How Long Before A Patent Kills A Hundred Million People?

from the is-this-really-wise? dept

Recent news that Angelina Jolie underwent a preventive double mastectomy because of her elevated risk of developing breast cancer has drawn attention to the Myriad Genetics case currently before the US Supreme Court, and to the whole area of gene patents. Myriad's monopoly has allowed it to set a high price for its tests -- $3000 -- and this is bound to have acted as a disincentive for those who were unable to afford such a sum. It is therefore quite likely that people have died as a result of Myriad's patents.

Here's another case where placing patenting above patients could lead to unnecessary deaths. It involves the SARS-like novel coronavirus that was first noted in Saudi Arabia, as this Reuters story explains:

The virus was identified in September last year, three months after a scientist took a sample from Saudi Arabia to the Erasmus Medical Center in the Netherlands.

"There was a lag of three months where we were not aware of the discovery of the virus," Saudi Arabia's Deputy Health Minister Ziad Memish told the Geneva meeting.

He said it was taken out of the country without permission and Saudi Arabia only learned of its discovery from ProMED, a U.S.-based internet-based reporting system.

The Rotterdam-based Erasmus lab then patented the process for synthesizing the virus, meaning that anyone else who wanted to use their method to study it would have to pay the lab.

The patenting had delayed the development of diagnostic kits and serologic tests for the disease, Memish said.

Fortunately, the virus does not seem to have spread widely during that three-month delay, but next time we might not be so lucky. It seems bordering suicidal that concerns about patenting should over-ride health concerns, especially when a viral pandemic could potentially kill a hundred million people, as it did in 1918. Let's hope that the Supreme Court recognizes this as yet another reason not to allow patents on genes, and that this becomes part of a broader move to share freely vital knowledge that can save lives and alleviate suffering around the world.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: gene patents, healthcare, netherlands, patents, saudi arabia

Dutch Law Would Authorize Police To Hack Into Foreign Computers And Phones: What Could Possibly Go Wrong?

from the thinking-it-through dept

When we wrote last year about a Dutch idea to give police there the power to break into computers -- even those located abroad -- we and many others pointed out a number of deep flaws with the plan. Undeterred, the Dutch government seems to be going ahead with the scheme, as Bits of Freedom explains:

The police should be allowed to hack into mobile phones and computers, even when these are located abroad. This is proposed by the Dutch government on May 2nd of 2013. While this appears to be a powerful asset for law enforcement, in reality it creates unnecessary vulnerabilities for citizens.

Not content with that really bad idea, there's a couple of others tacked on for good measure, as the BBC reports:

The bill would also make it a crime for a suspect to refuse to decipher encrypted files during a police investigation.

It is expected the draft legislation will be put to parliament by the end of the year.

The bill singles out child pornography and terrorism as two areas of special concern. The publication of stolen data would also become punishable.

It's easy to see how the last of those could be abused to silence inconvenient whistleblowers. Bits of Freedom sums up well the key danger with the bill:

other countries, such as China, will use the powers as a justification for their own activities. They will follow the Dutch example by allowing their police to use the same methods, including hacking abroad, in order to delete controversial data. Civilians will become the victims in an arms race between hacking governments.

Indeed, it's worth considering for a moment what the Chinese response will be when it finds Dutch police, with the full approval of the Dutch government, deleting files or installing spyware on computers on its territory. It won't matter if the latter were involved in breaking into Dutch systems, or controlling a global botnet: national pride will be at stake over what will effectively be an attack on Chinese citizens and property. So as not to lose "face", a robust response is guaranteed. Is the Netherlands (population 6,065,459 16,788,973) really ready to take on China (population 1,353,821,000) over this?

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: computers, hacking, law enforcement, netherlands, surveillance, unintended consequences

Dutch Parliament Member Fined For Hacking; He Says He Was Just Exposing Security Flaw

from the ethical-hacking-or-not dept

A few folks sent over this story of Dutch Member of Parliament (MP) Henk Krol being fined about $1,000 for "hacking." He claims that he was just exposing poor security on the part of a Dutch medical laboratory called "Diagnostics for You," which he felt was especially important since there are stricter privacy rules for medical info. Of course, "hacking" is used loosely here: basically, a patient overheard an employee at Diagnostics for You reveal the system password while he was in the lobby, and that patient passed the password along to Krol. So, the "flaw" could be as simple as a stupid employee revealing their password out loud (though, you could argue that a system like that should require two-factor authentication or some other more advanced security than a simple password).

Either way, the court recognized that Krol's intentions may have been in the right place, but faulted him for viewing and printing "more files than necessary" to make his point -- and also for going to the press with his findings at around the same time he notified the laboratory. The court said simply finding the flaw and even downloading some records to prove it to the lab would have been fine, but that he went too far (even if he carefully redacted personal info). And then going to the press immediately when the problem seemed to be more a case of a bad employee revealing their password, just seemed like too much. As the court noted: "the problem was not so acute that immediate use of media was necessary."

Of course, this kind of thing is often a struggle when it comes to security hacking. Different people have different opinions on whether or not it's appropriate to go to the press, and also how much information to access. But it seems to be handled on a case by case basis, rather than with clear rules. There are some norms among security researchers -- and that tends to include giving a company some period of time to fix things -- but this remains an area of the law that is sometimes a bit fuzzy. You want companies to respond quickly to security flaws, and sometimes going to the press ensures getting a real response faster. But, it also seems less likely to cause significant damage if you contact them first.

Perhaps MP Krol can now try to pass some legislation with standards on how to handle security breaches found without having them turn into legal cases against the researchers.

Filed Under: ethical hacking, hacking, henk krol, netherlands, security

Dutch Government Realizes That Non-Original Works Don't Deserve Copyright

from the about-time dept

For many years, we've discussed how Europe allows for a "database right" on collections of works, while the US forbids it. The US considers a database right improper, since copyright is not supposed to apply to facts and isn't supposed to be given out solely based on the "sweat of the brow," but rather to incentivize creativity. The Europeans, on the other hand, argued that the labor of putting together a database needed to be protected to create the necessary incentives for a thriving information/database industry. In many ways, this has created a useful natural experiment concerning copyright law and whether or not it actually creates incentives. The data has been overwhelming. Without a database right, the database industry in the US has thrived, while the same market in the EU has stagnated.

And yet, many in Europe (and some in the US) still see good things in such a government granted monopoly. We were just talking about how clinging to this outdated and clearly failed concept was now threatening important moves towards open data.

Thankfully, it appears that at least one European country has realized how damaging such rights are, and is moving in the other direction. The Dutch government, which has a number of politicians who really seem to get this stuff, is apparently trying to "modernize" its copyright law by removing protection for any "non-original" works such as databases. The link from the Future of Copyright site notes that the database right -- called "geschriftenbescherming" -- is being removed, as officials are noting that copyright should be focused on creativity, not merely protecting the upfront investments of publishers and printers:

The modernization of copyright law in the Netherlands will be done in two ways. Firstly, modern copyright will only serve to protect creative performances. Since ‘geschriftenbescherming’ does not cover any creative performance, this will now be removed. Secondly, the Dutch government believes copyright should not inadvertently preclude the creative reuse of existing material or the innovative use of information and easy exchange thereof. The protection of non-original works is often invoked to regulate parallel import instead of merely protecting the publisher’s or printer’s investment. By removing the additional protection under copyright law, the exchange and re-use of these works may be simplified. Also this could remove a legal barrier to the use of open data.

As noted in that last sentence, this story is almost the polar opposite to the one we just had about this same concept being used to hold back open data. This would be a nice step forward for the Dutch, and hopefully other European countries will quickly get with the program as well.

Update: In the comments someone points out that this is related to the EU Court of Justice ruling we wrote about last year, which noted that copyright rights need to include an element of creativity and that you can't just copyright facts.

Update 2: More information from the comments, which argues that, despite great similarities between the database right and geschriftenbescherming, this only impacts the latter not the former. The specific issue appears to be that geschriftenbescherming falls under copyright law and copyright law requires creativity (as noted in the story from last year). Yet database rights, fall under the database directive, and don't require any creativity (which is silly, for reasons we explained earlier). We apologize for any confusion and would like to thank the commenter for adding further details.

Filed Under: copyright, creativity, database rights, netherlands, non-creative works

Embedding And Linking Deemed Infringing In The Netherlands; Downloading... Not So Much

from the odd-choices dept

Here are two copyright stories coming out of the Netherlands, one good and one bad. The first is that the Dutch government has rejected an effort to make downloading copyrighted works for personal use infringement. There is, of course, an existing "you must be a criminal" tax on blank media there, which is part of the reason why such downloads are considered okay. Of course, now we only have to wonder how long it will be until the Netherlands shows up on the US's Special 301 report for "naughty" countries who don't follow Hollywood's extreme maximalist positions.

Of course, the entertainment industry may be much happier about a different copyright issue in the Netherlands. A court ruling in The Hague found that "embedding or linking to radio-streams without a license constitutes a violation of copyright." This is particularly crazy because it includes linking to a station's own stream. Yes, you read that right. This isn't talking about pointing to infringing streams, but to legitimate ones. And the court still found it to be infringing.

‘Nederland.fm’ embeds radio-streams from other (official) radio websites, while ‘Op.fm’ offers hyperlinks to those streams. Buma/Stemra argued that the websites enable users to listen to the music offered on the streams, and that this should be constituted as a ‘publication’ of the music to the public. The court followed this reasoning, primarily based on the fact that ‘Nederland.nl’ and ‘Op.nl’ not only offer streams or links, but they capture the consumer on their page, by playing the music within their own environment and because this environment, including ads, stays visible after clicking the links and buttons of radio stations.

That makes no sense at all. Just because someone makes money in some other manner doesn't mean they automatically owe money to someone else when they were using their legal streams. Unfortunately, we keep seeing wacky rulings like this around the globe that just muddy the picture when it comes to creating sensible copyright policies.

Filed Under: downloading, embedding, infringement, linking, netherlands

US Government Agencies Will Soon Be Able To Access Foreign Medical Dossiers Due To Patriot Act

from the radical-transparency dept

The US Patriot Act has suddenly scared an entire nation, and it's not the US itself this time. The Netherlands is currently going nuts about the US government being able to request medical details of all its citizens when the Dutch Electronic Patient Database (EPD) is implemented next month. This will not be the only country that freaks out because of the Patriot Act, as this sort of thing is likely to happen a lot more often. A recent study explained that US government agencies can secretly request anyone's data if they are using a cloud-computing service which 'conducts systematic business in the US'. It is already sufficient when the service provider is somehow a subsidiary of a US company.

That turns out to be a problem in the Netherlands, because the company that has developed the EPD and will be hosting the patients' data on its cloud computing systems is the US-based CSC. The Dutch government and the organization responsible for implementing the EPD are convinced there is no problem, because there are clear contracts which have assigned Dutch jurisdiction, and fortunately the Dutch have stringent data protection laws that will protect patients' sensitive data. Because that's what data protection laws do, right?

False! At least with regard to information law, researchers from Amsterdam University warn that this analysis is way too simplistic. According to the scholars, it is quite possible the US government agencies can circumvent data protection laws and could easily request access to medical information of every single person in the Netherlands. The study doesn't just cover the Netherlands (though it is especially timely for that), but rather looks at how these risks may apply more globally. Here are just a few of the findings that should raise eyebrows across the globe:

"When using a cloud service provider that is subject to U.S. jurisdiction, data may be requested directly from the company in question in the United States. […] From a legal point of view, access to such information cannot be denied and cloud service providers can give no guarantees in this respect. […] The possibility that foreign governments request information is a risk that cannot be eliminated by contractual guarantees. Nor do Dutch privacy laws offer any safeguards in this respect. […] It is a persistent misconception that U.S. jurisdiction does not apply if the data government requests for information do not apply to Dutch users of the cloud. […] legal protection under specific U.S. laws applies primarily to U.S. citizens and residents. […] Given the nature of intelligence work, it is not possible to gain insight into actual requests for information by the U.S. authorities […] Cloud providers will typically not be able to disclose whether such requests are made"

If the above doesn't yet lead to a new international outrage against the US Patriot Act, then the following sentence on the extra-territorial effects of the Patriot Act should at least send shivers down the spines of sovereignty-loving non-US government officials:

"The transition to cloud computing will, in principle, result in a lower degree of autonomy [...]"

Filed Under: europe, netherlands, patriot act, privacy

Skype Accused Of Handing Out Private Info To Private Company

from the massive-fail dept

Over the last year or so, there's been concern about Skype's commitment to privacy following its acquisition by Microsoft. Now a situation in the Netherlands is serving to renew those fears. As highlighted by Slashdot, it appears that Skype handed over information on a 16-year-old user to a private information technology firm that was investigating some denial of service attacks against PayPal.

The security firm, iSIGHT, was hired by PayPal to investigate the attacks, and an employee of the company reached out to Skype seeking information about one user who he thought might be involved. And Skype coughed up the info -- including username, real name, email address and home address -- no questions asked. As the article notes, there was no court order or anything like that. Just a guy from a private company asking and Skype said, "sure, here's all the info."

There are questions about whether this move violated some European privacy directives. At the very least it seems clear that it violated Skype's own policies, which include not providing customer data unless required by law, or if official law enforcement is involved. In this case, neither thing is true. One hopes that this is just a one-off mistake by Skype, but it's worrying nonetheless.

Filed Under: ddos, investigation, netherlands, private info
Companies: microsoft, paypal, skype

BREIN Scores Another Victory, Making It Suck Even More To Be A Dutch Internet Company

from the holy-secondary-liability dept

Torrentfreak reports on a really scary ruling coming out of the Netherlands, in which a court found hosting company XS Networks liable and ordered it to pay up because it hosted a torrent site. We've discussed issues of secondary liability, but this goes well beyond what we've seen elsewhere. As TorrentFreak explains, super-aggressive Dutch anti-piracy organization BREIN was trying to shut down the site SumoTorrent and get information about its operators. XS Networks, who briefly hosted the site, pointed out that it required a court order to turn over any info. This is a perfectly reasonable stance. However, it later backed down and reached an "agreement" with BREIN to hand over some info. By that time SumoTorrent had moved on to another host, and the info that XS Networks had to give to BREIN was incorrect or useless. BREIN then claimed that XS Networks was responsible for this situation and sued for damages.

This is the point that any reasonable court would laugh at BREIN and tell its boss Tim Kuik to learn a little something about suing the proper party, rather than a tool provider (especially one who simply asked for a court order before coughing up private info and who later was clearly willing to negotiate in good faith). Instead, the court went in the other direction, and said that SumoTorrent "is clearly facilitating copyright infringement" and that XS Networks should have magically known that to be the case, and shut the site down when BREIN first asked. Even if you're a copyright system supporter, this ruling should scare you. It takes away any sort of due process. Most reasonable people admit that whether or not a site is illegal should require at least a basic adversarial trial in which the site is able to make its case. But here the court ignores all of that, and the fact that it hadn't yet proved SumoTorrent guilty of infringement, and just insists that XS Networks should have magically accepted that BREIN must be right. Talk about a recipe for abuse by BREIN and other copyright holders.

If you're a hosting company in the Netherlands, your legal liability just shot way, way up. Apparently, if you don't magically kick off every site that might be enabling someone to break the law, you yourself may be liable for any illegal actions done on the site (even without such illegality ever being proved). That seems like a great recipe to get a bunch of Dutch hosting companies to reconsider even being in business.

Filed Under: hosting, liability, netherlands
Companies: brein, sumotorrent, xs networks

Dutch Propose Powers For Police To Break Into Computers, Install Spyware And Destroy Data -- Anywhere In The World

from the mutually-assured-destruction dept

Techdirt readers with long memories may recall a fantasy proposal from Orrin Hatch that would have seen technological means deployed to destroy the computers of those who downloaded unauthorized copies of files. Of course, the idea was so ridiculous it went nowhere. Now, nine years later, a similar idea has turned up, but with a rather better chance of being implemented, since it comes from a national government:

On 15 October, the Dutch ministry of Justice and Security proposed powers for the police to break into computers, install spyware, search computers and destroy data. These powers would extend to computers located outside the Netherlands.

The plan of allowing the police to break into domestic computers and install spyware is bad enough, as the German experience shows. There, it turned out that the malware employed had such serious flaws that anyone could take control of a machine infected with it. But the idea of giving Dutch investigators permission to break into computers anywhere in the world is even worse. The article from the digital rights group Bits of Freedom, quoted above, explains why:

If the Dutch government gets the power to break into foreign computers, this gives other governments the basis to break into Dutch computers which infringe the laws of their country. The end result could be less security for all computer users, instead of more. This is even more true with regard to the power to destroy data on foreign computers; it is likely that other governments would be very interested in using such a power against Dutch interests.

Even totally law-abiding users might be caught up in this digital war:

Furthermore, providing the government the power to break into computers provides a perverse incentive to keep information security weak. Millions of computers could remain badly secured because the government does not have an incentive to publish vulnerabilities quickly because it needs to exploit these vulnerabilities for enforcement purposes.

It's not really down to governments to publish details of flaws, but it's possible they might be less inclined to encourage the public to patch them, if they want to use the vulnerabilities themselves. This would doubtless lead to criminals taking advantage of widespread holes in security, with personal data being stolen, and financial systems compromised.

All-in-all, the Dutch proposal has to be one of the most foolish ever presented by a government in this area, and shows the folly of trying to come up with quick fixes for the currently-fashionable issue of "cybercrime", instead of really thinking through the consequences. Let's hope calmer heads prevail, and the proposal is withdrawn.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: computers, netherlands, security, spyware, surveillance

Absurdity Of Copyright Policy Leaves Dutch Supreme Court Confused

from the sidestep-and-postpone dept

The Dutch Supreme Court (Hoge Raad) has posed some pre-judicial questions to the Court of Justice of the EU regarding the home-copying exception in European copyright legislation -- raising significant questions about what is legal under EU rules and how it meshes with how people actually consume music. Of course, all it really seems to demonstrate is just how messy the copyright system is today. When the top judges of a country cannot figure out the seemingly simple question of whether downloading music and films is legal or not -- mainly due to a huge patchwork of amendments to copyright law over the years -- something needs to change. Drastically. Let's see if we can make some sense of it:

In essence, the home-copying exception allows people to make copies for non-commercial home uses. Such an exception makes a lot of sense, because these private copies are largely impossible to enforce anyway. A levy is imposed on manufacturers of blank media to compensate rights holders for the supposed "losses" from foregone license fees.

The case in question concerns a group of these blank media manufacturers, who refuse to pay the full levies imposed by the collecting society in charge of the compensation for the home-copying exception. The collecting society considers it fair to charge for "losses" that stem from people downloading unauthorized uploads. You see, in the Dutch system, there is a chicken and the egg problem where you may download copyright protected content, but you may not upload (not unlike its policy for marijuana where buying and selling is tolerated, but growing is not). Any uploaded material is therefore often considered to stem from an illegal source. There is a huge political debate about the desirability of this construction in the Parliament.

The Netherlands is one of the few countries that has a system like this, where the end-user is partly taken out of the equation for copyright infringement. This is due to a particularity in European copyright, which is a headache to comprehend, but necessary to understand the confusion of the Court. Here’s a quick summary:

The EU legislator adopted the so called "Copyright in the Information Society" Directive in the year 2001, which was supposed to "adapt legislation on copyright and related rights to reflect technological developments" and make sure all 27 copyright systems in the EU would become more or less uniform. The hope was that this would knock out some of the problems of very different systems, and create a better "single market" for European content.

Of course, no copyright law is complete without the important exceptions and limitations, like the fair-use doctrine in the US. However, in the case of the copyright directive, the exceptions and limitations were optional for Member States, thereby effectively eliminating any chance for a uniform (or "harmonized") copyright legislation in the EU and thus missing the point completely. Information activist Smari McCarthy explains the resulting chaos well:

The directive outlines 21 different optional exceptions or limitations to the right of reproduction of copyrighted works. Each country implementing the directive can choose to either include or leave out the exception clause. This gives us 2,097,152 different ways to implement the directive.

Now repeat this for the 27 Member States, and you see where this fragmentation exercise is going. Since only a few countries have also implemented this home-copying exception and there has not yet been a legal conflict about it, no jurisprudence exists on which the Dutch court can rely. The exception reads as follows:

Member States may provide for exceptions or limitations to the reproduction right provided for in Article 2 in the following cases: [...]

[...] in respect of reproductions on any medium made by a natural person for private use and for ends that are neither directly nor indirectly commercial, on condition that the rightholders receive fair compensation which takes account of the application or non-application of technological measures referred to in Article 6 to the work or subject matter concerned;

As you see, this text does not include any information on whether the fair compensation should be based on only foregone license fees (implying only copies from legal sources), or whether all copying on blank media carriers should be included.

When the collecting society proposed to start charging for copies from illegal sources in 2008, the manufacturers of blank media went to court hoping for a ruling that levies should only be payable for copies which are allowed under the copyright directive, thus only from legal sources (as this would decrease the levy significantly).

If you read through the lines of the courts’ analysis (and if you understand Dutch), I think you can see quite clearly that the judges tried their utmost to find a way to reconcile this copyright exception with the way people share and use works online. The Court states it would like to give rights holders a fair compensation via a levy system for losses from piracy, but it is unsure if EU law allows this. In its questions, the Court proposes some ways of establishing the mechanism for fair compensation and asks the European court whether this would be permissible under law. The questions asked by the Court are rather technical in nature, but here’s a quick summary of the main points (my interpretation, not a literal translation!):

1. Can the home-copying exception be interpreted so that the exception applies to all copies, regardless of whether the original was an authorized source? Or does the exception only apply to copies, which are derived from an original, which does not infringe copyright itself?
2a. Can the three-step test be used to expand the scope of the exception to include all copies?
2b. Is the Dutch construct – where downloading from any source is legal – in conflict with EU law? Would it help to mention that feasible technical tools to counter the making of private copies is not yet available, which may influence your decision regarding the three-step test? [...]

Dutch internet lawyer Christiaan Alberdingk Thijm is confused about the Courts’ deliberations:

I find it remarkable that Court contemplates a compensation paid for downloading copyright protected works from an illegal source, but that this does entail that the act of copying of this content is permissible under law. In my opinion, there are simply just two options: either it is permissible to make private copies from an illegal source and we pay the levy, or it is illegal and we don’t pay the levy. I do not agree with the current system either, though, where downloading from illegal sources is permissible but no levies are charged over this.

The court misses some important points here, indeed. First, if people are paying levies for unauthorized downloads, society will perceive their actions to be justified. Second, people mainly use phones, computers and portable devices for music and films. Hardly anyone uses blank media any more. Therefore, levies on CD’s, for example, miss the objective. Third, if a levy is imposed, we get into the sticky situation where actual losses from downloading unauthorized content needs to be determined, which is a seemingly impossible task. Finally, the Court may not have been informed about this, but there’s been a fierce quarrel on the amount charged for levies at the EU level, which has raged on for the past 15 to 20 years. Recently a mediator had to be hired to find a way out of this mess.

Apart from total confusion about the copyright system and how it should be applied to the internet, the Court may have also chosen to sidestep the current and hostile politicized debate in the Netherlands, which was met with opposition from many sectors of society. The Court has not given a conclusive ruling in this debate, so now the European Court may rule on whether the Dutch construction is legal. Expect an update in a few years time!

Filed Under: blank media, copyright, eu, eu court of justice, exceptions, levies, netherlands