Members Of Congress: Court Was Wrong To Say That Posting The Law Is Copyright Infringement

from the time-to-clarify-the-law dept

Back in February, we wrote about a disturbing court decision that said that standards that are "incorporated by reference" into law, could still be copyright infringing if posted to the internet. In that earlier post I go into much more background, but the short version is this: lots of laws point to standards put together by private standards bodies, and say, effectively, "to be legal, you must meet this standard." For example, fire codes may be required to meet certain standards put together by a private standards body. Carl Malamud has spent years trying to make the law more accessible, and he started posting such standards that are "incorporated by reference" into the law publicly. His reasoning: once the government incorporates the standard into the law, the standard must be publicly available. Otherwise, you have a ridiculous situation in which you can't even know what the law is that governs you unless you pay (often a lot) to access it.

Standards bodies weren't happy about this -- as some of them make a large chunk of money from selling access to the standards. But from a straight up "the law should be public" standpoint, the answer should be "too bad." Unfortunately, the district court didn't see it that way, and basically said it's okay to have parts of our laws blocked by copyright. We thought that ruling had some serious problems, and Malamud and his organization Public.Resource.Org appealed. A bunch of amicus briefs have been filed in the case -- which you can see at EFF's case page on the lawsuit. There's a good one from some law professors about how the lower court got it wrong, as well as a ton of library associations (and also other law professors and former gov't officials). Public Citizen also filed a good brief on the importance of having access to the law. It's worth reading them all.

However, I wanted to focus on a different amicus brief, filed by two sitting members of Congress, Reps. Zoe Lofgren and Darrell Issa. The brief was put together by Harvard's Cyberlaw Clinic, with help from lawyer Cathy Gellis (who has represented us from time to time, as well as written some posts for Techdirt). It's certainly not unheard of to have members of Congress file amicus briefs in cases, but it's not particularly common either. The fact that two members of Congress are worried about the due process implications of a court ruling should, hopefully, capture the court's attention.

For the law to govern and protect the people, the people must know what the law is. By offering an electronic platform for the publication of legal codes and standards, Public Resource helps the public by providing access to laws that might otherwise be functionally inaccessible. Without this access, the consequences are significant. First, those who inadvertently violate inaccessible regulations may be blindsided by civil and criminal penalties for violations they did not know to avoid. Second, those whose health and welfare depends on others’ compliance with these regulations may suffer damage to their life, liberty, and property, as a result of both others’ ignorance of the law and their own inability to access the law in order to pursue enforcement. This Court should not endorse a copyright regime that allows private SDOs to limit access to the legal rules that govern and protect the public.

Also:

As members of Congress, our job is to draft and enact laws that govern the United States. But mere passage of legislation is not enough; due process requires more. The Fifth and Fourteenth Amendments dictate that no person is to be “deprived of life, liberty, or property, without due process of law.” U.S. Const. amend. V; U.S. Const. amend. XIV. There can be no due process when people cannot remain informed of the laws by which they are bound. And they cannot remain informed when the law itself is not sufficiently communicated to the people it governs.

Lots of people could make those points -- but having it come from the people who actually make the laws seems to make the point that much more relevant. Hopefully the court agrees.

Filed Under: carl malamud, darrell issa, incorporated by reference, law, standards, zoe lofgren
Companies: public.resource.org

NSA-Developed Crypto Technology No Longer Trusted For Use In Global Standards

from the I-just-can't-think-why dept

One of the most shocking pieces of information to emerge from the Snowden documents was that the NSA had paid RSA $10 million to push a weakened form of crypto in its products. The big advantage for the NSA was that it made it much easier to decrypt messages sent using that flawed technology. A few months after this news, the National Institute of Standards and Technology announced that it would remove the "Dual Elliptic Curve" (Dual EC) algorithm from its recommendations. But of course, that's not the end of the story. Betraying trust is always a bad idea, but in the security field it's an incredibly stupid idea, since trust is a key aspect of the way things work in that shadowy world. So it should come as no surprise that following the Dual EC revelations, the world's security experts no longer trust the NSA:

An international group of cryptography experts has forced the U.S. National Security Agency to back down over two data encryption techniques it wanted set as global industry standards, reflecting deep mistrust among close U.S. allies.

In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them.

The NSA has now agreed to drop all but the most powerful versions of the techniques -- those least likely to be vulnerable to hacks -- to address the concerns.

The Reuters report has interesting comments from security experts explaining why they opposed the new standards. Concerns included the lack of peer-reviewed publication by the creators, the absence of industry adoption or a clear need for the new approaches. There's also the intriguing fact that the UK was happy for the NSA algorithms to be adopted. Given the extremely close working relationship GCHQ has with the NSA, you can't help wondering whether the UK's support was because it too knew how to break the proposed encryption techniques, and therefore was keen for them to be rolled out widely. Certainly, the reason its representative gave for backing the two NSA data encryption methods, known as Simon and Speck, was feeble in the extreme:

Chris Mitchell, a member of the British delegation, said he supported Simon and Speck, noting that "no one has succeeded in breaking the algorithms.”

Moreover, it was only half-true: the Reuters story says that academics have already had "partial success" in finding weaknesses, which surely calls for a cautious approach and more research, rather than simply accepting the proposal and hoping for the best. And even the British representative had to admit that his NSA mates had totally blown it:

He acknowledged, though, that after the Dual EC revelations, "trust, particularly for U.S. government participants in standardization, is now non-existent."

As the NSA -- and also the W3C, thanks to its blessing of DRM in HTML -- will now find, regaining that lost trust will be a long and difficult process. Maybe others can learn from their (bad) examples.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: encryption, nsa, standards, trust

Copyright Law And The Grenfell Fire - Why We Cannot Let Legal Standards Be Locked Up By Copyright

from the burning-down-the-house dept

It's always hard to write about the policy implications of tragedies – the last thing their victims need is the politicization of what they suffered. At the same time, it's important to learn what lessons we can from these events in order to avoid future ones. Earlier Mike wrote about the chilling effects on Grenfell residents' ability to express their concerns about the safety of the building – chilling effects that may have been deadly – because they lived in a jurisdiction that allowed critical speech to be easily threatened. The policy concern I want to focus on now is how copyright law also interferes with safety and accountability both in the US and elsewhere.

I'm thinking in particular about the litigation Carl Malamud has found himself faced with because he dared to post legally-enforceable standards on his website as a resource for people who wanted ready access to the law that governed them. (Disclosure: I helped file amicus briefs supporting his defense in this litigation.) A lot of the discussion about the litigation has focused on the need for people to know the details of the law that governs them: while ignorance of the law is no excuse, as a practical matter people need a way to actually know what the law is if they are going to be expected to comply with it. Locking it away in a few distant libraries or behind paywalls is not an effective way of disseminating that knowledge.

But there is another reason why the general public needs to have access to this knowledge. Not just because it governs them, but because others' compliance with it obviously affects them. Think for instance about the tenants in these buildings, or any buildings anywhere: how can they be equipped to know if the buildings they live in meet applicable safety standards if they never can see what those standards are? They instead are forced to trust that those with privileged access to that knowledge will have acted on it accordingly. But as the Grenfell tragedy has shown, that trust may be misplaced. "Trust, but verify," it has been famously said. But without access to the knowledge necessary to verify that everything has been done properly, no one can make sure that it has. That makes the people who depend on this compliance vulnerable. And as long as copyright law is what prevents them from knowing if there has been compliance, then it is copyright law that makes them so.

Of course, there are lots of standards at issue in the Public Resource cases, and not all of them necessarily would threaten mortal peril if they were not complied with. But the federal court's decision in these cases, if allowed to stand, means that all sorts of standards, including those bearing on public safety, can be kept from ready public view through a claim of copyright. As the resulting injunctions ordering Carl Malamud to delete accurate and operable law from his website makes clear, no matter how accurate or operable the legal standard, no matter how critical compliance with the standard is to ensure the health and safety of the public, people can be prevented from sharing the knowledge of what that standard contains.

And it not only prevents people in one jurisdiction from knowing what that standard is. It prevents people anywhere in the world from knowing. If an American jurisdiction has made innovations in public safety standards, no one else in the world can freely benefit from that knowledge in order to figure out whether their own local standards are sufficient. It's an absurd result – the purpose of copyright law is, after all, all about developing and disseminating knowledge – and it's one that hurts people. It is not something we should be encouraging copyright law, or any law, to do.

Filed Under: carl malamud, copyright, fire prevention, fire safety, grenfell, standards, uk

Federal Court Basically Says It's Okay To Copyright Parts Of Our Laws

from the incorporation-by-reference dept

For many years, we've written about Carl Malamud and his non-profit organization Public.Resource.org, which goes to great lengths to make sure that the law and other government documents are widely available to the public. While he's gotten lots of attention for battling states over their claims to hold a copyright in the law, perhaps his biggest fight has been over the question of whether or not private standards that are "incorporated by reference" into the law, are still covered by copyright. And, unfortunately, the federal district court in Washington DC has just ruled against him, and effectively said it's okay to lock up some important elements of the law with copyright. This is bad news.

Some background: as you probably know, there are tons of standards bodies out there who create various standards. Most techies are quite familiar with various technology standards, developed by various groups. But standards obviously go way beyond just the tech industry. Think: building codes for plumbers and electricians. These are often developed by independent, private bodies. Of course, you may also realize that some of these standards are in the law as well. These are generally known as "incorporated by reference." That's just a fancy way of saying that a private group created a standard and then lawmakers put into the law "this thing we're regulating needs to meet those standards." So, for example, fire codes may be developed by a private body, but then governments say that any building has to meet those standards. Voila: those standards are "incorporated (into the law) by reference."

The question, though, is how accessible are these standards? Many of the standards bodies that create those standards like to sell them. That's often how they make their money. But that seems to be in fairly dire conflict with the idea that the law should be publicly accessible. It's fairly difficult to argue that the rule of law is paramount when you can't even see the law without having to buy a bunch of expensive standards. To deal with this, many regulators and standards bodies have come up with awful hedges -- which basically say that any such standard incorporated by reference must be "available to the public," but they allow that availability to be insanely limited. So, for example, the EPA basically says, sure, you can see all of the standards, if you trek to DC and go to a special reading room (or a few other limited places):

Certain material is incorporated by reference into this part with the approval of the Director of the Federal Register under 5 U.S.C. 552(a) and 11 CFR part 51. To enforce any edition other than that specified in this section, the EPA must publish notice of change in the Federal Register and the material must be available to the public. All approved material is available for inspection at the EPA Docket Center, Public Reading Room, EPA WJC West, Room 3334, 1301 Constitution Ave. NW., Washington, DC, telephone number 202-566-1744, and is available from the sources listed below. It is also available for inspection at the National Archives and Records Administration (NARA). For information on the availability of this material at NARA, call (202) 741-6030 or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html.

And, of course, even then, there are serious restrictions on what you can do. Many of the reading rooms are "read only." You can read them, but you can't print or download electronic versions. As you can imagine, that can be fairly useless. Imagine you're trying to build a house, and every time you want to check if something is up to code, you have to go to DC to a special reading room, find the standard, check the details, but you can't print it out or download an electronic version.

You'd probably think that's a pretty silly way to have laws.

At least, that seems to be what Malamud thought, so he bought copies of a whole bunch of these standards, scanned them, and put them online, arguing that once they're incorporated by reference into the law, they are a part of the law and thus copyright shouldn't apply. The big standards bodies, including the American Society for Testing and Materials (ASTM), the National Fire Protection Association (NFPA), the American Society of Heating, Refrigerating, and Air-Conditioning Engineers (ASHRAE), the American Educational Research Association (AERA), the American Psychological Association (APA), and the National Council on Measurement in Education (NCME) sued Public.Resource.org for copyright infringement (and for some of them, trademark infringement). The plaintiffs were lumped into two groups -- the ASTM group (covering the first three groups listed above, which filed for copyright and trademark infringement) and the AERA group (covering the last three groups, which filed for just copyright infringement).

Public Resource made a number of arguments for why the standards bodies shouldn't win, but the court doesn't buy them. It's not impressed by the idea that since many people worked on these standards, the bodies don't really hold the copyrights. Malamud also argued that there's no valid copyright in standards, because there's nothing copyrightable in a bunch of standards, which are nothing more than "methods or systems" -- comparing it to the famous Feist case that said a telephone book isn't copyrightable, because it's just a collection of facts. And, of course, "methods and systems" are not copyrightable material under Section 102(b) of copyright law (this is the same issue that was debated in the Oracle/Google case over whether or not APIs were covered by copyright).

Unfortunately, the court doesn't see it that way for standards. It notes that even under Feist, standards meet the "extremely low" bar of creativity to be covered by copyright. And, it completely disregards the 102(b) argument as a misreading of the law, saying that it only bars trying to copyright the system or method itself, "not the written work explaining or describing that method." I can see that argument, though I'm still left wondering who actually thinks that copyright is the necessary incentive to create a building code. But, unfortunately, that's not quite how copyright law works these days.

The bigger issue is over what happens to the copyright once it's incorporated by reference into the law. Malamud's lawyers argued that it should be considered public domain. The court says... sorry, nope. As you surely know, copyright law says that works made by the federal government are not subject to copyright and are in the public domain. But that only applies to works actually created by the government. It has long been recognized that works created by others, and then assigned to the US government allow the government to retain the copyright. We can argue that this is dumb and bad policy (because it is), but it's pretty well-recognized. Here, Malamud's lawyers argued that even so, Congress intended things directly referenced into the law to be in the public domain. But the court basically says that Congress had a chance to weigh in on this and didn't... so, no dice:

Congress was well aware of the potential copyright issue posed by materials incorporated by reference when it crafted Section 105 in 1976. Ten years earlier, Congress had extended to federal agencies the authority to incorporate private works by reference into federal regulation.... However, in the Copyright Act of 1976, Congress made no mention of these incorporated works in § 105 (no copyright for “any work of the United States Government”) or any other section. As the House Report quoted above indicates, Congress already carefully weighed the competing policy goals of making incorporated works publicly available while also preserving the incentives and protections granted by copyright, and it weighed in favor of preserving the copyright system....

However, recognizing the importance of public access to works incorporated by reference into federal regulations, Congress still requires that such works be “reasonably available.” ... Under current federal regulations issued by the Office of the Federal Register in 1982, a privately authored work may be incorporated by reference into an agency’s regulation if it is “reasonably available,” including availability in hard copy at the OFR and/or the incorporating agency.... Thirteen years later, Congress passed the National Technology Transfer and Advancement Act of 1995 (“NTTAA”) which directed all federal agencies to use privately developed technical voluntary consensus standards.... Thus, Congress initially authorized agencies to incorporate works by reference, then excluded these incorporated works from § 105 of the Copyright Act, and, nearly twenty years later, specifically directed agencies to incorporate private works by reference. From 1966 through the present, Congress has remained silent on the question of whether privately authored standards and other works would lose copyright protection upon incorporation by reference. If Congress intended to revoke the copyrights of such standards when it passed the NTTAA, or any time before or since, it surely would have done so expressly.

Again, based on the legislative history, perhaps that's a reasonable, if unfortunate, reading of the law. And it's something that Congress should fix, but almost certainly won't.

But, taking a step back from all of this, there's still the problem that it's crazy. The idea that the law itself should be locked up under copyright is immensely problematic for a whole host of other reasons. And Malamud and his lawyers pointed this out, arguing that there's a due process issue here, where using copyright to block people from accessing the law deprives them of their due process. But, the court isn't impressed, basically saying other court opinions haven't bought this kind of argument, so it won't either. And, further, the court seems to feel that those limited reading rooms or fee-based copies are enough access:

... there is no evidence here that anyone has been denied access to the standards by the ASTM Plaintiffs or AERA Plaintiffs. Instead, Defendant simply argues that the public should be granted more expansive access.

Another argument is that once incorporated by reference, under the merger doctrine, the "law" and the creative expression are so tightly intertwined (i.e., "merged") that the law is now factual and thus not subject to copyright law. The court says "eh, we're not going to look at that, because it doesn't matter either way."

The court declines to resolve this merger doctrine issue, since under either approach, the standards maintain copyright protection.

After all that, we finally get to the fair use argument. Public.Resource argues that what it's done isn't copyright infringement, even if the work is covered by copyright, thanks to fair use. The court does a four factor analysis... and says "no fair use." On the big question of whether or not it's transformative, Public.Resource tried to argue that making the works more accessible (including turning them into digital versions that could be searched) was transformative. The ruling in the Google Book scanning case would seem to support that, but the court says no, because it doesn't see turning a written work into a searchable HTML file as enough of a transformation.

While it appears Defendant may enable blind individuals, like all other individuals, to access the standards at no cost, they still may have to take additional steps like OCR processing or converting to a different file type, as well as using additional screen reader programs in order to access the standards. There is no evidence that this would not be possible with Plaintiffs’ PDFs or by scanning Plaintiffs’ hard copy standards. In Defendant’s view, taking the first step or two towards making the standards entirely accessible to those with visual impairments is enough to have transformed the standards. This attempts to stretch logic, and certainly the doctrine of fair use, too far. Defendant has not offered a sufficiently new purpose to render the use transformative, and this weighs against a finding of fair use.

Within this analysis, I'd argue that the court goes way too far in dismissing the comparisons to the Google Books ruling and the ruling in the Swatch case that said that posting full transcripts of analyst calls can be fair use. The court here seems overly nitpicky, saying that Google Books doesn't count because it doesn't show full works, and Swatch (which does show full works) doesn't count because that work wasn't available in any other way (though I'm not sure what that really has to do with the fair use analysis).

The court also says that "the nature" of the work goes against Malamud, which surprises me. You'd think that the fact that these works are a part of the law would push it the other way. But, instead, the court misreads the nature of the Constitution to misunderstand what the framers meant by the word "science." This is unfortunate:

Defendant argues that Plaintiffs’ standards are “factual,” both because they are highly technical and because they are “the law.” However, the Constitution explicitly states that copyright exists to “advance the progress of science and the useful arts.” ... That Plaintiffs’ works involve technical scientific concepts and guidelines does not push it away from the core of intended copyright protection, but actually brings it closer. Plaintiffs’ standards are vital to the advancement of scientific progress in the U.S. and exactly the type of expressive work that warrants full protection under the Constitution and the Copyright Act.

This is just wrong. At the time the Constitution was written "science" had an entirely different meaning. It meant learning. That's entirely different than something that is mandated by law.

On the third factor of the "amount" of the work copied, obviously here it's all of it, and the court says that there is not "a single case" that supports the Defendant's view that because the entire standards were referenced into law, it's fair use. But that's also wrong. Again, the Google book scanning and the Hathitrust rulings both made it clear that using the whole work was fine because "it is literally necessary to achieve" the purpose they were looking to achieve.

While I found the court's reasoning on the copyrightability of the standards more persuasive, the fair use analysis seems incredibly weak -- and hopefully the appeals court will overturn it.

The only "win" for Malamud was that the argument for contributory infringement failed, but for fairly weak reasons, leaving it open to the possibility that a more complete attempt to make that claim could work.

Finally, the court also says that for the ASME plaintiffs, what Malamud did is also trademark infringement. I won't even bother getting into why, but this result was more or less expected given the results of the copyright part of the case.

The court then grants an injunction, basically ordering Malamud to delete all these standards from the internet. It includes a fairly bizarre determination of whether or not the public will be harmed by this:

Additionally, the public must not be disserved by the issuance of an injunction. Here, the public interest is served by the policy interests that underlie the Copyright Act itself, namely the protection of financial incentives for the continued creation of valuable works, and the continued value in maintaining the public-private system in place in the U.S. to ensure continued development of technical standards.

Did you get that ridiculous sleight of hand? The public is served by no longer having access to the law because it's better for some private organizations to get rich off of the standards that are a part of the law, or else such standards might not be developed. Huh?

I'm guessing that this case will be appealed, and hopefully the appeals court is more receptive to the fair use arguments. In the meantime, though, this seems like a pretty big loss for those who believe not just in the rule of law, but the idea that the law ought to be accessible to the public if it's to be respected.

Filed Under: building codes, carl malamud, copyright, copyrighting the law, incorporated by reference, rule of law, standards, standards bodies, the law
Companies: aera, asme, public.resource.org

Standards Body Whines That People Who Want Free Access To The Law Probably Also Want 'Free Sex'

from the bad-ansi,-bad dept

You would think that "the law" is obviously part of the public domain. It seems particularly crazy to think that any part of the law itself might be covered by copyright, or (worse) locked up behind some sort of paywall where you cannot read it. Carl Malamud has spent many years working to make sure the law is freely accessible... and he's been sued a bunch of times and is still in the middle of many lawsuits, including one from the State of Georgia for publishing its official annotated code (the state claims the annotations are covered by copyright).

But there's another area that he's fought over for many years: the idea that standards that are "incorporated by reference" into the law should also be public. The issue is that many lawmakers, when creating regulations will often cite private industry "standards" as part of the regulations. So, things like building codes may cite standards for, say, sheet metal and air conditioning that were put together by the Sheet Metal and Air Conditioning Contractors National Association (SMACNA), and say that buildings need to follow SMACNA's standards. And those standards may be great -- but if you can't actually read the standards, how can you obey the law. At one point SMACNA went after Malamud for publishing its standards. And while they eventually backed down, others are still in court against Malamud -- including the American Society for Testing & Materials (ASTM), whose case against Malamud is set to go to trial in the fall.

In the midst of all of this, various standards making bodies, along with the American National Standards Institute (ANSI), have been working over time to get the American Bar Association to adopt a proposal that limits publication of standards that are incorporated by reference. ANSI has pushed for a solution it prefers called "reasonable availability," in which the standard-makers decide by themselves how best to make the standards "available." ANSI, for example, hosts a bunch of incorporated by reference standards on its website -- but the only way to read them is to install a special kind of DRM (Windows and Mac only) that makes the documents purely read only. You are not allowed to save them. You are not allowed to download them permanently. You are not allowed to print them. And it's not all standards that are incorporated by reference. Why do they do this? Well, most of them sell their standards to professionals who need to buy them, and they don't want to give up on that revenue source (especially once those standards are incorporated by reference because at that point they become mandatory).

Either way, there was an attempt to push through a bad proposal at the ABA, getting it to take an official stance on standards that were incorporated by reference, but the first attempt was denied when various parts of the ABA pointed out that only a small group had worked on the issue. A larger task force was formed, but oddly, that task force was amazingly one-sided, including a number of people connected to ANSI or its supporters (including its former chair, Oliver Smoot, and its General Counsel, Patricia Griffin). Malamud asked multiple sections of the ABA if he could be a part of the working group and was denied. Not surprisingly, the final recommendation, which the ABA is about to consider next month, does not recognize that standards incorporated by reference should be widely and freely available, since they are the law. Instead, it takes a much more restrictive approach, whereby such standards would need to be made available (an improvement from the current situation), but that availability can still be in a very restrictive and locked down manner (such as with DRM and limitations).

The fact that it takes a small step in the right direction already has ANSI upset, and it's whining to its members asking them to tell the ABA not to support this proposal, dropping all sorts of FUD about how it will kill off various standards bodies, and complaining that the process by which this proposal was created was "closed" (leaving aside that ANSI and its friends made up a decent portion of the folks on the working group). Malamud has now sent a massive book detailing all of the problems with the proposal and noting that supporters of it are trying to rush it through, potentially looking to influence some of the lawsuits that he's currently involved in (such as the one about to go to trial). Some task force members raised the concern that it seems weird for the ABA to stake out a position on an issue that is about to be resolved by the courts. Either way, somewhat amazingly, both Malamud and ANSI agree that they don't want the ABA to accept the current proposal -- but for wildly different reasons.

Malamud's packet is impressive in the details and evidence that it presents. But his major complaint is that the ABA is making a huge mistake in trying to "balance" the interests of standards bodies that get money from locked up standards and the public. There's no need for balance here. General common sense says the public should win here and the law itself should be public and freely accessible. But that's not how the task force looked at this:

Think for a moment about the interests that are being “reconciled.” On the one side are the proprietary interests of a few nonprofit organizations, organizations that eagerly seek to have some of their standards incorporated into law, and also profit greatly from the sale of numerous products, such as the sale of non-mandatory standards, training, and certification. Nonprofit organizations such as ANSI have done quite well under the current system, paying million-dollar salaries to their executives and receiving numerous government subsidies, plus the all-important market positioning they get from being an official provider of an important segment of federal law. This is an enviable market position for a nonprofit, and they have profited handsomely from that position.

What is being balanced against those “proprietary interests” are the rights of the American people to read and speak the law. Joe S. Bhatia, the president of ANSI, put it well when he stated clearly that “a standard that has been incorporated by reference does have the force of law, and it should be available.” These standards are integral to the regulations, no different than any other edict of government. Public safety laws are too important to be carved out as a special category of edict of government, a category subject to arbitrary limitations on use.

The way that “balance” was struck is what disturbs those of us who wished to participate. The task force is asking the ABA House of Delegates to endorse severe restrictions on how citizens can access regulations, in the form of “read-only” documents on the Internet. The term “readonly” is a term that doesn’t make any sense to those of us who work on the Internet. What are being proposed are a series of licensing restrictions created by a click-through terms of use agreement, coupled with technical restrictions enforced by “Digital Rights Management” (DRM) technical measures. But the law is not a Hollywood movie and it is not a Tom Clancy novel. The law is special in our democracy, or in any society that observes the rule of law. The law belongs to the people and edicts of government are not subject to copyright under long-standing doctrines of common law and the clear and unambiguous policy of the U.S. Copyright Office.

And really, the principle here is pretty clear and shouldn't involve that much debate. If it's included as part of the law, it needs to be widely and freely available.

For those of us in the American Bar Association, the concept of “read only” flies directly against the work practices of members of the bar who must use the law to do their jobs. Lawyers do not simply read the law, they cite the law and copy it, they publish extracts in documents such as briefs, treatises, and newsletters. If we entertain the notion that a category of our law requires a license in order to repeat those laws—and that is precisely the position today of ANSI and its fellow SDOs—the bar will be faced with a situation where permission to use the law may be granted only after the extraction of unreasonable rents and a request for permission, which may be arbitrarily granted or refused. This is not a theoretical situation; it is the current stance of the organizations that drafted this resolution and they are proposing that Congress codify those restrictions.

Most disturbing in the resolution that the ABA is being asked to endorse is the idea that the right to speak the law—to post it on the Internet in a transformative fashion that allows others to use it more effectively—belongs to a single private party, and that private party may require a license before others are permitted to work with the material. Just imagine if John B. West had needed a license before including court opinions in his National Reporter System, an innovation that became central to the practice of law in the United States. Allowing only a single party, or those to whom they arbitrarily grant a license, to control access to primary legal materials deliberately retards innovation in order to maximize revenue through a monopoly over crucial components of federal public safety law. Putting the brakes on innovation for presentation of the law not only hurts democracy, it hurts the legal profession, depriving lawyers of better tools and services.

The packet that Malamud put together also includes some of the emails that were sent around as part of the working group's deliberations, including one rather incredible one in which ANSI board member Dan Bart of Valley View Corporation, completely mocks the idea that standards that are part of the law should be available for free -- saying that "some people are still clamoring for free beer and free sex too." Apparently, this individual feels everyone should pay for sex. Even ignoring what one hopes is an inadvertent slip up in logical arguments, the email completely ignores the issue. People aren't just asking for random stuff for free -- they're asking for the law to be freely available to the public. If you don't want that to happen, don't get your standard included in the law.

If you go through the emails included in the packet there are even more details, including the co-chair of the ABA's SciTech Technical Standardization Committee stepping down for being effectively ignored during the process of deciding on the resolution and not allowed to join the working group.

The whole thing is a mess. It's not even clear why the ABA should be considering this point at all. And, if it must consider it, why would it not support the most obvious conclusion: if it's a part of the law, it's part of the law and needs to be widely and freely available, not locked down by DRM.

Filed Under: carl malamud, dan bart, incorporated by reference, joe bhatia, law, public access, standards
Companies: aba, ansi

Congressmen Upton, Walden Latest To Insist Nobody Needs Faster Broadband

from the please-lower-your-standards dept

A little over a year ago, the FCC voted to raise the minimum definition of broadband from 4 Mbps downstream, 1 Mbps upstream -- to 25 Mbps downstream, 3 Mbps upstream. The standard better reflects household usage in the gigabit connection and Netflix binge watching era. However, the broadband industry has been whining like a petulant child ever since, largely because the change highlights how a lack of competition and the resulting failure to upgrade networks means a huge swath of the country doesn't technically have broadband.

Outraged by the FCC's sudden decision to have standards, incumbent broadband providers convinced six Senators to write in and scold the FCC last month, arguing that 25 Mbps was just a crazy metric, and that nobody needs that kind of bandwidth:

"Looking at the market for broadband applications, we are aware of few applications that require download speeds of 25 Mbps. Netflix, for example, recommends a download speed of 5 Mbps to receive high-definition streaming video, and Amazon recommends a speed of 3.5 Mbps. In addition, according to the FCC's own data, the majority of Americans who can purchase 25 Mbps choose not to."

As we noted then, the Senators apparently don't have teenage kids (or have them and don't pay attention to what they do), since 25 Mbps is a pretty reasonable standard for a household of hungry gamers, streamers, and social media addicts. And while the Senators use Netflix HD streaming as the holy grail for what constitutes "real" bandwidth usage, they apparently didn't realize that as Netflix moves to 4K, each stream will eat 25 Mbps all by itself. In the age of Google Fiber and gigabit cable, 25 Mbps is a pretty fair per household metric; in fact the upstream standard probably isn't high enough.

But this being Congress, the technical realities don't matter nearly as much as the campaign contribution cash tied at the end of telecom talking points memo. Not to be outdone by the manufactured outrage of their friends in the Senate, Congressmen Fred Upton and Greg Walden have similarly decided to waste everybody's time with a letter of their own (pdf), which accuses the FCC of "troubling actions" that "distort – or outright ignore – the FCC’s requirements to produce honest, data-driven reports to inform policymakers and the public."

Why, the Congressmen argue, does the FCC feel the need to mess with such an obviously competitive market?:

"The Communications Act requires the FCC to assess and report on the state of broadband deployment, the level of video competition, and the level of effective competition in the nation's mobile wireless market. Since 2011, it appears that the Commission has applied inconsistent definitions and analyses in making those determinations. Those reports have then been used to justify Commission actions to intervene in seemingly competitive markets. Despite the plain language of the Communications Act, the FCC's actions seem to benefit specific classes of competitors and do not promote competition. This behavior concerns us.

Yes, that's the Chairman of the Subcommittee on Communications and Technology complaining about having standards.

Of course the only reason the markets were "seemingly competitive" is that for fifteen years, the FCC has been basing policy on flimsy standards and cherry-picked industry data. Once the FCC raised the standards and started thinking a little more independently, phone companies that were happily selling snail-esque DSL at next-generation prices were suddenly outed for not trying very hard. Under the new standard, FCC data suggests 31 million Americans don't technically have broadband, and two-thirds of homes lack access to speeds of 25 Mbps from more than one provider.

Again, the real outrage isn't really that the FCC is some kind of rogue agency setting unrealistic standards just to make giant companies cry, the real outrage stems from the fact that the new standard makes it harder than ever to pretend that the United States is a competitive broadband market.

Filed Under: broadband, fcc, fred upton, greg warden, speeds, standards

Light Bulb DRM: Philips Locks Purchasers Out Of Third-Party Bulbs With Firmware Update

from the Patch-notes:-Adds-'buyer's-remorse' dept

The world of connected devices is upon us and things have never been better. Criminals can access your email account by breaking into your fridge. Your child's toys and your television record your conversations and send them to manufacturers' servers, where criminals are (again) able to access them. Your home thermostat goes HAL 9000 and attempts to set your house on fire. And, now, your light bulbs won't do the one thing you expect them to do: produce light.

Purchasers of the Philips Hue "smart" ambient lighting system are finding out that the new firmware pushed out by the manufacturer has cut off access to previously-supported light bulbs. (h/t William Neilson Jr.)

Philips just released firmware for the Philips Hue bridge that may permanently sever access to any “non-approved” ZigBee bulbs.

[...]

The recent change seems to suggest any non-Philips bulbs from manufacturers such as Cree, GE, and Osram will not be supported in many situations, whereas “Friends of Hue” branded product are. At the time of publication, it’s unclear whether 3rd party bulbs will stop working immediately after the firmware update or if they may only become inaccessible after the bridge is reset. We’re also not sure if being “reset” means rebooted or factory reset. This appears to apply to both the round v1 bridge and square v2 HomeKit-compatible bridge after the latest firmware update is applied.

ZigBee is the underlying standard that controls these smart lighting systems.

ZigBee is the open, global standard of choice for connected lighting applications providing ease-of-use and low-cost installation and maintenance for both consumers and business.

Philips uses ZigBee, which should mean any bulbs compatible with this standard will work with its Hue fixtures. Not anymore. The firmware update removes this support, limiting this "open, global" standard to Philips' own bulbs and those it has designated as "Friends of Hue."

Needless to say, purchasers aren't happy.

Literally. Philips has just slapped fans like us in the face and kicked interoperability out the door. Without any communication they delivered a new firmware to the system that disables adding products that they don't approve of. Basically they are banning other Zigbee Light Link products despite the fact that they are a Connected Lighting Alliance member whose mission is to promote interoperability.

As it seems (and unless this is just a huge mistake on Philips' side), they have without a warning turned their open product into a walled garden. They have also destroyed the value of the solutions that the customers have set up based on Philips' promises.

And the worst thing is that Philips has done this to their most enthusiastic fans. To the early adopters. To those who enthusiastically recommended the system to their friends.

Philips only began delivering nonsensical statements about its removal of previously-existent functionality after the complaints began to roll in. And like so many other companies that have wielded this DRM-esque tactic against their own customers, the excuses offered may as well just read "because this makes us more money." Seriously, are any of Philips' pissed off purchasers really going to believe this excuse?

While the Philips Hue system is based on open technologies we are not able to ensure all products from other brands are tested and fully interoperable with all of our software updates. For guaranteed compatibility you need to use Philips Hue or certified Friends of Hue products.

TL;DR: While technically an open system, we've closed it because $$$. These early adopters have already performed the heavy lifting on the compatibility end. They're the ones who have road-tested ZigBee-compliant bulbs and reported their findings to others. So, when a company removes support (by pushing a firmware update without prior warning) for compatible bulbs and claims the issue is "compatibility," it's so blatantly false as to be laughable. Unless you can't laugh, because you already bought one.

And Philips is apparently incredibly socially awkward. Trying to find which other bulbs are supported as "Friends of Hue" via Philips' websites is pointless. One just leads you to a page informing you that you can use Siri to control your lights. Searching for "Friends of Hue" brings you to another Philips website… which only lists products sold by Philips. In fact, while the "program" appears to allow third parties to sell products for its Hue line, it appears that every new development is sold under the Philips brand, which means that the competitiveness the phrase "Friends of Hue" implies is, in reality, no competition at all.

A walled garden is still a walled garden, no matter how beautifully lit it is. Philips has chosen to screw paying customers by locking them out of their choice of bulbs in pursuit of maximum profitability. There's nothing smart about that decision.

Filed Under: drm, hue, iot, lightbulbs, smart lightbulbs, standards, zigbee
Companies: philips

DailyDirt: Does It Take A Village Or A Japanese Metropolis?

from the urls-we-dig-up dept

Raising kids is an adventure filled with all sorts of imperfect decisions. A butterfly flapping its wings on your kid's iPad could initiate a cascade of events, leading to his/her eventual life of crime or triumph. Or maybe that butterfly has no effect whatsoever -- how did that unusual insect get into the house, anyway? Common core standards might be crushing young spirits with "new math" -- or just frustrating parents who don't remember how to do long division. Is there an optimal way to parent that leads to a society where every child is above average and no one graduates in the bottom half of the class? Maybe the best path is just to let kids figure it all out themselves. (But probably not.)

• Parents in Japan regularly let 9yo (and younger) kids ride the subway alone, but wouldn't necessarily do so if they moved to London or New York. Is there something special about the Japanese culture that allows unsupervised children to be (or at least feel) safe in a large city? Does Tokyo really have some kind of unspoken community ethics, or is something else going on? [url]
• Unschooling is a form of homeschooling -- but "un-schooled" kids have complete autonomy over their own education. This sounds like a pretty extreme lifestyle choice, but perhaps some elements of it (such as the skepticism of the increasing number of tests and hours spent on homework) may be appealing. [url]
• Who doesn't want to raise kids to be caring, respectful and responsible adults? Apparently, there are 5 simple steps to do so... but step 4 "being a good role model" is a bit much to ask , isn't it? [url]

Hold on. If you're still reading this, head over to our Daily Deals to save an additional 10% on any item in our Black Friday collection -- using the code: 'EARLY10' -- just through this Sunday, November 22nd.

Filed Under: common core, education, free range kids, parenting, standards, testing, unschooling

NSA's 'Apology' For Backdooring Crypto Standard Really A 'Sorry We Got Caught' Kind Of Apology

from the not-buying-it dept

Update: While the article in question claimed that Dr. Wertheimer was the Director of Research for the NSA, an email from the NSA alerts us that Wertheimer left the NSA before writing the article.

As you may recall, one of the big Snowden revelations was the fact that the NSA "took control" over a key security standard allowing backdoors to be inserted (or, at least, a weakness that made it easy to crack). It didn't take long for people to realize that the standard in question was Dual_EC_DRBG, or the Dual Elliptic Curve Deterministic Random Bit Generator. It also came out that the NSA had given RSA $10 million to push this compromised random bit generator as the default. That said, as we noted, many had already suspected something was up and had refused to use Dual_EC_DRBG. In fact, all the way back in 2007, there was a widespread discussion about the possibility of the NSA putting a backdoor in Dual_EC_DRBG, which is why so few actually trusted it.

Still, to have the details come out in public was a pretty big deal, so it also seemed like a fairly big deal to see that the Director of Research at the NSA, Dr. Michael Wertheimer (also former Assistant Deputy Director and CTO in the Office of the Director of National Intelligence), had apparently written something of an apology in the latest Notices of the American Mathematical Society. In a piece entitled, "The Mathematics Community and the NSA," Wertheimer sort of apologizes, admitting that mistakes were made. After admitting that concerns were raised by Microsoft researchers in 2007, and again with the Snowden documents (though without saying why they were raised the second time), here's Wertheimer's "apology."

With hindsight, NSA should have ceased supporting the Dual_EC_DRBG algorithm immediately after security researchers discovered the potential for a trapdoor. In truth, I can think of no better way to describe our failure to drop support for the Dual_EC_DRBG algorithm as anything other than regrettable. The costs to the Defense Department to deploy a new algorithm were not an adequate reason to sustain our support for a questionable algorithm. Indeed, we support NIST’s April 2014 decision to remove the algorithm. Furthermore, we realize that our advocacy for the Dual_EC_DRBG casts suspicion on the broader body of work NSA has done to promote secure standards. Indeed, some colleagues have extrapolated this single action to allege that NSA has a broader agenda to “undermine Internet encryption.” A fair reading of our track record speaks otherwise. Nevertheless, we understand that NSA must be much more transparent in its standards work and act according to that transparency. That effort can begin with the AMS now.

However, as security researcher/professor Matthew Green quickly shot back, this is a bullshit apology, because he's really only apologizing for not dropping the standard when they got caught red handed back in 2007.

The trouble is that on closer examination, the letter doesn't express regret for the inclusion of Dual EC DRBG in national standards. The transgression Dr. Wertheimer identifies is simply the fact that NSA continued to support the algorithm after major questions were raised. That's bizarre.

Green also takes on Wertheimer's weak attempt to still defend pushing the compromised Dual_EC_DRBG as ridiculous. Here were Wertheimer's arguments for why it was still okay:

• The Dual_EC_DRBG was one of four random number generators in the NIST standard; it is neither required nor the default.
• The NSA-generated elliptic curve points were necessary for accreditation of the Dual_EC_DRBG but only had to be implemented for actual use in certain DoD applications.
• The trapdoor concerns were openly studied by ANSI X9F1, NIST, and by the public in 2007.

But, again, those don't make much sense and actually make Wertheimer's non-apology that much worse. As Green notes, even though there were other random number generators, the now infamous RSA deal did lead some to use it since it was the "default" in a popular software library and because NIST had declared the standard safe, meaning that people trusted it. Green also goes into great detail describing how the second point is also incredibly misleading. It's worth reading his full explanation, but the short version is that despite some people fearing the NSA's plan would have a backdoor, the details and the possible "alternatives" to avoid that were completely hidden away and more or less dropped.

And that final point, well... really? Again, that's basically saying, "Well, people thought we might have put in a backdoor, but couldn't prove it, but there, you guys had your chance to debate it." Nevermind the fact that there actually was a backdoor and it wasn't confirmed until years later. And, as Green notes, many of the concerns were actually raised earlier and swept under the rug. Also, the standard was pushed and adopted by RSA as a default long before some of these concerns were raised as well.

This might all be academic, but keep this in mind: we now know that RSA Security began using the Dual EC DRBG random number generator in BSAFE -- as the default, I remind you -- in 2004. That's three years during which concerns were not openly studied by the public.

To state that the trapdoor concerns were 'openly' studied in 2007 is absolutely true. It's just completely irrelevant.

In other words, this isn't an apology. It's an apology that the NSA got caught (and didn't stop pushing things the first time it got caught), and then a weak defense of why they still went ahead with a compromised offering.

Wertheimer complains that this one instance has resulted in distrust from the mathematics and cryptography community. If so, his weak response isn't going to help very much.

Filed Under: apology, backdoor, cryptography, dual_ec_drbg, elliptic curve, encryption, matthew green, michael wertheimer, nist, nsa, random number generator, standards, surveillance