Laying Out All The Evidence: Shiva Ayyadurai Did Not Invent Email

from the a-review-of-the-facts dept

As you may have seen, last week we settled the lawsuit that Shiva Ayyadurai filed against us in early 2017. No money exchanged hands, but we did agree to post a link at the top of the 14 articles that he sued over. The text of that link says, "Dr. Shiva Ayyadurai's Response to this Article and Statement on the Invention of Email." You can read his link, and you can read our articles. As I've said in the past, I urge you to read both and make up your own mind.

Click Here to Support Techdirt

Nothing in our settlement stops us from continuing to report on Shiva Ayyadurai's claims to have invented email, and given that Ayyadurai has now fashioned himself a First Amendment freedom fighter, I am hopeful that he will be supportive of our use of our free expression rights to respond to his "response." Among the many statements that response page includes is the following:

Other unethical individuals and internet rags colluded to simply erase the facts and ridiculed journalists such as Mo Rocca of CBS' Henry Ford's Innovation Nation Show and Doug Aamoth of Time Magazine, who shared the truth about email's origin. These individuals included trolls at TechDirt, who parroted false histories of email history to create bogus citations for the heavily censored and manipulated Wikipedia, with its constant revisionism and purges.

But we stand by the information we've provided. Nothing in Ayyadurai's statement shows our posts to be "false" or "bogus," and indeed we have now uncovered additional evidence that continues to support our argument that Shiva Ayyadurai did not invent email, including some new evidence that suggests Ayyadurai himself was aware of this back in 1982.

Once again, as I've said multiple times in the past, all of the evidence suggests that Shiva Ayyadurai was an incredibly bright kid who accomplished something truly exceptional and praiseworthy: he built a functional email system for the University of Medicine and Dentistry of New Jersey (UMDNJ) in Newark, New Jersey, somewhere between 1978 and 1980. If he simply stuck to highlighting that impressive accomplishment, that would have been one thing, and would have likely earned him the level of praise he deserves. The problem is that, since 2011, Ayyadurai has insisted that his email system for UMDNJ was the first true email system, and thus that he "invented" email. The evidence disagrees with him, and as we'll show, that evidence includes statements from Shiva Ayyadurai himself.

One of the most comprehensive debunkings of Ayyadurai's claims comes from Thomas Haigh, the technology historian we've quoted at length in our previous stories on Ayyadurai. Haigh's detailed research is worth reading as well, and we'll quote from his summary:

V.A. Shiva Ayyadurai is not a member of the MIT faculty and did not invent email. In 1980 he created a small-scale electronic mail system used within University of Medicine and Dentistry of New Jersey, but this could not send messages outside the university and included no important features missing from earlier systems. The details of Ayyadurai’s program were never published, it was never commercialized, and it had no apparent influence on any further work in the field. He does not “hold the patent for email” or have a copyright on the word email, though in 1982 he did register a copyright claim covering the exact text of a program called "EMAIL." The U.S. Government has not recognized him as the inventor of email and he did not win the Westinghouse Science Talent Search for his program. Electronic mail services were widely used in the 1960s and 1970s and were commercially available long before 1980. To substantiate his claim to be the "inventor of email" Ayyadurai would have to show that no electronic mail system was produced prior to 1980, and so he has recently created an absurdly specific and historically inaccurate definition of electronic mail designed to exclude earlier systems. Ayyadurai has not even been able to show that he was the first to contract “electronic mail” to “email” or “e-mail” – his first documented use is in 1981 whereas the Oxford English Dictionary shows a newspaper usage in 1979. Despite Ayyadurai’s energetic public relations campaign, which presents him as the victim of a racist conspiracy financed by corporate interests, he has not received support from any credible experts in email technology or the history of information technology. His claims have been widely debunked by technology bloggers and articles based on them have been retracted by the Washington Post and the Huffington Post.

Ayyadurai's "response" to our postings fails to deal with nearly all of the actual details that both we at Techdirt and Haigh have laid out. It just repeats the same claims that our posts, and Haigh's research, have shown to be inaccurate. Rather than go line by line repeating the same things we've said in the past, I wanted to focus on the larger thrust of Ayyadurai's more recent claims.

The shifting story

In his response to our posts, Ayyadurai opens with the following claim:

In 1978, when Shiva Ayyadurai was a 14-year-old Research Fellow at the College of Medicine and Dentistry of New Jersey (today, known as Rutgers Medical School), he wrote 50,000 lines of software code to create an electronic system —the first of its kind— to replicate the myriad features of the interoffice paper-based mail system, which included many of the key components of modern day email, including the Inbox, Outbox, Drafts, Folders, Trash, Attachment, Address Book, Compose, Forward, Reply, Return Receipt, and the Memo, with the (now ubiquitous) terms, “To,” “From,” “Date,” “Subject,” “Cc,” and “Bcc.”

The details here are important. The 1978 date is a key one that Ayyadurai has focused on, as is his definition of email to "replicate the myriad features of the interoffice paper-based mail system." In this post, we'll explore both of those things.

First, as Haigh has detailed, Ayyadurai's story of the "invention of email" has shifted over time in response to some of the incontrovertible facts that were laid out. For example, Haigh notes that in Ayyadurai's earliest claims to have invented email, he set the date as 1980, not 1978, only to change it later:

Ayyadurai’s recent statements highlight his new insistence on applying the date 1978 to all aspects of his “invention.” This can produce some odd results – the site features an image from the 1982 code submission below a heading “EMAIL was named in 1978 in FORTRAN IV.” As mentioned previously, his original infographic timeline identified 1978 as the year in which “the challenge” to produce the system was made, 1979 as the year in which “the attributes of a memo... are converted into an electronic system” and 1980 as the year in which “the first version of the system is designed and deployed for use.” In 1981 he submitted an entry based on the system for the Westinghouse Science Talent Search, and in 1982 he mailed his code to the copyright office and received a registration number. The copyright form he submitted identifies the code as having been written in 1981. His timeline shows 0 “EMAIL accounts” in 1978, 2 in 1979, and 50 in 1980.

Indeed, the original infographic that Shiva himself created pretty clearly claims that he "invented email" in 1980:

However, later, Ayyadurai apparently started using the 1978 date instead, which does appear to be the year he was given the assignment to create such a system. An updated infographic on Ayyadurai's site now has the 1980 heading changed to "Using Email" instead of "Inventing Email" and you may notice a few other changes as well.

Of course, when he had an operational program going matters, in part because Ayyadurai himself has said that the implementation matters. For example, when people pointed out the many Request for Comment (RFC) documents defining email, such as RFC 733 published in 1977 (and which defines many email concepts, including the "to" "cc" "bcc" "subject" "comments" "reply" "sender" etc.), Ayyadurai's lawyer, Charles Harder, dismissed those as "a document, not software." Harder went further on that point:

"It was, at best, a specification attempting to provide a standardization of messaging protocols and interfaces. RFC 733 was not 'e-mail underpinnings' as some have said, nor equated as e-mail: the electronic software system intended to emulate the interoffice, inter-organizational paper-based mail system, created by Dr. Ayyadurai at UMDNJ in 1978."

Ayyadurai, himself, on a page on his website that he claims is for debunking myths about what we've all been highlighting, says something remarkably similar to his lawyer:

This quote, “…email underpinnings were further cemented in 1977's RFC 733, a foundational document of what became the Internet itself.” is a misuse of the term “email” because the RFCs (Request for Comments) and RFC 733 were written documentation not a computer program or code or a system. Moreover, this quote and others such as “In 1977 these features and others went from best practices to a binding standard in RFC 733.” are hyperboles. RFC 733 was drafted in November 1977 and was an attempt at standardization of messaging protocols and interfaces; it should not be conflated as “email underpinnings” with the electronic system of interlocked parts defining the interoffice paper mail system.

So, given that Ayyadurai and his own lawyer insist that merely writing out a document is not enough, the actual date when Ayyadurai implemented his code seems important. And it appears that he originally claimed it was in 1980. In researching this, we obtained Ayyadurai's full deposit copy for his 1982 copyright filing (on his site, he reveals the registration application, and not the details of his actual submission for his user manual, and in a moment you may understand why). At the beginning of the user manual he submitted to the Copyright Office, he notes in a letter dated August 18, 1982 that "after nearly three and a half years of development, I recently finished a program called EMAIL which allows one to send and receive mail via the HP 1000 computer system."

Only recently finished? Interesting. At the very least, this also provides more support for the idea that Ayyadurai did not actually begin even working on his program until 1979 (not 78), since three and a half years prior to August of 1982 would be early 1979. The letter does say that most of the work was completed in the first two years, with the most recent two being more about testing and adding features, though it doesn't indicate which features those were -- and that seems to matter quite a bit to Ayyadurai's claims as well, since Ayyadurai's definition is dependent on a large number of specific features.

Indeed, as Haigh also notes (and you can see in the Charles Harder quote above), much of Ayyadurai's claim focuses on his rather specific definition of email. Which also has changed over time. According to Haigh's tracking:

One of the five main tabs on Ayyadurai’s new site is “Definition of email.” This presents a short version (“email is the electronic version of the interoffice, inter-organizational paper-based email system”) and two lengthy checklists. The first checklist presents 32 distinct features of the traditional mail system, all of which he claims were necessary (“if any one component was taken away…you no longer had a functioning interoffice mail system.”) The second checklist repeats these, with some additional items added, and places a check mark by each one to indicate that Ayyadurai’s system had that capability. There are 87 of these check marks. If I understand his argument correctly then this signifies that a system must possess 87 specific features to properly be called email.

Has this definition been widely accepted since 1978, as Ayyadurai claims? No it has not. Indeed, Ayyadurai’s own website did not include these definitions of email until recently. The old site (prior to June 2012) offered a quite different six point definition of “an E-Mail System.” These six points were: User-Friendly Interface; A Rich Set of Features; Network Wide; Security and Login; Enterprise Management; Database and Archival.  The definition was originally presented as the work of one Matthew J. Labrador. Labrador claims to have “met Shiva in 1981 in a computer science class” and to have been impressed by his modesty. He recently been motivated by inaccurate reports on email origins to “do my own research... to provide readers with a more comprehensive and holistic history.” Ayyudari’s resume lists Labrador as a student whose bachelor’s thesis he supervised in 1990. Labrador, whose prose style closely resembles Ayyadurai’s own, expressed awe at Ayyadurai’s accomplishments  (“in writing this History, I was amazed at the vision that Dr. V.A. Shiva Ayyadurai had even as a 13 year old, in developing that first E-Mail system”), acknowledged his graciousness in providing materials, and proceeded to show that Ayyadurai’s system met this unorthodox six point definition. (Since the page was captured in June 2010 Ayyadurai has stopped hyphenating, switching his entire site first from “E-Mail” to “EMAIL” and now to “email.”)

(Update, 2014: Ayyadurai's 1997 book The Internet Publicity Guide includes the following definition: "Electronic Mail (e-mail) Personal messages sent between users of the Internet." The section on "E-Mail: Electronic Mail" fills pages 13-15. So Ayyadurai himself used to treat "e-mail" as a simple contraction of electronic mail and favor a very broad definition).

Since we've now seen what Ayyadurai submitted to the Copyright Office, it is, at best, unclear that his program in 1982 actually had most of the functions he has described as the definition of email. Even just by going with the description in his response to us, it should include:

Inbox, Outbox, Drafts, Folders, Trash, Attachment, Address Book, Compose, Forward, Reply, Return Receipt, and the Memo, with the (now ubiquitous) terms, “To,” “From,” “Date,” “Subject,” “Cc,” and “Bcc.”

However, if all of those features were included in his original software, they do not appear to be well documented -- or documented at all in the instruction manual he submitted to the Copyright Office. The manual shows a limited set of commands. It does not show attachments or "bcc", for example:

The code submitted to the Copyright Office shows a fairly limited set of commands as well, not as comprehensive as his 87 point checklist would suggest:

It is possible that there was more to Ayyadurai's original application. And if it's true his original system included attachments, it might have predated that feature showing up in other products such as ccMail, which had attachments by 1985. However, at least in the code seen in his submissions, it is not obvious that such a feature was part of his initial program, as of 1982. We would be open to seeing Ayyadurai present evidence that he created email attachments before others did, though it would not qualify as having "invented email."

The first electronic replica of an "interoffice" mail system?

A key piece of Ayyadurai's current definition of email, beyond the checklist, was the idea that his was the first replica of interoffice mail. From his response to us:

Dr. Ayyadurai named this system “email,” a term he was the first to create since he was inventing the “electronic” (or “e”) version of the interoffice paper-based “mail” system.

In an interview Ayyadurai gave with Ars Technica, while the lawsuit was ongoing, he made this point very clear:

“These ARPAnet guys, these old guys saying that they’re the ones who invented e-mail. OK?” he continued. “And I’m telling you, e-mail is the electronic version of the replicated form of the interoffice mail system, and I defined it. I called it E-M-A-I-L. These are facts.

On the "myths" page linked above, Ayyadurai insists that other versions of email don't count, because (he claims) he was the first to do a "full-scale emulation of the interoffice inter-organizational paper mail system."

This quote, “Under ARPAnet several major innovations occurred: email (or electronic mail), the ability to send simple messages to another person across the network,” is a misuse of the term “email.” The invention referenced here is command-line protocols for transferring text messages, not email as defined to be a system of interlocking parts, such as the 1978 EMAIL platform, a full-scale emulation of the interoffice inter-organizational paper mail system.

This implies that he was the first to come up with the idea of making a system to replicate the interoffice mail system. Again, the evidence to support this claim is lacking. On my desk I have a lovely scan of a September 13, 1976 Business Week article, page 94B, entitled: "When interoffice mail goes electronic." Amusingly, the third paragraph of that article notes:

In a sense, electronic mail is not new.

You don't say.

Let's zoom in on the date on that one, in case you can't see it:

So, it certainly suggests that there were electronic mail systems replicating the "interoffice mail system" on the market before Ayyadurai began work on his project.

Ayyadurai admits his program was not the first electronic mail system

And here's where we come back to Ayyadurai's full copyright filing. Not only did he tell the Copyright Office that he only recently finished the program in 1982, but in that same document he admits that there are other electronic mail systems on the market. Here's that full first paragraph:

After nearly three and a half years of development, I recently finished a program called EMAIL which allows one to send and receive mail via the HP 1000 computer system. Most of the code was written during my sophomore and junior years in high school and during the high school summer holidays. The past two years have involved quite a bit of testing and the addition of some new features. EMAIL consists of five programs and some several thousand lines of code. I, personally, feel EMAIL is as sophisticated as any electronic mail system on the market today.

We've got receipts:

So it certainly appears that back in 1982, Ayyadurai was well aware that his was not the first on the market.

The RAND paper

To argue that his was the first complete interoffice system, Ayyadurai quite frequently cites (but does not link to) a 1977 RAND paper by David Crocker, specifically looking at a particular electronic mail system called "MS".

According to Ayyadurai's "response" page, the portions of the report that he quotes:

"... reflect the limited scope of the efforts of these "internet pioneers," who were narrowly focused on rudimentary text messaging systems and were proposing minor modifications to expand that rudimentary functionality."

However, that does not appear to reflect what was actually in Crocker's report, which was focused on one particular program. If you read the full report (and you should!) it notes that it is only talking about "the design of one such program" and further that "Early electronic mail systems have existed on the larger computers," while explaining that MS is specifically being designed for DEC minicomputers, and that's its primary differentiator. The paper is not an analysis of the entire email market. Indeed, it says:

One of the earliest and most popular applications of the ARPANET computer communications network has been the transfer of text messages between people using different computers. This "electronic mail" capability was originally grafted onto existing informal facilities; however, they quickly proved inadequate.

The paper notes that as more and more people have used these services, they've demanded more and more features and he talks about how there are a variety of attempts to support those features, and those working on MS, in particular, have tackled those demands. The paper does not, as Ayyadurai repeatedly implies, suggest that no one anywhere was working on making an electronic version of the interoffice mail system (indeed, as the Business Week piece above notes, such systems were already on the market). Instead, Ayyadurai quotes two short parts of the fairly long paper, but appears to take them out of context. Ayyadurai claims that "early workers in the field of electronic messaging had no intention to create a full-scale electronic version of interoffice or inter-organizational paper mail system", citing two separate parts of the Crocker paper.

The first of those reference is Crocker saying, "At this time, no attempt is being made to emulate a full-scale, inter-organizational mail system." (on page 18 of the PDF I linked to above, which is technically page 4 of Crocker's document). Note that in Ayyadurai's version, he inserted an extra "interoffice." Crocker says, "inter-organizational." That seems like a key difference, especially since there is little to no evidence that Ayyadurai's email program was ever used beyond a single organization. Crocker is not saying no effort is being made to replicate the interoffice mail system. He's saying that, for now, the developers working on MS (not other email products) are, in fact, focusing just on interoffice email -- not inter-organizational, because that's not the current focus of the project.

Indeed, much of Crocker's paper is describing why and how MS is, in fact, modeled on an interoffice mail system. There are pages describing how MS is being developed to mimic interoffice mail so that it's a model that matches with the human expectations of those who would use it. It talks about how MS uses assumptions about existing models for delivering messages on the assumption that this will be easier for people to understand. On the very next page after the quote that Ayyadurai relies on to prove that no one was thinking of making an interoffice mail system, Crocker writes the following:

Within an office environment, messages typically arrive at a person's "inbox," are viewed and perhaps acted upon, and are then filed into an appropriate folder which contains related messages. Later, the person may wish to take other actions relating to the material in the folder. All of this activity occurs on the person's desk. Several folders may be open at one time.

Two of the more common actions people take are responding to a message and forwarding a copy of it to others. In both cases, material in the original message determines portions of the news message. For responses, the title ("Subject") and the names of the originator and recipients are used; and for forwarded messages, only the name(s) of new recipient(s) must be added. Another common action is the creation of a new message for a third party.

This sounds quite similar, in fact, to Ayyadurai's own description of how he went about crafting his email system. It's just that Crocker's version comes a few years before Ayyadurai's.

From there, Crocker goes deeper in explaining how MS is being developed to deal with users' expectations based on existing interoffice mail systems. In fact, there's a lengthy discussion about whether or not MS should use similar terms to the traditional interoffice mail system, because it might make it easier -- and specifically discusses secretaries who have little experience with computers.

The final way in which MS attempts to conform to users' expectations is in the vocabulary used to describe and invoke its processing. Concern for this level of detail has been questioned, on the theory that humans are quite good at learning new terms and, in fact, they are not consistent in their own use of vocabulary. That is, there probably does not exist a set of terms which is consistent among users and, even if there is, using that set rather than another will probably not greatly affect a user's performance with, or attitude towards, a message system.

In the belief that computer-oriented users and designers cannot be used as references for testing the presence and nature of such vocabulary in the potential user population, several informal experiments were conducted. Subjects were secretaries who had little or no experience using computers. In each case, relatively neutral language was used to explain a typical office situation which required use of a single word for referencing a particular object or action. The subject was then asked what word or symbol was most appropriate in that situation. In most cases, subjects immediately had a term they thought best and the terms were relatively consistent among subjects.

For example, a message being created is called a "draft"; the structured part of a memo is called the "headers"; and placing a message into a folder is called "filing".

In other words, Crocker is highlighting how testing of their system resulted in non-computer users insisting on the similarities to... the interoffice mail system. He later notes that when they tried to use more technical vocabulary, it "often evoked laughter." Indeed, Crocker's conclusion is that modeling the system on interoffice mail is the most likely way to build adoption.

The second Crocker quote that Ayyadurai highlights is the following:

To construct a fully-detailed and monolithic message processing environment requires a much larger effort than has been possible with MS. In addition, the fact that the system is intended for use in various organizational contexts and by users of differing expertise makes it almost impossible to build a system which responds to all users’ needs. Consequently, important segments of a full message environment have received little or no attention and decisions have been made with the expectation that other Unix capabilities will be used to augment MS.”

Ayyadurai uses that to suggest that no one but himself seriously considered building a full replica of the interoffice mail system as a computer program. But, again, that appears to be taking Crocker's quote very much out of context. First, he is just discussing one program: MS, which was designed for a specific set of computers, rather than the whole of the electronic mail market. You can read this quote on pages 21 and 24 of the pdf (page 7 and 10 of the internal document -- the middle two pages are a diagram, explaining the jump in page numbers). The context here is that Crocker is talking about how MS (and not all other email systems) is specifically being built in a modular way so that lots of others can jump in and provide other features and interfaces to cover whatever specific need they have. Indeed, Crocker notes that this document is just to basically describe the nature of how MS mimics an interoffice mail system's underlying structure so that anyone else can implement the version that works best for them. Just a few paragraphs before the quote Ayyadurai cites, Crocker writes:

This document, and the style of the resulting system implementation it specifies, is a bit unusual and deserves some explanation. Most system specifications address either the human interface or the internal design -- how the system appears to human users or what data structures and function primitives are to exist. The specification for MS is at neither level, although it has more of the flavor of an interface description. In particular, the document may be viewed as specifying the human interface, minus the command language. That is, the functions, to be made available to human users, are described; but the precise way in which users formulate requests to MS is not.

The reason for this idiosyncratic specification style is that several very different command interfaces are being constructed and it is hoped that specifying the system at this level will assist interface builders in realizing and accommodating some of the user issues described above. (The concern for proper vocabulary, therefore, is more representative of a lobbying effort than of a guarantee for what is provided in the command interface.) Experience to date suggests that the construction of interfaces is, in fact, simplified.

He then goes on to describe three separate interfaces for MS that have already been constructed, and makes it clear that he's effectively "lobbying" for the developers building on MS to use the language and approach that matches the interoffice mail system because that will make it easier for users to grasp the purpose of the system.

That gets us into the context that Ayyadurai leaves out. Crocker is saying that MS itself is a lower layer set of functions, and the idea is that others can develop their own interfaces to match their own environments' specific needs. The quote that Ayyadurai cites, about it being "almost impossible to build a system which responds to all users' needs," is Crocker noting that different offices have very different requirements, and the nature of MS is not that those working on it will build a system that works everywhere, but that anyone can implement their own interface to match that office's needs.

From there, there are another 30 pages or so of Crocker laying out the details of MS, including how it basically offers up the underlying functionality to recreate whatever sort of interoffice mail system you might like, leaving each interface builder to determine how best to implement.

In other words, a full reading of the document does not support Ayyadurai's claims, and, again, suggests that the idea of an electronic interoffice mail system was very much on the minds of many different developers.

The naming of email

That leaves one final claim that Ayyadurai insists is central to his argument: that he was the first to name email and got "the copyright" on email. In his response to our posts, he states:

Dr. Ayyadurai named this system “email,” a term he was the first to create.

He also states:

On August 30, 1982, Dr. Ayyadurai obtained the first U.S. copyright for this system, “EMAIL”. At the time, Copyright Law was the only mechanism to protect software inventions because the U.S. Supreme Court decisions at the time held that software could not be patented.

Thomas Haigh's summary responding to the claims of having named email is pretty straightforward:

“Electronic mail” was widely discussed in the 1970s, but was usually shortened simply to “MAIL” when naming commands. However, the Oxford English Dictionary (3rd edition online) gives a June 1979 usage (“Postal Service pushes ahead with E-mail”) so Ayyadurai was not the first to use this contraction in print.

Tellingly, even the Oxford English Dictionary thinks that the 1979 date is probably too late. It has a standing public request seeking evidence of an earlier contraction from "electronic mail" to email, noting that they found it in the journal Electronics on June 7th and that this does not suggest the coining of a new term at all, but rather one that readers would already be familiar with.

Meanwhile, as Haigh highlights, the first documented proof of Ayyadurai's program being called "EMAIL" is not until 1981. An earlier article about his program in 1980 does not mention such a name. Also, it's pretty clear that even if there is some evidence that shows that Ayyadurai contracted electronic mail down to email first, that's not what made the word "email" popular.

The program name “EMAIL” is not mentioned in the 1980 newspaper article on Ayyadurai but does appear in his 1981 Westinghouse competition submission. By that year the name EMAIL was in use by CompuServe. Compuserve had offered timesharing computer access and electronic mail to businesses for years. In 1979 it launched a new service, aiming to sell otherwise wasted evening computer time to consumers for the bargain price of $5 an hour. A trademark application (later abandoned) that CompuServe made for “EMAIL” listed 1981/04/01 as its first use by the company, which fits with this May 1981 message mentioning CompuServe’s “EMAIL program.” By January 1983 “Email™” (for trademark) was part of CompuServe’s advertising campaign.

For years CompuServe users could type “GO EMAIL” to read their messages. Whether Ayyadurai or CompuServe was the first to adopt “EMAIL” as a program name it is clear that CompuServe popularized it.

In other words, the earliest evidence Ayyadurai has for his program being called EMAIL is the 1981 Westinghouse submission. But 1981 is also the same time that Compuserve was offering email. The newsgroup mention of "Email" in 1981 attributed to Compuserve certainly shows that Compuserve was using it commercially by at least May of that year. It's entirely possible that both Ayyadurai and Compuserve came up with the same shortening of electronic mail to email, but there is no evidence suggesting that it was Ayyadurai who made it popular. And, as Haigh notes, coming up with the name is kind of meaningless when talking about who invented something. See, for example, all these other inventors:

Even if Ayyadurai does eventually produce evidence that he used the linguistic contraction “email” in 1978, and this turned out to be the earliest documented usage, what would that really signify? We acknowledge John Logie Baird as the inventor of TV as well as television, even though he called his machine the Televisor. The Wright Brothers didn’t call their flying machine a “plane” in 1903 and the Oxford English Dictionary has no reference for this contraction of Aeroplane being used until 1908. Yet we not honor the first person to shorten the word as “the inventor of the plane.” Alexander Graham Bell patented an “acoustic telegraph” in 1876 but is today remembered as the inventor of both the telephone (a name he did adopt) and the phone (a contraction the OED does not show usage for until 1880). Marconi worked for years on what he called a system of “wireless telegraphy” but is nonetheless remembered for this effort as the father of radio. It is likewise natural and appropriate for us to think of the electronic mail systems of the 1970s as email, even though they would not have been called this at the time.

As Haigh also notes, while it's been scrubbed, Ayyadurai originally claimed he had invented "electronic mail."

In any event, Ayyadurai’s previous website identified him as creator of the first “Electronic MAIL system,” which further undermines this line of argument. Likewise, his infographic includes for 1979 the heading “Memos to Electronic Mail.” In 2010 he was hyphenating the name of his system as “E-Mail”. His claim to be the inventor of email is also a claim to be the inventor of electronic mail.

And, related to this, as we've described at length in our previous articles to which Ayyadurai has never provided an adequate response, the copyright on his particular program, even if it's called "Email", does not establish him as the inventor of email. Haigh compares it to songs called "rock and roll":

Lou Reed wrote a song called “Rock and Roll.” So did Led Zeppelin. Both the songs were copyrighted by their respective publishing companies. Neither of them owned the term “Rock and Roll” as a result of writing these songs. Neither of them had to show that they had invented rock music to receive the copyright.

To make the point even clearer, as I have noted in the past, Microsoft quite clearly holds a copyright on a software program called "Windows." Yet no one would ever credit Microsoft with "inventing" the concept of windowed interfaces on computers. Anyone familiar with that history will remember that Steve Jobs saw the GUI interface at Xerox PARC and then used it for the Mac. Microsoft later made its own version after seeing the success of Apple's -- leading Apple to sue (unsuccessfully). Microsoft still retains the copyright on "Windows," but I've yet to see anyone claim that Bill Gates "invented" windowed graphical user interfaces (let alone Bill Gates himself).

The only response that Ayyadurai provides when people point this out is a weird bit of misdirection, suggesting that copyright was the functional equivalent of a patent back in 1982. He also suggested that he didn't copyright it earlier because you couldn't copyright software prior to 1980.

In 1978, when Shiva created email, there was no mechanism to protect software inventions, through either Copyright or Patent;

In 1980, the Copyright Act of 1976 was amended to become the Computer Software Act of 1980, which allowed software inventors to have their software inventions protected through Copyright. Even then the Supreme Court did not recognize Software Patents;

And, in the "response" to our posts that we're now linking to on our earlier stories, Ayyadurai again makes this claim:

On August 30, 1982, Dr. Ayyadurai obtained the first U.S. copyright for this system, “EMAIL”. At the time, Copyright Law was the only mechanism to protect software inventions because the U.S. Supreme Court decisions at the time held that software could not be patented.

Regarding the patent claim, that's not entirely accurate. As can be seen in this PBS show about Martin Goetz, the first software patent was granted in 1968. What is true is that in a series of Supreme Court cases in the 1970s and early 1980s (Gottschalk v. Benson, Parker v. Flook, and Diamond v. Diehr), the Supreme Court greatly limited what kinds of software were eligible for patents, rejecting "pure algorithms" (in Gottschalk) but allowing them if there's some "inventive concept in [their] application" in Flook. Ayyadurai may have thought, after Gottschalk/Flook, that his software would not qualify for a patent, although if his email program was an "inventive concept" it likely still would have. But it is entirely reasonable to believe that, as a teenager, Ayyadurai was unaware of the ins-and-outs of patent law at the time. However, this many years later, with several actual patents to his name, one would hope he would be more accurate.

Either way, that doesn't change the fact that the copyright in a single program does not establish him as the "inventor" of email. It establishes him as the author of his particular program. Again, Bill Gates was not the inventor of windowed graphical user interfaces, even if his company, Microsoft, holds a copyright on Windows. Indeed, Ars Technica spoke to William Roberts, who at the time was the Associate Register of Copyrights, and he pointed out that Ayyadurai's assertions were incorrect.

We ran this claim past William Roberts, associate register of copyrights at the United States Copyright Office. “His assertion, as you describe it to me, is not accurate,” said Roberts. That’s because copyright for a computer program simply registers the precise code of that particular program, making it illegal to copy without permission.

Famed law professor Eugene Volokh expressed his opinion on Ayyadurai's copyright claims after his lawsuit was filed against us, and found it legally dubious:

No — a copyright registration for a program named “email” is not the U.S. government recognizing Ayyadurai “as the inventor of email.” No-one at the Copyright Office determines whether a program (or any other work) is a new invention. (Patent examiners may do that, but the Copyright Office doesn’t.) Indeed, no-one at the Copyright Office runs the program, reads the source code, or tries to compare the program’s description to those of other programs. Indeed, I can today register a copyright on another program called “email,” “computer program for electronic mail system.” Just as there can be many copyrighted books with the same title, there can be many copyrighted programs with the same title. (Selling a book or a program with a title that’s confusing may violate trademark law, but that’s a separate matter.)

The function of copyright law is not to recognize inventors of ideas; it’s to protect authors of particular implementations of those ideas. That’s why you can have a thousand different detective stories registered with the Copyright Office, and none of them be the invention of the detective story (or even of a detective story involving a hyper-rational super-observant detective). And it’s why you can have a thousand different e-mail programs — whether or not called “email” — registered with the Copyright Office, and none of them be the invention of e-mail.

And with that, we'll (hopefully) leave this saga aside. If Ayyadurai would like to respond to this, or to supply evidence to contradict the points and evidence raised above, he is, as always, welcome to provide it. He could have done so any time since 2012 when we first wrote about him and his claims, rather than taking us to court for two and a half years. I still believe that Ayyadurai should, in fact, be praised for what he accomplished as a teenager -- building a working email system as he apparently did, at the time he did, is no small feat. Our only issue with his claims is the decision to argue that his impressive creation was actually "the invention of email." It was not.

On a related note, we'd like to be able to continue to do this kind of reporting, but to do that, we need your help. Please consider donating to the Techdirt Survival Fund to help us recover from the financial harm we've suffered in fighting this lawsuit for the past two and a half years.

Filed Under: copyright, email, shiva ayyadurai

German Politician Thinks Gmail Constituent Messages Are All Faked By Google

from the not-how-it-works dept

Christopher Clay alerts us to the latest Google Derangement Syndrome from an EU Bureaucrat. Last year, we noted that various EU politicians kept insisting that all of the complaints about their awful plan were due to Google lobbying and astroturfing -- when the reality showed that nearly all of the lobbying came from legacy copyright players.

However, German MEP Sven Schulze must have thought he was really on to something in claiming he had real proof of Google astroturfing. In a tweet (in German) he claimed that because all of the complaints he's getting seem to come from people with Gmail addresses, it's proof of fakery. No, really. Here's a translation (courtesy of Google, of course) of his tweet:

Now coming back every second of messages about # upload filter & # Article 13 pure. Apart from the fact that these contents are not correct, ALL come from # Gmail accounts. 🤔Man # google , I know that you are angry, but ye have this # fake really necessary action?

Really now? Perhaps Schultze is unaware that (as of the most recent public stats), Gmail is used by 1.5 billion people. These days, it's pretty typical for lots and lots of people to use Gmail as their personal (and often professional) email address. To claim that seeing Gmail emails proves Google is astroturfing is... nutty. And, it would appear that Schulze's followers recognize just how idiotic this looks.

How do you say ratioed in German?

And many of those 4.5 thousand replies are ruthlessly mocking him for being completely clueless.

I'm guessing he'll blame Google for all those replies as well?

Filed Under: article 13, bots, copyright, email, eu, eu copyright directive, gmail, lobbying, sven schulze

German Data Protection Authority Says GDPR Requires Email To Use At Least Transport Layer Encryption

from the but-why,-is-not-entirely-clear dept

As Techdirt has reported, the EU's GDPR legislation certainly has its problems. But whatever you think of it as a privacy framework, there's no denying its importance and global reach. That makes a recent ruling by a data protection authority in Germany of wider interest than the local nature of the decision might suggest. As Carlo Pilz reports in his post examining the case in detail, the Data Protection Authority of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen -- LfDI NRW for short) looked at what the GDPR might mean for email -- in particular, whether it implied that email should be encrypted in order to protect personal information, and if so, how.

The LfDI NRW made a fundamental distinction between encryption at the content level and encryption at the transport level for the transmission of emails. The former encrypts content and attachments, using technology such as S/MIME and OpenPGP. However, the metadata associated with an email is not encrypted. With transport layer encryption, both the content and the metadata is encrypted. Pilz explains:

LfDI NRW therefore assumes that without exception at least transport encryption must always be implemented. As mentioned above, such a mandatory encryption obligation does not result from the GDPR. One could therefore argue that this view goes beyond the requirements of the GDPR. In its assessment, the authority may assume that transport encryption is now the "state of the art" mentioned in Art. 32 para 1 GDPR. This could be supported by the reference to the European providers. Nevertheless, Art. 32 para 1 GDPR provides, in addition to the feature "state of the art", for further criteria which must be taken into account for the measures to be implemented, such as in particular the risk of varying likelihood and severity for the rights and freedoms of natural persons. Thus, under the GDPR, controllers and processors should still be able to assess whether encryption of the data is absolutely necessary on the basis of these characteristics. Unfortunately, the opinion of the authority does not go into the individual criteria mentioned in Art. 32 para 1 GDPR in detail and does not justify its opinion.

So the newly-published position of the German data protection authority is not exactly clear as to why it thinks transport layer encryption must be used, although it does specify which standard must be followed: BSI TR-03108-1: Secure E-Mail Transport (pdf). It also mentions that transport layer encryption may not be enough when dealing with particularly sensitive personal information. This includes "account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data". The problem here is that even though encrypted in transit, the emails are stored in cleartext on the servers. To address this, LfDI NRW says that additional security measures are required, for example using end-to-end encryption, or even falling back to physical postal delivery of highly-sensitive documents.

Because of the way GDPR is enforced, it's worth noting that the opinion of the LfDI NRW does not automatically determine the policies everywhere in the EU. It may influence the thinking elsewhere, but it's possible that other data protection authorities in the EU might disagree with this interpretation -- in which case the Court of Justice of the European Union would be called upon to adjudicate and offer a definitive interpretation. However, at the very least, the LfDI NRW's position indicates that the GDPR is likely to impact when and how email encryption is deployed by companies operating in the EU, along with all the other areas it touches upon.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: email, encryption, gdpr, germany, transport layer encryption

But Her Emails: Ivanka Trump Also Used A Private Email Account For Official Government Business

from the SAD! dept

As we near the midpoint of Trump's presidential term, White House renovations continue, including the erection of a glass-walled enclosure for stone-throwing.

Ivanka Trump sent hundreds of emails last year to White House aides, Cabinet officials and her assistants using a personal account, many of them in violation of federal records rules, according to people familiar with a White House examination of her correspondence.

White House ethics officials learned of Trump’s repeated use of personal email when reviewing emails gathered last fall by five Cabinet agencies to respond to a public records lawsuit. That review revealed that throughout much of 2017, she often discussed or relayed official White House business using a private email account with a domain that she shares with her husband, Jared Kushner.

According to White House counsel, this was all a misunderstanding. Apparently, Ivanka Trump wasn't aware of the rules governing the discussion of official government business on private channels. This would only be excusable if her father hadn'tspent a great deal of time calling for Hillary Clinton to be locked up for the same behavior.

Given the (still!) ongoing excoriation of Clinton by Donald Trump, you'd think his administration would have tried to lead by example and make sure everyone was on official channels from day one. Instead, his admin team did the same thing Clinton did, minus the setup of a private server.

And there are a few differences between Ivanka Trump's personal email use and Clinton's. Some commenters will make this part of the post redundant as they seek to find something hypocritical in Techdirt's coverage of this story or simply demand it be known Ivanka's actions were far more acceptable than Clinton's. Nevertheless, here we go:

It appears no classified information made its way into her personal email account. She also did not set up her own server to handle all official communications. She is also now apparently using her official White House email account after being informed of the rules -- a corrective effort Hillary Clinton never made.

Since I'm sure this short post pointing out the hypocrisy of the Trump Administration will be viewed as biased, here's Techdirt's history on government officials and private email accounts:

Techdirt criticizes Hillary Clinton's use of a private email server

Techdirt criticizes James Comey's handling of the Clinton email investigation

Techdirt criticizes Jame Comey's reopening of the Clinton email investigation

Techdirt criticizes Chicago Mayor Rahm Emanuel's use of a private email account

Techdirt criticizes New York Governor Andrew Cuomo's use of a private email account

Techdirt criticizes former New York Mayor Mike Bloomberg's use of a private email account

Techdirt criticizes VP Mike Pence's use of a private email account

If a government official has used private email accounts for official business, Techdirt has criticized them. Ivanka Trump doesn't get a pass and neither does anyone on the other side of the gaping political divide. She may not have known the specifics governing official communications but the Trump Administration has no one to blame but itself for the black eye it's now sporting.

HER EMAILS was a major plank in Trump's election platform. His administration team could have prevented this but was too busy keeping their own communications off the record to straighten out Ivanka Trump.

Filed Under: email, hillary clinton, ivanka trump

Verizon's Oath Will Still Scan Your E-mail For Advertising Purposes Because Hey, It's Verizon

from the Verizon-gonna-Verizon dept

While all major webmail companies have veered away from the idea of automatically scanning private e-mails in a bid to monetize the content for behavioral advertising due to public backlash, that's simply not how Verizon rolls. According to a deep dive over at the Wall Street Journal (watch out for the paywall, here's a Verizon-owned Techcrunch alternative), Verizon and its Oath subsidiary now offer the country's only major webmail service that still thinks this practice is a good idea:

"Yahoo’s owner, the Oath unit of Verizon Communications, has been pitching a service to advertisers that analyzes more than 200 million Yahoo Mail inboxes and the rich user data they contain, searching for clues about what products those users might buy, said people who have attended Oath’s presentations as well as current and former employees of the company."

After backlash, Google ended its own practice of auto-monetizing e-mail content for behavioral ads last year, acknowledging that the practice doesn't exactly instill trust in your customers (e-mails are still automatically scanned as part of the company's "Smart Compose" feature, but content is no longer monetized). Apple has never scanned subscriber e-mails for this purpose, and Microsoft told Techcrunch this week that the company does “not use email content for ad targeting in any way, anywhere in Microsoft." The shift has been part of an effort to compete on privacy, which is an idea that should be encouraged.

Coming from the telecom sector, Verizon's not quite as familiar with this whole competition thing. In comments to the Journal, Oath's vice president of data, measurements and insights provided a very Verizon-esque response, suggesting the scanning was a public benefit to users eager to see more relevant ads:

"Mr. Sharp said that being served ads is part of the trade-off users make in exchange for free online services, and that Yahoo’s research shows they prefer ads that are relevant to them.

"Email is an expensive system,” Mr. Sharp said. "I think it’s reasonable and ethical to expect the value exchange, if you’ve got this mail service and there is advertising going on."

Yes, so ethical.

On the plus side, Verizon's e-mail scanning doesn't include health and medical information, though in the wild west of consumer privacy oversight that is the United States, you'd have a hard time confirming that this or other information (like financial data) isn't being exploited. After all, Verizon doesn't exactly have a great track record about being candid about this sort of thing. That said, it looks like even before Verizon came on board Yahoo's e-mail scanning and monetization system went notably further than Google's ever did:

"Initially, Yahoo mined users’ emails in part to discover products they bought through receipts from e-commerce companies such as Amazon.com Inc., people familiar with the practice said. Yahoo salespeople told potential advertisers that about one-third of Yahoo Mail users were active Amazon customers, one of the people said. In 2015, Amazon stopped including full itemized receipts in the emails it sends customers, partly because the company didn’t want Yahoo and others gathering that data for their own use, someone familiar with the matter said."

The problem is that while Verizon has hungrily eyed Silicon Valley giants' ad revenues for years, its effort to pivot into the ad sector isn't going so well. The company's Go90 video platform, purported to be the cornerstone of Verizon's Millennial-focused video ad ambitions, recently imploded after a fairly severe lack of public interest. And while Oath may ultimately prove to be a powerhouse in advertising, refusing to bend to competitive trends and consumer concerns by scanning the e-mails of millions of subscribers for an extra buck isn't a great way to build a trustworthy brand.

Of course, anybody surprised that Verizon would take the low road shouldn't be. After all, this is the same company that was caught a few years ago covertly modifying user wireless packets so it could track users around the internet without telling them. It took two years for security researchers to even notice it, and months more before Verizon could be bothered to offer a working opt out tool. And while the company was ultimately fined by the FCC for the practice, a bigger variant of that technology has long-since been implemented across Verizon's entire Oath (the combination of Yahoo and AOL) ad network.

Of course we haven't even gotten to Verizon's ultra-cozy relationship with the nation's intelligence apparatus yet, or the fact that giant ISPs routinely engage in pretty sleazy behavior to undermine pretty much any effort to shore up the nation's privacy standards, regardless of the quality of the effort. All while hoovering up and monetizing private user browsing and location data on a scale that pretty routinely makes the Facebook, Cambridge scandal look like child's play.

Granted if Verizon wants to undermine its own efforts to pivot into the online ad space that's its prerogative, but it might make sense for the traditionally myopic telecom giant to try and evolve on the consumer trust front as well. As an aside, if you're a Yahoo e-mail customer, you should be able to opt out here.

Filed Under: email, privacy, scanning, yahoo, yahoo mail
Companies: oath, verizon, yahoo

Inspector General Not Too Happy With James Comey's Handling Of The Clinton Email Investigation

from the FBI-still-sucks-but-in-exciting-new-ways! dept

The damning report the President has been waiting for has arrived. The Inspector General's report covering everything from James Comey's handling of the Clinton email investigation (terribly with bonus insubordination) to a couple of FBI agents forming a two-person #Resistance (stupid and made the FBI look bad, but not illegal) runs almost 600 pages and won't make anyone looking to pin blame solely on one side of the partisan divide very happy.

It's been claimed the report would finally show the FBI to be an agency filled with partisan hacks, further solidifying "Deep State" conspiracy theories that the government Trump runs is out to destroy Trump. It was somehow going to accomplish this despite many people feeling the FBI's late October dive back into the Clinton email investigation handed the election to Trump.

Whatever the case -- and whatever side of the political divide you cheer for -- the only entity that comes out of this looking terrible is the FBI. That the FBI would engage in questionable behavior shouldn't come as a surprise to anyone, but the anti-Trump "resistance" has taken Trump's attacks on the FBI as a reason to convert Comey, the FBI, and the DOJ into folk heroes of democracy.

The summary of the report [PDF] runs 15 pages by itself and hands out enough damning bullet points to keep readers occupied for hours. Then there's the rest of the report, which provides the details and may take several days to fully parse.

Here are some of the low lights from Inspector General Michael Horowitz, possibly the only person who should be touting "Deep State" theories since he's spent his IG career being dicked around by the DEA, DOJ, FBI, and DEA.

The report says everything about the Clinton email investigation was unusual. Termed the "Midyear Exam" by the FBI, the investigation was mostly a voluntary affair. Most of the evidence and testimony obtained was obtained from consenting witnesses and participants. The FBI rarely felt the need to compel testimony or evidence with subpoenas. It also did not access the contents of multiple devices used by Clinton's senior aides, devices that may have contained classified info that had been circulated through a private email server. As the report notes, this is at odds with Comey's sudden interest in Anthony Weiner's laptop, where his estranged wife (and former Clinton personal assistant) Huma Abedin apparently had stored copies of Clinton emails.

The IG says the tactics used were unusual but does not pass official judgment on them. However, the actions of five FBI employees involved in the investigation did further damage to the FBI and its reputation by taking an investigation already viewed as politically-questionable and aggravating the perception.

In undertaking our analysis, our task was made significantly more difficult because of text and instant messages exchanged on FBI devices and systems by five FBI employees involved in the Midyear investigation. These messages reflected political opinions in support of former Secretary Clinton and against her then political opponent, Donald Trump. Some of these text messages and instant messages mixed political commentary with discussions about the Midyear investigation, and raised concerns that political bias may have impacted investigative decisions.

However, the IG did not uncover evidence suggesting any of these FBI employees had the power to steer the investigation. Some of those engaged in anti-Trump texts actually pushed for additional subpoenas and search warrants in an investigation that seemingly had little use for any testimony not obtained voluntarily. But that doesn't mean these actions were harmless.

Nonetheless, these messages cast a cloud over the FBI’s handling of the Midyear investigation and the investigation’s credibility.

From there, it moves on to James Comey's surprising decision to go public with the email investigation's conclusions in July of 2016. This followed the softening of language in the FBI's investigative report. Clinton's handling of classified info went from "grossly negligent" to "extremely careless." The possibility of hostile actors accessing Clinton's email server went from "reasonably likely" to "possible." Then Comey decided to go public, cutting plenty of people out of the loop so they wouldn't prevent him from doing so.

Comey acknowledged that he made a conscious decision not to tell Department leadership about his plans to make a separate statement because he was concerned that they would instruct him not to do it. He also acknowledged that he made this decision when he first conceived of the idea to do the statement, even as he continued to engage the Department in discussions about the “endgame” for the investigation.

Comey admitted that he concealed his intentions from the Department until the morning of his press conference on July 5, and instructed his staff to do the same, to make it impracticable for Department leadership to prevent him from delivering his statement. We found that it was extraordinary and insubordinate for Comey to do so, and we found none of his reasons to be a persuasive basis for deviating from well-established Department policies in a way intentionally designed to avoid supervision by Department leadership over his actions.

[...]

We concluded that Comey’s unilateral announcement was inconsistent with Department policy and violated long-standing Department practice and protocol by, among other things, criticizing Clinton’s uncharged conduct. We also found that Comey usurped the authority of the Attorney General, and inadequately and incompletely described the legal position of Department prosecutors.

The late October letter to Congress about the reopening of the investigation isn't viewed as any better by the OIG. Comey claimed he needed to do this because withholding the discovery of emails on Anthony Weiner's laptop might have been viewed as swinging the election in Clinton's favor. The IG disagrees.

Much like with his July 5 announcement, we found that in making this decision, Comey engaged in ad hoc decisionmaking based on his personal views even if it meant rejecting longstanding Department policy or practice. We found unpersuasive Comey’s explanation as to why transparency was more important than Department policy and practice with regard to the reactivated Midyear investigation while, by contrast, Department policy and practice were more important to follow with regard to the Clinton Foundation and Russia investigations.

Comey’s description of his choice as being between “two doors,” one labeled “speak” and one labeled “conceal,” was a false dichotomy. The two doors were actually labeled “follow policy/practice” and “depart from policy/practice.” Although we acknowledge that Comey faced a difficult situation with unattractive choices, in proceeding as he did, we concluded that Comey made a serious error of judgment.

Then comes the irony. As Comey became the front-mouth for an investigation he shouldn't have been talking about, he routinely engaged in the same behavior he was currently investigating.

We identified numerous instances in which Comey used a personal email account to conduct unclassified FBI business. We found that, given the absence of exigent circumstances and the frequency with which the use of personal email occurred, Comey’s use of a personal email account for unclassified FBI business to be inconsistent with Department policy.

In addition to being a violation of FBI policy, James Comey -- currently idolized by some as a speaker of truth to power for being fired by the president -- also violated FOIA law by using a private email account for government communications. Comey wasn't the only one -- other agents involved in the investigation routinely used private email accounts -- but he was the FBI's personification of the Clinton email investigation. On top of this, he told other FBI agents the use of personal email accounts would subject them to harsh punishment.

In an October 2016 speech at an FBI conference in San Diego, Comey said, "I have gotten emails from some employees about this, who said if I did what Hillary Clinton did I'd be in huge trouble. My response is you bet your ass you'd be in huge trouble. If you used a personal email, Gmail or if you [had] the capabilities to set up your own email domain, if you used an unclassified personal email system to do our business... you would be in huge trouble in the FBI."

Some may quibble about the lack of classified info being circulated by these agents and their Gmail accounts, but the fact remains the use of private email accounts increases the risk of circulation exponentially. Sticking to government accounts reduces this possibility to zero.

There's much more in the report, including some discussion about the propriety of the Russian influence investigation that Trump claims is a witch hunt. Nothing in the report suggests the investigation isn't valid, even if the actions of agents (the anti-Trump texting) and Andrew McCabe's non-recusal (his wife took money from a Clinton-connected PAC) managed to cover everything with a slimy gloss of impropriety.

The upshot of the report is this: James Comey deserved to be fired, although probably not for the reasons Trump had in mind when he did it. The people employed by the FBI are not always able to set aside their personal biases when engaged in investigations. But the FBI is no one party's political tool. It's a blend of both sides, which makes it unlikely anything was done intentionally to harm Trump or Clinton's political prospects. For all the complaining done by Trump, he's the one in office. If the election was "thrown" by Comey's fourth quarter audible in the email investigation, Trump was the beneficiary of the FBI's actions. This makes complaints about a Russian investigation "witch hunt" incoherent, as it tries to retcon the FBI's actions to portray them as being #NeverTrump even when they were (not officially) helping him. The simultaneous investigations of Clinton and Trump make it difficult to craft a coherent conspiracy theory, but it certainly isn't stopping anyone from trying. The FBI is untrustworthy, but it's not a kingmaker.

Filed Under: doj, donald trump, email, fbi, hillary clinton, inspector general, james comey, michael horowitz, private email, procedures

Many Of Those Desperate GDPR Emails You've Been Getting Are Violating A Different EU Regulation

from the not-to-mention-unnecessary dept

As we careen wildly into a post-GDPR world at the end of this week, you've probably already been inundated with tons upon tons of emails from various companies where you either have an account or have been signed up for their mailing list. Some of these emails likely note that they want you to confirm that you want to remain on their list because of the GDPR. Others pretend they're just checking in with you for the hell of it. According to an expert in EU regulation, many of these emails probably violate another EU regulation, one designed to make spamming illegal. As for the others? They're almost certainly not necessary under the GDPR and appear to be people misunderstanding the GDPR "out of an abundance of caution."

In short, if a service already has proper permission from you, then it doesn't need to get it again. If it doesn't, it's violating EU spam regulations by asking you to give your consent to receive such messages.

Vitale said, if the business really does lack the necessary consent to communicate with you, it probably lacks the consent even to email to ask you to give it that consent.

“In many cases the sender will be breaching another set of regulations, the Privacy and Electronic Communications Regulations, which makes it an offence to email someone to ask them for consent to send them marketing by email.”

And, yes, EU regulators are aware of all of this:

“We’ve heard stories of email inboxes bursting with long emails from organisations asking people if they’re still happy to hear from them,” Steve Wood, the deputy information commissioner, wrote in guidance for businesses. “So think about whether you actually need to refresh consent before you send that email, and don’t forget to put in place mechanisms for people to withdraw their consent easily.”

Like Vitale, Wood emphasised that asking for marketing consent from people who had not given it initially could be illegal. “It’s also important to remember that in some cases it may not be appropriate to seek fresh consent if you are unsure how you collected the contact information in the first place, and the consent would not have met the standard under our existing Data Protection Act,” he said.

Depending on how you look at this, it's either the most European of European regulation situations -- in which efforts to comply with a new set of convoluted regulations means violating existing convoluted EU regulations -- or just another example of how ridiculous companies act. Still, it does seem fairly clear that the whole GDPR situation is an utter mess, with tons of companies having no idea what they actually need to do, or how to actually comply with the law.

Whether you think the GDPR is a wonderful innovation in protecting our privacy, or you think it's a giant clusterfuck of bureaucratic virtue signaling, it does seem like it could be something of a general problem if basically every internet company everywhere has no idea how to actually be in compliance.

Filed Under: data protection, email, eu, gdpr, opt-in, permission, privacy, spam

Judge Says Yahoo Still On The Hook For Multiple Claims Related To Three Billion Compromised Email Accounts

from the if-you-don't-fix-the-front,-you'll-be-paying-on-the-back-end dept

A federal judge is going to let a bunch of people keep suing Yahoo over its three-year run of continual compromise. Yahoo had hoped to get the class action suit tossed, stating that it had engaged in "unending" efforts to thwart attacks, but apparently it just wasn't good enough to prevent every single one of its three billion email accounts from falling into the hands of hackers.

In a decision on Friday night, U.S. District Judge Lucy Koh in San Jose, California rejected a bid by Verizon Communications Inc, which bought Yahoo’s Internet business last June, to dismiss many claims, including for negligence and breach of contract.

Koh dismissed some other claims. She had previously denied Yahoo’s bid to dismiss some unfair competition claims.

Yahoo was accused of being too slow to disclose three data breaches that occurred from 2013 and 2016, increasing users’ risk of identity theft and requiring them to spend money on credit freeze, monitoring and other protection services.

Three billion is a lot of potential class-mates, even though many Yahoos users had moved on to more viable/useful services long before the breach began. That being said, password reuse is common. So is the tendency to have the same user name in place across several platforms. And, needless to say, personally identifiable info stays the same, no matter what platform Yahoo's former users have strayed to.

The complaint -- amended again after news broke that Yahoo's entire user base had been compromised -- notes that Yahoo's "unending" efforts were routinely terrible, if not practically nonexistent. The suit points out multiple Yahoo hosts were compromised in 2008 and 2009. The next year, Google notified Yahoo that its systems were being used to attack Google. And in 2012, Yahoo suffered two breaches, including one stemming from a SQL injection attack that revealed the company unendingly stored passwords in plain text.

A couple of claims have been dismissed but the most damaging -- negligence -- remains. The plaintiffs so far have presented plenty of evidence that Yahoo handled users' PII extremely carelessly. From the decision [PDF]:

First, the contract entered into between the parties related to email services for Plaintiffs. Plaintiffs were required to turn over their PII to Defendants and did so with the understanding that Defendants would adequately protect Plaintiffs’ PII and inform Plaintiffs of breaches. Second, it was plainly foreseeable that Plaintiffs would suffer injury if Defendants did not adequately protect the PII. Third, the FAC asserts that hackers were able to gain access to the PII and that Defendants did not promptly notify Plaintiffs, thereby causing injury to Plaintiffs. Fourth, the injury was allegedly suffered exactly because Defendants provided inadequate security and knew that their system was insufficient. Fifth, Defendants “knew their data security was inadequate” and that “they [did not] have the tools to detect and document intrusions or exfiltration of PII.” “Defendants are morally culpable, given their repeated security breaches, wholly inadequate safeguards, and refusal to notify Plaintiffs . . . of breaches or security vulnerabilities.” Id. Sixth, and finally, Defendants’ concealment of their knowledge and failure to adequately protect Plaintiffs’ PII implicates the consumer data protection concerns expressed in California statutes, such as the CRA and CLRA.

Yahoo also has to keep fighting "deceit by concealment" allegations stemming from its delayed reporting of known security breaches.

Defendants also criticize Plaintiffs for continuing to use Yahoo Mail and taking no remedial actions after learning of Defendants’ allegedly inadequate security. However, Defendants fail to acknowledge that Defendants’ delayed disclosures are likely to have harmed Plaintiffs in the interim. Plaintiffs did not even know that they should take any remedial actions during the periods of Defendants’ delayed disclosures. Moreover, contrary to Defendants’ suggestion, the actions that Plaintiffs took after the fact do not conclusively determine what actions they would have taken if they had been alerted before the fact. The FAC provides at least one good reason why Plaintiffs may not have ceased their use of Yahoo Mail after the fact—namely, Plaintiffs have already established their “digital identities around Yahoo Mail.” Plaintiffs can consistently plead that they took minimal or no action after learning of the security defects but that they “would have taken measures to protect themselves” if they had been informed beforehand.

In total, Yahoo is still on the hook for 9 of 15 allegations related to the massive security breach. And it has no one to blame but itself if new owner Verizon ends up shelling out for damages. Yahoo's terrible security had been a problem for a half-decade before the 2013 breach. Three years later, it became clear everything Yahoo had collected on three billion email accounts was now in the hands of other people. This long line of breaches show Yahoo was very interested in increasing its user base, but much less motivated to protect their info.

Filed Under: breach, cybersecurity, email, hack, liability, negligence, security, standing
Companies: verizon, yahoo

Hacks Are Always Worse Than Reported: All Of Yahoo Email Was Hacked In 2013. All. Of. It.

from the yes-all-of-it dept

Given recent and massive stories about data security breaches by some very, very large players in the technology and financial spaces, we have developed a mantra that you should have on repeat in your head any time you read stories about a breach: however big the breach is reported to be initially, it's always bigger. We formulated that 12 years ago and it has continually held true. We saw it with Equifax. We saw it with Deloitte. And you will also likely recall that 2013 and 2014 were not banner years for data security at a little company called Yahoo. Hacks of Yahoo's email platform were reported initially to be in the hundreds of thousands in terms of the number of accounts compromised. As Verizon began negotiating the purchase of Yahoo, that number crept into the hundreds of millions. Eventually, Yahoo settled on a billion compromised accounts resulting from the hacks.

The Verizon deal went through, with a hefty price reduction as a result of the security breaches. And so it's under the Verizon umbrella that Yahoo informed the public this past week that the need for numerical quantification for the two security breaches has been rendered moot. Because it's much easier to just say, "Yahoo email was compromised." As in: all of it.

In 2016, Yahoo disclosed that more than one billion of about three billion accounts had likely been affected by the hack. In its disclosure Tuesday, the company said all accounts were likely victimized. Yahoo included the finding in a recent update to its Account Security Update page, saying that it found out about the wider breach through new intelligence obtained during the company's integration into Verizon Communications. Outside forensic experts assisted in the discovery, the company said.

"It is important to note that, in connection with Yahoo's December 2016 announcement of the August 2013 theft, Yahoo took action to protect all accounts. The company required all users who had not changed their passwords since the time of the theft to do so. Yahoo also invalidated unencrypted security questions and answers so they cannot be used to access an account," Yahoo said Tuesday.

Also important to note is that the yahoos at Yahoo were only able to correctly inform the public as to the specific number of accounts breached in these attacks once the use of numbers no longer mattered. Tooting its own horn about the actions it took to protect "all accounts" when it didn't even know that "all accounts" had indeed been compromised violates PR rule number 1: don't request praise in the middle of a crisis. The crisis, in this case, is why anyone should have a Yahoo email account at all moving forward, given how laughably bungled this whole mess has been handled.

But the larger point harkens back to the introduction: remember the mantra. These things are always, always way worse than initially reported. Why companies engage in this sort of slow-motion bandaid-pulling is beyond me, but it sure seems to be the playbook.

Filed Under: disclosure, email, hack
Companies: yahoo

Well-Known Email Prankster Ends Up With Sensitive Document From Jared Kushner's Lawyer

from the sold-out-by-autocomplete? dept

Careless handling of sensitive emails isn't just a problem for Trump's top advisor, Jared Kushner. Having rolled into office on the echoing cries of "Lock her up!" Trump's team nonetheless continued to use private email accounts for official correspondence. Kusher did this twice: using both a Republican National Committee account as well as another personal email address.

It's a security issue as well as a transparency issue. Personal email accounts -- while convenient (and conveniently opaque) -- are little more than attack vectors for cybercriminals and state-sponsored hacking. Making this security problem worse are Trump team legal reps, who can't seem to stop communicating with staffer-spoofing accounts.

A prankster known only by his Twitter handle (SINON_REBORN) has a few admin team trophies on his wall already. The prankster has already duped White House Special Counsel Ty Cobb with an impersonation of White House Media Director Dan Scavino. That followed successful pranking of Breitbart editors and White House Homeland Security Advisor Tom Bossett.

The latest victim is Jared Kushner's lawyer, Abbe Lowell. He's been stung twice, as the Verge's Sarah Jeong reports.

This is the second time that Abbe Lowell, a partner at Norton Rose Fulbright LLP, who began representing Kushner in June, has fallen for a prankster who calls himself SINON_REBORN (a reference to the original legend of the Trojan Horse). Two days ago he corresponded with kushner.jared@mail.com, as the fake Jared Kushner asked for legal advice on whether to remove correspondence on his private email account that featured "adult content." Fortunately for Lowell, the conversation didn't go far, ending with, "Don't delete. Don't send to anyone. Let's chat in a bit."

This email exchange likely gave Kushner's lawyer a few mental images he wished he'd never had. A more descriptive recounting of the email exchange at Business Insider shows Abbe Lowell tangling with possibly unfamiliar fetishes.

"I need to see I think all emails between you and WH (just for me and us)," Lowell wrote. "We need to send any officials emails to your WH account. Not stuff like you asked about. None of those are going anywhere."

"But we can bury it?" the prankster responded. "I'm so embarrassed. It's fairly specialist stuff, half naked women on a trampoline, standing on legoscenes, the tag for the movie was #standingOnTheLittlePeople :("

That Lowell believed this was from his client raises questions about the frequency of emojis in Kushner's communications. But this exchange wasn't the end of it. The next email the prankster received from Kushner's lawyer was unsolicited, but it contained a sensitive document.

We don't know exactly what happened, but the most likely scenario is that Lowell's mail client autocompleted to the fake Kushner email address, landing a sensitive letter right in the prankster's inbox. SINON_REBORN then reposted the letter on Twitter.

The document is a committee-eyes-only letter from the Senate Intelligence Committee, ordering him to preserve emails from his personal account possibly related to the ongoing Russian election interference investigation. Presumably these emails wouldn't include half-naked trampoline Lego porn, but Lowell's response to take the discussion offline suggests there are still several ongoing discussions the Intelligence Committee won't be able to access.

Is this administration's operational security worse than the last one's? There's not enough data available to tell. But SINON-REBORN's pranks were already well-known before this latest administration gaffe, suggesting a lack of detail orientation by admin members and their legal representation.

Filed Under: abbe lowell, email, jared kushner, prank