Yahoo Asks James Clapper To Please Let It Talk About The Email Scanning It Did For The Government

from the 'it-already-sucks-enough-to-be-us' dept

After spending several days basking in the fiery glow of negative press (and seeing potential investors walk away from buying the company), Yahoo is asking the government to please please let it talk about the spying it apparently performed for the NSA or FBI.

Yahoo sent a letter to National Intelligence director James Clapper on Wednesday urging the U.S. government to provide clearer information to citizens on national security demands for user data.

Yahoo’s letter called for intelligence groups to confirm if future reported demands for data are real, and if they are, declassify them with context for the public.

Pots, kettles, and other analogous materials are rendered incomprehensible in its statement, which involves a media company implicitly criticizing other media companies.

In a letter today to James Clapper, Director of National Intelligence (DNI), Yahoo is formally urging that the U.S. government provide its citizens with clarification around national security orders they issue to internet companies to obtain user data.

While the letter makes specific reference to recent allegations against Yahoo, it is intended to set a stronger precedent of transparency for our users and all citizens who could be affected by government requests for user data. As we’ve said before, recent press reports have been misleading; the mail scanning described in the article does not exist on our systems.

"Does not exist" is not nearly the same thing as "did not exist." This means Yahoo is no longer scanning emails in this fashion, not that it never performed this scanning.

The letter does make a good point about transparency. Currently, Yahoo is unable to defend itself against any allegations because it is likely under a gag order. Yahoo would like Clapper's office to share in the public pain, especially since it had a problem sharing in the communications gathered on its behalf by the email provider.

Public embarrassment or not, Clapper's office is probably not rushing through a declassification review of this Section 702 FISA order. It could still be months or years before the government produces this document and/or allows Yahoo to speak openly about its email scanning program.

Perhaps recognizing that a displeased letter to the ODNI doesn't create much leverage, the company appears to be making this a global issue, rather than simply a domestic one. Marcy Wheeler points out that the letter mentions Yahoo's global reach and users several times and namechecks the EU's Privacy Shield agreement. This may be the key that loosens the Intelligence Community's Glomarred lips.

But there’s another reason why Clapper’s office — or rather ODNI General Counsel Bob Litt — may be so quiet.

Litt is the one who made many of the representations about US spying to authorities here [Wheeler is in Europe at the moment]. Someone — Litt, if he’s still around for a hearing that may take place under President Hillary — may also need to go testify under oath in an Irish court in conjunction with a lawsuit there. Whoever testifies will be asked about the kinds of surveillance implicating European users the government makes US companies do.

In other words, Bob Litt is the one who made certain representations to the European authorities. And now some of those same people are asking questions about how this scan complies with the terms Litt laid out.

Which makes his silence all the more instructive.

Someone's going to have to start talking about Yahoo's email scanning program soon. Yahoo obviously can't, which means the ODNI is going to have to address this on someone else's timetable. We already have US legislators demanding answers. European politicians are already unhappy about the apparent breach of the Privacy Shield Agreement. If the ODNI continues to avoid the issue, all it will be doing is letting a private company take the fall for its possible overreach.

Filed Under: email, gag order, james clapper, mass surveillance, nsa, scanning, surveillance
Companies: yahoo

Continued Disagreement And Confusion Over Yahoo Email Scanning

from the someone-needs-to-come-clean-for-real dept

The story behind Yahoo's apparently scanning over every email for the NSA continues to be... confusing. Earlier this week we noted some conflicting reports in the media on what was actually happening. The NY Times report said that it was via a FISA Court Order, which would be interesting, and would almost certainly require a declassification of the FISA opinion. However, Reuters insisted that it was actually under Section 702 of the FISA Amendments Act (which doesn't involve a FISA Court Order). So, confusion abounded.

And now it's getting worse. That same NY Times report said that the system was just a modification of Yahoo's malware scanners for a particular snippet of text or code:

To comply, Yahoo customized an existing scanning system for all incoming email traffic, which also looks for malware, according to one of the officials and to a third person familiar with Yahoo’s response, who also spoke on the condition of anonymity

Except, according to a new report from Motherboard, that's not actually true, and instead the NSA was asking Yahoo to install its own malware which was super buggy:

Anonymous sources told The Times that the tool was nothing more than a modified version of Yahoo’s existing scanning system, which searches all email for malware, spam and images of child pornography.

But two sources familiar with the matter told Motherboard that this description is wrong, and that the tool was actually more like a “rootkit,” a powerful type of malware that lives deep inside an infected system and gives hackers essentially unfettered access.

The rootkit-like tool was found by Yahoo’s internal security testing team during one of their checkups, according to a source.

That's more consistent with the original report in Reuters, which talked about the security team finding the code and believing it was malware. And, apparently the rootkit/malware code that the NSA gave Yahoo was super buggy and put everyone at risk:

“It definitely contained something that did not look like anything Yahoo mail would have installed,” the source added. “This backdoor was installed in a way that endangered all of Yahoo users.”

Another source, who also requested anonymity and was familiar with what happened, confirmed that describing the tool as a “buggy” “rootkit” is accurate.

A different article over at the Intercept has similar claims as well. It's possible that this is the same source going to multiple publications, or it could actually be different sources. Seeing as the language in the two articles is similar, it very likely is the same source though:

According to the Yahoo alum, a mere “modification to [existing] mail filters wouldn’t have raised a red flag … [the security team] wouldn’t have been able to detect it in the first place.” Rather, Yahoo’s security team had detected “something novel, like something a hacker would have installed.” The team believed it “was or looked like a root kit,” a piece of software installed on a computer system to give a third party complete, invisible control. In this case, according to the ex-Yahoo source, it was “a program that runs on your servers that has access to incoming data.”

And the buggy nature is also discussed as well:

“The program that was installed for interception was very carelessly implemented, in a way that if someone like an outside hacker got control of it, they could have basically read everyone’s Yahoo mail,” something the source attributed to “the fact that it was installed without any security review.”

I'm guessing this is the same source who went to both publications, but it continues to raise more questions about this. Forcing Yahoo to actually install code is a big, big deal and gets back to the questions raised by the DOJ trying to force Apple to do the same thing. And, once again, this is the kind of thing the government isn't supposed to be able to do in secret. Yes, individual orders and details about who or what is being searched can and should be kept secret, but requiring a company to install code that sniffs through every email... that's not how these things are supposed to work.

Filed Under: email, malware, mass surveillance, nsa, rootkit, scanning
Companies: yahoo

Yahoo Issues Tone Deaf Non-Denial Denial Of Email Scanning Report

from the blink-twice-if-you're-being-forced-to-say-this dept

After basically all the big tech companies have come out with strong and clear denials, Yahoo this morning released a silly mealy mouthed non-denial denial, written by a PR firm, that took almost 24 hours to craft:

Good morning –

We are reaching out on behalf of Yahoo regarding yesterday’s Reuters article. Yahoo said in a statement:

“The article is misleading. We narrowly interpret every government request for user data to minimize disclosure. The mail scanning described in the article does not exist on our systems.”

Best,

The Joele Frank Team

Of course, people are parsing every word of that and noting some... remaining questions. The article is misleading? Okay, how? Which parts? What did it get wrong? You narrowly interpret every government request? Great. So explain what was found here, or explain the specifics of what Yahoo is doing. "Does not exist on our systems"? Did it ever? Does it exist on someone else's system? Does a different mail scanning system exist? Lots of people would like to know.

More importantly, note that they say they want to minimize disclosures. But that's not the key issue here, as Chris Soghoian points out. The Reuters report was on the searching of all emails, not the disclosure bit. Yes, sure, it seems clear that after searching everyone's email, Yahoo likely only "disclosed" a small number to the NSA, but that's not really the point, is it?

I mean, I guess this statement is better than Yahoo's original: "Yahoo is a law abiding company, and complies with the laws of the United States" statement. But, it's not very reassuring. Much more important is what Yahoo could have said, but didn't. But that's not happening. Yahoo has said that it "can't comment further" which either means it doesn't want to comment further or, potentially, that it feels it is legally barred from commenting any further -- which is certainly a possibility (though a disturbing one).

The NSA or the Director of National Intelligence could help clear this up, but so far they're going all Glomar on any questions: And that alone should be a giant warning sign to any tech company that decides not to fight these kinds of demands: when it inevitably leaks to the public (and it will), the intelligence community will let you hang out to dry all by yourself.

Filed Under: email, mass surveillance, non-denial denial, nsa, scanning, section 702
Companies: yahoo

Yahoo Secretly Built Software To Scan All Emails Under Pressure From NSA Or FBI

from the uh-wait-a-second dept

So Reuters had a big exclusive report this morning about Yahoo creating "custom software to search all of its customers' incoming emails for specific information" at the behest of the NSA or FBI. This was built last year -- which came well after the Snowden disclosures, and after Yahoo had been revealed to have legally challenged earlier NSA dragnet attempts -- and after it had rolled out end-to-end encryption on email.

Apparently, this was a decision made at the top by Marissa Mayer, and pissed off the company's top security guy, Alex Stamos (who is awesome and a big supporter of end-to-end encryption) leading him to leave the company (and move to Facebook, where he is currently).

According to the two former employees, Yahoo Chief Executive Marissa Mayer's decision to obey the directive roiled some senior executives and led to the June 2015 departure of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook Inc."Yahoo is a law abiding company, and complies with the laws of the United States," the company said in a brief statement in response to Reuters questions about the demand. Yahoo declined any further comment.

Of course, this comes out less than a week after the NY Times had a big report on how Mayer de-prioritized security, despite having built up a great team of computer security experts called "The Paranoids." But, Mayer apparently downplayed or blocked their efforts, leading many to go elsewhere. And now we find out that Yahoo agreed to create this special software for scanning all emails for certain phrases or keywords. Bizarrely, this new report notes that Mayer gave the task of writing this software not to the security team, but to email engineers, leaving the security team in the dark, until they discovered it, thinking it was malware:

They were also upset that Mayer and Yahoo General Counsel Ron Bell did not involve the company's security team in the process, instead asking Yahoo's email engineers to write a program to siphon off messages containing the character string the spies sought and store them for remote retrieval, according to the sources.

The sources said the program was discovered by Yahoo's security team in May 2015, within weeks of its installation. The security team initially thought hackers had broken in.

When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users' security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails.

Now, there are still a number of open questions about this: chief among them if others, such as Google, Microsoft, Facebook, and Twitter were similarly compelled to create similar software. This may not be that meaningful, but the article does not say that it was a FISA Court "order" but rather a "directive" that compelled this:

The company complied with a classified U.S. government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said two former employees and a third person apprised of the events.

The question then is what secret "directive" does the government have that allows such broad scanning? The most likely (but certainly not the only) possibility is a stretched interpretation of Section 702 of the FISA Amendments Act. That Section is responsible for two known programs for the NSA to collect info: PRISM, which had big tech companies sharing specific information with the NSA, and "upstream" collection in which broadband providers like AT&T would scan all traffic for certain information. Without more detail, it's a little difficult to know what happened here, but it sounds like something in between PRISM and upstream -- in which online service providers were similarly asked to scan all content for certain information.

It seems clear that Yahoo either didn't think it could win a legal fight over this (certainly a possibility), or that it just didn't want to. At the very least, this seems like yet another example of totally secretive rulemaking by the US government on what surveillance capabilities are legal, without any public review or adversarial process designed to make sure that civil liberties are protected. I know that many of the more paranoid folks out there think that the NSA already had deals with the big companies to scan all content, but they weren't supposed to, and as far as we knew they did not as of a few years ago. But if that changed last year, that's a big, big deal, and much more information needs to become public on this.

Filed Under: alex stamos, bulk collection, email, marissa mayer, mass surveillance, nsa, privacy, scanning, section 702
Companies: yahoo

Why Is The UK's Intellectual Property Office Praising National Portrait Gallery's Copyfraud Claims Over Public Domain Images?

from the wtf? dept

The other day I saw the following tweet and was very confused: That's a tweet from the UK's Intellectual Property Office (IPO) asking how does the UK's National Portrait Gallery in London "manage the copyright of national treasures like Shakespeare?" My initial response, of course, was "Wait, Shakespeare is in the bloody public domain, you don't have any copyright to manage!" It seems rather easy to manage "the copyright" of Shakespeare when there is none. But it turns out the link is... even worse. It's to a blog post on the IPO website eagerly praising the National Portrait Gallery for engaging in out-and-out copyright fraud. You'd think that the Intellectual Property Office would recognize this, but it does not.

The tweet was doubly misleading, also, because it's not the works of William Shakespeare, but rather a portrait of William Shakespeare. The IPO then explains that the National Portrait Gallery is doing a brisk business licensing these public domain images, noting that:

According to the gallery’s most recent statistics – the top five individual portraits licensed from its website are, in descending order: William Shakespeare, Richard III, Queen Elizabeth 1, King John and King Henry V.

Obviously, all of those portraits were created centuries ago -- and are in the public domain. So why is the National Portrait Gallery licensing them at all? Well, I'm pretty sure this goes back to an issue we've written about quite some time ago. While in the US the caselaw is clear that merely digitizing public domain images does not create a new copyright, the National Portrait Gallery in London has always taken the opposite view. Back in 2009, we wrote about this very same museum threatening Wikimedia Commons for posting scans of high resolution images of public domain works that were downloaded from the NPG's website.

But, here's the thing: just a few months ago, we wrote that the UK Intellectual Property Office (the same organization as above) had declared that scans of public domain works are also in the public domain in Europe (including the UK... for now at least). Here's what the UK's IPO said just months ago about copyright on scans of public domain images:

However, according to the Court of Justice of the European Union which has effect in UK law, copyright can only subsist in subject matter that is original in the sense that it is the author’s own 'intellectual creation'. Given this criteria, it seems unlikely that what is merely a retouched, digitised image of an older work can be considered as 'original'. This is because there will generally be minimal scope for a creator to exercise free and creative choices if their aim is simply to make a faithful reproduction of an existing work.

And, then, just months later, it's praising the National Portrait Gallery for falsely claiming copyright on such images and on then fraudulently profiting by licensing those images based on copyrights it doesn't hold? And the IPO's whole focus seems to be on just how much money can be made here. Read this and try not to feel sick:

Online availability and easy access to images and other data are crucial aspects of modern museum and library curation. Huge databases of valuable information are available. Users need to know where to find these resources and how to use them without infringing copyright. Museums and libraries are developing strategies to improve access for researchers, to give access to businesses users who want to develop their own intellectual property (IP) by using cultural resources and develop their own brands and merchandising.

Mathew Bailey, Rights and Images Manager at the National Portrait Gallery, balances the high wire between providing public access to our shared national assets and the need to encourage, develop and supply the creative economy with legally certain, quantifiable, marketable IP. The commodity he deals in – our heroes – couldn’t be more volatile.

Then, to make matters even stupider, the UK's Intellectual Property Office notes that no one has any idea who created any of these top portraits:

It’s no accident the names of the artists who painted the UK’s top five portraits are uncertain - King John looks like he’s just sat on a thistle, whereas Richard III only half fills his canvas. The lives of Richard III, King John and Henry V were all dramatised by Shakespeare during the reign of Elizabeth I. She was an image conscious monarch in the first age of mass communication and Shakespeare was her blockbuster dramatist. Shakespeare’s narratives add value and are the real reason why he, Richard, Elizabeth, John and Henry are still top of the portrait pops.

It didn't occur to Dan Anthony, who wrote this article, to recognize the absurdity of the fact that the National Portrait Gallery is claiming a copyright in works where it doesn't even know the name of the artists who created those works? Holy crap. How does the UK IPO find these people?

Oh, and then the article ends with this:

All images © National Portrait Gallery, London.

Bloody hell. They are not. They're in the public domain. Here's Shakespeare's portrait: You can find it, accurately listed as being in the public domain over at Wikipedia. Dan Anthony at the UK IPO is incredibly misinformed, and he should ask his own colleagues, who just months ago made it clear that such images were in the public domain, before posting such ridiculousness on the IPO's website.

Filed Under: copyfraud, copyright, ipo, licensing, national portrait gallery, portraits, public domain, scanning, uk, william shakespeare

Judge Tackles Police Use Of Radar To Scan Home Interiors And Comes Up With No Real Answers

from the it-comes-down-to-details-and-there-just-aren't-enough-of-those dept

Being in law enforcement often means brushing right up against the edges of the Fourth Amendment. It's your job to catch criminals, and most criminals have zero interest in being caught. The resulting surface tension is easily broken. Some breaks are inadvertent. Others are much more deliberate. But in this case, the circumstances are ambiguous at best.

A recent case presided over by Judge Neil Gorsuch of the Tenth Circuit Court deals with these stretched edges. [via Orin Kerr] Convicted felon Steven Denson stopped meeting with his probation officer and holed up in his house, where he was subsequently arrested for parole violations and the illegal possession of firearms. (The guns hadn't been used in any criminal activity, but Denson's previous felony conviction made it illegal for him to possess them.)

We know Denson was in his house because the end result bears that out. Leading up to the entrance of his residence, the police gathered other information indicative of Denson's whereabouts: utilities registered in his name, his lack of employment and electricity usage that surpassed that of an empty house.

Denson challenged the arrest and the post-arrest seizure of weapons on the basis of a single act performed by the officers prior to entry: the use of Doppler radar to determine whether someone was actually on the premises.

While it's never specifically stated as such, the gist appears to be that the Doppler radar was considered a warrantless search by Denson -- something that should negate the actions of the officers following the radar's use. The police had no warrant to search the premises, only a warrant to effect an arrest. While he was being arrested, police swept his home (without a warrant), uncovering the illegal weapons. Judge Gorsuch -- after some discussion on whether the police had enough "probable cause" to believe Denson was at home -- tackles the issue of the radar itself, something that presents Fourth Amendment concerns. [pdf link]

Separately and as we alluded to earlier, the government brought with it a Doppler radar device capable of detecting from outside the home the presence of “human breathing and movement within.” All this packed into a hand-held unit “about 10 inches by 4 inches wide, 10 inches long.” The government admits that it used the radar before entering — and that the device registered someone’s presence inside. It’s obvious to us and everyone else in this case that the government’s warrantless use of such a powerful tool to search inside homes poses grave Fourth Amendment questions. See, e.g., Kyllo v. United States, 533 U.S. 27, 33-35 (2001) (holding that using warrantless thermal imaging to show activity inside a home violated the Fourth Amendment) New technologies bring with them not only new opportunities for law enforcement to catch criminals but also new risks for abuse and new ways to invade constitutional rights.

Denson argues the police had no reason to enter his home, much less search it. The only reason they did was because the Doppler radar indicated someone was in the house. He also argues that the use of the radar should have negated the officers' stated need to perform a sweep of the house for other individuals -- this protective sweep being the instrument of discovery for Denson's weapons stash.

The single mention of a precedential case (Kyllo v. United States) is inserted near the discussion about "grave Fourth Amendment questions," and never mentioned again. It would appear that the Doppler radar was a warrantless search of Denson's premises, at least under this Supreme Court ruling, but Gorsuch ignores this and focuses on the probable cause factors justfying entry of the home in the first place.

Gorsuch examines the protective sweep more closely, and finds it wanting, considering the pre-entry radar deployment. On one hand, Denson's history of violent crime and known violent criminal associates would have justified a "protective sweep" during his arrest. But, on the other hand, the cops already knew no one else was on the premises.

But what — again — about the radar? Before the officers entered, their radar search suggested the presence of one person inside. And given that, one might well wonder: did the officers’ questionable search outside the home paradoxically negate their otherwise solid case for a search inside the home? Surely, after all, the government isn’t entitled to perform searches to guard against phantom risks, ones they know don’t exist. If radar (or any other investigative technique for that matter) dispels the possibility of a hidden danger, a search predicated on that possibility becomes constitutionally unreasonable.

The government cannot take the benefit of a questionable radar search without having to live with its costs. Neither does the government seek to justify its protective sweep in this case on the presence of any threat (say, traps or bombs) that its radar wasn’t designed to detect. The government’s only professed fear was the presence of persons, something its radar was admittedly designed to detect.

Gorsuch could have pushed a bit more on this point, but unfortunately, defers to the unknown.

Even so, without more facts about the radar, its capacities and how it was used, we just can’t say it “dispel[led]” the officers’ “reasonable suspicion of danger” in this case. We know the radar suggested the presence of someone inside. But how far inside the structure could it see? Could the device search the whole house and allow the officers to be sure that they had located every person present? Could it distinguish between one person and several? We just don’t know. Our record lacks any answers. As a result, we simply aren’t in a position to say that the radar search negated the officers’ otherwise specific and articulable reasons to worry about a compatriot lurking inside.

And that's where it ends. Gorsuch notes that the use of these devices means this sort of thing will be discussed again. As for the police department, it's safe to assume it isn't interested in divulging further details about its technology, even if what it withholds may jeopardize the evidence it obtained.

But behind it all, there were two searches performed -- both without a warrant. First, there was the Doppler "search," which determined someone was home. Then there was the search performed under the guise of a "protective sweep." The guns were uncovered in a closet, something that would be checked during a sweep, but the question falls back to whether the sweep itself was justified. Gorsuch says basically that he just doesn't know and the question remains open until the situation presents itself again.

The troubling aspects about the Doppler radar align with concerns about Stingray devices. Police have used IMSI catchers to track down suspects without having to deal with search warrants -- something radar can do as well. In both cases, details about capabilities are left to the courts' imaginations. No one in law enforcement wants to talk about the level of intrusion or the inherent limits of the tech and, for the most part, their silence has been unchallenged.

Filed Under: 4th amendment, houses, policy, privacy, scanning, steven denson

Court Says That Google's Scanning Email Content To Place Ads Could Violate Wiretap Laws

from the really? dept

We've discussed before a series of class action cases filed against Google, claiming that Gmail violates various wiretapping laws, because its service scans email contents for the purpose of matching ads to the content of the email. This was a complaint that was raised back when Gmail was first launched, but people appeared to fairly quickly recognize that all that's happening is a computer is scanning the email to match up an attempt at a more relevant ad. People signed up in droves because they don't seem at all bothered by this. No human other than the sender and recipient is seeing the content of the email. Eventually, though, this class action lawsuit was filed, in part arguing that non-Gmail users never consented to this sort of "invasion." Except it's not an invasion at all. It's just how Google (and others) process email. However, Judge Lucy Koh, has more or less rejected Google's attempt to have the case thrown out.

This seems like a total misreading of the Wiretap Act. Under this kind of interpretation, all sorts of online services would basically be barred. While it goes into a long discussion, the short version is that the court says that while the Wiretap Act allows for the interception of messages in the course of business, that exception is "narrow" and does not include how Google "intercepts" emails.

Plaintiffs have plausibly alleged that Google’s reading of their emails was not within this narrow ordinary course of its business. Specifically, Plaintiffs allege that Google intercepts emails for the purposes of creating user profiles and delivering targeted advertising, which are not instrumental to Google’s ability to transmit emails. The Consolidated Complaint alleges that “Google uses the content of the email messages [Google intercepts] and the derivative data it creates for its own benefit in other Google services unrelated to the service of email or the particular user.” Plaintiffs support their assertion by suggesting that Google’s interceptions of emails for targeting advertising and creating user profiles occurred independently from the rest of the email-delivery system. In fact, according to the Consolidated Complaint, the Gmail system has always had separate processes for spam filtering, antivirus protections, spell checking, language detection, and sorting than the devices that perform alleged interceptions that are challenged in this case. As such, the alleged interception of emails at issue here is both physically and purposively unrelated to Google’s provision of email services. Google’s alleged interceptions are neither instrumental to the provision of email services, nor are they an incidental effect of providing these services. The Court therefore finds that Plaintiffs have plausibly alleged that the interceptions fall outside Google’s ordinary course of business.

I honestly don't get this. Google is not "intercepting" the email. It's just having its computers scan to match up ads with it. If that's "interception" and somehow illegal, then wouldn't the same be true of spam and anti-virus detection? All of those things equally involve having a computer scan the contents of an email. Does anyone honestly believe that a spam filter is an illegal wiretap?

Either way, I'm sure there will be an appeal, so this case is a long way from being finally decided.

Filed Under: class action, email, scanning, wiretaps
Companies: google

Appeals Court Hints VERY Strongly That Google Books Is Fair Use, Even Though It Wasn't Asked About That

from the look-at-that dept

Back in May, we noted that the appeal in the Authors Guild case against Google over Google Books had taken something of an odd turn. The specific question on appeal had been entirely focused on whether or not it was appropriate to have this be a class action lawsuit for all authors. Google had, quite reasonably, argued that fair use can be pretty fact specific, and a very different analysis may apply for different kinds of books, and thus it would be a bad idea to lump all authors together in a class action lawsuit. However, the district court had ruled in favor of a class action, and supposedly it was that question that was being discussed on appeal. Instead, we noted that during the oral arguments, the three judge panel seemed to have no interest in that actual question, and instead talked about how Google's book scanning project seemed likely to be covered by fair use.

So, I guess it should come as little surprise that today's ruling on the matter barely even mentions the class action issue, other than to say that Google's argument "may carry some force." Instead it sends the case back to the district court, saying that it should do the fair use analysis first, suggesting that this might make the whole question of whether or not a class should be certified entirely moot. In other words, the Second Circuit is basically screaming to the district court: "what Google is doing is fair use, full stop, so we're wasting time arguing about whether or not this is a class action: just end the thing by saying it's fair use." The ruling is short and sweet and is a huge victory for Google. Here's the key part:

Putting aside the merits of Google’s claim that plaintiffs are not representative of the certified class—an argument which, in our view, may carry some force—we believe that the resolution of Google’s fair use defense in the first instance will necessarily inform and perhaps moot our analysis of many class certification issues, including those regarding the commonality of plaintiffs’ injuries, the typicality of their claims, and the predominance of common questions of law or fact, see Fed. R. Civ. P. 23(a)(2), (3), (b)(3). See, e.g., FPX, LLC v. Google, Inc., 276 F.R.D. 543, 551 (E.D. Tex. 2011) (denying plaintiffs’ request for class certification “because of the fact-specific inquiries the court would have to evaluate to address [defendants’] affirmative defenses [including fair use of trademarks]”); Vulcan Golf, LLC v. Google Inc., 254 F.R.D. 521, 531 (N.D. Ill. 2008) (“The existence of affirmative defenses [such as fair use of trademarks] which require individual resolution can be considered as part of the court’s analysis to determine whether individual issues predominate under Rule 23(b)(3).”); see also Coopers & Lybrand v. Livesay, 437 U.S. 463, 469 n.12 (1978) (“Evaluation of many of the questions entering into determination of class action questions is intimately involved with the merits of the claims. The typicality of the representative’s claims or defenses . . . and the presence of common questions of law or fact are obvious examples.” (quotation marks omitted)); Castano v. Am. Tobacco Co., 84 F.3d 734, 744 (5th Cir. 1996) (“[A] court must understand the claims, defenses, relevant facts, and applicable substantive law in order to make a meaningful determination of the certification issues.”); cf. Wal-Mart Stores, Inc. v. Dukes, 131 S. Ct. 2541, 2561 (2011) (holding that “a class cannot be certified on the premise that [a defendant] will not be entitled to litigate its statutory defenses to individual claims”). Moreover, we are persuaded that holding the issue of class certification in abeyance until Google’s fair use defense has been resolved will not prejudice the interests of either party during the projected proceedings before the District Court following remand. Accordingly, we vacate the District Court’s order of June 11, 2012 certifying plaintiffs’ proposed class, and we remand the cause to the District Court, for consideration of the fair use issues.

I'm actually somewhat surprised at this. While I've argued from the very beginning that Google's book scanning project was clearly fair use (and was annoyed when it looked like Google was dropping that argument in its original settlement effort), it does seem a bit strange for the judges to jump straight to the fair use analysis across the board. I would guess that the Author's Guild, somewhat ironically, might now want to hit back with Google's own argument in trying to block the class, by saying that different authors have different arguments, and seeking a fair use judgment across the board wouldn't make any sense. Still, in terms of getting this many-years process finally over and done with, it seems like skipping ahead to the fair use analysis is probably the best way to finally settle the matter.

Filed Under: class action, copyright, fair use, google books, scanning
Companies: authors guild, google

Vermont Declares War On Patent Trolls; Passes New Law And Sues Notorious Patent Troll

from the wow dept

I've always liked the state of Vermont -- but mainly because it was a nice place to visit. But, now the state appears to be declaring war on patent trolls. A new anti-patent trolling law has been quietly enacted, H.299, which targets patent trolls. Or, as it says "bad faith assertions of patent infringement." It does this by amending the state's consumer protection laws, to give tools to judges to recognize when patent litigation is done in bad faith (i.e., for trolling, rather than legitimate reasons). Eric Goldman summarizes the law this way:

Vermont’s law (H.299, to be codified at 9 V.S.A. § 4195-4199) is entitled “Bad Faith Assertions of Patent Infringements.” However, it doesn’t define “bad faith patent assertion.” Instead, it enumerates factors to help judges distinguish legitimate from illegitimate patent assertions. Factors that suggest a bad faith patent assertion include not identifying the patent(s)-at-issue, the patent owner, and exactly how the recipient’s behavior violates the patent; demanding too quick a response or too much money; and making deceptive or meritless assertions. Factors that suggest a legitimate patent assertion include commercializing the patented invention; being either the original inventor (i.e., not having bought the patent for assertion purposes) or an educational institution; and having successfully enforced the patent in court.

The law would allow those threatened by trolls to sue back and seek damages, even if no lawsuit has been filed. In other words, it helps those who are being shaken down and don't want to settle. That's a nice feature, but there are some reasons to be skeptical. It also allows the state Attorney General to go after patent trolls. While the law may scare of some patent trolls, I think Eric Goldman is right that a state-based solution is neither a good idea for this, nor is it probably legal. Patent law is a federal law, and federal preemption likely means that state laws that impact patents aren't allowed. This tries to hide it as a consumer protection law, which is an interesting strategy, but I could easily see this law being tossed out.

Of course, even before the law was officially on the books, it looks like Vermont's Attorney General has already sued a patent troll under existing consumer protection laws (raising questions as to why the new law is necessary). In this case, the troll is one we've written about a few times. Remember the series of rotating shell companies that had claimed that businesses who had a networked scanner need to pay $1,000 per employee? Yeah, that one.

The Vermont Attorney General claims that many of the statements made in the threat letters sent out by the rotating set of shell companies include "deceptive statements" and "deceptive practices" that violate consumer protection laws:

Defendant engaged in unfair trade practices in commerce in violation of the Vermont Consumer Protection Act, 9 V.S.A. § 2453(a) including:

a. Stating that litigation would be brought against the recipients, when Defendant was neither prepared nor likely to bring litigation;
b. Using legal counsel to imply that Defendant had performed a sufficient pre-suit investigation, including investigation into the target business and their potentially infringing activities, that would be required to justify filing a lawsuit;
c. Targeting small businesses that were unlikely to have the resources to fight patent-litigation, or even to pay patent counsel;
d. Sending letters that threatened patent-infringement litigation with no independent evidence that the recipients were infringing its patents;
e. Shifting the entire burden of the pre-suit investigation onto the small businesses that received the letters;
f. Propounding burdensome information demands on any business that claimed not to infringe the patents; and
g. Using shell corporations in order to hide the true owners of the patents, avoid liability, and encourage quick settlements.

Defendants engaged in deceptive trade practices in commerce in violation of the Vermont Consumer Protection Act, 9 V.S.A. §2453(a), by making deceptive statements in the threatening letters which would likely lead consumers to believe the following:

a. Defendant would sue the target business if they did not respond within two weeks;
b. Defendant would sue the target business if they did not pay money;
c. Defendant had a reasonable basis for identifying the target businesses as infringing its patents;
d. Subsidiary Shell LLCs were exclusive licencees able to enforce the patents;
e. Target companies were within the sending Shell LLC's alleged area of exclusivity;
f. Defendant's licensing program had received a positive response from the business community;
g. Many or most businesses were interested in promptly purchasing a license from Defendant;
h. Based on prior licensing agreements, the fair price of a license was between $900 and $1200 per employee;
i. Target businesses were receiving a third letter, which refers to two prior letters, when in many cases recipients had received no prior letters.

The lawsuit also claims that lawyer Jay Mac Rust is really the person who owns the patents via the company MPHJ. As you may recall, last month we wrote about Mac Rust after Joe Mullin at Ars Technica interviewed him in connection with the case. At the time, Mac Rust claimed that he was just one lawyer working for the owner of the patent, but who handled the "irate" recipients. So it's interesting to see the claim that he's really the guy behind MPHJ. As we've noted, there's long been an assumption that the use of shell companies is often done to hide the fact that it's the patent lawyers themselves who own the patents being used.

The use of consumer protection law in response to patents is an interesting strategy. I'm skeptical as to how well it will actually work in court, but there's no denying that many of the claims made in threat letters are, in fact, untrue and could be deemed deceptive (this kind of thing might work against copyright trolls as well). No matter what, this is going to be a key case to follow.

Filed Under: attorney general, consumer protection, jay mac rust, networked scanners, patent trolls, patents, scanning, vermont
Companies: mphj, paperless post

More Details Revealed On The Patent Lawyers Demanding $1000 For Every Worker At Companies Using Scanners

from the those-shakedown-artists-sure-are-nice dept

Earlier this year we wrote about Joe Mullin's excellent reporting on a series of patent holding shell companies, led by one called MPHJ Holdings, who were sending demand letters to tons of companies demanding that they pay between $900 and $1200 per employee for using scanners connected to a network with a "scan to email" feature. Mullin is back with more on MPHJ, talking to two of the lawyers working for the patent troll, though the identity of the actual patent holder remains a secret.

One of the lawyers is heading up the whole threat letter and (expected) litigation campaign (no lawsuits have been filed but "draft" complaints have been sent to various companies, indicating lawsuits will be coming soon) and the other is in charge of talking to "irate" recipients of the shakedown letter. That lawyer, Jay Mac Rust, apparently is one of a few lawyers who have certain "territories" in this scheme, but in a recorded message that Mullin obtained with a discussion between Mac Rust and one of the letter recipients, Mac Rust explains that he's the one who deals with the angry ones. Mac Rust repeatedly suggests that letter recipients consult a patent lawyer to find out that this is all "legal." Of course, doing so also will help people realize just how much a patent lawyer costs and can then do the math on the value of fighting back.

Also, it's somewhat amusing that a lawyer who claims to have spent time understanding patent law seems quite confused about copyright law. Mullin tried to reach Mac Rust a bunch of times, only to finally get him to call when told that the article was soon to be published, and would include quotes from the recorded phone call with the letter recipient and a picture of Mac Rust. Mac Rust didn't like that and said that copyright law meant Mullin couldn't use his photo:

"I'd appreciate you not running a photo of me, anywhere," said Rust. "You know how photographs work, with copyright and all. If there's a photograph up online of me, I own it."

That's not true. At all. The copyright is normally with the photographer, not the subject of a photo, for one thing (though the copyrights can be assigned). But, on top of that Mullin publishing such a photo at Ars Technica is clearly protected by fair use.

Mullin also runs through some somewhat shady business practices that Mac Rust was sued over in the past, though Mac Rust seems to suggest that the questionable stuff was done by the guy employing him, and for the most part it looks like he's gotten out of the various lawsuits through settlement or dismissal.

Mullin then talks to the lawyer officially representing MPHJ, who doesn't seem to think there's anything wrong with what he's doing, arguing that inventors deserve to be protected. He doesn't seem to acknowledge that the "inventor" appears to have "invented" a general idea that lots of people had, but few people implemented, not because the idea wasn't there, but the tech itself wasn't ready. The fact that the "inventor" on the patent failed to actually successfully sell a product in the market should be indication enough that there was nothing special about the patent itself. But the lawyer, Bryan Farney, doesn't seem to see how that's an issue.

“The inventor obviously came up with something that’s widely used,” Farney said. “That happens sometimes.”

This is the frustrating thing about patent system supporters. They never seem even marginally willing to admit that there are massive problems that come about when someone gets a patent on a general idea that lots of people have, but which the technology is not yet ready for. They seem to think this is fine, never acknowledging how they're actually stomping on the basic rights of everyone else who came up with the idea, followed by (in this case) everyone who is using a basic technology offered by nearly every scanner maker today. There is no way anyone can view this as a reasonable result or the intention of today's patent system.

Filed Under: bryan farney, jay mac rust, patents, scanning
Companies: mphj