Norwegian Security Service Wants Details Of Citizens' Web Comments Retained For Six Months

from the anything-else? dept

Governments around the world are seeking to monitor more and more of their citizens' online activities -- and it's not just the most obviously repressive regimes doing this. In the US, there is CISPA, while the UK is drawing up the Communications Capability Development Programme. Thomas Steen alerts us to a further escalation of this desire to spy on the public, in Norway. The secret service there (known by the acronym PST) want details about comments posted on all Web sites retained (via Google Translate):

"This will make it possible to identify which IP address to publish a given post at a particular time," writes PST letter also signed the acting chief Roger Berg.

The current requirement is to store information detailing where, when, how and with whom Norwegians communicate using the phone, mobile or e-mail. The latest proposal would be a major extension to that, since it would require data about highly personal content to be stored. Here's how the PST would access that information:

If it becomes subject to compulsory saving for six months, it will mean that the district court, upon request from the PST, may require that those who have online discussion must submit the information about who wrote a given post and when it was done.

In addition, prosecutors called a "rush of competence" in cases where data is needed very quickly. Then the police and PST require data directly from the supplier, but as the court approve it afterwards.

Aside from that retrospective approval for data grabs, the other worrying aspect of this proposal from the Norwegian secret service is that, if implemented, it would establish a precedent that other countries may seek to follow.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: comments, ip address, monitoring, norway

Swedish Film Institute Learning That An IP Address Is Not A Person

from the lessons-learned dept

Earlier this month, an anti-piracy tracking company traced the origin of some Swedish films found on The Pirate Bay... all the way back to the Swedish Film Institute. After some embarrassment and further investigation, the Institute is now insisting that it can't find any evidence that someone there leaked the films... and they're complaining that the anti-piracy firm DoubleTrace "aren’t... forthcoming with their evidence." Shocking, I'm sure. But the larger point is that the Swedish Film Institute is pointing out that the IP address alone does not identify the user. This is, of course, entirely true. It's what tons of people have been pointing out for years, and what the film industry (and the recording industry) has often mocked as being a silly excuse. So I'm in agreement with TorrentFreak when it says:

The important thing here is that when it comes to the allegations against SFI, and the refusal of the anti-piracy company to make their ‘evidence’ available, SFI should be given the benefit of the doubt.

But, unlike the hundreds of thousands of other ISP account holders around the world who receive letters claiming that they illegally uploaded a movie or song and therefore should pay compensation or, increasingly, be disconnected from the Internet, they are treated more respectfully, quite simply because of who they are.

An IP address is not a person, and unless anti-piracy companies want to let their ‘evidence’ be seen and tested in public, perhaps it’s better if they keep their allegations to themselves.

Filed Under: copyright, evidence, file sharing, ip address, sweden
Companies: swedish film institute

ICE Screws Up, Seizes Tor Exit Node; Vows Not to Learn From Its Mistake

from the these-people-protect-us? dept

Given the various domain seizures and other efforts by ICE to act as Hollywood's personal police force, it long ago became clear that they're not particularly technically competent. As if to demonstrate how technically illiterate they are, ICE recently seized six computer hard drives from the home of Nolan King as part of a criminal investigation. ICE's evidence in getting a warrant? Solely an IP address. Yet, as the EFF notes in the link above, if ICE were even mildly technically competent, it would have been able to tell before it seized the machines that King was running a Tor exit node, and thus was not the person connected to the IP (nor could he say who was).

We've seen this before. Earlier this year we wrote about law enforcement in Europe being equally confused by a Tor exit node.

Of course, some people will claim that this is "the price you pay" for running a Tor exit node. In fact, after the EFF gave ICE agents basic remedial training in how the internet works, it returned King's hard drives, but told him "this could happen again." Sure, it could. But it shouldn't. The fact that law enforcement is clueless over the fact that an IP address is not a unique identifier, and yet seems to rely on it as if it does, shouldn't place more of a burden on users. It should indicate that law enforcement should be required to do more than simply identify an IP address.

An IP address alone is not probable cause that a person has committed a crime. Furthermore, search warrants executed solely on the basis of IP addresses have a significant likelihood of wasting officers' time and resources rather than producing helpful leads.

In the case of Tor, the police can avoid mistakenly pursuing exit relay operators by checking the IP addresses that emerge in their investigations against publicly available lists of exit relays published on the Tor Project's web site. The ExoneraTor is another tool that allows anyone to quickly and easily see whether a Tor exit relay was likely to have been running at a particular IP address during a given date and time. The Tor Project can also help law enforcement agencies set up their own systems to query IP addresses easily. These simple checks will help officers concentrate their investigative resources on tracking down those actually committing crimes and ensure that they don't execute search warrants at innocent people's homes.

Filed Under: evidence, exit node, ice, ip address, tor

Motion To Quash Against Copyright Troll Explains How IP Address Does Not ID User

from the will-it-work? dept

That Anonymous Coward alerts us to a recently filed "motion to quash" (pdf) one of the many subpoenas that copyright troll lawyer John Steele has been trying to get courts to issue. After running into trouble convincing judges in his home state of Illinois, it appears that Steele has branched out. This latest involves a lawsuit filed in the Northern District of California, where (unfortunately) Magistrate Judge Howard Lloyd went ahead and allowed early discovery and the issuance of subpoenas. While this is standard in many cases, more and more courts have begun realizing it is not appropriate in these copyright trolling cases where the sole purpose is to identify users to try to pressure them into settling.

While there have certainly been many motions to quash, this one made some particularly good points that seemed worth highlighting. First, it explains that IP addresses are not like fingerprints and do not identify a user (my emphasis):

The Third Degree Films complaint and ex parte request for expedited discovery form yet another in a wave of suits in which copyright infringement plaintiffs seek to “tag” a defendant based solely on an IP address. However, an IP address is not equivalent to a person or entity. It is not a fingerprint or DNA evidence – indeed, far from it. In a remarkably similar case in which an adult entertainment content producer also sought expedited discovery to learn the identity of persons associated with IP addresses, United States District Judge Harold Baker of the Central District of Illinois denied a motion for expedited discovery and reconsideration, holding that, “IP subscribers are not necessarily copyright infringers…The infringer might be the subscriber, someone in the subscriber’s household, a visitor with her laptop, a neighbor, or someone parked on the street at any given moment.” Order of Apr. 29, 2011, VPR Internationale v. DOES 1-1017, No. 2:11-cv-02068 (Central District of Illinois) (Judge Harold A. Baker) [hereinafter VPR Internationale Order], attached hereto as Exhibit C. The point so aptly made by Judge Baker is that there may or may not be a correlation between the individual subscriber, the IP address, and the infringing activity. Id. The risk of false identification by ISPs based on internet protocol addresses is vividly illustrated by Judge Baker when he describes a raid by federal agents on a home allegedly linked to downloaded child pornography. The identity and location of the subscriber were provided by the ISP (in the same fashion as Plaintiff seeks to extract such information from Wide Open West.) After the raid revealed no pornography on the family computers, federal agents eventually learned they raided the wrong home. The downloads of pornographic material were traced to a neighbor who had used multiple IP subscribers’ Wi-Fi connections. Id. This risk of false identification and false accusations through disclosure of identities of internet subscribers is also presented here. Given the nature of the allegations and the material in question, should this Court force Wide Open West to turn over the requested information, DOE No. 605 would suffer a reputational injury.

Separately, it notes that those using these tactics are using high pressure efforts to get people to pay up to settle:

If the mere act of having an internet address can link a subscriber to copyright infringement suits, internet subscribers such as DOE No. 605 will face untold reputational injury, harassment, and embarrassment. The reputational risk that Judge Baker found to be an undue burden is equally presented here: “[W]hether you’re guilty or not, you look like a suspect.” Id. at 3. Moreover, this case presents the same extortion risk that so concerned Judge Baker:

“Could expedited discovery be used to wrest quick settlements, even from people who have done nothing wrong? The embarrassment of public exposure might be too great, the legal system too daunting and expensive, for some to ask whether VPR has competent evidence to prove its case.”

Id. Discovery is not a game. Yet, plaintiffs in these types of cases use discovery to extort settlements from anonymous defendants who wish to avoid the embarrassment of being publicly associated with this type of allegation. Id. Such abuse of the discovery process cannot be allowed to continue.

From there, it argues that since an IP address does not identify the user, the subpoena itself is invalid:

Additionally, this subpoena should not have been issued in the first place because the information sought is not relevant to Plaintiff’s allegations. Implicit in the rule granting subpoena power is a requirement that the subpoena seeks relevant information. See Syposs v. United States, 181 F.R.D. 224, 226 (W.D.N.Y. 1998)(“the reach of a subpoena issued pursuant to [FED. R. CIV. P. 45] is subject to the general relevancy standard applicable to discovery under [FED. R. CIV. P. 26(b)(1)].”). The information linked to an IP address cannot give you the identity of the infringer. VPR Internationale Order, at 2. Because the infringer could have been anybody with a laptop passing within range of the router, the information sought by Plaintiff is not relevant to the allegations in any way. Id. Moreover, even if the information has some small amount of relevance to the claim—which it does not—discovery requests cannot be granted if the quantum of relevance is outweighed by the quantum of burden to the defendant. FED. R. CIV. P. 26(b)(2)(C)(iii). Plaintiff’s request fails that balancing test. Given that DOE No. 605 was only one of many persons who could have used the IP address in question, the quantum of relevance is miniscule at best. However, as discussed above, the burden to DOE No. 605 is severe. The lack of relevance on the one hand, measured against the severe burden of risking a significant reputational injury on the other, means that this subpoena fails the Rule 26 balancing test. Id. Plaintiff’s request for information is an unjustified fishing expedition that will cause reputational injury, prejudice, and undue burden to DOE No. 605 if allowed to proceed. Good cause exists to quash the subpoena served on Wide Open West to compel the disclosure of the name, address, telephone number and e-mail address of DOE No. 605."

Nice to see more people fighting back against obvious fishing expeditions. Hopefully more judges start realizing what these kinds of requests are really about.

Filed Under: copyright, id, ip address, trolls

French Court Says IP Address Does Not Identify A User

from the but-is-that-good-or-bad dept

Michael Scott points us to the news that a French court has ruled that an IP address is not enough to identify a single individual. Now, obviously, many of us agree with this general point, and we've brought that up time and time again in the past when lawsuits insisted that a single IP address was enough to identify a user. And, given that France now has its three strikes law which will be based in large part on entertainment companies indicating a single IP address as evidence of infringement, this might seem like a good ruling. But in this case, there's another side to it which is important. The reason why the court ruled that an IP address doesn't identify an individual, is to say that it is not a privacy violation to get someone's IP address.

This isn't a new issue. We discussed a similar case before, and I actually think, on the whole, it's correct. An IP address shouldn't be considered private information directly, since it doesn't identify a individual and you effectively have to give it out just to use the internet. But for people who argue that revealing IP addresses is a violation of confidential information, they might not like this ruling very much. On the whole, though, I think in the long run it's better to have a world where the courts recognize that an IP address does not identify a user, even if it means that IP addresses aren't considered private info.

Filed Under: france, ip address, privacy

Norway Decides Privacy Is More Important Than Protecting The Entertainment Industry's Business Model

from the good-for-them dept

It appears that Norway has decided that it's sick of passing laws designed to prop up obsolete industry business models at the expense of individual privacy. First, the country started telling ISPs to delete log files after just three weeks (making it pretty hard to identify individual filesharers), and now it's refused to renew the license given to the one law firm allowed to sniff IP addresses in trying to seek out unauthorized file sharing. Apparently there's been a bit of a debate about the license, with concerns about potential privacy violations. I have to admit that I'm not sure this makes much sense to me. I still have trouble understanding the European point of view that an IP address -- which your computer more or less needs to share publicly with other computers is somehow "private information." However, that's the way many European countries view it, and so such snooping is a potential privacy violation. Effectively, the country has decided that privacy rights are more important than the entertainment industry's old business model.

Filed Under: business model, ip address, norway, privacy

German Court Rules That IP Addresses Are Not Personal Info

from the it's-just-business dept

There's been an ongoing discussion in Europe as to whether or not IP addresses should be considered personal info. The implications have a lot to do with how companies deal with your IP address. If it is considered private info, then they are quite limited in what they can do with it. If it's not, then it opens up ISPs to being required to store your IP addresses in log files that they may be required to keep. As we noted when this debate first heated up, the entire argument is a little misleading, as it sets up a false scenario. Lots of your info is private in some scenarios and public in others. You give out your name freely in some cases, but in others might not want it known. Your IP address is, by default, "public" in that you have to display it to computers you connect to in order to do anything online.

A German court has now ruled that IP addresses should not be considered personal info, and thus can be stored without problem by ISPs. In this case, an individual had sued, claiming that sites that kept log files were violating his privacy, but that would be like saying a store that videotaped you entering their premises violated your privacy. Putting yourself out in public means you're out in public, even if it's online. In this case, it sounds like the court got it right.

Filed Under: germany, ip address, personal info, private info

Turns Out Viacom Is Really Interested In What Google Employees Are Uploading/Viewing On YouTube

from the Google-janitors-are-supposed-to-know-copyright-laws dept

With all the fuss over a court telling Google it needs to give Viacom its log files, Google and Viacom have been discussing ways to hand over the data and retain anonymity (not an easy task). However, apparently one key point is that Viacom is most interested in finding out what Google employees were uploading and viewing on YouTube. That's an interesting, if sneaky, strategy, as in theory Viacom could use that to try to prove that Google employees "knew" that certain content was infringing, which potentially could remove some DMCA safe harbors. However, that would be a huge stretch in terms of the meaning of the law. If anything, this move shows how much Viacom's case appears to be based on grasping at straws. If the best it can do is try to show that some Google employees viewed or uploaded infringing material, that's a pretty weak case -- rather than focusing on the fundamental issue of how much responsibility Google has over the content users upload.

Filed Under: copyright, dmca, employees, ip address, privacy, usernames
Companies: google, viacom, youtube

Italy Says P2P Monitoring Firm Broke The Law -- But This Might Not Be A Good Thing

from the there-goes-that-evidence dept

There have been various accusations in the US that the techniques used by various P2P monitoring firms that the entertainment industry uses are an "illegal investigation." While we're still waiting to see the outcome of such cases, over in Italy, the government organization in charge of privacy has determined that, indeed, the efforts to monitor P2P use violates local privacy laws. This comes just a few months after a similar finding in Switzerland. With the EU recently saying that IP addresses are private information, you can see why these types of rulings are coming through.

While I will argue vehemently over the fact that the entertainment industry's tactics are wrong, short-sighted and unfair to many of the people it accuses of copyright infringement, I'm not so sure that merely collecting information that someone's computer broadcasts about themselves should be considered a violation of privacy. I do agree that ISPs shouldn't just hand over data on who's account is attached to a certain IP address (that's a privacy violation. But, to simply collect the data, which is publicly "broadcast" by the user, hardly seems like a privacy violation. There are plenty of arguments against the entertainment industry's tactics -- but you get into dangerous territory when you start declaring publicly broadcast information as somehow "private." While it may be appealing in that it makes life more difficult for short-sighted entertainment industry execs hellbent on suing customers, the unintended consequences of such things could be dire. It raises serious questions about how other types of publicly broadcast info may be judged later.

Filed Under: ip address, italy, monitoring, p2p, privacy

Wrong IP Address Puts Man In Prison For 50 Days

from the sorry-about-that dept

As many companies would still like to believe that an IP address is all you need to identify a person using a computer, it's worth remembering that not only does an IP address not definitively identify who was using a computer, but it can easily get mixed up. A year ago, we had the story of someone whose house got incorrectly raided (by Shaquille O'Neal, for some unexplained reason) for child porn after an ISP gave investigators the wrong IP address info. It sounds like something similar has happened in India, where a man spent 50 days in prison for posting insulting pictures to Orkut. The only problem was that the guy had nothing to do with it. His ISP handed over the wrong information. This was only discovered once police found and arrested the people who actually uploaded the image. We won't even get into the question of why people are being arrested for uploading insulting photos, but this should serve as a warning to anyone who thinks that relying on an IP address as the sole piece of evidence is reasonable.

Filed Under: ip address
Companies: airtel, google