitz, who worked for three decades on policy issues for the RIAA, at a time when the RIAA did so much of its policy awfulness by hiding it away from the public, in particular by sneaking awful ideas into secretly negotiated trade agreements, and then turning around and demanding that democratically elected legislatures write laws to match what he helped the RIAA sneak into those agreements. Or how about the will of "the people" when Turkewitz's RIAA colleague, just months before taking his job with the RIAA literally snuck four words overnight into a bill that would help the RIAA member labels take away rights from all of its artists. Was that "the will of the people"?

The recording industry spent decades actively subverting the will of the people at every turn. Even though the Constitutional mandate for copyright be that it promote the progress of science and learning by providing more material into the public domain, the RIAA spent decades -- usually in secret -- pushing and changing the law to turn it into a welfare system for record labels. For decades, "the public" wasn't even aware of what was happening, in part because copyright directly touched their lives so little.

That changed with the advent of the internet, and the fact that copyright and the internet don't work all that well together. Now, these changes that the RIAA used to push through in a smokey backroom is likely to impact the tools and services that billions of people use to communicate every day. And the consequences of those changes will have a huge impact on them. So no one should be surprised when the public speaks out about this. It's not a criminal conspiracy by Google. It's the public actually caring about what the internet looks like and whether or not they'll be allowed to speak without first getting permission and a license.

Filed Under: article 13, chris castle, conspiracy, copyright, neil turkewitz, progress, public interest
Companies: google

Democratic National Committee's Lawsuit Against Russians, Wikileaks And Various Trump Associates Full Of Legally Nutty Arguments

from the slow-down-there-dnc dept

This morning I saw a lot of excitement and happiness from folks who greatly dislike President Trump over the fact that the Democratic National Committee had filed a giant lawsuit against Russia, the GRU, Guccifier 2, Wikileaks, Julian Assange, the Trump campaign, Donald Trump Jr., Jared Kushner, Paul Manafort, Roger Stone and a few other names you might recognize if you've followed the whole Trump / Russia soap opera over the past year and a half. My first reaction was that this was unlikely to be the kind of thing we'd cover on Techdirt, because it seemed like a typical political thing. But, then I looked at the actual complaint and it's basically a laundry list of the laws that we regularly talk about (especially about how they're abused in litigation). Seriously, look at the complaint. There's a CFAA claim, an SCA claim, a DMCA claim, a "Trade Secrets Act" claim... and everyone's favorite: a RICO claim.

Most of the time when we see these laws used, they're indications of pretty weak lawsuits, and going through this one, that definitely seems to be the case here. Indeed, some of the claims made by the DNC here are so outrageous that they would effectively make some fairly basic reporting illegal. One would have hoped that the DNC wouldn't seek to set a precedent that reporting on leaked documents is against the law -- especially given how reliant the DNC now is on leaks being reported on in their effort to bring down the existing president. I'm not going to go through the whole lawsuit, but let's touch on a few of the more nutty claims here.

The crux of the complaint is that these groups / individuals worked together in a conspiracy to leak DNC emails and documents. And, there's little doubt at this point that the Russians were behind the hack and leak of the documents, and that Wikileaks published them. Similarly there's little doubt that the Trump campaign was happy about these things, and that a few Trump-connected people had some contacts with some Russians. Does that add up to a conspiracy? My gut reaction is to always rely on Ken "Popehat" White's IT'S NOT RICO, DAMMIT line, but I'll leave that analysis to folks who are more familiar with RICO.

But let's look at parts we are familiar with, starting with the DMCA claim, since that's the one that caught my eye first. A DMCA claim? What the hell does copyright have to do with any of this? Well...

Plaintiff's computer networks and files contained information subject to protection under the copyright laws of the United States, including campaign strategy documents and opposition research that were illegally accessed without authorization by Russia and the GRU.

Access to copyrighted material contained on Plaintiff's computer networks and email was controlled by technological measures, including measures restricting remote access, firewalls, and measures restricting acess to users with valid credentials and passwords.

In violation of 17 U.S.C. § 1201(a), Russia, the GRU, and GRU Operative #1 circumvented these technological protection measures by stealing credentials from authorized users, condcting a "password dump" to unlawfully obtain passwords to the system controlling access to the DNC's domain, and installing malware on Plaintiff's computer systems.

Holy shit. This is the DNC trying to use DMCA 1201 as a mini-CFAA. They're not supposed to do that. 1201 is the anti-circumvention part of the DMCA and is supposed to be about stopping people from hacking around DRM to free copyright-covered material. Of course, 1201 has been used in all sorts of other ways -- like trying to stop the sale of printer cartridges and garage door openers -- but this seems like a real stretch. Russia hacking into the DNC had literally nothing to do with copyright or DRM. Squeezing a copyright claim in here is just silly and could set an awful precedent about using 1201 as an alternate CFAA (we'll get to the CFAA claims in a moment). If this holds, nearly any computer break-in to copy content would also lead to DMCA claims. That's just silly.

Onto the CFAA part. As we've noted over the years, the Computer Fraud and Abuse Act is quite frequently abused. Written in response to the movie War Games to target "hacking," the law has been used for basically any "this person did something we dislike on a computer" type issues. It's been dubbed "the law that sticks" because in absence of any other claims that one always sticks because of how broad it is.

At least this case does involve actual hacking. I mean, someone hacked into the DNC's network, so it actually feels (amazingly) that this may be one case where the CFAA claims are legit. Those claims are just targeting the Russians, who were the only ones who actually hacked the DNC. So, I'm actually fine with those claims. Other than the fact that they're useless. It's not like the Russian Federation or the GRU is going to show up in court to defend this. And they're certainly not going to agree to discovery. I doubt they'll acknowledge the lawsuit at all, frankly. So... reasonable claims, impossible target.

Then there's the Stored Communications Act (SCA), which is a part of ECPA, the Electronic Communications Privacy Act, which we've written about a ton and it does have lots of its own problems. These claims are also just against Russia, the GRU and Guccifer 2.0, and like the DMCA claims appear to be highly repetitive with the CFAA claims. Instead of just unauthorized access, it's now unauthorized access... to communications.

It's then when we get into the trade secrets part where things get... much more problematic. These claims are brought against not just the Russians, but also Wikileaks and Julian Assange. Even if you absolutely hate and / or distrust Assange, these claims are incredibly problematic against Wikileaks.

Defendants Russia, the GRU, GRU Operative #1, WikiLeaks, and Assange disclosed Plaintiff's trade secrets without consent, on multiple dates, discussed herein, knowing or having reason to know that trade secrets were acquired by improper means.

If that violates the law, then the law is unconstitutional. The press regularly publishes trade secrets that may have been acquired by improper means by others and handed to the press (as is the case with this content being handed to Wikileaks). Saying that merely disclosing the information is a violation of the law raises serious First Amendment issues for the press.

I mean, what's to stop President Trump from using the very same argument against the press for revealing, say, his tax returns? Or reports about business deals gone bad, or the details of secretive contracts? These could all be considered "trade secrets" and if the press can't publish them that would be a huge, huge problem.

In a later claim (under DC's specific trade secrets laws), the claims are extended to all defendants, which again raises serious First Amendment issues. Donald Trump Jr. may be a jerk, but it's not a violation of trade secrets if someone handed him secret DNC docs and he tweeted them or emailed them around.

There are also claims under Virginia's version of the CFAA. The claims against the Russians may make sense, but the complaint also makes claims against everyone else by claiming they "knowingly aided, abetted, encouraged, induced, instigated, contributed to and assisted Russia." Those seem like fairly extreme claims for many of the defendants, and again feel like the DNC very, very broadly interpreting a law to go way beyond what it should cover.

As noted above, there are some potentially legit claims in here around Russia hacking into the DNC's network (though, again, it's a useless defendant). But some of these other claims seem like incredible stretches, twisting laws like the DMCA for ridiculous purposes. And the trade secret claims against the non-Russians is highly suspect and almost certainly not a reasonable interpretation of the law under the First Amendment.

Filed Under: cfaa, conspiracy, dmca, dnc, donald trump junior, ecpa, gru, hack, hacking, jared kushner, julian assange, paul manafot, rico, roger stone, russia, sca, trade secrets
Companies: dnc, wikileaks

The Indictment Against Malware Researcher Marcus Hutchines Is Really Weird

from the why-is-that-illegal? dept

So, yesterday, we wrote a quick post about recently-famous malware research Marcus Hutchins (famous for accidentally stopping the WannaCry attack) being detained by the FBI as he left Defcon. An hour or so later, we updated it with the details of the indictment which had been released. That had my quick response, which noted that the "evidence" didn't seem very strong. It just claims (without anything else) that Hutchins wrote the Kronos malware, and most of the indictment and most of the activity focuses on a second defendant (whose name is redacted) who apparently was out selling the malware. I was planning to write up a more thorough look at the indictment and its problems today, but last night, Orin Kerr beat me to it, and he (famed lawyer, law professor and former assistant US attorney) has a bit more expertise in the subject, so let's work off of his analysis.

The crux of the indictment is that Hutchins and the unnamed "co-conspirator" worked together to create and sell malware, leading Kerr to ask the fairly obvious question:

This raises an interesting legal question: Is it a crime to create and sell malware?

After all, as many others pointed out, there are lots of folks out there who build and sell malware of one kind or another -- and, indeed, the US government is often a large purchaser of malware sold by others. Kerr's initial gut reaction was more or less the same as mine: that the actual amount of evidence in the indictment is pretty minimal, though obviously they may have a lot more that just hasn't been shared yet (or they may turn up more).

Do the charges hold up? Just based on a first look at the case, my sense is that the government’s theory of the case is fairly aggressive. It will lead to some significant legal challenges. It’s hard to say, at this point, how those challenges will play out. The indictment is pretty bare bones, and we don’t have all the facts or even what the government thinks are the facts. So while we can’t say that this indictment is clearly an overreach, we can say that the government is pushing the envelope in some ways and may or may not have the facts it needs to make its case. As always, we’ll have to stay tuned.

From there, Kerr digs into each of the charges. The first is "conspiracy." This one struck my layman's mind as somewhat odd. Two people working together does not a conspiracy make. Kerr similarly calls it "odd" and notes that for this charge to work, the government has to argue that selling malware is the same as using malware to damage a computer. And that seems... difficult. Kerr points out that there are two conditions that must be met for this to work:

First, the government must prove that Hutchins and X had an intent to damage a computer. That is, the goal of their conspiracy must have been to impair the availability or integrity of a program or data. Maybe there are facts that support that, but at the very least they don’t appear in the indictment. The indictment makes it seem that the purpose of selling the malware was to, well, sell malware. It’s not obvious that Hutchins and X cared what the buyer did with the malware after so long as they paid. If Hutchins and X didn’t care what the buyer did with the malware, it’s hard to see how they could have a purpose to impair the availability or integrity of a computer.

Second, the government must prove that the agreement was to cause the result of damaging a computer. In an ordinary 1030(a)(5)(A) case, causation is easy. The person sends the malware and the malware damages the machine. Here, though, the government’s theory adds an intermediary: The theory seems to be that Hutchins and X conspired, and the goal of their collective activity was to cause damage, even though the actual act of damaging a computer (if it happened) was to be caused directly by the buyer using the malware rather than by Hutchins and X.

That second point is especially interesting to me. We've seen more and more attempts to charge "intermediaries" with crimes based on actions of third party users of their tools (the Megaupload case being one big example). And that seems like a very dangerous path to go down. One of the reasons why we talk about "intermediary liability protections" on Techdirt so much is that they're so important on a basic "blame the person who actually did the wrong" spectrum. It's not the intermediary, it's the user. Go after the user, even if that's more difficult. Here, the DOJ seems to be going after the intermediary. Because.

The next three charges are all similar, and I didn't quite get them at first, but Kerr explains. They're making use of 18 U.S.C 2512 which Kerr describes as, "a rarely-used law that criminalizes making, selling, or advertising for sale illegal wiretapping devices." Yes, wiretapping devices. Here, Kerr focuses on the question of whether or not a piece of malware software is a "device" under the law, and argues that may be difficult as well.

In Potter v. Havlice, 2008 WL 2556723 (S.D. Ohio 2008), the plaintiff sued the defendant under Section 2512 for making and selling “Activity Monitor,” which was billed as “an ideal spy software package to ensure you have the control you need over your child or spouse activity when they are online.” After rejecting Section 2512 liability because there is no civil cause of action under the statute, the court added an alternative holding that “Activity Monitor is not a device as contemplated by Section 2512.”

Section 2512 makes the manufacture and/or trafficking of “any electronic, mechanical, or other device” illegal. The phrase “electronic, mechanical, or other device” is defined in 18 U.S.C. § 2510(5) to generally mean “any device or apparatus which can be used to intercept a wire, oral, or electronic communication….” Clearly, Activity Monitor alone cannot be used to intercept communications. It must be installed in a device, such as a computer, to be able to do so.

Also, the definition of the word “device” does not encompass software such as Activity Monitor. Merriam Webster Dictionary defines “device” as “a piece of equipment or a mechanism designed to serve a special purpose or perform a special function.” Activity Monitor alone is not a piece of equipmentor a mechanism.

So... that's going to make this interesting. Of course, then there's the further question of whether or not the malware itself is really intercepting communications. Either way, this feels like a way to try to twist a law targeting older technology to pretend that it applies to a very different kind of technology. I know this happens semi-frequently, but it always troubles me. You get bad results this way, because the technology that was originally being regulated, and what it's now being used against, are very different, and should be treated differently. But when you try to shove something like malware into laws created to stop wiretapping devices... you end up with bad results, where rulings can be made about something being "bad" without realizing the wider reverberations it may have.

And, finally, there's a CFAA claim, because if there's a criminal case that could be summarized as "behaving badly on a computer" you have to expect an eventual CFAA claim.

This count raises the same challenges as count one. The theory seems to be that that selling a copy of malware is akin to using the malware to damage a computer. But to get there, they need to show that Hutchins and X had the intent to impair the availability or integrity of information on a computer and not just intent to distribute the malware to a paying customer. The government also needs to prove that their act of distributing the malware was the proximate cause of the resulting damage even though a third party’s intentional act of sending the malware was required for that to happen.

Again... this seems quite difficult to actually show, though perhaps there's more evidence that the DOJ hasn't yet revealed.

In the meantime, others are insisting that the DOJ has the wrong guy. A friend and colleague of Hutchins, Kevin Beaumont, insisted that the DOJ is simply wrong, and that Marcus has more or less dedicated his life to fighting malware, not creating it:

On top of that, the BBC spotted the fact that Marcus asked on Twitter if anyone had a sample of Kronos after it first was discovered:

Now, of course, that alone is not evidence of much. After all, if he really had created it, why not tweet something like that to make sure people think he hadn't? But, still, it is worth pointing out, along with multiple other folks saying that they simply don't believe Hutchins would have been behind the malware, let alone the broader legal question of whether or not making and selling malware is even illegal in the first place.

Filed Under: cfaa, conspiracy, doj, indictment, kronos, malware, malwaretech, marcus hutchins, orin kerr, selling malware

Judge's Opinion On Kim Dotcom Shows An Unfortunate Willingness To Ignore Context

from the this-is-disappointing dept

Last night, we posted the news that a judge in New Zealand had ruled that Kim Dotcom and his colleagues were extraditable. Dotcom is appealing the decision, so it's not over yet. Soon after the decision was announced, the full ruling by Judge Nevin Dawson was released. It's a staggering 271 pages, and I've spent a good chunk of today reading it over. Some parts of it are more compelling than others, and there may even be enough to support the ruling. However, what troubles me is how frequently Judge Dawson appears to totally, without question, accept the US government's arguments (as relayed by New Zealand prosecutors), despite the fact that many of them are clearly misleading at best, or downright incorrect.

It would take too long to go point by point through the whole thing, but I did want to highlight a few points that I found concerning. The key issue in the extradition fight is whether or not copyright infringement is an extraditable offense. Under the treaty between the US and New Zealand, it is not considered an extraditable offense, which is why a variety of other "conspiracy" charges are piled on in the complaint against Dotcom. Yet, Judge Dawson basically tosses much of that out, arguing that "conspiracy to defraud" is an extraditable offense, and copyright infringement can be a conspiracy to defraud. As Dotcom's lawyers noted yesterday, this would basically write out the fact that copyright is not an extraditable offense.

However, almost all of this "conspiracy to defraud," as well as the other issues that the court finds extraditable (such as "money laundering") are all based on the claims of the DOJ, many of which were presented ridiculously out of context by the DOJ in the original indictment, but which Judge Dawson takes as perfectly accurate, without considering alternative explanations. For example, there's the question of whether or not Megaupload had its own search engine. As we noted in the original indictment, this is particularly ridiculous. A key reason why the original Napster got shut down was because it had a search engine, which the court used to argue that it was more involved in the infringement. Thus, there's a strong argument for why a site should not have a search engine, in order to make it harder to find infringing materials. Yet, the DOJ argued that this was part of the "conspiracy" and that it showed that Megaupload was trying to hide the infringing activities from law enforcement. Damned if you do, damned if you don't. But Judge Dawson flat out accepted the DOJ's argument. Judge Dawson quotes a Skype discussion between two of Dotcom's colleagues, Mathias Ortmann and Bram Van Der Kolk, in which Ortmann notes that "searchability is dangerous and will kill us." And the judge concludes:

There was so much infringing content on the sites that its presence had to be disguised and made non-searchable. Traffic flowed to this content through third party sites.

That's one interpretation. A more plausible explanation could be that these guys didn't want to make their site easy to use for infringement and thus didn't make the material searchable. Instead, that's used against them.

Elsewhere, the judge uses a discussion between Kim Dotcom and Ortmann about how to make sure the service is "invulnerable" to legal challenges as proof that they "appreciated that Mega operated unlawfully and was at risk of being shut down by a court." Of course, a perfectly reasonable alternative explanation is that their discussion was on how to make sure they were not unlawful and not at risk of being shut down by a court. There are plenty of business discussions that tons of businesses could have like this that, devoid of context, could be presented in this misleading way. Any time any two executives from a business were to discuss specifics of making sure their business is legal could then be misrepresented as evidence that they "knew it operated unlawfully and was at risk of being shut down by a court."

There are lots of other examples of this, including conversations between basically all of the defendants discussing (and sometimes joking about) the possibility of lawsuits (most of which they assume would be civil lawsuits). But just because you think you might get sued is hardly evidence of a conspiracy or belief that what you're doing is illegal. I've had many discussions with our lawyers about doing things to protect ourselves from getting sued. That doesn't mean I believe I'm operating illegally. It means I understand the legal environment we operate in, where lawsuits happen frequently, and I'd like to minimize the risk. But in this case, every hint of Megaupload doing the same is treated as an admission of knowingly breaking the law. It's true that there are some conversations that do seem to go beyond this point, such as when Ortmann and Van Der Kolk complain that the business can't be sold because it's not "legit" -- so it's reasonable to argue that those are enough. But, so many of the conversations seem to be spun so far beyond reality that it makes the evidence appear a lot stronger than it really is.

Some of the evidence is just outright ridiculous. At one point, Ortmann sends Dotcom a link to an agenda for an "IP Crime Conference" that was hosted in the same building that was officially Megaupload's headquarters (a Hong Kong hotel) with the tagline "in the lion's den." The judge concludes that from this you can infer "Mega's business was copyright piracy." Huh? How is that a reasonable inference?

Now, I know that some folks are already banging angrily below in the comments about this, pointing out that of course Megaupload was used for infringement, and all of this is just hand-waving to ignore that fact. But that's not what I'm doing here at all. Yes, it's quite clear that Megaupload was widely used for infringement. But that alone is not a criminal offense. When the VCR was first introduced, it was widely used for infringement. When the mp3 player was first introduced, it was widely used for infringement. When the DVR was first introduced. Tape players. Photocopiers. Radio. But that alone does not constitute a criminal offense. Yet, here the judge seems to think that any weak inference that the execs at Megaupload knew that their service was used for infringement implicates them in a criminal conspiracy.

That seems incredibly problematic.

Similarly, as the DOJ did in its indictment, the Judge focuses a lot on the "incentive" program that Megaupload put in place, whereby users who post files that get a lot of downloads could profit from those downloads. The claim by the DOJ, and totally accepted by Judge Dawson, is that this is proof that they were encouraging infringement. But, again, such a program could just as easily be useful for non-infringing purposes as well. If you were a singer and wanted to give away your music for free, but still profit from it, you could see how this could be a compelling business model. In fact, some major recording artists, such as Busta Rhymes, were excited about using Megaupload in just this manner. Yes, obviously some would use this to post infringing files, but again the fact that some users could misuse the service does not mean the company's execs are criminals.

For example, the court uses the fact that Ortmann and Van Der Kolk messaged each other about how uploaded files in the program are "not yet" being "audited for copyright violation" as evidence that the program was designed to drive infringement. But there is no requirement under the law to proactively monitor the content for infringement. Later the judge uses the fact that the incentive program was purposely designed to "attract new users" and to reward "huge uploaders" as evidence that "this was not cyberlocker activity but mass distribution of illicit content." Again, this presumes that the only possible use for a cyberlocker is to store personal data, and not to use it to distribute and share files (many of which may be perfectly legitimate).

Again, some of the other statements may cross the line -- including discussions about specific users where the defendants appear to recognize that certain files are infringing. There are also discussions about whether to cut off incentive payments in cases where they know a user is uploading infringing material (where they don't cut off those payments). Those may be the most damning. But, again, straight up copyright infringement isn't supposed to be an indictable offense. And it's all this other stuff that the judge uses to argue some wider "conspiracy to defraud."

Also, as has been pointed out time and time again, there is no such thing as "secondary" criminal copyright infringement. That is, it's not a criminal offense if your tool is used by someone else to infringe. But all that basically gets ignored.

There's a lot more in there, and it's worth reading through and looking at all of the arguments and evidence. I can see why the judge ruled the way he did. And much of it is similar to the arguments in the original indictment. And, again, there may actually be enough in there for the extradition to go forward, but so much of it seems bound up in taking statements out of context that it seems pretty sketchy. If those kinds of arguments were dropped, and the ruling focused just on the clear evidence of some sort of plan to "defraud" it would seem like a much stronger argument. The fact that piece of evidence after piece of evidence just seems so... weak, raises serious questions about the whole decision.

Filed Under: bram van der kolk, conspiracy, conspiracy to defraud, copyright, doj, extradition, kim dotcom, mathias ortmann, nevin dawson, new zealand
Companies: megaupload

US Court Rules That Kim Dotcom Is A 'Fugitive' And Thus DOJ Can Take His Money

from the um. dept

In the long, convoluted and complex legal battles facing Megaupload founder Kim Dotcom, there was some bizarre stuff that happened late last year. As you may recall, early on, the US government seized basically all of his stuff and money. Dotcom has made efforts to get some of it returned, as it's tough to fight the most powerful government in the world when it's holding onto all of your money. Keep in mind from our previous discussions on asset seizure and forfeiture, the government can basically seize whatever it wants, just by claiming it was somehow related to a crime, but the seizure is only a temporary process. If the government wants to keep it, it then needs to go through a separate process known as civil asset forfeiture, which is effectively the government suing the assets. Back in July, the US government moved to forfeit everything it had seized from Dotcom in a new lawsuit with the catchy name USA v. All Assets Listed In Attachment A, And All Interest, Benefits, And Assets Traceable Thereto. As you may have guessed, Attachment A [pdf] is basically all of Kim Dotcom's money and posessions.

Back in November, the DOJ argued that it should get to keep all of Kim Dotcom's money and stuff because he's a "fugitive", which is a bizarre and ridiculous way to portray Kim Dotcom, who has been going through a long and protracted legal process over his potential extradition from New Zealand (though he's offered to come to the US willingly if the government lets him mount a real defense by releasing his money). Dotcom's lawyers told the court that it's ridiculous to call him a fugitive, but it appears that Judge Liam O'Grady didn't buy it.

In a ruling [pdf] that was just posted a little while ago, O'Grady sided with the government, and gave the DOJ all of Dotcom's things. You can read the full reasoning here and it seems to take on some troubling logic. Dotcom's lawyers pointed out, as many of us have, that there is no secondary copyright infringement under criminal law, but the judge insists that there's enough to show "conspiracy to commit copyright infringement." But the reasoning here is bizarre. Part of it is the fact that Megaupload did remove links to infringing content from its top 100 downloads list. To me, that seems like evidence of the company being a good actor in the space, and not trying to serve up more infringing downloads. To Judge O'Grady and the DOJ, it's somehow evidence of a conspiracy. No joke.

The government has alleged that the conspirators knew that these files were infringing copyrights, as evidenced by their exclusion of infringing files from the "Top 100" list. The "Top 100" list purported to list the most frequently downloaded files on Megaupload.... According to the government, an accurate list would have consisted almost entirely of infringing content, so the claimants "carefully curated" the list to make the site look more legitimate.... Additionally, the claimants regularly told copyright holders, including many U.S.-based organizations, that they would remove infringing content, when in actuality they only removed particular links to the files.... The actual infringing files remained on the Mega-controlled servers and could be accessed from other links.

As for that latter part, there are tons of perfectly legitimate reasons to only remove the links and not the underlying files. If Megaupload was doing deduping, then some version of the same file could be perfectly legitimate. Let's take an example: say that you and I have an MP3 of a Katy Perry song. I upload it to Megaupload to keep as a backup. You upload it to distribute to the world. Megaupload dedupes it, and just has the file stored one time. Your link could be potentially infringing if you distribute unauthorized copies, whereas my copy may be a legitimate personal backup. Given that, Megaupload should only delete the links that are called out as infringing, rather than the underlying files, which -- depending on their use -- may or may not be infringing. But the court just takes the DOJ's version and says "good enough for me."

The court also has no problem with the fact that most of the assets aren't in the US, noting that since some of the "conspiracy" took place in the US, that's good enough. It more or less brushes off the concerns raised by Dotcom and the other defendants that this appears to violate existing treaties between New Zealand and the US -- basically saying that because Dotcom refuses to come to the US, it's not "punitive." Huh? On top of that, the judge says that taking all of Dotcom's assets shouldn't interfere with the legal process in New Zealand, because the New Zealand courts could (yeah right) reject the DOJ's request after this ruling to hand over Dotcom's assets.

Then we get to the whole "fugitive" bit. Judge O'Grady notes that the statute does allow him to call anyone who "declines to enter" the United States a fugitive, and argues that Dotcom fits that description. Furthermore, he actually argues that Dotcom's offer to the DOJ to come willingly to the US if the money is freed for his defense actually works against Dotcom, and gives weight to the fugitive claim:

As demonstrated, Dotcom need not have previously visited the United States in order to meet the prerequisites of § 2466. The statute is satisfied where the government shows that the claimant is on notice of the criminal charges against him and refuses to "enter or reenter" the country with the intent to avoid criminal prosecution. Because the court assesses intent under the totality of the circumstances, it is certainly relevant that Dotcom has never been to the United States and that he has lived in New Zealand since 2011, where he resides with his family. This tends to show that he has other reasons for remaining in New Zealand besides avoiding criminal prosecution. However, the existence of other motivations does not preclude a finding that he also has a specific intent to avoid criminal prosecution. Dotcom's statements, made publicly and conveyed by his attorneys to the government, indicate that he is only willing to face prosecution in this country on his own terms. See Technodyne, 753 F.3d at 386 (2d Cir. 2014) ("The district court was easily entitled to view those [requests for bail], evincing the [claimants'] desire to face prosecution only on their own terms, as a hallmark indicator that at least one reason the [claimants] declined to return in the absence of an opportunity for bail was to avoid prosecution"). Dotcom has indicated through his statements that he wishes to defend against the government's criminal charges and litigate his rights in the forfeiture action. If it is truly his intent to do so, then he may submit to the jurisdiction of the United States.

In short, damned if you do, damned if you don't. This is the justice system, ladies and gentlemen. The DOJ gets to seize and keep all your money, and merely asking for access to it to fight to show your innocence is used as a reason to allow the DOJ to keep it. So he comes to the US and has to fight criminal charges without his own money, or he stays in New Zealand and the government uses it as an excuse to keep all the money. How is any of this even remotely fair? Where is the "due process" in totally handicapping Dotcom from presenting a defense?

Again, it is entirely possible that Dotcom and the others broke the law -- though the case certainly does look pretty weak to me. But what's really astounding is how far the DOJ appears to want to go to make it absolutely impossible for Dotcom to present a full defense of his case.

Filed Under: asset forfeiture, conspiracy, copyright, copyright infringement, criminal copyright infringement, doj, fugitive, kim dotcom
Companies: megaupload

Judge Not Impressed By Ross Ulbricht's 'But Bitcoin Isn't Money' Defense

from the wanna-try-that-again dept

Ross "Dread Pirate Roberts" Ulbricht's attorneys had recently seized on some debate within the US government over whether or not Bitcoin was actually money to try to sneak through a loophole to get out of the money laundering charges against him. As you may recall, the IRS recently declared that virtual currency was more akin to equity/property than money. And Ulbricht's lawyers hoped that distinction might help. It did not. The judge clearly wasn't buying it:

[T]he defendant alleges that he cannot have engaged in money laundering because all transactions occurred through the use of Bitcoin and thus there was therefore no legally cognizable "financial transaction." The Court disagrees. Bitcoins carry value - that is their purpose and function - and act as a medium of exchange. Bitcoins may be exchanged for legal tender, be it U.S. dollars, Euros, or some other currency. Accordingly, this argument fails.

Later in the ruling, the judge goes even further:

In fact, neither the IRS nor FinCEN purport to amend the money laundering statute (nor could they). In any event, neither the IRS nor FinCEN has addressed the question of whether a "financial transaction" can occur with Bitcoins. This Court refers back to the money laundering statute itself and case law interpreting the statute.

It is clear from a plain reading of the statute that "financial transaction" is broadly defined.... It captures all movements of "funds" by any means, or monetary instruments. "Funds" is not defined in the statute and is therefore given its ordinary meaning.

While this was the headline argument, many of the other arguments that Ulbricht's lawyers made were more important -- focusing on the nature of Ulbricht merely setting up the marketplace, and not being liable for how it's used. Judge Katherine Forrest is, once again, not impressed. It's worth pointing out here, that Section 230 liability protections do not apply to criminal behavior, so that particular out wasn't ever really on the table. But the general concept of intermediary liability is clearly tied up in this case. In particular, here, Ulbricht argued that there was no "conspiracy" since he wasn't "conspiring" with users of Silk Road, just setting up the marketplace. The court notes that Ulbricht appeared to be much more involved than just merely running an open market:

Ulbricht argues that his conduct was merely as a facilitator - just like eBay, Amazon, or similar websites.6 Even were the Court to accept this characterization of the Indictment, there is no legal prohibition against such criminal conspiracy charges provided that the defendant possesses (as the Indictment alleges here) the requisite intent to join with others in unlawful activity.

Moreover, in this case, the charges in the Indictment go further than Ulbricht acknowledges. The Indictment alleges that Ulbricht engaged in conduct that makes Silk Road different from other websites that provide a platform for individual buyers and sellers to connect and engage in transactions: Silk Road was specifically and intentionally designed for the purpose of facilitating unlawful transactions. The Indictment does not allege that Ulbricht is criminally liable simply because he is alleged to have launched a website that was - unknown to and unplanned by him - used for illicit transactions. If that were ultimately the case, he would lack the mens rea for criminal liability. Rather, Ulbricht is alleged to have knowingly and intentionally constructed and operated an expansive black market for selling and purchasing narcotics and malicious software and for laundering money. This separates Ulbricht's alleged conduct from the mass of others whose websites may - without their planning or expectation - be used for unlawful purposes.

In other words, it's one thing to set up a marketplace. It's another thing to set up a marketplace with the specific intent of using that marketplace to enable criminal behavior. I'm still a little troubled by the possible implications of this -- and even how it might be read back towards cases like the ridiculous lawsuit against Tor we were just discussing. Overall, though, it seems clear that the court isn't going to let Ulbricht off easy. There appears to be some level of guilt-by-association in this latest ruling, some of which may lead to interesting legal challenges down the road, but it's pretty clear that Ulbricht has a long legal road in front of him -- meaning that it's actually likely he'll work out some sort of plea deal rather than continue to fight.

Filed Under: bitcoins, conspiracy, dread pirate roberts, money laundering, ross ulbricht, secondary liability, silk road
Companies: silk road

Obama Complains That TPP Critics Are 'Conspiracy Theorists' Who 'Lack Knowledge' About Negotiations

from the well,-that-would-appear-to-be-your-own-fault dept

It's become fairly clear that the TPP agreement is in trouble these days (for a variety of reasons). And it appears that President Obama is losing his cool concerning the agreement and its critics. In a press conference with Malaysian Prime Minister Najib Razak, President Obama lashed out at TPP critics, calling them "conspiracy theorists" whose criticism "reflects lack of knowledge of what is going on in the negotiations." Oh really?

If you take an issue like drugs, for example, the United States does extraordinary work in research and development, and providing medical breakthroughs that save a lot of lives around the world. Those companies that make those investments in that research oftentimes want a return, and so there are all kinds of issues around intellectual property and patents, and so forth.

At the same time, I think we would all agree that if there’s a medicine that can save a lot of lives, then we’ve got to find a way to make sure that it’s available to folks who simply can’t afford it as part of our common humanity. And both those values are reflected in the conversations and negotiations that are taking place around TPP. So the assumption somehow that right off the bat that’s not something we’re paying attention to, that reflects lack of knowledge of what is going on in the negotiations.

But my point is you shouldn’t be surprised if there are going to be objections, protests, rumors, conspiracy theories, political aggravation around a trade deal. You’ve been around long enough, Chuck — that’s true in Malaysia; it’s true in Tokyo; it’s true in Seoul; it’s true in the United States of America — and it’s true in the Democratic Party.

Um. You know why those complaining may "lack knowledge of what is going on in the negotiations"? Perhaps it's because the USTR -- a part of the Obama White House -- has insisted that the entire negotiations take place in complete secrecy with no transparency at all. If President Obama doesn't want conspiracy theories about the agreement, and wishes that its critics were more informed about the negotiations, he can change that today by instructing the USTR to release its negotiating positions and promise to make all future negotiating positions public.

But he won't do that. Why? Because the USTR has admitted that if the public knew what was going on with the TPP, it wouldn't support the agreement. And so the negotiations continue in secret. And the President Obama gets frustrated about a lack of knowledge and conspiracy theories? Really?

Filed Under: barack obama, conspiracy, criticism, secrecy, tpp, transparency, ustr

'Bay Of Tweets Invasion' Legitimizes Nearly Every Crackpot Anti-US Claim From Dictators Around The Globe

from the a-complete-disaster dept

Last week, we wrote about the Associated Press's Hollywood script-like story of how USAID, who is not supposed to be engaged in intelligence activities, apparently set up a Cuban version of Twitter, called ZunZuneo, designed to give more Cubans a way to communicate with each other -- but also to foment a pro-democracy movement and spy on certain Cubans. While the concept of encouraging democracy and open communications may be good, the fact that it was done via a series of secretive shell companies and that it was used for spying and subversive anti-government efforts is just incredibly stupid. As we noted in our original piece on it, this would likely create huge headaches around the globe for legitimate US humanitarian efforts, because foreign governments will now point to this story as a reason to distrust USAID and pretty much any other US activities.

In fact, the impact is being seen already. Remember how we'd just been discussing Turkey's latest attempt to ban Twitter? Zeynep Tufecki explains how this latest news has played right into the hands of Turkey's Prime Minister, noting that the Twitter ban was actually a calculated strategy to appeal to the fears of lower- and middle-class Turks that Twitter was part of an American plot to foment unrest. To have the ZunZuneo story come out days later simply serves to better confirm that plot:

Until now, though, in trying to paint their online critics as “foreign agents,” these governments were grasping at straws. For example, lacking a better model, Ankara’s AKP mayor, Melih Gokcek, who became the Turkish government’s most vocal spokesperson during the Gezi protests, kept referring to OTPOR — the small, insignificant and defunct Serbian activist organization that received USAID funding in the 1990s — as supposedly the power behind all global protests, including Gezi.

I suspect there will be no more grasping at straws after ZunZeneo. Secretly funded by the U.S. government? Check. Aimed for regime change? Check. Collected information from unsuspecting users for political purposes? Check. Tried clumsily to hide its tracks? Check. The “Cuban Twitter” was a dictator’s fever dream made real.

Meanwhile, what seemed like wacky conspiracy theories a month ago concerning USAID's efforts in Ukraine to overthrow the government there, suddenly seem more legitimate. In fact, most of the claims do appear to be nothing more than crazy conspiracy theories, but prior to the ZunZuneo story coming out, most people would have assumed that that, too, was a crazy conspiracy theory. And that's the huge problem here. Even if most of what USAID does is really important and valuable work for truly noble purposes, the ZunZuneo story undermines all of that, by making any conspiracy story seem legit. Last year, people thought Bolivian President Evo Morales was crazy for expelling USAID, claiming that it was seeking to "conspire against" the Bolivian government. Suddenly it's tough to assume that his claims weren't accurate. Similarly, with this story, there are suddenly additional stories coming out of highly questionable activities by USAID, which often look quite a lot like intelligence activities to undermine foreign governments.

In fact, Glenn Greenwald is reporting that the ZunZuneo story is just a drop in the bucket of US propaganda efforts around the globe.

These ideas–discussions of how to exploit the internet, specifically social media, to surreptitiously disseminate viewpoints friendly to western interests and spread false or damaging information about targets–appear repeatedly throughout the archive of materials provided by NSA whistleblower Edward Snowden. Documents prepared by NSA and its British counterpart GCHQ–and previously published by The Intercept as well as some by NBC News–detailed several of those programs, including a unit devoted in part to “discrediting” the agency’s enemies with false information spread online.

And, once again, even if the actual impact of these programs is limited, the mere perception that the US government is engaged in these kinds of practices helps push along pretty much any conspiracy theory about US government involvement, no matter how wacky or ridiculous. So, in a bumbling effort to spread a pro-US, pro-democracy message, USAID appears to have done the exact opposite, and handed crackpot authoritarian dictators ever more ammunition to crack down on actual American humanitarian aid and tools for communication.

Filed Under: conspiracy, development, diplomacy, usaid

Senator Leahy Tries To Sneak Through Plans To Make Merely Talking About Computer Hacking A Serious Crime

from the that's-not-good dept

You may have heard about the recent high-profile, malicious hack of Target's point of sale systems, giving the attackers access to the details of at least 40 million credit cards. Senator Patrick Leahy is, incredibly cynically, using this news event to try to sneak through a change to the "anti-hacking" law, the CFAA, which was used to prosecute Aaron Swartz and many others. And it's not a change to improve that law, but to broaden it, extending massively how the DOJ can charge just about anyone they want with serious computer crimes. This is monumentally bad, and Senator Leahy is trying to hide it behind a major news event because he knows he couldn't get this kind of DOJ wishlist through without hiding it.

Officially, this is Leahy reintroducing his Personal Data Privacy and Security Act -- a bill he's tried to introduce a number of times before. The crux of that bill makes some sense: requiring companies that have had a security breach to inform those who were impacted. State laws (most notably, California's) already include some similar requirements, but this is an attempt to create a federal law on that front. There are some reasonable concerns about such a law, but the general idea of better protecting the public from data breaches, by at least letting them know about it, is an idea worth considering.

The problem is that Leahy has inserted a couple of other dangerous bits and pieces into the bill, including a couple of "reforms" to the parts of the CFAA that have raised significant concerns, and burying them deep within this bill. Section 105 of the bill, for example, simply repeats the same change that the House Judiciary tried to include last year in an attempt at bad CFAA reform. It's basically part of the DOJ's wishlist, changing the CFAA to make you guilty of violating the law if you merely "conspire or attempt to commit" the offense, rather than if you actually do commit the offense. It may be difficult to understand if you just read the proposed bill (this is on purpose), but the bill says it wants to include the term "for the completed offense" so that the CFAA now reads:

Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided for the completed offense in subsection (c) of this section.

Right now, the law does not include those four words. Why is that a big change? As we explained last year:

All they did was add the "for the completed offense," to that sentence. That may seem like a minor change at first, but it would now mean that they can claim that anyone who talked about doing something ("conspires to commit") that violates the CFAA shall now be punished the same as if they had "completed" the offense. And, considering just how broad the CFAA is, think about how ridiculous that might become.

While the proposed bill does include a further change that notes that merely violating a terms of service agreement does not make you subject to the CFAA, it's not just the TOS issue that concerns so many people about the CFAA.

The CFAA needs to be greatly scaled back, not expanded, no matter what the DOJ wants. It's ridiculous that Senator Leahy is not only proposing this, but then trying to hide it in this bill about security breach reporting, tying it to a news event.

Filed Under: aaron swartz, cfaa, conspiracy, criminal, data breach, patrick leahy
Companies: target

IRS Gives $104 Million To UBS Whistleblower... Who The DOJ Put In Jail

from the mixed-messages dept

Sometimes it seems that the federal government's left hand has no idea what it's right hand is doing. Bradley Birkenfeld, a former banker for Swiss banking giant UBS, blew the whistle on UBS practices of helping Americans hide their money offshore. For his troubles, the Justice Department charged him, leading to a plea deal in which he plead guilty to fraud conspiracy and was put in jail for a few years. He just got out a month ago... and now the IRS has handed him $104 million for the whistleblowing, which resulted in UBS paying $780 million to the government to avoid prosecution itself. The IRS claims they're doing this to encourage others to blow the whistle on tax fraud... though they might want to warn the DOJ not to put their whistleblowers in prison. That said... $104 million seems somewhat insane. I realize that it may have resulted in the US government getting a lot more money, but $104 million still seems like a giant sum of money to give a guy who, as the government's own efforts show, participated in fraud. If the idea is to "get the word out" to whistleblowers, you would think that smaller sums, still in the millions of dollars, would do the trick...

Filed Under: awards, bradley birkenfeld, conspiracy, doj, irs, jail, whistleblowers
Companies: ubs