Top German Court Rules Facebook's Collection And Use Of Data From Third-Party Sources Requires 'Voluntary' Consent

from the oh-no,-not-more-pop-ups dept

Back at the end of 2017, Germany's competition authority, the Bundeskartellamt, made a preliminary assessment that Facebook's data collection is "abusive". At issue was a key component of Facebook's business model: amassing huge quantities of personal data about people, not just from their use of Facebook, WhatsApp and Instagram, but also from other sites. If a third-party website has embedded Facebook code for things such as the 'like' button or a 'Facebook login' option, or uses analytical services such as 'Facebook Analytics', data will be transmitted to Facebook via APIs when a user calls up that third party's website for the first time. The user is not given any choice in this, and it was this aspect that the Bundeskartellamt saw as "abusive".

After the preliminary assessment, in February 2019 the German competition authority went on to forbid Facebook from gathering information in this way without voluntary permission from users:

(i) Facebook-owned services like WhatsApp and Instagram can continue to collect data. However, assigning the data to Facebook user accounts will only be possible subject to the users' voluntary consent. Where consent is not given, the data must remain with the respective service and cannot be processed in combination with Facebook data.

(ii) Collecting data from third party websites and assigning them to a Facebook user account will also only be possible if users give their voluntary consent.

If consent is not given for data from Facebook-owned services and third party websites, Facebook will have to substantially restrict its collection and combining of data. Facebook is to develop proposals for solutions to this effect.

Naturally, Facebook appealed against this decision, and the Düsseldorf Higher Regional Court found in its favor. However, as the New York Times reports, the Federal Court of Justice, which monitors compliance with the German constitution, has just reversed that:

On Tuesday, the federal court said regulators were right in concluding that Facebook was abusing its dominant position in the market.

"There are neither serious doubts about Facebook's dominant position on the German social network market nor the fact that Facebook is abusing this dominant position," the court said. "As the market-dominating network operator, Facebook bears a special responsibility for maintaining still-existing competition in the social networking market."

Needless to say, Facebook vowed to fight on -- and to ignore the defeat for the moment. The case goes back to the lower court to rule again on the matter, but after the Federal Court of Justice guidance, it is unlikely to be in Facebook's favor this time. There is also the possibility that the case could be referred to the EU's top court, the Court of Justice of the European Union, to give its opinion on the matter.

Assuming that doesn't happen, the ruling could have a big impact not only on Facebook, but on all the other Internet giants that gather personal details from third-party sites without asking their visitors for explicit, voluntary permission. Although the ruling only applies to Germany, the country is the EU's biggest market, and likely to influence what happens elsewhere in the region, and maybe beyond. One bad outcome might be even more pop-ups asking you to give permission to have your data gathered, and be tracked as you move around the Internet.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: data collection, data privacy, germany, permission
Companies: facebook

German Constitutional Court Says Unjustified Surveillance Of Foreign Citizens Is Illegal

from the when-it's-up-to-domestic-courts-to-give-AF-about-non-citizens dept

The German government pretended to be bothered by the NSA's spying when the Snowden leaks began, claiming surveillance of overseas allies was somehow a bit too much. It had nothing to say about its own spying, which was roughly aligned with the NSA's "collect it all" attitude. This could be chalked up to "Five Eyes" envy, perhaps. The NSA works with four other countries to hoover up massive amounts of data directly from internet fire hoses located around the world, but Germany has never made the cut.

While the German PM made a lot of noise about being surveilled, Germany's intelligence agencies continued to perform both domestic and foreign surveillance, resulting in legal challenges to the country's surveillance programs. The German Constitution restricts domestic surveillance but doesn't have nearly as much to say about subjecting foreigners to intrusive snooping. Foreigners are usually considered fair game -- non-recipients of protections given to citizens of whatever country does the spying.

One legal challenge dead-ended when a German court decided a service provider couldn't sue on behalf of its spied-upon users. But others continued, and there's good news to report.

The German government must come up with a new law regulating its secret services, after the country's highest court ruled that the current practice of monitoring telecommunications of foreign citizens at will violates constitutionally-enshrined press freedoms and the privacy of communications.

The ruling said that non-Germans were also protected by Germany's constitutional rights, and that the current law lacked special protection for the work of lawyers and journalists. This applied both to the collection and processing of data as well as passing on that data to other intelligence agencies.

The recognition of the extension of domestic rights to foreign citizens is the end result of a lawsuit filed by journalists against the German government. The lawsuit alleged BND's all-encompassing spying made targets out of everyone, including those normally protected by their own countries' laws preventing the surveillance of protected speech.

The German government argued that foreigners are not protected by anything -- not even the rights granted to them by their governments. The Constitutional Court disagreed, finding that allowing the BND (Germany's NSA equivalent) cannot be allowed to unilaterally decide who could be targeted by its surveillance programs. Current "best practices" allow the BND to roll up on the nearest internet trunk to collect everything: communications routed through a Frankfurt interchange that handles data flowing from France, Russia, and the Middle East.

If the government wishes to continue hoovering up everything flowing through Frankfurt (and internet exchanges elsewhere in the country), it will need to to codify the process with some guardrails in place -- guidelines that will hopefully include some respect for the rights of foreign citizens, including journalists, activists, and lawyers who generally cannot be targeted by their own countries.

Now, all everyone has to do is wait. The German government has until 2021 to amend the law. Presumably, the BND will do whatever it can to appeal this decision that extends domestic rights to foreigners. And it will likely delay any modifications as long as possible to allow for maximum snoopage. Bureaucratic delays aside, this ruling sends a message: the stuff that was considered just normal stuff for maximum national security is no longer acceptable. The judicial system in Germany is unwilling to sacrifice foreigners' rights for the surveillance whims of an agency that hasn't shown a compelling reason why it should have access to everything people from other countries talk about.

Filed Under: bnd, collect it all, foreign citizens, germany, surveillance

Suspected DNC & German Parliament Hacker Used His Name As His Email Password

from the opsec-yo dept

You may have seen the news reports this week that German prosecutors have issued an arrest warrant for Dmitry Badin for a massive hack of the German Parliament that made headlines in 2016. The reports about the German arrest warrant all mention that German authorities "believe" that Badin is connected to the Russian GRU and its APT28 hacking group.

The folks over at Bellingcat have done their open source intelligence investigation thing, and provided a ton of evidence to show that Badin almost certainly is part of GRU... including the fact that he registered his 2018 car purchase to the public address of a GRU building. This is not the first time this has happened. A few years back, Bellingcat also connected a bunch of people to the GRU -- including some accused of hacking by the Dutch government -- based on leaked car registration info.

There's much, much more in the Bellingcat report, but the final paragraph really stands out. Bellingcat also found Badin -- again, a hacker who is suspected in multiple massive and consequential hacks, including of email accounts -- didn't seem to be all that careful with his own security:

The most surreal absence of “practice-what-you-breach” among GRU hackers might be visible in their lackadaisical attitude to their own cyber protection. In 2018, a large collection of hacked Russian mail accounts, including user name and passwords, was dumped online. Dmitry Badin’s email — which we figured out from his Skype account, which we in turn obtained from his phone number, which we of course got from his car registration — had been hacked. He had apparently been using the password Badin1990. After this, his email credentials were leaked again as part of a larger hack, where we see that he had changed his password from Badin1990 to the much more secure Badin990.

Yes, the password for at least one of his email accounts... was apparently his own last name and the year he was born. The cobbler's kids go shoeless again.

Filed Under: apt28, dmitry badin, dnc, dnc emails, email, germany, gru, hacking, opsec, passwords, podesta emails, russia

Double Blow To The EU's Long-Delayed Unified Patent Court, But Supporters Unlikely To Give Up

from the increasingly-anachronistic dept

Remember the EU's unitary patent plan? No surprise if you don't -- attempts to create a unitary patent system across the region have been dragging on for decades. Back in 2012, Techdirt noted that the European Parliament had finally approved the plan to set up a new Unified Patent Court (UPC) for the EU, but it still hasn't come to fruition. Recently, the scheme has been dealt two major blows that are likely to delay it further, even if they don't kill it off entirely.

The first concerns the UK. It's one of the three nations that had to sign up to the UPC agreement for it to come into force. A big question was whether it could or would do so after brexit. The answer turns out to be "no". The second problem comes from Germany, where the country's constitutional court has ruled as follows:

The Act of Approval to the Agreement on a Unified Patent Court ("the Act of Approval") to confer sovereign powers on the Unified Patent Court is void. In its outcome, it amends the [German] Constitution in substantive terms, though it has not been approved by the Bundestag with the required two-thirds majority.

However, it's possible that can be solved by the Bundestag -- German's parliament -- holding another vote which does attain the two-thirds majority. There is likely to be pressure to do so because elsewhere the ruling by Germany's constitutional court (full translation from FFII.org) is helpful to supporters of the UPC, for reasons explained by The Register:

the German Constitutional Court effectively rejected the other arguments against the UPC's validity. In essence, they were: that because the UK is exiting the EU that the UPC is no longer valid because the UK was one of three compulsory signatories to it (the other two being France and Germany); and that the European Patent Office (EPO) is insufficiently independent because of "reforms" made by its former president Benoit Battistelli that concentrated power in his hands.

Importantly, the first point means the refusal of the UK to sign up is not regarded as an issue now that it has left the EU. As Florian Mueller writes on his blog: "there is widespread consensus that re-ratification (subsequently to renegotiation) is a question of when, not if." Although FFII.org agrees the patent industry will push hard to get the UPC implemented, it notes there are yet more bumps in that particular road:

the German Constitutional Court still have to decide soon over 4 other complaints, where complainants have raised the issue that the European Patent Office (EPO) cannot be brought to court for maladministration, in breach of the "rule of law" principle. If the court finds the EPO not in line with fundamental rights, this might have a bigger impact over the current system.

This point relates to the central role that will be played by the EPO in issuing the new unitary patents, valid across the EU. The EPO has long been a controversial institution: it is not part of the EU, its premises enjoy extraterritoriality, and its executives are granted diplomatic immunity that effectively places them outside the law. If allegations of maladministration cannot be brought to EU courts, that seems like a recipe for disaster. Irrespective of those particular questions, The Register article raises a more fundamental one: is it really worth bothering with a plan that was born decades ago? Both the unitary patent and UPC reflect a very different world from the one we now inhabit, which no longer regards more powerful patents as an obvious blessing.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: brexit, epo, eu, germany, patents, uk, unified patent court

Germany Wants To Limit Memes And Mashups Derived From Press Publishers' Material To 128-by-128 Pixels In Resolution, And Three Seconds In Length

from the yeah,-that-sounds-totally-reasonable dept

Last month, Mike wrote about France's awful proposals for implementing the EU Copyright Directive's upload filter (originally known as Article 13, but Article 17 in the final version). Just as France was the most vocal proponent of this dangerous development, so Germany was the main driving force behind the ancillary copyright requirement, also known as the snippet or link tax. And like France, Germany has managed to make its proposed national implementation (original in German) of what was Article 11, now Article 15, even worse than the general framework handed down by the EU. The former Pirate Party MEP Julia Reda has a Twitter thread (in German) that picks out the main bad ideas. Under the German proposals, in general only "single words or very short extracts" of a press article can be quoted without a license. Specifically, free quotation is limited to:

the headline

a small-format preview image with a resolution of 128-by-128 pixels

a sequence of sounds, images or videos with a duration of up to three seconds

The proposal states that the new ancillary copyright does not apply to hyperlinks, or to "private or non-commercial use" of press publishers' materials by a single user. However, as we know from the tortured history of the Creative Commons "non-commercial" license, it is by no means clear what "non-commercial" means in practice. Press publishers are quite likely to insist that posting memes on YouTube, Facebook or Twitter -- all undoubtedly commercial in nature -- is not allowed in general under the EU Copyright Directive. We won't know until top EU courts rule on the details, which will take years. In the meantime, online services will doubtless prefer to err on the side of caution, keen to avoid the risk of heavy fines. It is likely they will configure their automated filters to block any use of press publishers' material that goes beyond the extremely restrictive limits listed above. Moreover, this will probably apply across the EU, not just in Germany, since setting up country-by-country upload filters is more expensive. Far easier to roll out the most restrictive rules across the whole region.

Before the new laws go into operation, people can submit their views to the German government at the email address

konsultation-urheberrecht@bmjv.bund.de

until 31 January 2020. Now might be a good time to remind the German lawmakers -- politely -- that supporters of the EU Copyright Directive insisted repeatedly that memes were "exempt" and "safe" under the new rules. Germany's unbalanced and extreme implementation shows that simply isn't true, and means that memes and mashups are most definitely under threat -- just as many of us warned.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: article 11, article 15, copyright, eu copyright directive, germany, linking, memes, neighboring rights, press snippets

Copyright Troll Threatens Criminal Charges In Germany Against Domain Registrar

from the not-how-it-works dept

I've discussed in the past how problematic it is when people don't recognize the differences between edge providers and infrastructure providers when it comes to internet services. Usually it's policymakers (or the press) getting these things confused, but we've certainly seen our fair share of attempts by copyright maximalists to use this confusion to their advantage. However, this may be the first I recall of seeing a copyright trolling operation trying to effectively do the same.

Earlier this fall, Mark Jeftovic, from EasyDNS had a blog post about how a German copyright troll, called Fechner Law, had threatened criminal charges against the company if it didn't take down an allegedly infringing URL and pay a significant cash settlement. Jeftovic responded to Robert Fechner, the young lawyer behind Fechner Law, and pointed out that EasyDNS is merely the domain registrar, and doesn't host the site in question. Fechner, somewhat obnoxiously hit back by saying that German law required EasyDNS to at least turn over the information about the website owner or face criminal charges -- even adding on "additional damages due to your uncooperative and unlawful behaviour will be claimed."

Dear Mr Jeftovic,

I appreciate your alleged concern for your users’ privacy.

Nonetheless, according to OLG Frankfurt a. Main, Urteil v. 22.8.2017, Az. 11 U 71/16 you have to provide us at least with a name and e-mail of the infringer.

If you fail to comply with the law, further proceedings will be to file a criminal complaint against you in order to acquire this information on the basis of § 14 II TMG.

In this case, additional damages due to your uncooperative and unlawful behaviour will be claimed.

We await your reply until 20.09.2019.

Sincerely,

Rechtsanwalt Robert Fechner
FECHNER LEGAL

Jeftovic proceeded to point out that Canada, where he is based, is not Germany (who knew?) and thus was not subject to whatever interpretation of German law Fechner believed was relevant here:

Mr. Fechner,

That is all very interesting.

It appears that you do not understand that we are a domain registrar. We are not the alleged copyright infringer. This is not our website. We are not even hosting the website. My company, easyDNS Technologies, Inc., must comply with Canadian privacy law that, in these circumstances, prohibits the disclosure of customer information absent a Court order that is enforceable in Ontario, Canada.

My company must also comply with Canadian copyright law. There is a process to be followed under the Copyright Act (see s. 41.25) if you are actually interested in having the notice provided to the customer and the allegedly infringing photograph taken down. I suggest you follow that process.

Your threat of criminal sanction against a law-abiding passive intermediary is unethical and should be met by your judicial system with serious concern.

We did not receive any of your earlier correspondence. Your letters appear to have been sent by email to [redacted]/@myprivacy.net. (MyPrivacy.net Ltd. is a service that protects the public disclosure of registration details on the “whois” registry.) MyPrivacy.net is not the owner of the website. The email address, [redacted]/@myprivacy.net, also seems to contain an error (there is a / in the address). Most likely the emails didn’t go anywhere. We urge you to consult a Canadian lawyer to help you understand the privacy and copyright regimes that apply here.

- mark

Mark tells me that Fechner has not replied to this email, but this kind of blustering threat letter seems all too common these days from copyright trolls. It seems that, despite their pretend adherence to being all about "law and order," when it suits their purposes (i.e., shaking people down for money), they don't much care about the law beyond that it lets them sound scary to people who aren't knowledgeable enough about the law. This is, as Mark notes in his own email, quite unethical.

Filed Under: canada, copyright, copyright troll, domain registrar, germany, privacy, robert fechner
Companies: easydns, fechner law

Germany's CDU, Angela Merkel's Party Of Fuddy-Duddies, Decides To Join The Cool Kids: Backs Open Standards, Open Source, Open Data, Open APIs -- Open Everything

from the it's-groovy,-man dept

The Christian Democratic Union (CDU) of Germany is Angela Merkel's party. She led it for 18 years before resigning last year as leader, but remaining as Chancellor of Germany until 2021. It is a party that has often held the reins of power in Germany, but has seen a steady decline in membership over the last 30 years. From a peak of nearly 800,000 in 1990, it is now down to around half that. According to figures on Wikipedia, in 2012, the members' average age was 59 years, and 6% of the Christian Democrats were under 30 years old. In other words, it is German's party of old fuddy-duddies. Against that historical background, the following passage from its "Digital Charter", agreed during its recent party conference, is noteworthy (original in German pdf):

The open and jointly developed standards of the Internet and open interfaces are the principles from which we advance the digitisation of Germany. It is only through openness that competition can be created; only through openness can new players in competition challenge the top dogs. This is why the following will apply to all (public) digitisation projects in Germany in the future: the awarding of contracts and funding will be subject to compliance with the principles of open source and open standards. Software financed by public funds should serve all citizens. In addition, free and open APIs should facilitate access for independent developments.

That's an impressive hit-rate for the "opens": openness, open interfaces, open source, open standards. Also thrown in for good measure is the idea that publicly-funded code should be available to everyone -- presumably as open source. Elsewhere in the document, the Digital Charter speaks approvingly of open data and open educational resources (OER), and promises to create an "open public repository" of re-usable digital components. On the downside, the document also includes the usual platitudes about blockchains, AI, 5G and "smart cities", as well as rolling out tired buzzwords such as "agility", "sandboxing" and "decentralization".

Nonetheless, the emphasis on openness in all its forms is striking and thoroughgoing. The Digital Charter may not commit the party to doing anything concrete very soon. But it's a clear and welcome sign that openness has entered the mainstream to such an extent that even the fuddy-duddies get it.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: angela merkel, cdu, germany, open, open interfaces, open source, open standards