Supreme Court Says Patent Review Judges Are Unconstitutional, But It Can Be Fixed If USPTO Director Can Overrule Their Decisions

from the well-that-creates-some-other-problems dept

As you may recall, a few weeks ago I wrote about how Congress was asking the GAO to investigate whether the director of the US Patent & Trademark Office had been interfering in determinations made by the Patent Trial and Appeal Board (PTAB). I'm not going to go into all of the background again (please read the original for that), but under the America Invents Act, a process for reviewing patents after they were granted was set up, known as the Inter Partes Review (IPR) process. This was important, because the granting of patents is a non-adversarial process, where patent examiners are not given very much time to actually review everything. So the IPR process allowed those (especially those with prior art) to kick off a process by which the PTAB would recheck to see if the original examiner made a mistake in granting a 20 year monopoly to someone.

Unfortunately, because the members of the PTAB are designated as Administrative Patent Judges (APJs), there was the question of whether or not they needed to be appointed by the President with Senate confirmation to abide by the Appointments Clause of the Constitution. That question has been hanging out in the Supreme Court for many months -- with the decision finally coming down this week. In arguing against this notion, the USPTO itself had claimed that the APJs were "interior officers" that don't need Senate confirmation, and part of their "proof" was that the Director of the PTO could review their decisions. This raised some alarms in Congress, because it certainly wasn't their intention (from everything stated so far) to allow the Director of the PTO to put their finger on the scale of what is and what is not patentable.

The full opinion from the Supreme Court is a bit of a mess -- with different Justices signing onto different parts. But the key bits to pull out of this are that the Supreme Court found that the APJs are (or have been) "Principal Officers" meaning they should have been appointed by the President and confirmed by the Senate.

History reinforces the conclusion that the unreviewable executive power exercised by APJs is incompatible with their status as inferior officers. Since the founding, principal officers have directed the decisions of inferior officers on matters of law as well as policy. Hamilton articulated the principle of constitutional accountability underlying such supervision in a 1792 Treasury circular. Writing as Secretary of the Treasury to the customs officials under his charge, he warned that any deviations from his instructions “would be subversive of uniformity in the execution of the laws.” 3 Works of Alexander Hamilton 557 (J. Hamilton ed. 1850). “The power to superintend,” he explained, “must imply a right to judge and direct,” thereby ensuring that “the responsibility for a wrong construction rests with the head of the department, when it proceeds from him.”

However, in then immediately inserts its own remedy, saying that everything is fixable if the Patent Office Director actually can review the IPR decisions.

In sum, we hold that 35 U. S. C. §6(c) is unenforceable as applied to the Director insofar as it prevents the Director from reviewing the decisions of the PTAB on his own. The Director may engage in such review and reach his own decision. When reviewing such a decision by the Director, a court must decide the case “conformably to the constitution, disregarding the law” placing restrictions on his review authority in violation of Article II

So, the good news here is that the important PTAB/IPR process remains alive. But it does seem quite worrisome that the end result is that any Director of the Patent Office can now step in and overrule the PTAB. One would hope that the political ramifications of doing so would prevent it, but it does seem that it's now possible that a Director who just doesn't like the whole IPR/PTAB process (and there are many patent system fans who hate it) could just automatically deny every single IPR.

And that seems very worrisome. Of course, all of this could be solved by making the APJs Senate confirmable, but apparently no one wants to bother with doing that. Alternatively, we could rethink the entire patent approval process altogether, so that it doesn't need to go back and realize it granted 20 year monopolies for no good reasons... but, you know, that would take actual effort.

Filed Under: appointments clause, oversight, patent appeals board, patent review, patentability, patents, ptab, supreme court, uspto

'Press X To Apply Fourth Amendment:' Documents Show How GrayKey Brute Forces IOS Passwords

from the device-helpfully-backlit-to-combat-going-darkness dept

Consecutive FBI directors (James Comey, and Chris Wray) have declared a small scale war on encryption. Both of these directors relied on inflated numbers to make their case -- an error chalked up to software rather than rhetorical convenience. (The FBI has refused to hand over a correct count of encrypted devices in its possession for more than three years at this point.)

The FBI's narrative keeps getting interrupted by inconvenient facts. Proclamations that the criminal world is "going dark" are often followed by the announcement of new exploits that give law enforcement the ability to decrypt phones and access their contents.

Grayshift is one of the vendors selling phone-cracking tech to law enforcement agencies. The company has an ex-Apple security engineer on staff and has been duking it out with the device manufacturer for the past few years. It seems to be able to find exploits faster than Apple can patch them, leading to a tech arms race that law enforcement appears to be able to win from time to time.

Joseph Cox at Motherboard has obtained more documents about Grayshift's phone-cracking device, GrayKey. Apple prides itself on providing secure devices. But it appears GrayKey is still capable of bypassing iOS security features, enabling investigators to brute force device passwords. And it can still do this even if the targeted device is on the verge of battery death.

The instructions describe the various conditions it claims allow a GrayKey connection: the device being turned off (known as Before First Unlock, or BFU); the phone is turned on (After First Unlock, or AFU); the device having a damaged display, and when the phone has low battery.

"GrayKey known to install agent with 2 to 3% battery life," the document reads, referring to the "brute force agent" GrayKey installs on the phone in order to unlock the device.

This suggests the agent doesn't demand too much from the processor when installing. It also suggests GrayKey's devices are portable, allowing cops to attempt to access phone contents while away from the office with limited options for charging seized devices.

The device includes a 1.5-billion word dictionary that can be utilized during brute force attacks to guess alphanumeric passwords. The instructions obtained by Motherboard also indicate the device has the power to extract metadata from "inaccessible" files -- something it can apparently do even if the device is still in a locked state.

And Grayshift truly cares about your rights, Joe and Judy Criminal Suspect.

"Prior to connecting any Apple mobile device to GrayKey, determine if proper search authority has been established for the requested Apple mobile device," the document reads.

Yeaaaaaahhhhh... that should do it. Grayshift has no way of enforcing this so cops are on the honor system. And we've all seen how great cops are at keeping themselves honest. This little nod towards Supreme Court precedent and Fourth Amendment doesn't even ask for something like a supervisor's passcode prior to operation to help ensure all the proper paperwork is in order. Left to their own devices, cops are bound to illegally access suspects' devices.

And if brute forcing doesn't work, there's another built-in option -- one covered here previously. GrayKey can surreptitiously install a very targeted keylogger that records the passcode when it's entered by the phone's owner. Cops can get their largesse on and give suspects back their devices so they can copy down phone numbers or let people know where they're at. And when suspects unlock their devices to this, cops are CC'ed by Grayshift's malware.

The battle between government contractors and device makers continues. And as long as it remains a battle in which neither party has proven to be able to hold a lead, it's disingenuous to claim -- as Chris Wray and James Comey have -- that encryption is a barrier impossible to overcome.

Filed Under: 4th amendment, cracking, doj, encryption, fbi, going dark, graykey, hacking, ios
Companies: apple, grayshift

Did The Supreme Court Just Take A Sledge Hammer To Copyright's Statutory Damages?

from the possibly... dept

Last week, in a somewhat controversial decision in the TransUnion v. Ramirez case, the Supreme Court ruled, 5 to 4, that plaintiff's in a class action lawsuit did not have standing to sue under the Fair Credit Reporting Act (FRCA). The issue may seem wholly unrelated from copyright, but in reading through the decision, it's possible it could lead to a vastly different world for copyright going forward, because the same issues that the Court finds fault with in the FRCA also apply to copyright law -- and, indeed, it's the part of copyright law that is most widely abused in lawsuits.

I should be clear that I think the holding in the TransUnion case is problematic and seems... well... weird. But if what the majority decided is true, then I don't see how copyright's statutory damages can remain constitutional. Let's dig into the case to explore why. The majority opinion, written by Justice Kavanaugh gives the basic overview right upfront:

To have Article III standing to sue in federal court, plaintiffs must demonstrate, among other things, that they suffered a concrete harm. No concrete harm, no standing. Central to assessing concreteness is whether the asserted harm has a “close relationship” to a harm traditionally recognized as providing a basis for a lawsuit in American courts—such as physical harm, monetary harm, or various intangible harms including (as relevant here) reputational harm.

The issue in this case involved TransUnion's credit reports damaged people by flagging their reports to say that they might be listed on an Office of Federal Assets Control (OFAC) watchlist. Basically, if TransUnion thought that someone's name matched someone on the OFAC list, it would put that in their credit report. For a lot of people who aren't actually on the OFAC list, that can really suck. That resulted in this lawsuit. The court found that for those on that list who could show actual damage, they had standing. But, for others who were flagged by TransUnion, but could not show any actual harm, they did not have standing to sue.

In this case, a class of 8,185 individuals sued TransUnion, a credit reporting agency, in federal court under the Fair Credit Reporting Act. The plaintiffs claimed that TransUnion failed to use reasonable procedures to ensure the accuracy of their credit files, as maintained internally by TransUnion. For 1,853 of the class members, TransUnion provided misleading credit reports to third-party businesses. We conclude that those 1,853 class members have demonstrated concrete reputational harm and thus have Article III standing to sue on the reasonable-procedures claim. The internal credit files of the other 6,332 class members were not provided to third-party businesses during the relevant time period. We conclude that those 6,332 class members have not demonstrated concrete harm and thus lack Article III standing to sue on the reasonable-procedures claim.

The constitutional analysis focuses on the power of the judiciary to deal with actual cases and controversies:

Therefore, we start with the text of the Constitution. Article III confines the federal judicial power to the resolution of “Cases” and “Controversies.” For there to be a case or controversy under Article III, the plaintiff must have a “‘personal stake’” in the case—in other words, standing. Raines, 521 U. S., at 819. To demonstrate their personal stake, plaintiffs must be able to sufficiently answer the question: “‘What’s it to you?’” Scalia, The Doctrine of Standing as an Essential Element of the Separation of Powers, 17 Suffolk U. L. Rev. 881, 882 (1983).

To answer that question in a way sufficient to establish standing, a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief. Lujan v. Defenders of Wildlife, 504 U. S. 555, 560– 561 (1992). If “the plaintiff does not claim to have suffered an injury that the defendant caused and the court can remedy, there is no case or controversy for the federal court to resolve.” Casillas v. Madison Avenue Assocs., Inc., 926 F. 3d 329, 333 (CA7 2019) (Barrett, J.).

So, then the open question is whether or not a law that allows a private right of action over something that is a potential, but not concrete, harm meets the standard. And the majority decides it does not. And then, it goes even further, and notes that even if Congress creates a statutory "prohibition or obligation," courts can't just accept that as evidence of a concrete harm:

Importantly, this Court has rejected the proposition that “a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Spokeo, 578 U. S., at 341. As the Court emphasized in Spokeo, “Article III standing requires a concrete injury even in the context of a statutory violation.” Ibid.

Congress’s creation of a statutory prohibition or obligation and a cause of action does not relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III any more than, for example, Congress’s enactment of a law regulating speech relieves courts of their responsibility to independently decide whether the law violates the First Amendment. Cf. United States v. Eichman, 496 U. S. 310, 317– 318 (1990). As Judge Katsas has rightly stated, “we cannot treat an injury as ‘concrete’ for Article III purposes based only on Congress’s say-so.” Trichell v. Midland Credit Mgmt., Inc., 964 F. 3d 990, 999, n. 2 (CA11 2020) (sitting by designation); see Marbury, 1 Cranch, at 178; see also Raines, 521 U. S., at 820, n. 3; Simon v. Eastern Ky. Welfare Rights Organization, 426 U. S. 26, 41, n. 22 (1976); Muskrat v. United States, 219 U. S. 346, 361–362 (1911).

As the Court then says explicitly, just because someone will have claimed to have violated a statutory cause of action that does not automatically mean there is a concrete harm:

For standing purposes, therefore, an important difference exists between (i) a plaintiff ’s statutory cause of action to sue a defendant over the defendant’s violation of federal law, and (ii) a plaintiff ’s suffering concrete harm because of the defendant’s violation of federal law. Congress may enact legal prohibitions and obligations. And Congress may create causes of action for plaintiffs to sue defendants who violate those legal prohibitions or obligations. But under Article III, an injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.

Indeed, the majority argues that this is, fundamentally, a separation of powers issue:

In sum, the concrete-harm requirement is essential to the Constitution’s separation of powers. To be sure, the concrete-harm requirement can be difficult to apply in some cases. Some advocate that the concrete-harm requirement be ditched altogether, on the theory that it would be more efficient or convenient to simply say that a statutory violation and a cause of action suffice to afford a plaintiff standing. But as the Court has often stated, “the fact that a given law or procedure is efficient, convenient, and useful in facilitating functions of government, standing alone, will not save it if it is contrary to the Constitution.” Chadha, 462 U. S., at 944. So it is here.

The main dissent, written by Justice Thomas (it's an ideologically odd pairing: Justice Thomas with the three Justices most commonly found on the other end of the ideological spectrum: Justices Breyer, Sotomayor, and Kagan) is actually fairly compelling regarding the issue of concrete harm:

The principle that the violation of an individual right gives rise to an actionable harm was widespread at the founding, in early American history, and in many modern cases. See Uzuegbunam, 592 U. S., at ___–___ (slip op., at 5–8) (collecting cases); Havens Realty Corp. v. Coleman, 455 U. S. 363, 373 (1982) (“[T]he actual or threatened injury required by Art. III may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing” (citing cases; brackets and internal quotation marks omitted)). And this understanding accords proper respect for the power of Congress and other legislatures to define legal rights. No one could seriously dispute, for example, that a violation of property rights is actionable, but as a general matter, “[p]roperty rights are created by the State.” Palazzolo v. Rhode Island, 533 U. S. 606, 626 (2001). In light of this history, tradition, and common practice, our test should be clear: So long as a “statute fixes a minimum of recovery . . . , there would seem to be no doubt of the right of one who establishes a technical ground of action to recover this minimum sum without any specific showing of loss.” T. Cooley, Law of Torts *271.3 While the Court today discusses the supposed failure to show “injury in fact,” courts for centuries held that injury in law to a private right was enough to create a case or controversy.

Thomas also goes back to the issue of statutory damages in copyright to prove his point:

The First Congress enacted a law defining copyrights and gave copyright holders the right to sue infringing persons in order to recover statutory damages, even if the holder “could not show monetary loss.” Muransky v. Godiva Chocolatier, Inc., 979 F. 3d 917, 972 (CA11 2020) (Jordan, J., dissenting) (citing Act of May 31, 1790, §2, 1 Stat. 124–125). In the patent context, a defendant challenged an infringement suit brought under a similar law. Along the lines of what TransUnion argues here, the infringer contended that “the making of a machine cannot be an offence, because no action lies, except for actual damage, and there can be no actual damages, or even a rule for damages, for an infringement by making a machine.” Whittemore v. Cutter, 29 F. Cas. 1120, 1121 (No. 17,600) (CC Mass. 1813). Riding circuit, Justice Story rejected that theory, noting that the plaintiff could sue in federal court merely by alleging a violation of a private right: “[W]here the law gives an action for a particular act, the doing of that act imports of itself a damage to the party” because “[e]very violation of a right imports some damage.” Ibid.; cf. Gayler v. Wilder, 10 How. 477, 494 (1851) (patent rights “did not exist at common law”).

But this example in the dissent now seems to serve the opposite point: and effectively argues that under the majority decision, copyright's statutory damages may not be available at all if a plaintiff cannot show "concrete harm."

That's a very big deal in the copyright context. For years, we've pointed out the problematic nature of statutory damages in copyright. Under copyright law, if the work is registered before the infringement, statutory damages are available. And the whole theory behind them is that it's supposedly difficult to show the concrete harm of infringement, and therefore, you don't need to show any actual harm to get statutory damages, and those damages are wholly unrelated to any actual harm. As we noted a decade ago, this makes it "too attractive to sue." Basically, the possible payout from statutory damages, without having show any actual harm or damages at all, is massively distortionary.

And, now, looking at this ruling, it seems that there's an open argument if copyright plaintiffs will now be able to rely on statutory damages if they can't show any harm at all. This wouldn't completely take away statutory damages, but would, at the very least require plaintiffs to show some kind of harm.

Of course, when it comes to copyright law, one of the things we've noted is that courts seem to ignore every other precedent and treat everything related to copyright as if it's different. And, if this issue ever comes back to the court, I'd predict we'd see that same thing again. Judges will bend over backwards to insist that copyright is somehow "different." And it's possible that the majority ruling has an escape valve for that: it mentions repeatedly that part of the way of judging whether or not there's concrete harm is whether or not the issue is "traditionally recognized as providing a basis of a lawsuit in American courts." And, as the Thomas dissent makes clear, that's definitely been the case for copyright law and statutory damages going back basically to the beginning.

However, I do wonder if there's another interesting opening here on that: while in the early 2000s, Larry Lessig pushed a variety of failed cases to try to argue that the massive changes brought about by more recent copyright law changes raised constitutional issues. The Supreme Court rejected those arguments (wrongly in my opinion), but I do wonder if this ruling in TransUnion, at the very least, raises questions about statutory damages under the 1976 Copyright Act, since it covers so much more content, for so much longer, than was "traditional" under copyright law for the first two centuries of the country.

Filed Under: concrete harm, copyright, ofac, ramirez, statutory damages, supreme court
Companies: transunion

Daily Deal: The Modern Web Development And MySQL Programming Bundle

from the good-deals-on-cool-stuff dept

The Modern Web Development And MySQL Programming Bundle has 5 courses to help you master the top programming languages. Courses cover PHP, MySQL, GitHub, Heroku, Blazor, .NET, and more. It's on sale for $20.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Ninth Circuit Appeals Court Says Some Disturbing Stuff About Section 230 While Dumping Another Two 'Sue Twitter For Terrorism' Lawsuits

from the not-a-lot-of-good-news-in-the-167-pages dept

In a very dense and somewhat counterintuitive opinion [PDF], the Ninth Circuit Court of Appeals has dumped two more of the dozens of bogus "sue social media companies for acts committed by terrorists" lawsuits. But it has kept one alive. Worse, the 167-page ruling comes with concurring opinions that suggest Ninth Circuit judges think Section 230 immunity is, on the whole, letting social media companies get away with too much bad stuff.

The two lawsuits whose dismissals were affirmed deal with the San Bernardino shooting and the terrorist attacks in Paris, France. The one kept alive deals with a terrorist attack in Istanbul, Turkey. The first case (Gonzalez v. Google) deals with allegations that Google's revenue sharing with terrorist organizations amounted to material support. But the allegations aren't strong enough to sustain the lawsuit.

Although monetary support is undoubtedly important to ISIS’s terrorism campaign, the TAC is devoid of any allegations about how much assistance Google provided. As such, it does not allow the conclusion that Google’s assistance was substantial. Nor do the allegations in the TAC suggest that Google intended to assist ISIS. Accordingly, we conclude the Gonzalez Plaintiffs failed to state a claim for aiding-and-abetting liability under the ATA. We do not consider whether the identified defects in the Gonzalez Plaintiffs’ revenue-sharing claims—principally, the absence of any allegation regarding the amount of the shared revenue—could be cured by further amendment because the Gonzalez Plaintiffs were given leave to amend those claims and declined to do so.

The third case (Clayborn v. Twitter) involves several of the same allegations, but dealing with the San Bernardino shooting. The claims here fail mainly because there was no evidence ISIS directed or was directly involved in the attack.

Even if Congress intended “authorized” to include acts ratified by terrorist organizations after the fact, ISIS’s statement after the San Bernardino Attack fell short of ratification. The complaint alleges that ISIS stated, “Two followers of Islamic State attacked several days ago a center in San Bernardino in California, we pray to God to accept them as Martyrs.” This clearly alleges that ISIS found the San Bernardino Attack praiseworthy, but not that ISIS adopted Farook’s and Malik’s actions as its own.

The second case (Taamneh v. Twitter) stays alive. The allegations are pretty much identical to those in Gonzalez v. Google, with the main difference being what issues the lower court reached. In this case, there was no Section 230 discussion. And, as the Ninth Circuit sees it, that difference allows the claims it dismissed in Gonzalez to survive in Taamneh.

Because the bulk of the Gonzalez Plaintiffs’ claims were properly dismissed on the basis of § 230 immunity, our decision in Gonzalez principally focuses on whether the Gonzalez Plaintiffs’ revenue-sharing theory sufficed to state a claim under the ATA. In contrast, the district court in Taamneh did not reach § 230; it only addressed whether the Taamneh Plaintiffs plausibly alleged violations of the ATA for purposes of Rule 12(b)(6). The Taamneh appeal is further limited by the fact that the Taamneh Plaintiffs only appealed the dismissal of their aiding-and-abetting claim.

Hesitantly, the Ninth says this single lawsuit can proceed, mainly because it specified more direct support like use of Google's AdSense and other revenue-sharing.

We also recognize the need for caution in imputing aiding-and-abetting liability in the context of an arms-length transactional relationship of the sort defendants have with users of their platforms. Not every transaction with a designated terrorist organization will sufficiently state a claim for aiding-and-abetting liability under the ATA. But given the facts alleged here, we conclude the Taamneh Plaintiffs adequately state a claim for aiding-and-abetting liability.

Now, here comes the bad stuff. The concurring opinions don't deal much with the facts of the case, but rather with some judges' view that Section 230 is too broad and should be trimmed back. If Congress won't do it, maybe the Ninth Circuit will.

Here's Judge Marsha Berzon's take:

I concur in the majority opinion in full. I write separately to explain that, although we are bound by Ninth Circuit precedent compelling the outcome in this case, I join the growing chorus of voices calling for a more limited reading of the scope of section 230 immunity. For the reasons compellingly given by Judge Katzmann in his partial dissent in Force v. Facebook, 934 F.3d 53 (2d Cir. 2019), cert. denied, 140 S. Ct. 2761 (2020), if not bound by Circuit precedent I would hold that the term “publisher” under section 230 reaches only traditional activities of publication and distribution—such as deciding whether to publish, withdraw, or alter content—and does not include activities that promote or recommend content or connect content users to each other. I urge this Court to reconsider our precedent en banc to the extent that it holds that section 230 extends to the use of machine-learning algorithms to recommend content and connections to users.

The judge has problems with the recommendation algorithms used by social media companies -- ones that naturally tend to show people the sorts of things they appear to be interested in. In most cases, this is innocuous. But in some cases, the algorithms can send people down rabbit holes.

If viewers start down a path of watching videos that the algorithms link to interest in terrorist content, their immersive universe can easily become one filled with ISIS propaganda and recruitment. Even if the algorithm is based on content-neutral factors, such as recommending videos most likely to keep the targeted viewers watching longer, the platform’s recommendations of what to watch send a message to the user. And that message—“you may be interested in watching these videos or connecting to these people”—can radicalize users into extremist behavior and contribute to deadly terrorist attacks like these.

This is a really weird, really dangerous place to start drawing the line in Section 230 lawsuits. Algorithms react to input from users. If YouTube can't be held directly responsible for videos uploaded by users, it makes sense it would be immunized against algorithmically suggesting content based on users' actions and preferences. The algorithm does next to nothing on its own without input from content viewers. It takes a user to really get it moving.

Judge Ronald Gould's concurrence contains many of the same complaints about social media recommendation algorithms. And he similarly believes Section 230 shouldn't cover these, apparently for the simple reason that terrorists can benefit from recommendations made to users who've expressed an affinity for content allegedly created by terrorists.

The majority ultimately concludes that Section 230 shields Google from liability for its content-generating algorithms. I disagree. I would hold that Plaintiffs’ claims do not fall within the ambit of Section 230 because Plaintiffs do not seek to treat Google as a publisher or speaker of the ISIS video propaganda, and the same is true as to the content-generating methods and devices of Facebook and Twitter.

Accepting plausible complaint allegations as true, as we must, Google, through YouTube, and Facebook and Twitter through their various platforms and programs, acted affirmatively to amplify and direct ISIS content, repeatedly putting it in the eyes and ears of persons who were susceptible to acting upon it.

And if Congress won't act fast enough for Judge Gould, then the courts should step in and regulate social media companies.

I further urge that regulation of social media companies would best be handled by the political branches of our government, the Congress and the Executive Branch, but that in the case of sustained inaction by them, the federal courts are able to provide a forum responding to injustices that need to be addressed by our justice system. Here, that means to me that the courts should be able to assess whether certain procedures and methods of the social media companies have created an unreasonably dangerous social media product that proximately caused damages, and here, the death of many.

Judge Gould says this should be easy to do correctly and without collateral damage to legitimate content.

The record shows that despite extensive media coverage, legal warnings, and congressional hearings, social media companies continued to provide a platform and communication services to ISIS before the Paris attacks, and these resources and services went heedlessly to ISIS and its affiliates, as the social media companies refused to actively identify ISIS YouTube accounts, and only reviewed accounts reported by other YouTube users. If, for example, a social media company must take down within a reasonable time sites identified as infringing copyrights, it follows with stronger logic that social media companies should take down propaganda sites of ISIS, once identified, within a reasonable time to avoid death and destruction to the public, which may be victimized by ISIS supporters. Moreover, if social media companies can ban certain speakers who flout their rules by conveying lies or inciting violence, as was widely reported in the aftermath of tweets and posts relating to the recent “insurrection” of January 6, 2021, then it is hard to see why such companies could not police and prohibit the transmission of violent ISIS propaganda videos, in the periods preceding a terrorist attack.

This ignores the fact that the DMCA process is pretty much an ongoing train wreck, one that's abused to silence speech and often mistakenly targets non-infringing content. And social media companies' attempts to stop the spread of disinformation or deal with harassing/threatening content have rarely been viewed as competent, much less exemplary. This whole spiel ignores the fact that a lot of the moderation Gould considers easy or successful is also heavily reliant on reports by site users.

Finally, not only does Judge Gould suggest Section 230 should be narrowed, he thinks another course of legal action should be made available to plaintiffs to sue tech companies not just for the content they host, but for the actions of terrorist organizations all over the world.

As a matter of federal common law, I would hold that when social media companies in their platforms use systems or procedures that are unreasonably dangerous to the public—as in the case where their systems line up repeated messages in aid of terrorists like ISIS—or when they omit to act to avoid harm when omitting the act is unreasonably dangerous to the public—as in the case where they fail to review and self-regulate their websites adequately to notice and remove propaganda videos from ISIS that are likely to cause harm—then there should be a federal common law claim available against them.

That's Gould's "product liability" theory. In his view, the algorithms are defective because some users turn towards terrorism. And if the product is defective, the manufacturer can be sued. Gould really has to stretch the analogy to make it fit.

Here and similarly, social media companies should be viewed as making and “selling” their social media products through the device of forced advertising under the eyes of users.

Huh. But what if users use ad blockers? I mean, that's just one of several questions this raises. The product is access to site users and their attention. That's what's being sold to advertisers. If that's the case, the only parties who would have standing to bring lawsuits under this theory would be dissatisfied companies who feel their ads are being placed along content that's being served up by algorithms that are possibly radicalizing some users into committing terrorist acts. That's more than a little attenuated from the actual harm, especially if no one working for the aggrieved companies has been a victim of a terrorist attack. Sure, users could try to complain the product is defective, but the product -- according this this judge's own take -- isn't the social media platform.

Look, moderation is far from perfect and will likely always cause some sort of collateral damage as adjustments are made. If everyone would like to see less moderation and fewer social media options, they should definitely allow the courts and Congress to start creating a bunch of exceptions to Section 230 immunity. In these three lawsuits, plaintiffs suffered tragedies and were encouraged by questionable law firms to sue third parties with no link to terrorists and their acts other than some hosted content. If these claims had any merit, we'd see more wins. But we haven't seen these wins because these claims are weak and seem mostly propelled by finding the largest, easiest target to hit rather than any true desire to see justice done.

Filed Under: 9th circuit, ata, intermediary liability, section 230, terrorism
Companies: twitter

Ohio Republicans Forced To Back Off Unpopular Ban On Community Broadband

from the good-luck-with-that dept

Ohio Republicans have been forced to back off an attempt to ban community broadband networks in the state after massive public opposition. As we recently noted, state Republicans included a last-hour amendment to a state budget bill (at AT&T and Charter's behest) that would have effectively outlawed community and municipal broadband. Such networks are an organic, grass roots response to market failure at the hands of regional telecom monopolies. And instead of addressing them by offering better, cheaper service, giant ISPs often find it's cheaper to just lobby state and federal lawmakers.

The Ohio proposal was so unpopular, none of the Republican backers were willing to even publicly acknowledge their support. After several weeks of significant backlash, the Ohio Senate conference committee was forced to scrap the proposal. That's good news to FairlawnGig, a locally-owned ISP built on the back of a local power utility, which offers significantly faster fiber broadband at lower rates than most national providers. From an email the ISP sent out Monday morning:

"We’d like to thank everyone in Fairlawn and Summit County for their support in rallying together to tell elected officials in Columbus how important municipal broadband is to them,” says Ernie Staten, Director of Public Service for Fairlawn. "Municipalities only enter the broadband space when forced to by the inaction of the private sector. The competition and service we bring is the key difference for many communities to compete and thrive in the 21st century economy."

Again, most of the major ISPs lobbying for these kinds of restrictions want to have their cake and eat it too. They want to operate as apathetic regional monopolies providing expensive, spotty, and slow service, but they don't want anybody, at any real level, to do anything about it. Their own inaction created the trend of locally-built broadband networks, but instead of getting out ahead of the issue by doing better, they've repeatedly attempted to tilt the playing field in their favor. So instead of finishing the fiber networks taxpayers have paid billions for, they've passed 17 state laws prohibiting community broadband.

Because community broadband sees such bipartisan popularity, dominant ISPs also fund an entire cottage industry of pundits, academics, and regulators who like to insist that desperate cities trying to build better telecom infrastructure is "socialism" or "government run amok." While community broadband isn't some mystical panacea, the data is pretty clear that such options usually provide faster, cheaper service. They also pour local money back into the local economy, instead of funneling it to Comcast or AT&T executive compensation half a world away.

Of course it doesn't have to be an either/or scenario. There are plenty of opportunities for collaboration and public/private partnership. But giants like AT&T, Comcast, Charter, and others really like the existing US approach to broadband policy, which for thirty-five years now has basically involved throwing billions in subsidies at industry giants for half-completed networks, paying some empty lip service to the "digital divide," ignoring the perils of regional monopolization (and the corruption that protects it), while pretending the US broadband market is the pinnacle of free market innovation.

Filed Under: broadband, community broadband, competition, ohio

Congressional Leadership Realizing That 'Big Tech' Antitrust Bills Aren't Ready For Prime Time

from the back-to-the-drawing-board dept

As you've now heard, there's a big push in Congress to revise how antitrust works. A group of mostly Democratic House members (with a few Republicans on board) introduced a questionable package of antitrust bills, with many, many problems. There were some good ideas (such as better funding of the FTC) and some more creative ideas (such as around interoperability), but done in such ham-fisted ways that they would cause a lot more harm than good. We've noted how the bills would create massive problems for content moderation, and raise related speech issues.

Last week's marathon markup hearing in the House Judiciary Committee did not ease these concerns -- if anything they made them much, much worse. After the hearing was finally over, a bi-partisan group of Judiciary Committee members put out a statement highlighting the half-baked nature of the proposals.

“The marathon markup – that started Wednesday morning, recessed as the sun came up on Thursday morning, and then reconvened for another four hours on Thursday – featured several bills that would radically change America’s leading tech companies and made crystal clear that the bill text as debated is not close to ready for Floor consideration.

“The package of legislation poses harm to American consumers and the U.S. economy and left Members on both sides of the aisle with basic questions that have yet to be answered. What companies are covered in the scope of the bills? If only four, why? Why are foreign firms not covered? Were the definitions of ‘covered platforms’ arbitrary or not? How would the bills impact useful products that consumers rely on? How do the bills protect the data of American consumers? How do the bills protect consumers from arbitrary tech company abuses, as well as safeguard the nation’s security and economic interests?

“The 16-month-long investigation conducted by the Antitrust, Commercial, and Administrative Law Subcommittee rightfully scrutinized digital markets in an effort to remove barriers to competition. Unfortunately, the resulting legislative proposals – which the full Committee did not hold a hearing on or have reasonable time to fully consider – fell short of adequately addressing identified problems in an effective way that serves Americans’ interests. We urge the sponsors of the bills to take the necessary time, commit to a comprehensive approach, and work with their bipartisan colleagues of this Committee to address the concerns articulated during markup to further develop these bills.”

Of course, given how nearly all of those concerns were brushed aside by Committee members who support the bills, my fear was that this process was on an unstoppable train track. People had asked Rep. Jerry Nadler to slow things down before the hearing and he had refused. However, it appears that more soberly minded members of the leadership are now realizing that maybe this rush job is a mistake.

Majority Leader Steny Hoyer is now pumping the brakes on moving these antitrust bills to a full floor vote.

“There was disagreement among the Democrats in the committee and not every Democrat voted for it, and some very senior members opposed it,” Hoyer said of the House Judiciary’s consideration of the legislation last week. “There’s a lot of discussion to be had before I get to scheduling bills for the floor.”

What this really means is that someone has taken the temperature of the other members and realized there aren't enough votes to pass these bills. That doesn't mean they won't be back (or that this process won't just jump over to the Senate for now). It's entirely possible that updated versions of the bills will be even worse. But, for now, at least, it appears that Congress is taking at least a temporary breather on rushing through these bills.

Filed Under: antitrust, big tech, congress, david cicilline, steny hoyer

Ubisoft Teams Up With Mystery Rights Holder To Remove Fun Fan-Made 'GoldenEye 007' Maps From 'Far Cry'

from the no-fun-for-you dept

We have seen our monumentally absurd permission and copyright culture kill off all sorts of cool fan projects. Perhaps no industry is impacted by this more than the video game space, where you have the combination of rabid fans of particular games and franchises coupled with an above average level of technical skill in exhibiting that fandom. This combination sees an absolute ton of fan-made projects, including ports of games to different hardware, fan-made games, and even the re-creation of old games within new ones. It should be obvious that all of this carries very little monetary risk for the game makers, and, in fact, often times could be a boon, and yet it is all too common for publishers and developers to sic lawyers on their own fans rather than figuring out a way to coexist or benefit from them.

But sometimes this nonsense gets down to an absurdly granular level. Such appears to the be the case with one YouTuber going by Krollywood, who spent hundreds of hours recreating the maps for the classic N64 game GoldenEye 007 in Far Cry 5, only to have those maps removed by Ubisoft in response to a copyright claim.

You could find and play these levels yourself by hopping into Far Cry 5’s arcade mode and punching in Krollywood’s username. As of this writing, you no longer can. Ubisoft removed them all from Far Cry 5, a move that Krollywood described as “really sad,” noting that he probably won’t be able to restore them since he’s “on their radar now.”

“I’m really sad—not because of myself or the work I put in the last three years, [but] because of the players who wanna play it or bought Far Cry just to play my levels,” Krollywood told Kotaku in an email today.

Ubisoft hasn't responded as of this writing as to who made the copyright claim, but it appears the rights are held by MGM, the film studio that put out the movie of the same name. Notably, it's unclear just how valid a copyright claim would even be. Ubisoft owns the code used to make the game and used by fans to make new levels. Krollywood recreated the levels, rather than borrowing any digital assets from the original. Also, the maps were not for sale; they were free to download.

But even if we granted that MGM or someone else could make a valid copyright claim on these maps... why the hell bother to do so? What precisely is the threat being staved off here?

Players just want a taste of nostalgia, and MGM has a track record of shattering the plates before they’re even delivered to the table. (Recall GoldenEye 25, the fan remake of GoldenEye 007 remade entirely in Unreal 4 that was lawyered into oblivion last year.) MGM has further neglected to do anything with the license it’s sitting on—for a game that’s older than the Game Boy Color, by the way. At the end of the day, shooting this latest fan-made project out of the sky comes across as a punitive move, at best.

“In the beginning, I started this project just for me and my best friend, because we loved the original game so much,” Krollywood said. “But there are many GoldenEye fans out there … [The project] found many new fans and I’m so happy about it.”

Sadly, it appears happiness is not on the menu at present, to keep the analogy going. Instead, the only dish served is cold, hard copyright.

Filed Under: fan made maps, fans, far cry 5, goldeneye 007, video games
Companies: ubisoft

'Malicious' Actor Is Wiping The Data Of Countless Western Digital My Book Users

from the past-its-expiration-date dept

Owners of the Western Digital popular My Book external hard drives aren't having a particularly good week. The company is advising customers to stop using the devices for now after customers mysteriously found their data deleted. According to complaints over at the company's website (first spotted by Bleeping Computer), many users say they woke up to find that the content of their external USB-connected storage drives had been completely wiped. Worse, they couldn't log in to the device's administrative systems to run any kind of diagnosis on the drives:

"I have a WD mybook live connected to my home LAN and worked fine for years. I have just found that somehow all the data on it is gone today, while the directories seems there but empty. Previously the 2T volume was almost full but now it shows full capacity.

The even strange thing is when I try to log into the control UI for diagnosis I was-only able to get to this landing page with an input box for “owner password”. I have tried the default password “admin” and also what I could set for it with no luck. There seems to be no change to retrieve or reset password on this landing page either."

The problem appears to have begun at around 3PM on June 23, at which point these devices started receiving a remote command to perform a factory reset. This appears to still be happening on a staggered basis. The Western Digital announcement sent out to customers suggests that a malicious actor has found a way to compromise the devices, and is deleting data for their own amusement:

"Western Digital has determined that some My Book Live devices are being compromised by malicious software. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. We understand that our customers’ data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are available."

There's been absolutely no indication given of when customers can expect a fix. Western Digital stopped supporting the My Book Live in 2015 for cost reasons, leaving millions of devices with dated firmware and vulnerabilities. According to user threads at the company's website, some Western Digital MyDrive users who say they disabled all cloud functionality to protect themselves, say their data was wiped anyway. Since much of this data is encrypted, recovering it may prove to be a long shot, meaning that many users who thought they were being smart by backing up their essential files, will have likely lost everything permanently.

It's not that hard for an everyday consumer -- inundated with an endless sea of obligations -- to miss the handful of notifications (if they even existed) that their devices are now neither supported nor secure. Given the millions of shitily-secured network routers and IOT devices that are being connected annually, the scope of the problem (and our collective apathy to it) really can't be overstated. If you know somebody who uses this hardware for backups and storage, you might want to give them a nudge.

Filed Under: cybersecurity, external hard drive, malicious actors, mybook, ownership