What Are The Ethical Issues Of Google -- Or Anyone Else -- Conducting AI Research In China?

from the don't-be-evil,-but-AI-first? dept

AI is hot, and nowhere more so than in China:

The present global verve about artificial intelligence (AI) and machine learning technologies has resonated in China as much as anywhere on earth. With the State Council’s issuance of the "New Generation Artificial Intelligence Development Plan" on July 20 [2017], China's government set out an ambitious roadmap including targets through 2030. Meanwhile, in China's leading cities, flashy conferences on AI have become commonplace. It seems every mid-sized tech company wants to show off its self-driving car efforts, while numerous financial tech start-ups tout an AI-driven approach. Chatbot startups clog investors' date books, and Shanghai metro ads pitch AI-taught English language learning.

That's from a detailed analysis of China's new AI strategy document, produced by New America, which includes a full translation of the development plan. Part of AI's hotness is driven by all the usual Internet giants piling in with lots of money to attract the best researchers from around the world. One of the companies that is betting on AI in a big way is Google. Here's what Sundar Pichai wrote in his 2016 Founders' Letter:

Looking to the future, the next big step will be for the very concept of the "device" to fade away. Over time, the computer itself -- whatever its form factor -- will be an intelligent assistant helping you through your day. We will move from mobile first to an AI first world.

Given that emphasis, and the rise of China as a hotbed of AI activity, the announcement in December last year that Google was opening an AI lab in China made a lot of sense:

This Center joins other AI research groups we have all over the world, including in New York, Toronto, London and Zurich, all contributing towards the same goal of finding ways to make AI work better for everyone.

Focused on basic AI research, the Center will consist of a team of AI researchers in Beijing, supported by Google China's strong engineering teams.

So far, so obvious. But an interesting article on the Macro Polo site points out that there's a problem with AI research in China. It flows from the continuing roll-out of intrusive surveillance technologies there, as Techdirt has discussed in numerous posts. The issue is this:

Many, though not all, of these new surveillance technologies are powered by AI. Recent advances in AI have given computers superhuman pattern-recognition skills: the ability to spot correlations within oceans of digital data, and make predictions based on those correlations. It's a highly versatile skill that can be put to use diagnosing diseases, driving cars, predicting consumer behavior, or recognizing the face of a dissident captured by a city's omnipresent surveillance cameras. The Chinese government is going for all of the above, making AI core to its mission of upgrading the economy, broadening access to public goods, and maintaining political control.

As the Macro Polo article notes, Google is unlikely to allow any of its AI products or technologies to be sold directly to the authorities for surveillance purposes. But there are plenty of other ways in which advances in AI produced at Google's new lab could end up making life for Chinese dissidents, and for ordinary citizens in Xinjiang and Tibet, much, much worse. For example, the fierce competition for AI experts is likely to see Google's Beijing engineers headhunted by local Chinese companies, where knowledge can and will flow unimpeded to government departments. Although arguably Chinese researchers elsewhere -- in the US or Europe, for example -- might also return home, taking their expertise with them, there's no doubt that the barriers to doing so are higher in that case.

So does that mean that Google is wrong to open up a lab in Beijing, when it could simply have expanded its existing AI teams elsewhere? Is this another step toward re-entering China after it shut down operations there in 2010 over the authorities' insistence that it should censor its search results -- which, to its credit, Google refused to do? "AI first" is all very well, but where does "Don't be evil" fit into that?

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: ai, artificial intelligence, china, research
Companies: google

Study Suggests Shutting Down Filesharing Sites Would Hurt Music Industry, New Artists

from the you-don't-say dept

The evolution of the music industry's response to the fact that copyright infringement exists on the internet has been both plodding and frustrating. The industry, which has gone through stages including a focus on high-profile and punitive lawsuits against individual "pirates", its own flavors of copyright trolling, and misguided attempts to "educate" the masses as to why their natural inclinations are the worst behavior ever, have since settled into a mantra that site-blocking censorship of the internet is the only real way to keep the music industry profitable. All of this stems from a myopic view on piracy held by the industry that it is always bad for every artist any time a music file is downloaded for free as opposed to purchased off of iTunes or wherever. We have argued for years that this view is plainly wrong and far too simplistic, and that there is actually plenty of evidence that, for a large portion of the music industry, piracy may actually be a good thing.

Well, there has been an update to a study first publicized as a work in progress several years ago run by the Information Economics and Policy Journal out of Queen's University. Based on that study, it looks like attempts to shut down filesharing sites would not just be ineffectual, but disastrous for both the music industry as a whole and especially new and smaller-ticket artists. The most popular artists, on the other hand, tend to be more hurt by piracy than helped. That isn't to be ignored, but we must keep in mind that the purpose of copyright law is to get more art created for the benefit of the public and it seems obvious that the public most benefits from a larger successful music ecosystem as opposed to simply getting more albums from the largest audiences.

The methodology in the study isn't small peanuts, either. It considered 250,000 albums across five million downloads and looked to match up the pirating of those works and what effect that piracy had in the market for that music.

“I now find that top artists are harmed and mid-tier artists may be helped in both markets, but that these effects are larger for digital sales,” Lee tells TorrentFreak. “This is consistent with the idea that people are more willing to switch between digital piracy and digital sales than between digital piracy and physical CDs.”

The findings lead to the conclusion that there is no ideal ‘one-size-fits-all’ response to piracy. In fact, some unauthorized sharing may be a good thing.

This is in line with observations from musicians themselves over the past years. Several top artists have admitted the positive effects of piracy, including Ed Sheeran, who recently said that he owes his career to it.

None of this is to argue that piracy is always a net benefit, obviously. Such an argument would be the counterargument to the music industry's description of piracy as always bad, all the time, for everyone. And it would be equally fallacious. What this study chiefly points out is exactly what the conclusion above states: there is no one-size fits all truth on the effect of piracy for artists. It helps some, it hurts others.

While we shouldn't take the negative impact on artists it may hurt lightly, remember that this is all framed by a music industry regularly calling for the blocking of filesharing sites. That really is a one size fits all "solution" to piracy and, based on this study, it would hurt many, many musical acts.

According to the researcher, the music industry should realize that shutting down pirate sites may not always be the best option. On the contrary, file-sharing sites may be useful as promotional platforms in some cases.

“Following above, a policy of total shutdown of private file sharing networks seems excessively costly (compared with their relatively small impact on sales) and unwise (as a one-size-fits-all policy). It would be better to make legal consumption more convenient, reducing the demand for piracy as an alternative to purchasing,” Lee tells us. “It would also be smart to experiment with releasing music onto piracy networks themselves, especially for up-and-coming artists, similar to the free promotion afforded by commercial radio.”

The pain here is in how obvious it all is. We've been saying exactly this for years, except the proposed solutions from the music industry have only grown more drastic in that same time. Flat censorship is something of a nuclear option and it's being used against sites that actually help some percentage of artists.

How in the world is that the best plan for a thriving music ecosystem?

Filed Under: censorship, copyright, infringement, musicians, piracy, research, site blocking, studies

Danish University And Industry Work Together On Open Science Platform Whose Results Will All Be Patent-Free

from the they-said-it-couldn't-be-done dept

Here on Techdirt, we write a lot about patents. Mostly, it's about their huge downsides -- the stupid patents that should never have been awarded, or the parasitic patent trolls that feed off companies doing innovative work. The obvious solution is to get rid of patents, but the idea is always met with howls of derision, as if the entire system of today's research and development would collapse, and a new dark age would be upon us. It's hard to refute that claim with evidence to the contrary because most people -- other than a few brave souls like Elon Musk -- are reluctant to find out what happens if they don't cling to patents. Against that background, it's great to see Aarhus University in Denmark announce a new open science initiative that will eschew patents on researchers' work completely:

The platform has been established with funds from the Danish Industry Foundation and it combines basic research with industrial innovation in a completely new way, ensuring that industry and the universities get greater benefit from each other's knowledge and technology.

University researchers and companies collaborate across the board to create fundamental new knowledge that is constantly made available to everyone -- and which nobody may patent. On the contrary, everyone is subsequently freely able to use the knowledge to develop and patent their own unique products.

According to Aarhus University, Danish industry loves it:

The idea of collaborating in such a patent-free zone has aroused enormous interest in industry and among companies that otherwise use considerable resources on protecting their intellectual property rights.

The attraction seems to be that an open platform will make it easier for companies -- particularly smaller ones -- to gain access to innovative technologies at an early stage, without needing to worry about patents and licensing. Aarhus University hopes that the approach will also allow researchers to take greater risks with their work, rather than sticking with safer, less ambitious projects, as has happened in the past. The first example is already up and running. It is called SPOMAN (Smart Polymer Materials and Nano-Composites), and has a project page hosted on the Open Science Framework site:

In this project, you will find minutes from the Open Science meetings, current status of the initiative, general presentations etc. More importantly, this project has links to the individual activities and research projects under Open Science. In these projects, the research progress, lab journals and more are found.

Combined with the no-patent promise, you don't get much more open than that.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: denmark, open access, open science, patent free, research
Companies: aarhus university, danish industry foundation

There Is Simply No Scientific Backing For TSA's Behavioral Detection Program

from the hearsay-isn't-evidence dept

The Government Accountability Office has taken a run at the TSA's Behavioral Detection program in the past. Its findings were far from complimentary. Specially-trained "Behavior Detection Officers" (BDOs) were basically human coin flips. Deciding whether or not someone was a threat came down to a lot of subjective readings of human behavior, rather than proven principles.

In response to this report, the TSA started trimming back the number of BDOs it deployed, converting about 500 of them back into regular TSA officers. But the TSA still believed there was something to its pseudoscience patchwork, so it's still sending out 2,600 BDOs to covertly stare at travelers' throats and eyes (no, really) until terrorism reveals itself.

The GAO's second report focuses on the TSA's stubborn insistence that the Behavior Detection program is worth what we're paying for it. It has made claims to oversight that this program is scientifically-backed and scientifically-based. The GAO's investigation [PDF] finds almost nothing that backs these assertions.

We reviewed and categorized all 178 sources that, as of April 2017, TSA cited as providing support for specific indicators in its revised list of behavioral indicators to identify the extent to which they present valid evidence. We defined valid evidence as original research that meets generally accepted research standards and presents evidence that is applicable in supporting TSA’s specific behavioral indicators.

[...]

Of the 178 total sources TSA cited, we determined that 137 are news or opinion sources, and we took no further action because these do not meet our definition of valid evidence. We determined that 21 of the 178 sources are reviews of studies— sources that rely on the source author’s assertion of support for the indicator rather than original analysis, methods, or data that can be independently used as valid evidence.

Of the 178 sources cited by the TSA (with great confidence, one imagines), only 20 met the GAO's definition of valid evidence.

The TSA claims its BDOs have the ability to sniff out terrorism by looking for behavioral indicators. There are long lists of indicators to look for but, again, the TSA has nothing in the way of evidence to back these up.

In our review of all 178 sources TSA cited in support of its revised list, we found that 98 percent (175 of 178) of the sources do not provide valid evidence applicable to the specific indicators that TSA identified them as supporting. In total, we found that TSA does not have valid evidence to support 28 of its 36 revised behavioral indicators, has one source of valid evidence to support each of 7 indicators, and has 2 sources of valid evidence to support 1 indicator.

In fact, it appears the TSA may just be Googling for indicators, as its supporting "evidence" is extremely scattershot.

For example, among other sources, TSA cited four separate news articles that provide eyewitness accounts of a single 2005 suicide bombing incident at an Israeli bus station as support for 2 behavioral indicators. In another example, TSA cited a 2004 newsletter published by the New Hampshire Police Standards and Training Council as support for 11 behavioral indicators.

A partial snapshot of the chart created by the GAO shows the utter failure of the TSA's behavioral "science."

The individual breakdown of the scientific "support" for behavioral indicators is even more damning.

As a result of our analysis, we determined that TSA does not have valid evidence supporting 28 of its 36 revised behavioral indicators. Specifically, every source TSA cited in support of these 28 indicators is a news or opinion source, a review of studies source, or an original research source that either does not meet generally accepted research standards or is not applicable to the behavioral indicator it was provided to support. For example, TSA cited 105 sources to support the use of indicator number 11, which involves BDOs identifying individuals who seem to be attempting to conceal their normal appearance. However, we found that none of the 105 sources present original research that meets generally accepted research standards. In another example, TSA cited 63 sources to support the use of indicator number 5, which involves BDOs identifying individuals who seem to be sweating heavily. While we found that one of the 63 sources cited is original research that meets generally accepted research standards, we also found that this source does not present evidence that is applicable as support for this indicator.

To which is appended this footnote:

Some reviews of studies sources TSA cited as support for behavioral indicators present conflicting information on whether the use of behavioral indicators and behavior detection more generally is useful in identifying individuals who may pose a threat to security. For example, one article states that indicators of suicide bombers “are drawn from multiple sources and have not been formally or empirically validated.” Another states that indicators used by law enforcement to identify potential suicide bombers are “vague, contradictory, and so broad as to be useless.”

The DHS responded to the GAO's draft by claiming it still had plenty of research and science justifying the deployment of BDOs. More "evidence" was submitted and found to be just as useless as everything the GAO had already examined.

[I]n its letter, DHS cited passages from a 2013 RAND report as providing support for TSA’s use of behavior detection. However, the report DHS cited does not clearly support TSA’s use of behavior detection. As DHS noted, the RAND report states that there is value and unrealized potential for using behavioral indicators as part of a system to detect attacks. However, the indicators reviewed in the RAND study could not be used in real time in an airport environment, as we reported in 2013. Further, the RAND report refers to behavioral indicators that are defined and used significantly more broadly than those used by TSA. For example, the RAND report includes indicators such as mobile device tracking, monitoring online activity, and changes in lifestyle patterns.

The DHS also said the program was justified because trained BDOs also sometimes saw things even untrained non-professionals might be able to spot.

DHS also stated that there are certain common-sense indicators that TSA cannot reasonably ignore, with or without valid evidence. Specifically, DHS highlighted the indicator “unusual exposed wires or electrical switches on a person.”

Of course, these could (MAYBE) be detected by normal screeners, not specially-trained officers costing the taxpayers millions each year. The GAO agrees BDOs should ignore common sense. But much of what the DHS considers to be "common sense indicators" are highly-subjective takes on normal human behavior.

We recognize DHS’s position that certain common-sense indicators of mal-intent should not be ignored. However, TSA’s revised list of 36 behavioral indicators also includes indicators that are subjective, such as assessing the way an individual swallows or evaluating the degree to which an individual’s eyes are open.

Finally, the DHS protests it should be able to do it because other agencies (CBP, FBI) and other countries do it. The GAO patiently responds that behavioral detection may work for others, but the point is the TSA has yet to prove it works when it does it and can offer no solid evidence to back its claims.

The TSA's Behavioral Detection program isn't dead yet, but a few more nails have been driven into the coffin. If the regular TSA screening procedures are security theater, the BDOs are the mimes. A whole lot of moving around, but in the end, there's really nothing there.

Filed Under: behavioral detection, dhs, gao, research, scientific basis, security theater, studies, tsa

Latest EU Parliament Votes On Copyright: Fuck The Public, Give Big Corporations More Copyright

from the that's-not-good dept

The weird and persistently silly copyright reform process in the EU Parliament continues to get more and more bizarre and stupid. Last month, we told you about the first committee vote, which we feared would be terrible, but turned out to be only marginally stupid, as the worst parts of the proposal were rejected. Now, two more committees -- the Culture and Education (CULT) and Industry, Research and Energy (ITRE) Committees -- have voted on their own reform proposals and the results are really, really bad if you support things like culture, education, research and the public. And, yes, I get the irony of the fact that the Culture and Education Committee in the EU just declared a giant "fuck you" to culture and education with its vote.

Among the many problematic aspects approved by these committees is a filter requirement that would block users from uploading legally obtained media into the cloud. This makes no sense -- especially given that the EU already has additional "you must be a pirate" taxes on situations where individuals are making copies of their legally acquired works.

And then there's the whole "snippet tax" which legacy newspapers are demanding because they've failed to adapt to the digital age, and they want Google News to send them money for daring to send them traffic without monetary compensation. The whole concept is backwards... and here, it's been expanded. As Copybuzz explains:

The press publishers’ right went from applying to ‘digital’ uses of press to all uses, including print. Aside from the fact that this seems a violation of Article 10(1) of the Bern Convention (which establishes a mandatory exception for ‘press summaries’), the impact of such a massive extension is unfathomable.

The definition of press publications has become so broad that infringements to article 11 are impossible to predict and hence prevent. The ‘exceptions’ to the applications of this new right just add to the potential legal uncertainty, as the CULT text states ‘The [publisher] rights granted under this Directive should be without prejudice to the authors’ rights and should not apply to the legitimate uses of press publications by individual users acting in a private and non-commercial capacity. The protection granted to press publications under this Directive should apply to content automatically generated by an act of hyperlinking related to a press publication without prejudice to the legitimate use of quotations.’ This paragraph alone opens such a Pandora Box of unanswered questions, such as:

• What is a legitimate use of press publications? And who’s the judge of the legitimacy?
• When are you acting in your private and non-commercial capacity?
• Content automatically generated by an act of hyperlinking related to a press publication: so that mean that when you share a link on social media and that triggers automatically the appearance of a snippet, you are now officially in trouble?
• When are you ‘legitimately’ quoting? Is that a new criteria imposed on top of the only mandatory exception globally? And if so, who judges if you comply?

None of that sounds good or well thought out. It sounds like the kind of thing that someone not very knowledgeable about the subject would put together after just hearing one side from a bunch of whining newspaper execs.

And then there's this nonsense, as summarized by Parliament Member Julia Reda:

Incredibly, the ITRE committee – responsible for research and usually a staunch defender of open access – even voted to extend the extra copyright to academic publications, which would make open access publishing virtually impossible. It would stop people from linking to academic content, despite the content itself being free. This would apply to both online publications and print journals. The chilling effects on the spread of academic works and information would be substantial.

Yes, linking to academic content will now require payment -- even if it's open access. That's... nuts.

And, finally, on the "text and data mining" issue -- which is one of the key points that the EU has been fighting over with this new copyright reform effort, ITRE again severely limited who can do data mining to tiny startups. Again from Copybuzz:

The ITRE Committee for example has in its extreme generosity decided to leave the benefit of the Text and Data Mining exception limited to research organisations and ‘start-up companies’, defined as ‘any company with fewer than 10 employees and an annual turnover or balance sheet below €2 million and which was established not earlier than three years before benefiting from the exception’. The message for European start-ups is clear: don’t dare scale up your first three years of business if you want to mine content and if you do, move away from the EU (and move anyway after 3 years)! Never mind jobs and growth, the EU mantra we keep on hearing. Oh, and please do not be innovative any longer once you are an established player: we would not want our economy to be competitive on the international scene.

This is really a killer for innovation. There's a massive industry now being built up around machine learning and AI and autonomous machines -- and an awful lot of it actually relies on the ability to do text and data mining on the internet. With this proposal, the (of all things) "Industry & Research" committee is basically saying there shall be no such industry or research in Europe. It's pushing one of the most promising up and coming industries out of the EU entirely. Incredible.

It's almost stunning how bad these decisions were. But, of course, some of the legacy copyright industry folks decided to celebrate, claiming that the votes showed that the EU Parliament "would not tolerate free-riding platforms." That's complete nonsense and an insult. Again: things like news aggregators and search engines have been enormously helpful in creating new markets and expanding attention and traffic to sites. If anything, legacy content producers have been "free riding" on those platforms.

Hopefully saner heads will prevail as this process moves forward, but the EU seems to be going down a dark and dangerous road on copyright policy.

Filed Under: copyright, cult, data mining, education, eu, eu parliament, filters, itre, open access, research, snippet tax

Tim Berners-Lee Sells Out His Creation: Officially Supports DRM In HTML

from the this-is-bad dept

For years now, we've discussed the various problems with the push (led by the MPAA, but with some help from Netflix) to officially add DRM to the HTML 5 standard. Now, some will quibble with even that description, as supporters of this proposal insist that it's not actually adding DRM, but rather this "Encrypted Media Extensions" (EME) is merely just a system by which DRM might be implemented, but that's a bunch of semantic hogwash. EME is bringing DRM directly into HTML and killing the dream of a truly open internet. Instead, we get a functionally broken internet. Despite widespread protests and concerns about this, W3C boss (and inventor of the Web), Tim Berners-Lee, has signed off on the proposal. Of course, given the years of criticism over this, that signoff has come with a long and detailed defense of the decision... along with a tiny opening to stop it.

There are many issues underlying this decision, but there are two key ones that we want to discuss here: whether EME is necessary at all and whether or not the W3C should have included a special protection for security researchers.

First, the question of whether or not EME even needs to be in HTML at all. Many -- even those who dislike DRM -- have argued that it was kind of necessary. The underlying argument here is that certain content producers would effectively abandon the web without EME being in HTML5. However, this argument rests on the assumption that the web needs those content producers more than those content producers need the web -- and I'm not convinced that's an accurate portrayal of reality. It is fair to note that, especially with the rise of smart devices from phones to tablets to TVs, you could envision a world in which the big content producers "abandoned" the web and only put their content in proprietary DRM'd apps. And maybe that does happen. But my response to that is... so what? Let them make that decision and perhaps the web itself is a better place. And plenty of other, smarter, more innovative content producers can jump in and fill the gaps, providing all sorts of cool content that doesn't require DRM, until those with outdated views realize they're missing out. Separately, I tend to agree with Cory Doctorow's long-held view that DRM is an attack on basic computing principles -- one that sets up the user as a threat, rather than the person who owns the computer in question. That twisted setup leads to bad outcomes that create harm. That view, however, is clearly not in the majority, and many people admitted it was a foregone conclusion that some form of EME would move forward.

The second issue is much more problematic. A bunch of W3C members had made a clear proposal that if EME is included, there should be a covenant that W3C members will not sue security researchers under Section 1201 of the DMCA should they crack any DRM. There is no reason not to support this. Security researchers should be encouraged to be searching for vulnerabilities in DRM and encryption in order to better protect us all. And, yet, for reasons that no one can quite understand, the W3C has rejected multiple versions of this proposal, often with little discussion or explanation. The final decision from Tim Berners-Lee on this is basically "sure a covenant not to sue would have been nice, and we think companies shouldn't sue, but... since this wasn't raised at the very beginning, we're not supporting it":

We recommend organizations involved in DRM and EME implementations ensure proper security and privacy protection of their users. We also recommend that such organizations not use the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA) and similar laws around the world to prevent security and privacy research on the specification or on implementations. We invite them to adopt the proposed best practices for security guidelines [7] (or some variation), intended to protect security and privacy researchers. Others might advocate for protection in public policy fora – an area that is outside the scope of W3C which is a technical standards organization. In addition, the prohibition on "circumvention" of technical measures to protect copyright is broader than copyright law's protections against infringement, and it is not our intent to provide a technical hook for those paracopyright provisions.

Given that there was strong support to initially charter this work (without any mention of a covenant) and continued support to successfully provide a specification that meets the technical requirements that were presented, the Director did not feel it appropriate that the request for a covenant from a minority of Members should block the work the Working Group did to develop the specification that they were chartered to develop. Accordingly the Director overruled these objections.

This is unfortunate. What's bizarre is that the supporters of DRM basically refuse to discuss any of this. Even just a few days ago, the Center for Democracy and Technology proposed a last-ditch "very narrow" compromise to protect a limited set of security and privacy researchers (just those examining implementations of w3C specifications for privacy and security flaws.) Netflix flat out rejected this compromise saying that it's "similar to the proposal" that was made a year ago. Even though it's not. It was more narrowly focused and designed to respond to whatever concerns Netflix and others had.

The problem here seemed to be that Netflix and the MPAA realized that they had enough power to push this through without needing to protect security researchers, and just decided "we can do it, so fuck it, let's do it." And Tim Berners-Lee -- who had the ability to block it -- caved in and let it happen. The whole thing is a travesty.

Corry Doctorow has a thorough and detailed response to the W3C's decision that pushes back on many of the claims that the W3C and Berners-Lee have made in support of this decision. Here's just part of it:

We're dismayed to see the W3C literally overrule the concerns of its public interest members, security experts, accessibility members and innovative startup members, putting the institution's thumb on the scales for the large incumbents that dominate the web, ensuring that dominance lasts forever.

This will break people, companies, and projects, and it will be technologists and their lawyers, including the EFF, who will be the ones who'll have to pick up the pieces. We've seen what happens when people and small startups face the wrath of giant corporations whose ire they've aroused. We've seen those people bankrupted, jailed, and personally destroyed.

This was a bad decision done badly, and Tim Berners-Lee, the MPAA and Netflix should be ashamed. The MPAA breaking the open internet I can understand. It's what that organization has wanted to do for over a decade. But Netflix should be a supporter of the open internet, rather than an out and out detractor.

As Cory notes in his post, there is an appeals process, but it's never been used before. The EFF and others are exploring it now, but it's a hail mary process at this point. What a shame.

Filed Under: circumvention, copyright, dmca, drm, eme, html, html 5, research, security, tim berners-lee
Companies: mpaa, netflix, w3c

Copyright Office Realizes The DMCA Fucks With Security Research While The W3C Still Doesn't See It

from the what-a-world dept

Last week, the Copyright Office finally released a report that it had been working on for some time, looking specifically at Section 1201 of the DMCA. In case you're new around here, or have somehow missed all the times we've spoken about DMCA 1201 before, that's the "anti-circumvention" part of the DMCA. It's the part that says it's against copyright law to circumvent (or provide tools to circumvent) any kind of "technological protection measures," by which it means DRM. In short: getting around DRM or selling a tool that gets around DRM -- even if it's not for the purpose of infringing on any copyrights -- is seen as automatically infringing copyright law. This is dumb for a whole host of reasons, many of which we've explored in the past. Not only is the law dumb, it's so dumb that Congress knew that it would create a massive mess for tons of legitimate uses. So it built in an even dumber procedure to try to deal with the fact it passed a dumb law (have you noticed I have opinions on Section 1201?).

Specifically, every three years, people and companies can petition the Copyright Office/Librarian of Congress to "exempt" certain technologies or uses from 1201, saying that it is legal to circumvent the technological protection measures in that case, for the succeeding three years (yes, after three years, the original exemption expires, unless it is renewed). This triennial review process has historically been an (annoying) joke, where people basically have to beg the Copyright Office to let them, say, get around DVD DRM, in order to make documentaries. Or, famously, that time in 2012 when the Librarian of Congress refused to renew the phone unlocking exemption, magically making it illegal to unlock your phone for no clear reason at all. The whole thing is fairly described as a hot mess.

And, it really harms our own security the most.

That's because security researchers often need these exemptions the most, because they don't want to be accused of violating copyright law for doing their jobs in figuring out where there are weaknesses and vulnerabilities in various technologies. So, many of the applied for exemptions tend to come from the security community -- and sometimes they're granted, and other times they are not. A year ago, some security researchers (along with the EFF) sued the US government, arguing that 1201 violates the First Amendment, scaring off security researchers, and providing none of the usual defenses against infringement, such as fair use (which the Supreme Court has argued is a necessary First Amendment valve on copyright). That case is still waiting for a judge to rule on early motions (and it's waiting a long time).

Given all that as background, it's somewhat fascinating (and marginally surprising) to see that the Copyright Office officially agrees that the 1201 setup totally sucks for security researchers, and it would actually like Congress to fix that. The report specifically recommends expanding the existing "permanent exemption" for certain types of "security testing" to make it more applicable to a wider set of security practices:

... the Office recommends that Congress consider expanding the exemption for security testing under section 1201(j). This could include expanding the definition of security testing, easing the requirement that researchers obtain authorization, and abandoning or clarifying the exemption’s multifactor test for eligibility.

There's another section in the law for "encryption research" and, again, the Copyright Office recognizes that should be expanded:

The exemption for encryption research under section 1201(g) may benefit from similar revision, including removal of the requirement to seek authorization and clarification or removal of the multifactor test.

For what it's worth, the report (obviously remembering how it got basically mocked and burned by everyone for removing the cell phone unlocking exemption in 2012) now asks for phone unlocking to be designated a permanent exemption under the law.

These are fairly small changes being sought by the Copyright Office, but it strikes me as somewhat incredible (and very disappointing) that this small bit of enlightenment goes much further than the World Wide Web Consortium's (W3C) view on DRM and security research. As you may recall, there's this ongoing battle over DRM in HTML 5. When the W3C refused to block it outright, some members came up with a fairly straightforward no-brainer rule: all members had to agree not to go after security researchers for circumventing the DRM in HTML 5. And the W3C rejected that proposal.

In other words, the Copyright Office -- famous for its historically expansionist view of copyright, as well as its general tilt towards supporting Hollywood over everyone else -- is now recognizing that it's obvious that security researchers should have the right to circumvent DRM without violating copyright law, while the W3C -- famous for promoting an open web -- is against this. This is "up is down, night is day, cats & dogs living together" kind of stuff. Maybe someone should let the W3C know that it's position on security researchers and DRM is now more extremist than the Copyright Offices?

Either way, at the very least, Congress should follow up on this report and expand the exemptions for security research. It doesn't just help out those researchers, it helps all of us when security researchers are able to do their jobs and help to protect us all.

Filed Under: anti-circumvention, copyright office, dmca, dmca 1201, drm, research, security, triennial review
Companies: w3c

European Commission May Join Gates Foundation And Wellcome Trust In Becoming An Open Access Publisher

from the if-you-want-a-job-done-properly,-do-it-yourself dept

Open access isn't a new idea -- the term was first defined back in 2002, and arguably the first examples go back even further to the founding of arXiv.org in 1991 (pdf). And yet progress towards making all academic knowledge freely available has been frustratingly slow, largely because hugely-profitable publishers have been fighting it every inch of the way. In response to that intransigence, academics have come up with a variety of approaches, including boycotts, mass cancellation of subscriptions, new kinds of overlay journals and simply making everything available with or without permission. Here's another interesting move to open up publishing, reported by the journal Science:

One of Europe's biggest science spenders could soon branch out into publishing. The European Commission, which spends more than €10 billion annually on research, may follow two other big league funders, the Wellcome Trust and the Bill & Melinda Gates Foundation, and set up a "publishing platform" for the scientists it funds, in an attempt to accelerate the transition to open-access publishing in Europe.

It was quite surprising to see the Wellcome Trust start its own rapid-publishing unit, called Wellcome Open Research, a move that seems to have encouraged the Bill & Melinda Gates Foundation to follow suit with the similar Gates Open Research platform, due to start publishing later this year. For the EU's main executive body to do the same is even more extraordinary. It's true that there has been no official announcement about the European Commission's publishing move, but the Science article suggests that it is likely:

A commission spokesperson says the two charities [Wellcome and Gates Foundation], which opted for a system in which papers are reviewed after publication, are "models," but that the commission is only "considering" the idea. But last week in Berlin, at a closed meeting of the Open Science Policy Platform (OSPP), European Commissioner for Research, Science and Innovation Carlos Moedas suggested a "decision" to create the platform had already been made, says Michael Mabe, CEO of the London-based International Association of Scientific, Technical, and Medical Publishers (STM). OSPP member Sabina Leonelli of the University of Exeter in the United Kingdom, who tweeted from the meeting, confirms Mabe’s assessment.

For three giant funding organizations -- the Wellcome Trust, the Bill & Melinda Gates Foundation and the European Commission -- to be driven to take this step shows just how frustrated they all are with the academic publishing world's unhelpful response to two decades of calls for open access. It also underlines that they now seem determined to open up the research they fund by bypassing completely the traditional publishers who are proving so obstructive.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: european commission, open access, research
Companies: gates foundation, wellcome trust

Russian Bank Sends Legal Threats To Researcher Who Revealed Spike In Traffic Supposedly Tied To Trump's Server

from the is-the-wrong-message-worth-shooting-the-messenger-over? dept

Late last year, a security researcher noticed what was believed to be an unusual amount of network traffic between Donald Trump's server and a Russian bank. A lot of bad reporting followed -- some it aided by the security researcher's conclusions -- which attempted to tie some spikes in spam to Trump's supposed collusion with the Russians.

It was a conspiracy theory borne of a researcher's belief something was happening, even when further research by others showed it to be a whole lot of nothing. At this point, only the die hard conspiracy theorists are still holding onto this spike in traffic between a Trump server and a Russian bank as evidence of anything.

Now, there's an additional wrinkle. The FBI is investigating possible connections between Trump and Russia that may have played a part in the election. Nothing has been confirmed by the FBI. As for the spike in network traffic noticed by the researcher, it can still be chalked up to the most boring of non-conspiracy theories: spammers using the same domain name server as both Trump's server and a Russian bank to spam recipients with hotel-related email.

The other party that can't let go of this conspiracy theory is the Russian bank's lawyers. CyberScoop reports Alfa Bank's lawyers have issued legal threats to a security researcher behind the Trump-Russia story.

In a document obtained by CyberScoop, Alfa Bank notified Indiana University computer researcher L. Jean Camp that it’s pursuing “all available options” after Camp’s research suggested the bank engaged in some form of communication with the Trump Organization. Washington-based law firm Kirkland & Ellis sent the letter on the bank’s behalf on March 17.

Alfa Bank is considering, among other things, using one of our nation's most easily-abused laws to pursue legal action against Camp for "promoting an unwarranted investigation" into the bank's ties to Donald Trump. The CFAA is cited as one route the bank may take towards making Camp pay for besmirching the reputation of the Russian bank. It also demands [PDF] she retain records possibly needed in upcoming litigation, including those detailed in this memorable sentence:

communications between you and the individuals you have publicly identified as a "loose group of concerned nerds" with whom you reportedly worked in concert regarding this matter

Being a security researcher is dangerous enough, even when you're 100% in the right. Legal threats tend to follow news of security breaches or unpatched exploits. When you follow the wrong conclusion because you're so sure you're right, you make things worse. The CFAA is a blunt weapon with surprising flexibility, and all the data researchers normally avail themselves of without issue can be twisted into "unauthorized access" by a complainant with sufficient motivation.

Filed Under: cfaa, donald trump, investigation, jean camp, research, russia
Companies: alfa bank