Could Article 13's Upload Filters Be Thrown Out Because Of The EU-Canada Trade Deal CETA?

from the it-ain't-over-yet dept

Now that the EU's awful Copyright Directive has been passed, it would be easy to give up, and assume that nothing more can be done. That's far from the case. Under EU law, this directive must now be implemented through national legislation in all of the EU Member States. Although that process is compulsory, there is still plenty of scope for interpreting what exactly the Copyright Directive's text means. As a result, the fight against the worst elements -- the upload filter and ancillary copyright for news -- can now begin at a national level.

Moreover, there are other ways in which these aspects of the Copyright Directive can be challenged once they are law. A number of people have pointed out that Article 13 (now renumbered as Article 17) effectively imposes an obligation on sites to carry out "general monitoring". That's something that the Court of Justice of the European Union (CJEU), the highest court of the region, has already thrown out because it runs counter to Article 15 of the EU's e-Commerce Directive. Once upload filters are implemented in national law, they can be challenged in the local courts. Since a question that affects the whole of the EU is involved -- are upload filters a form of general monitoring? -- the national court would almost certainly make a reference to the CJEU for clarification. The hope has to be that the whole approach would be ruled as inadmissible, as has already happened twice with other cases of general monitoring.

That's one obvious avenue to pursue. But as the Pirate Party MEP Julia Reda mentioned in a recent Techdirt podcast, there's another route worth investigating. Article 20.11 of the Comprehensive Economic and Trade Agreement (CETA) between the EU and Canada reads as follows:

Subject to the other paragraphs of this Article, each Party shall provide limitations or exceptions in its law regarding the liability of service providers, when acting as intermediaries, for infringements of copyright or related rights that take place on or through communication networks, in relation to the provision or use of their services.

Moreover:

The eligibility for the limitations or exceptions referred to in this Article may not be conditioned on the service provider monitoring its service, or affirmatively seeking facts indicating infringing activity.

So the question is whether that excludes the kind of monitoring activity that the EU Copyright Directive will require. Obviously, the complex interaction of CETA and the new directive is something that will need consideration in the appropriate legal forum, whatever that might be. But at the very least, the idea that CETA could nullify Article 13/17 is an intriguing possibility.

In the past, the copyright industry has used commitments in existing trade deals to block proposals to create much-needed rights and exceptions for members of the public. It would be poetic justice if for once a trade deal blocked a key part of a new law that Big Copyright wanted so desperately.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: article 13, canada, ceta, copyright, eu, eu copyright directive, intermediary liability, julia reda, trade agreements

Canadian ISPs Call For Standardization And Fines For Copyright Trolls Ignoring Changes To Copyright Law

from the needs-teeth dept

Sometimes stories that appear to have good outcomes end up with unsatisfying ends. Such appears to be the case with the recent changes to Canada's copyright laws. After ISPs in Canada began making a great deal of noise about the plague that is settlement threat letters, which ISPs are required to pass through to their customers under threat of fines, the government did the unthinkable and changed the law. The changes made it so that copyright trolls could not force ISPs to pass these letters to ISP customers if the letters contained the usual tactics: offers to settle the claim of infringement, requests for payment or personal information, a reference or link to any such demands, etc. This should have been the end, in other words, of copyright troll fishing expeditions as facilitated by ISPs.

But, as Michael Geist pointed out at the time, that hope was always fleeting, as the new law failed to put in place any punishment for copyright trolls should they simply ignore the law. And ignore the law they most certain did!

Unfortunately the new rules – as predicted – are being abused by companies who feel the law doesn’t apply to them.

As reported by TF earlier this month, anti-piracy outfit Digital Millennium Forensics (a Canada-based company), in conjunction with Elevation Pictures, is continuing to send notices that breach all of the rules, especially the demands for cash settlement. Since the publication of our article, TF has received numerous additional copies of notices sent to even more customers of Eastlink, the ISP featured in the piece. The government says that ISPs don’t have to pass abusive notices on but Eastlink told us they don’t have the capability to filter them out, since there are so many of them.

Since then, the flow has continued. TorrentFreak has received even more copies of abusive notices sent by Digital Millennium Forensics and forwarded by other ISPs. They include Shaw, one of Canada’s most prominent providers, through to Xplornet, the country’s “leading supplier” of rural high-speed Internet.

The examples continue to flourish from there. ISPs that have bothered to comment have pointed out that they have no good way of filtering the letters trolls send to them for content that violates the law. There are so many of these letters, which was the entire problem to begin with, that doing this manually would be a full on nightmare. It's also worth noting that the ISPs' job is not to confirm that third parties are complying with these new aspects of Canadian copyright law. So the ISPs are throwing up their hands, forwarding all notices along as they had been before, and nothing has changed.

Well, some ISPs have suggested how this might be fixed: the standardization of these notices and some actual teeth in the law to punish violations.

Unfortunately, Xplornet did not respond to TorrentFreak’s request for comment. Shaw Communications did, however, and a spokesperson indicated that it’s aware of the issue and is calling for measures against senders of abusive notices.

“Unfortunately, some rightsholders and their representatives may continue to disregard the requirements of the notice-and-notice regime. Shaw makes it clear to our customers that they are not obligated to comply with settlement demands,” Shaw said in its response. “At the same time, we are urging the introduction of measures in the Copyright Act to end this practice – such as monetary penalties applicable to rightsholders who issue notices that include settlement demands or other prohibited content.”

Frankly, the very least the government could do would be to give its constituents some reason to comply with its written law. After all, if the law was worth writing, isn't it worth making sure that that same law is actually followed? Not to mention that ISPs are already under threat of monetary fine if they don't comply with the law in forwarding the notices on to customers, so why not ensure rightsholders are treated the same?

Geist is back again, pointing out that this is all a problem of scale. A problem of the copyright trolls' own making.

“The problem is that the government’s approach does not penalize sending settlement notices via this system. Instead, it merely states that ISPs are not obligated to send such notices,” Geist told TF. “However, given that ISPs are still required to send compliant notices under threat of penalty, many ISPs will send all notices because it is too difficult to manually distinguish between compliant and non-compliant notices.”

Like the ISPs, Geist says there are potential solutions, such as the standardization of notices or establishing penalties for sending non-compliant notices, as suggested by Shaw. As things stand, however, things are likely to continue as they are.

Making the much-needed changes to Canadian copyright law is an exercise in mental timewasting and isn't worth whatever paper the law was written on. The encouraging part of all of this is that ISPs were able to get this law written in the first place. Hopefully, they'll be able to get the law some actual teeth as well.

Filed Under: canada, copyright, copyright trolling, demand letters, isps

Court Documents Show Canadian Law Enforcement Operated Stingrays Indiscriminately, Sweeping Up Thousands Of Innocent Phone Owners

from the bleeding-edge-meets-zero-fucks-given dept

A wide-ranging criminal investigation involving eleven suspects has resulted in the reluctant disclosure of Stingray data by Canadian law enforcement. The Toronto PD and the Royal Canadian Mounted Police joined forces to deploy a surveillance dragnet that swept up thousands of innocent Canadians, as Kate Allen reports for the Toronto Star.

Toronto police and RCMP officers deploying controversial “Stingray” surveillance technology over a two-month period swept up identifying cellphone data on more than 20,000 bystanders at malls, public parks and even a children’s toy store.

As police sought cellphone data for 11 suspects in a 2014 investigation, they deployed a Stingray — also known as an IMSI catcher — at three dozen locations, including the middle of Yorkville, at the Dufferin Mall, at Vaughan Mills Mall, near Trinity Bellwoods Park, near Kensington Market, and at a Toys ‘R’ Us store in Richmond Hill.

These sweeps occurred years before either law enforcement agency admitted to possessing and deploying Stingray devices. In prior years, Canadian prosecutors dropped charges rather than discuss the devices in open court. This case must have been too big to let go. It involved 50 raids, 112 arrests, and a plethora of charges ranging from gun possession to murder.

Multiple defendants are now challenging the evidence derived from the multiple Stingray deployments, arguing that it was gathered unlawfully. The courts may decide to see it the defendants' way, but it's unlikely these deployments broke the agencies' own policies. Pretty much every law enforcement agency anywhere that has acquired a Stingray has deployed first and developed policies after their Stingray use could no longer be kept secret. The agencies involved here are no exception:

An RCMP spokesperson said that policy regarding deployment and resting time is “still being developed,” and that interim guidelines state that the devices will generally operate for three minutes, though may be operated for longer periods under certain circumstances and if permitted by a judge.

From what's contained in the tracking logs submitted as evidence in these cases, there appears to have been very little done to limit the tracking of non-suspects.

According to the logs, police deployed the device at three dozen locations between March 18 and May 23, 2014. In all, the device logged approximately 25,000 captures. The same cellphones may have been captured more than once in that time, since police used the device multiple times at some locations; with those repeat locations excluded, a minimum of 20,000 bystanders in Toronto and the GTA saw their cellphone data swept up.

At one location -- a condo where a target was suspected to live -- law enforcement operated the device for nearly ten minutes, sweeping up 1,400 cellphones.

Many of the logs show violations of the limitations law enforcement set for itself when applying for a warrant. The officer obtaining the affidavit failed to mention the device's ability to act as a tracking device. The officer also stated the device would only be operated for three minutes at a time, followed by two minutes of "rest" -- a minor concession meant to limit the impact on phone operation in the area. Instead of doing either of these things, officers switched frequencies every three minutes, running the device pretty much uninterrupted during each deployment.

This whole thing started out with the RCMP farming out the warrant request to a novice -- one who probably swore to his own "training and expertise" while combining boilerplate cribbed from other warrants with his subject matter inexperience.

According to court documents, the Toronto police sergeant who obtained the warrant testified he had never used an IMSI catcher before, and that he copied and pasted a set of “standard” wording used in a warrant for a previous case. The RCMP’s program manager for deployment of the technology testified that the standard wording was written “by people that are not operators of the equipment so they didn’t fully understand the capabilities and how it operated.”

To reiterate: the Stingrays were (and are) being deployed in an operational policy vacuum. According to a statement given to the Star, the policies the RCMP said it would draw up after it publicly admitted it owned and used Stingrays still aren't in place. An interim policy, instituted in 2017, is the only internal legal framework guiding Stingray use. In practice, this means the RCMP isn't controlling deployments. In this case, it also meant sending an amateur to do a professional's job when it came to securing a warrant. Put it all together and you have the mess both law enforcement agencies created by simply assuming no one would ever find out they'd been using these devices.

Filed Under: canada, law enforcement, privacy, stingray, surveillance

Canada's Bell Tried To Have VPNs Banned During NAFTA Negotiations

from the missing-the-point dept

Countries around the world continue to wage a not particularly subtle war on the use of virtual private networks (VPNs) and encryption. In Russia, the government has all but banned the use of VPNs by layering all manner of obnoxious restrictions and caveats on VPN operators. The goal, as we've seen in China and countless other countries, is to ban VPN use without making it explicitly clear you're banning VPN use. The deeper goal is always the same: less privacy and online freedom for users who use such tools to dodge surveillance or other, even dumber government policies.

Of course there's plenty of companies eager to see VPN use banned as well, whether it's the entertainment industry hoping to thwart piracy, or broadcasters trying to hinder those looking to dance around geographical viewing restrictions. Lost in the hysteria is usually the fact that VPNs are just another security tool with a myriad of purposes, most of which aren't remotely nefarious and shouldn't be treated as such.

Apparently, you can count Canadian telecom incumbent Bell among the companies hoping to ban VPN use. Anja Karadeglija, the editor of paywalled telecom news outlet the Wire Report, obtained documents this week highlighting how Bell had been pushing Canadian Foreign Affairs Minister Chrystia Freeland for a VPN ban to be included in NAFTA negotiations. Why? It doesn't want users using VPNs to watch the US Netflix catalog:

"In its submission, Bell argued that Canadians accessing content from a US service with a VPN “unjustly enriches the US service, which has not paid for the Canadian rights” but nonetheless makes that content available to Canadians. Bell’s media arm reportedly spends millions on content for it streaming service, Crave TV, which allows Canadians to stream content from American networks such as HBO and Showtime."

Again though, it's not the VPN doing that. And if you want to stop users from flocking to better content catalogs elsewhere on the continent, you should focus your ire on the things causing that to happen -- like increasingly dated and absurd geo-viewing restrictions, and your own substandard content offerings that fail to adequately match up. That message was lost on Bell, however:

“Canada should seek rules in NAFTA that require each party to explicitly make it unlawful to offer a VPN service used for the purpose of circumventing copyright, to allow rightsholders to enforce this rule, and to confirm that it is a violation of copyright if a service effectively makes content widely available in territories in which it does not own the copyright due to an ineffective or insufficiently robust geo-targeting system,” the submission stated."

How exactly you're supposed to determine that somebody is using a VPN to not watch Bell's own television services isn't really explained, and the fact that enforcement would likely be technically impossible appears to have been an afterthought. As Canadian Law Professor Michael Geist was quick to note, trying to ban VPNs just as they're reaching critical mass as a partial solution to raging North American privacy scandals suggests Bell may not exactly have its finger on the pulse of common sense on this particular subject.

Filed Under: canada, streaming, trade agreements, usmca, vpn, vpns
Companies: bell canada

Canada Outlaws Settlement Threat Letters Sent Through ISPs

from the coming-to-america? dept

Somehow, it seems things move quite quickly in the Great White North. It was only in October that we discussed Canadian ISPs making a great deal of noise over the plague that is settlement letters sent to their subscribers over supposed copyright infringement. In the Canadian system, rightsholders pass along a letter to the ISP, which is then supposed to pass those letters along to the subscriber. ISPs began complaining that its own administrative burden was being repurposed as part of the copyright trolling business model, used to extract settlements purely out of fear. In November, ISPs got their wish, with a proposed law that would amend copyright law to outlaw these letters when they include these types of extortion attempts.

And now, in December, the law has officially passed, bringing an end to threat settlement letters sent to subscribers through their ISPs.

Bill C-86, the Budget Implementation Act, has now received royal assent, so there will be some big changes in the Great White North. Section 41.‍25 of the Copyright Act is now amended with the addition of the following;

(3) A notice of claimed infringement shall not contain:

(a) an offer to settle the claimed infringement;
(b) a request or demand, made in relation to the claimed infringement, for payment or for personal information;
(c) a reference, including by way of hyperlink, to such an offer, request or demand; and
(d) any other information that may be prescribed by regulation.

The text is pretty straightforward, in that it prohibits demands for settlement in the notices themselves or on a third-party site where such a demand may also be available. This is important since some notices contain hyperlinks that not only lead to demands for cash but also undermine subscriber privacy with the use of tracking code.

Now, rightsholders can still send these letters on their own, assuming they can use the courts to unmask ISP customers. They can also include all the offers of settlement they wish. But that's nearly besides the point, since the math in the copyright trolling business model only really works if the troll can get the ISP to act as its clearinghouse. If trolls have to do all of this heavy lifting in unmasking customers and sending these letters out on an individual basis, that changes things dramatically.

It hasn't gone unnoticed, however, that ISPs are still the enforcement wing of this new law.

However, Geist also cautions that the new amendments contain no punishments for anti-piracy companies that fail to follow the rules.

“The key remaining question is whether ISPs will crackdown on non-compliant notices. Since there is no penalty associated with sending non-compliant notices, subscribers are dependent upon ISPs carefully reviewing notices to ensure that they only forward those that fully comply with the law,” Geist notes.

One expects this to be something of a selling point for Canadian ISPs. If they don't have plans to tout their plans to strictly comply with the new law in favor of their customers, they really should have their PR and Marketing folks getting on this with haste. What Canadian citizen is going to want to get internet service from a company that is too lazy to protect its customers by complying with the law?

Filed Under: canada, copyright, copyright trolls, settlement letters, shakedown letters

Pompous 'International Grand Committee' Signs Useless But Equally Pompous 'Declaration On Principles Of Law Governing The Internet'

from the they're-really-going-all-in-on-this dept

So just a few weeks after a bunch of countries (and companies and organizations) signed onto a weird and mostly empty Paris Call for Trust and Safety in Cyberspace, a group of nine countries -- Argentina, Belgium, Brazil, Canada, France, Ireland, Latvia, Singapore and the UK, have declared themselves the "International Grand Committee on Disinformation and Fake News" and signed onto a Principles of the Law Governing the Internet. If that list of countries sound familiar, that's because it's the same list of countries that put on that grandstanding inquisition of Facebook that produced fake news in its own way, by falsely claiming that Facebook had discovered Russians extracting 3 billion data points via its API back in 2014 (it wasn't Russia, it was Pinterest; it wasn't 3 billion, it was 6 million; it wasn't abuse of the API, but using it correctly).

The Declaration makes some grand pronouncements:

Noting that:— the world in which the traditional institutions of democratic government operate is changing at an unprecedented pace; it is an urgent and critical priority for legislatures and governments to ensure that the fundamental rights and safeguards of their citizens are not violated or undermined by the unchecked march of technology; the democratic world order is suffering a crisis of trust from the growth of disinformation, the proliferation of online aggression and hate speech, concerted attacks on our common democratic values of tolerance and respect for the views of others, and the widespread misuse of data belonging to citizens to enable these attempts to sabotage open and democratic processes, including elections.

Affirming that:— representative democracy is too important and too hard-won to be left undefended from online harms, in particular aggressive campaigns of disinformation launched from one country against citizens in another, and the co-ordinated activity of fake accounts using data-targeting methods to try manipulate the information that people see on social media.

Believing that:— it is incumbent on us to create a system of global internet governance that can serve to protect the fundamental rights and freedoms of generations to come, based on established codes of conduct for agencies working for nation states, and govern the major international tech platforms which have created the systems that serve online content to billions of users around the world.

Okay. So what does it all mean? Well, here are the details of the "declaration":

i. The internet is global and law relating to it must derive from globally agreed principles;
ii. The deliberate spreading of disinformation and division is a credible threat to the continuation and growth of democracy and a civilising global dialogue;
iii. Global technology firms must recognise their great power and demonstrate their readiness to accept their great responsibility as holders of influence;
iv. Social Media companies should be held liable if they fail to comply with a judicial, statutory or regulatory order to remove harmful and misleading content from their platforms, and should be regulated to ensure they comply with this requirement;
v. Technology companies must demonstrate their accountability to users by making themselves fully answerable to national legislatures and other organs of representative democracy.

Of course, in the context of the committee who created this Declaration having now been revealed to have created "fake news" itself, this kind comes off pretty... weak. But also, the whole thing is kind of meaningless. The companies do recognize their "power" and have been trying to deal with this issue. Yes, perhaps they didn't grasp the severity of the issue in the past, but they certainly have more recently. But simple declarations and pronouncements don't really do anything useful in "solving" those issues. That's because much of it is a human nature issue, and expecting tech companies to "take responsibility" for human nature is... well... nonsense.

Filed Under: argentina, belgium, brazil, canada, content moderation, disinformation, fake news, france, internet regulation, ireland, latvia, prais call, singapore, uk
Companies: facebook