Bill Gates And Other Major Investors Put $52.6 Million Into Site Sharing Unauthorized Copies Of Academic Papers

from the so-how-is-that-different-from-sci-hub? dept

As we've noted, the main reason the Sci-Hub site is so popular with academics is not because it is free -- researchers generally have free access to papers anyway -- but because it is so easy to use. Among other things, it provides a centralized store of a huge number of papers -- 58 million at the time of writing -- that can be downloaded with a single click. But an interesting post on the Green Tea and Velociraptors blog points out Sci-Hub's holdings are beaten by the total number of papers available on the ResearchGate site, which has 12 million members:

The platform boasts that 2.5 million published outputs are uploaded by its users every month, equivalent to around the total number of published scholarly research articles each year. The site claims to have around 100 million published articles, which is very impressive seeing as only around 20-25 million have ever been published Open Access [OA].

The same post points out that many of those 100 million articles seem to be unauthorized copies:

Based on a random sample of English language articles drawn from ResearchGate, the study [published last month] showed that 201 (51.3%) out of 392 non-OA articles infringed the copyright and were non-compliant with publishers' policy. While this sample size was small, there is no reason to think that the same cannot be said if we scale up to consider the entire corpus of articles shared on RG. This means that around half, or approximately 50 million, research papers on RG are most likely illegally hosted.

If that analysis is correct, it would seem that ResearchGate holds roughly as many unauthorized copies of academic papers as Sci-Hub. Despite that fact, ResearchGate has just revealed that back in November 2015, it received investments totalling $52.6 million from some rather starry names, including that famous hater of pirates, Bill Gates:

Wellcome Trust, Goldman Sachs Investment Partners, and Four Rivers Group with participation from Ashton Kutcher, Groupe Arnault, Xavier Niel, and existing investors Bill Gates, Tenaya Capital, Benchmark, and Founders Fund.

ResearchGate says it is the responsibility of the uploader to make sure that they have the necessary rights to post material to the site:

As we do not have any information about rights you may hold, or any license terms or other restrictions which might apply to such content, we necessarily rely on you to understand your rights and act accordingly. For this reason, we request that you fully investigate and confirm that you have sufficient rights to post particular content to ResearchGate before you post such content. As a general matter, if you are an author publishing in a journal, you may be allowed to publish certain versions of your article, but not others, and privately share certain content with others. However, many journals restrict publication of final versions and impose limitations on private sharing.

As that notes, authors are typically only allowed to post certain versions of their papers -- usually early ones. But most researchers don't bother with that detail, and simply upload the final version to ResearchGate, which is probably why the recent analysis mentioned by the Tea and Velociraptors blog found so many unauthorized copies. Along with laziness, or ignorance of the niceties here, another factor driving this phenomenon may be that academics are aware that much of their work has been paid for by the public, and therefore feel the definitive results should be disseminated as widely as possible.

Still, the contrast between ResearchGate, which has received major investments from some rather big names, and Sci-Hub, which is currently being pursued in the courts by Elsevier, is stark, given that their respective holdings turn out to be so similar. It's another indication that the academic publishing system is broken, and that copyright is an irrelevance as far as millions of researchers are concerned.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: academic papers, bill gates, copyright, infringement, investment, research
Companies: researchgate

The Codification Of Web DRM As A Censorship Tool

from the exceptions-that-create-a-rule dept

The ongoing fight at the W3C over Encrypted Media Extensions -- the HTML5 DRM scheme that several companies want ensconced in web standards -- took two worrying turns recently. Firstly, Google slipped an important change into the latest Chrome update that removed the ability to disable its implementation of EME, further neutering the weak argument of supporters that the DRM is optional. But the other development is even more interesting -- and concerning:

Dozens of W3C members -- and hundreds of security professionals -- have asked the W3C to amend its policies so that its members can't use EME to silence security researchers and whistleblowers who want to warn web users that they are in danger from security vulnerabilities in browsers.

So far, the W3C has stonewalled on this. This weekend, the W3C executive announced that it would not make such an agreement part of the EME work, and endorsed the idea that the W3C should participate in creating new legal rights for companies to decide which true facts about browser defects can be disclosed and under what circumstances.

One of the major objections to EME has been the fact that, due to the anti-circumvention copyright laws of several countries, it would quickly become a tool for companies to censor or punish security researchers who find vulnerabilities in their software. The director of the standards body called for a new consensus solution to this problem but, unsurprisingly, "the team was unable to find such a resolution." So the new approach will be a forced compromise of sorts in which, instead of attempting to carve out clear and broad protections for security research, they will work to establish narrower protections only for those who follow a set of best practices for reporting vulnerabilities. In the words of one supporter of the plan, it "won't make the world perfect, but we believe it is an achievable and worthwhile goal."

But this is not a real compromise. Rather, it's a tacit endorsement of the use of DRM for censoring security researchers. Because the argument is not about to what degree such use is acceptable, but whether such use is appropriate at all. It's not, but this legitimizes the idea that it is.

Remember: it's only illegal to circumvent DRM due to copyright law, which is not supposed to have anything to do with the act of exploring and researching software and publishing findings about how it functions. On paper, that's a side effect (though obviously a happy and intentional side effect for many DRM proponents). The argument at the W3C did not start because of an official plan to give software vendors a way to censor security research, but because that would be the ultimate effect of EME in many places thanks to copyright law. Codifying a set of practices for permissible security disclosures might be "better" than having no exception at all in that narrow practical sense, but it's also worse for effectively declaring that to be an acceptable application of DRM technology in the first place. It could even make things worse overall, arming companies with a classic "they should have used the proper channels" argument.

In other words, this is a pure example of the often-misunderstood idea of an exception that proves a rule -- in this case, the rule that DRM is a way to control security researchers.

Of course, security research isn't the only thing at stake. Cory Doctorow was active on the mailing list in response to the announcement, pointing out the significant concerns raised by people who need special accessibility tools for various impairments, and the lack of substantial response:

The document with accessibility use-cases is quite specific, while all the dismissals of it have been very vague, and made appeals to authority ("technical experts who are passionate advocates for accessibility who have carefully assessed the technology over years have declared that there isn't a problem") rather than addressing those issues.

How, for example, would the 1 in 4000 people with photosensitive epilepsy be able to do lookaheads in videos to ensure that upcoming sequences passed the Harding Test without being able to decrypt the stream and post-process it through their own safety software? How would someone who was colorblind use Dankam to make realtime adjustments to the gamut of videos to accommodate them to the idiosyncrasies of their vision and neurology?

I would welcome substantive discussion on these issues -- rather than perfunctory dismissals. The fact that W3C members who specialize in providing adaptive technology to people with visual impairments on three continents have asked the Director to ensure that EME doesn't interfere with their work warrants a substantive reply.

For the moment, it doesn't look like any clear resolution to this debate is on the horizon inside the W3C. But these latest moves raise the concern that the pro-DRM faction will quietly move forward with making EME the norm (Doctorow also questioned the schedule for this stuff, and whether these "best practices" for security research will lag behind the publication of the standard). Of course, the best solution would be to reform copyright and get rid of the anti-circumvention laws that make this an issue in the first place.

Filed Under: browsers, drm, eme, exceptions, html 5, research, security
Companies: google, w3c

2012 Research Paper Linking Video Games And Violence Finally Retracted Over Massaged Data Accusation

from the boom,-headshot dept

For all of the studies that often appear almost fervent in their attempts to find any thread of a link between violent video games and real life tendencies to violence, one of the standouts in the crowd has been Brad Bushman. Bushman last graced our pages showing how some combination of candy and loud noises showed that teenagers who had played a violent video game ate more bad food and were aggressive towards others in the immediate aftermath. This was used to essentially claim that violent video games were bad for teenagers, despite longer-term studies involving more participants coming to the opposite conclusion.

More to the point for this post were accusations from Bushman's peers that his research methods were generally flawed and that he was known to pick and choose which results from his experiments he wanted to include in the final analysis. It seems the study we discussed in that last post wasn't the only study in which Bushman has done this, as a 2012 research paper Bushman authored, delightfully entitled Boom, Headshot!?: Effect of Video Game Play and Controller Type on Firing Aim and Accuracy, has finally been retracted by the journal Communication Research.

Now, the stated reason for the retraction is that there were some questions from peers about the data used in the paper and that Bushman could no longer produce that data for analysis, hence the retraction. That's a barely accurate description of what actually happened regarding the paper.

The two outside researchers mentioned in the notice are Patrick Markey, psychology professor at Villanova University and Malte Elson, a behavioral psychology postdoc at Ruhr University Bochum in Germany. They began questioning the results when Markey noticed some statistical inconsistencies that suggested the data were positively skewed. Bushman has claimed that the push to retract the paper was a smear campaign. But, ultimately, he agreed with the retraction.

It stretches credulity that research done a mere few years ago and the resulting data would disappear in this way, and only after criticism of it arises. And Bushman's agreeing to the retraction should tell you the whole story here. But what's crazy about this is that Markey and Elson have been lodging complaints against Bushman's paper for years. That the paper was allowed to stay in its published form for all this time doesn't say much for Communication Research's standards. Elson, in particular, appears to be happy, but exasperated.

I am pleased to see the paper is finally retracted almost 3 years after the authors were first notified of the concerns (and 2 years after it was first reported to the Ohio State University). The public record has now been corrected, which is the only thing Patrick and I ever wanted after we found evidence of severe errors in the data on which the now retracted paper was based.

Who knew the peer review process actually took so long?

Filed Under: brad bushman, research, retraction, video games, violence

DMCA Process Abused To Nuke Post About Researcher Who Faked Data On Federally-Funded Study

from the 'DM'-stands-for-'Dick-Move' dept

Wonderful. It's another one of those anomalies that happens all the time: copyright as censor.

This time, the person abusing copyright protection tools to shut someone up is a disgraced researcher (Kaushik Deb) who received a three-year federal funding ban for "intentionally, knowingly, and recklessly" fabricating data in a research paper created with tax dollars.

Retraction Watch was informed by its hosting service that it had received a DMCA notice targeting the post. The tactic used here is one we've seen before: copy-pasting and backdating of posts to make it appear as though the targeted site is the one engaging in copyright infringement.

On Wednesday, our host, Bluehost, forwarded us another false copyright claim — aka a Digital Millennium Copyright Act (DMCA) takedown notice — by someone calling himself “Jiya Khan” and claiming to be based in Delhi, India. (Well, specifically, in “Rohini,sector-12,” which would mean that he or she is based at one of two petrol stations.)

Khan insisted under penalty of perjury that a December 2014 post of ours — which we have now temporarily removed from public view (more on that in a moment) — violated his or her copyright.

What actually happened, in an eerie echo of the 2013 case, is that Khan copied and pasted our December 9 post onto his or her site, then backdated it to December 5 to make it look older than ours, so that he or she could make a false copyright claim. (That, among other things, is a bit of a problem for Khan; the Federal Register notice that the post is about — and to which it manages not to link — wasn’t published until December 9.)

The bogus backdated Blogspot blog contains several other copy-pasted posts, suggesting "Jiya Khan" is just a fake name fronting for a sketchy reputation management service. Presumably, bogus DMCA notices have been issued to target the mixture of critical articles and negative reviews splashed across the blog's pages. It's not exactly a surefire way to rid the net of criticism, but it's cheap and easy and works just often enough it's worth trying. We saw this with disgraced real estate lawyer Sean Gjerde, and gripe sites have seen it happen with just about everyone else.

For the time being, the Retraction Watch post is down. The Federal Register's recounting of the incident and its sanctioning of Dr. Kaushik Deb is still live, and there are multiple snapshots of Retraction Watch's post on Kaushik Deb's data-faking hosted at the Internet Archive.

Retraction Watch is challenging the DMCA takedown notice. Presumably, the post will be live again in the near future. Then again, "Jiya Khan" may continue to insist he created Retraction Watch's post, which means Bluehost won't be able to do much more than keep the post down until all permutations of the DMCA process have been played out.

But that's how easy it is to make fully-factual criticism disappear, even if only temporarily. And whoever's mismanaging Kaushik Deb's questionable reputation knows this. Even if there's provable perjury in the takedown request, who's going to actually be able to track down the real person behind the "Jiya Khan" facade, much less manage to hold them accountable for their abuse of the system?

Filed Under: censorship, dmca, kaushik deb, reputation management, research
Companies: bluehost, retraction watch

Do You Have Examples Of Constructive Responses To Hateful/Abusive/Trollish Speech Online?

from the please-share dept

Do you have examples of communities or individuals coming up with unique, creative or innovative ways to respond to hateful, abusive or trollish speech? Please let us know in the comments as we're trying to help an important research project on this -- including getting people past the kneejerk reactions to seeing speech they dislike by assuming that the only thing one can do it about it is ban it. I'll explain more below -- but if you have good examples, please share them -- preferably with links so that they can be investigated further.

This is a project that we're trying to help out with, put together by Susan Benesch from American University and the Berkman Klein Center at Harvard. Over the last year or so, I've been fortunate to get to spend some time talking to Susan. Coming from a human rights background, she's done some amazing work on free speech, and on how speech can lead to violence or other dangers. She's also behind the related Dangerous Speech Project, which has looked at examples of the kind of inflammatory and violent rhetoric that often precedes mass violent outbursts to find patterns. I know that, among many free speech advocates (like ourselves), hearing some of that may raise the hairs on our necks, fearing that what comes after that is a demand to shut down that kind of speech. Yet, Susan has focused not just on understanding what kind of speech precedes violence, but also on what works in counteracting that -- and she argues (and we agree!) that censorship rarely does.

But... many people who are first encountering either such trollish/abusive behavior and/or seeing the aftermath of actual violence often jump to the conclusion that banning such speech is the only or best solution. Partly this is an emotional response. And partly it's a response due to the simple fact that, in the spur of the moment it's both difficult to think of alternatives and it's difficult to envision the unintended (potentially negative) consequences of silencing such speech. Also, it should be admitted, that blocking such speech is often "easier" than alternative solutions, even if it rarely works and is open to abuse of its own.

So we're now trying to work with Susan to help explore various alternatives and to categorize what they are, what's good about them (and what's bad!) and just lay out the wider spectrum of possibilities. And, while Susan's work has gone way beyond just speech on the internet, the internet is fertile ground for this kind of research. But (and this is where you come in), it's not easy to track down these examples -- especially when the responses are organic or community driven, where they may only be known about in smaller circles. That is, at this stage, we're not necessarily looking for what, say, internet platforms do, but how users of internet platforms respond themselves.

I'll give a few examples of what we're talking about. First is one that we discussed nearly a year ago, in which an ISIS-associated Twitter account an account that would translate ISIS statements posted on that "called on" Muslims to "join the fight," and a bunch of Muslim Twitter users responded by making jokey excuses about why they were too busy to do so [Update: in our initial post we incorrectly suggested that the original tweets themselves were from an ISIS-associated account, rather than an anti-ISIS activist who was translating the content for others to read -- and that some of the responses were from people who knew that. This still works as an example of a type of response, but of a somewhat different nature. We aplogize for the error.] Another example is an interesting project in Germany called "Donate the Hate," in which a group of internet users are giving donations to various charities in response to racist or xenophobic comments that they find online, leaving a note that a donation was made to a certain group in their name. There are lots and lots of other examples -- not all of them necessarily good, but they're examples of the way individuals and groups are dealing with these things. And we'd love to see more examples that you may be aware of. A few more examples to keep you thinking: Professors at Colgate jumped onto Yik Yak a few years ago to counter a bunch of racist speech with happy, positive speech. There are examples of people actually befriending trolls -- such as the famed academic Mary Beard who even wrote a job reference for a troll -- but also naming and shaming some of the trolls sending abusive content her way and publicly exposing them. This reminds me of another story in which somoene would take rape threats she received and would track down the troll's mother and send them to her.

Again, whether you approve of any of these individual methods or not, there's a wide range of ways in which individuals and groups have come up with unique ideas for responding to speech they (at the very least) find uncivil or (at the very worst) threatening or frightening. And we'd love to know more examples -- big or small -- that people have come across, so that we can look at as many examples as possible to try to sort through them, categorize and analyze them, and see if we might all learn something useful about them. So please, add any examples you might have in the comments.

Filed Under: abusive speech, counterspeech, dangerous speech, free speech, harassment, research, susan benesch

Researchers Find Vulnerability That Enables Accounting Fraud, PwC Decides The Best Response Is A Legal Threat

from the you're-not-helping dept

For years now, we've noted that some companies apparently think it's a good idea to punish security researchers that expose vulnerabilities in their products, even when the researchers use the proper channels to report their findings. This kind of absurdity runs hand-in-hand with international attempts to criminalize security research -- or the tools researchers use -- to do their jobs. Obviously, this kind of behavior has one tangible end result: it makes all of us less secure.

The latest chapter in this saga of myopic bumbling comes courtesy of PwC, which for whatever reason decided that the best response to a major security flaw found in one of the company's products was to to fire off a cease and desist letter aimed at the researchers. More specifically, Munich-based ESNC published a security advisory earlier this month documenting how a remotely exploitable bug in a PwC security tool could allow an attacker to gain unauthorized access to an impacted SAP system.

The advisory was quick to point out that the vulnerability could allow a hacker to manipulate accounting documents and financial results and commit fraud, if they were so inclined:

"Based on the business processes implemented on the SAP systems on which ACE is installed, this security vulnerability may allow an attacker to e.g. manipulate accounting documents and financial results, bypass change management controls, and bypass segregation of duties restrictions. This activity may result in fraud, theft or manipulation of sensitive data including PII such as customer master data and HR payroll information, unauthorized payment transactions and transfer of money.

The researchers say they received the cease and desist threat despite meeting with PwC in August to discuss the flaw. ESNC also gave PwC three months to fix the flaw before issuing their public advisory, in line with the firm's responsible disclosure policy. ESNC says this was the first time they'd ever sent their research and findings to PwC. It was also the first time they've ever been legally threatened for doing their job, despite the discovery of over 100 security vulnerabilities to date. Despite two cease and desist letters, ESNC released their findings anyway -- "because it is the right thing to do."

When pressed for comment, PwC read directly from the tone-deaf playbook, first pointing out that ESNC did not have a license to use this software (irrelevant), then trying to downplay the fact that the vulnerability could enable accounting and financial fraud:

"ESNC did not receive authorized access or a license to use this software. The software is not publicly available and was only properly accessed by those with licenses, such as PwC clients working with trained PwC staff," said the spokesperson.

"The bulletin describes a hypothetical and unlikely scenario -- we are not aware of any situation in which it has materialized," the spokespersons said.

This kind of behavior has always been, for lack of a more scientific term, blisteringly idiotic. But it's becoming more of a problem with the rise of the internet-of-poorly-secured things, which has amplified exponentially the number of attack vectors and product vulnerabilities in the wild. With security researchers now clearly warning us that the failure to secure these products will inevitably result in human fatalities at scale, this ongoing attempt to criminalize security research needs to be considered a criminal act in and of itself.

Filed Under: cybersecurity, legal threats, research, security, security research, threats
Companies: esnc, pwc

Only Thing 'Exposed' By Bad Reporting About Russia/Trump Link Is Malware Researchers' Unethical Behavior

from the so-dumb dept

On Monday evening, you may have seen news of a "big scoop" at Slate by famed reporter Franklin Foer, about how Donald Trump had a server that was "communicating" with a Russian server. Foer, who famously got pushed out of The New Republic for not being very with it on technology on the internet (among other things), makes a really big deal out of some really weak tea. After reading the article (along with another one alleging Russian spies had been "cultivating" Trump) I tweeted out that the evidence on both was super weak. I kept expecting a smoking gun in the Foer piece, but instead got a lot of handwaving and confusion about DNS. Of course, Clinton supporters were quick to jump on the article as some sort of proof, despite the really weak claims.

A lot of Foer's work stems from an anonymous blog post from a few weeks earlier that tries to make a big deal out of some extraordinarily weak connections. The confirmation bias is strong with the folks involved here. The biggest clue? This ridiculous chart that tries to show increased activity between the Trump server and the Russian bank server at key moments, but doesn't actually show that. There seem to be random ups and downs at the conventions, and then a huge spike in the middle of August which corresponds with... nothing. But the researchers and Foer just ignore it. In fact, Foer actually claims that "there were considerably more DNS lookups, for instance, during the two conventions." Except there weren't really. And, of course, within a few hours, people were debunking basically every aspect of the story. The Intercept notes that at least six other news outlets had been looking into the same story, and none of them felt comfortable pushing a story, because the details just didn't stack up. The first person I saw to debunk it was Naadir Jeewa, who pointed out that the server was maintainted by Cendyn, a marketing company that handles email spam marketing for tons of hotel chains, including Trump. The "connection" from Alfa-Bank, he suggested, was just a typical email scanner attempting to reverse the connection as a sort of anti-spam tool (basically checking if the email server is real). As Jeewa concludes: The Intercept actually reached out to Alfa-Bank... and got the hotel spam that it had received from Trump. They also received the similar spam from Spectrum Health (who is included in Foer's story for reasons too pointless to explain). Guess what: spam. Rob Graham from Errata Security went even deeper in explaining how this was a giant nothing grown out of a reporter getting confused. Cendyn doesn't just control the mail1.trump-email.com domain, but also controls a variety of other hotel domains, including hyatte-concierge.com, reservertravelonline.com, sheratonmenus.com, westinmenus.com, hyattmenus.com, cphollywoodbeach.com (CP = Crown Plaza), hayattproposal.com and a bunch of others as well. It's not Trump using this, it's a marketing company that specializes in spamming hotel customers. From Graham:

This is why we can't have nice things on the Internet. Investigative journalism is dead. The Internet is full of clues like this if only somebody puts a few resources into figuring things out. For example, organizations that track spam will have information on exactly which promotions this server has been used for in the recent past. Those who operate public DNS resolvers, like Google's 8.8.8.8, OpenDNS, or Dyn, may have knowledge which domain was related to mail1.trump-email.com.

Indeed, one journalist did call one of the public resolvers, and found other people queried this domain than the two listed in the Slate story -- debunking it. I've heard from other DNS malware researchers (names remain anonymous) who confirm they've seen lookups for "mail1.trump-email.com" from all over the world, especially from tools like FireEye that process lots of spam email. One person claimed that lookups started failing for them back in late June -- and thus the claim of successful responses until September are false. In other words, the "change" after the NYTimes queried Alfa Bank may not be because Cendyn (or Trump) changed anything, but because that was the first they checked and noticed that lookup errors were happening.

But Graham also points out that all this fretting about Trump & Russia misses the real story here. The only reason this is a story at all is because some nameless security researchers started abusing the data they were given access to for malware research. Much of what Foer relies on came from an anonymous researcher going by the name "Tea Leaves". But Graham points out that the real story here is how companies are sharing all sorts of information with security researchers under the belief that it will only be used for malware research... and not for spying on what server is connecting to what server:

Malware research consists of a lot of informal relationships. Researchers get DNS information from ISPs, from root servers, from services like Google's 8.8.8.8 public DNS. It's a huge privacy violation -- justified on the principle that it's for the general good. Sometimes the fact that DNS information is shared is explicit, like with Google's service. Sometimes people don't realize how their ISP shares information, or how many of the root DNS servers are monitored.

People should be angrily calling their ISPs and ask them if they share DNS information with untrustworthy researchers....

This is another reason why we've pointed out that all the focus on "information sharing" in various cybersecurity bills from Congress was a red herring. Information sharing can lead to all sorts of questionable activity. It's done in these instances for the purpose of spotting malware, but it appears some researchers went looking for weird Trump conspiracy theories and were so invested in those theories that they didn't even realize how ridiculous it was when looked at in the light of day -- and also forgot that they're not supposed to reveal they have access to this info.

Yes, of course, we're at the very peak of the political silly season and lots of people are looking for big breaking stories. But it would be nice if we could keep them in the realm of reality.

Filed Under: cybersecurity, dns, donald trump, franklin foer, malware, privacy, research, rob graham, russia
Companies: cendyn

EFF Asks Court To Block The DOJ From Prosecuting Researcher For DMCA Violations

from the jumping-ahead-of-the-threat dept

A few more wrinkles have appeared in the EFF's attempted legal destruction of the DMCA's anti-circumvention clause. Back in July, the EFF -- along with researchers Bunny Huang and Matthew Green -- sued the government, challenging the constitutionality of Section 1201 of the DMCA. As it stands now, researchers are restricted by the limitations built into the anti-circumvention clause. The Library of Congress can grant exceptions, but these are only temporary, lasting three years and generally vanishing at the end of that term.

Projects and research efforts continue to be thwarted by this provision, opening up those who circumvent DRM and other protective measures to the possibility of prosecution. And their options when facing charges are severely limited. There is no "fair use" exception to Section 1201 of the DMCA -- something the EFF would like to see changed.

The threat of prosecution may be mostly existential, but it's still far from nonexistent. This is why the EFF has requested a preliminary injunction that would prevent the DOJ from trying to put its client in jail.

The Electronic Frontier Foundation (EFF) asked a court Thursday for an order that would prevent the government from prosecuting its client, security researcher Matthew Green, for publishing a book about making computer systems more secure.

[...]

But publishing the book, tentatively entitled Practical Cryptographic Engineering, could land Green in jail under an onerous and unconstitutional provision of copyright law. To identify security vulnerabilities in a device he has purchased, Green must work directly with copyrighted computer code, bypassing control measures meant to prevent the code from being accessed.

The injunction request [PDF] points out that -- in addition to the anti-circumvention clause being a form a prior restraint -- Green will be performing the sort of actions the DOJ has prosecuted people for in the past.

A rigorous and effective audit of a computer system’s security requires that Dr. Green analyze the software controlling the system. Often, secure computer systems prevent access to their software code through technological protection measures (“TPMs”) such as encryption, username/password combinations, or physical memory restrictions preventing a user from accessing certain stored information. An adversary seeking to extract information about the software code or about the system’s user, or to install their own malicious software, would seek to bypass these measures in order to maximize their ability to locate and exploit vulnerabilities.

To identify security flaws, Dr. Green must do the same; indeed, finding and reporting on the vulnerability of these access controls is a critical part of auditing the security of the system. If he does not bypass access controls in a computer system, Dr. Green’s research is significantly limited. While he may be able to discover some vulnerabilities, he cannot determine with confidence whether devices are secure against an adversary willing to circumvent access controls.

The DOJ has already responded (sort of) to some of the claims raised in the EFF's injunction request. Its motion to dismiss [PDF] -- filed the same day as the EFF's injunction request -- claims the EFF and Matthew Green have no standing to challenge Section 1201 of the DMCA. Not only that, but they cannot provide any evidence prosecution is likely if Green continues with his research work.

Plaintiffs’ claims should be dismissed in their entirety. As an initial matter, Plaintiffs lack standing to raise their First Amendment claims on a pre-enforcement basis because the assertions in their Complaint fail to establish a credible threat of prosecution, under the DMCA’s criminal enforcement provision, for engaging in constitutionally-protected activity. None of the Plaintiffs claims to have been threatened with criminal prosecution. Plaintiffs’ conclusory assertion that others have been prosecuted under the DMCA in the past, for unidentified reasons, is insufficient to establish that Plaintiffs face a credible threat, as is their assertion that third parties might bring suit against them under a separate civil private right of action. Moreover, Plaintiffs fail plausibly to assert that the acts of circumvention and trafficking that they wish to undertake qualify as speech or expressive conduct that is entitled to First Amendment protection but prohibited by the DMCA.

The DOJ's arguments roughly align with the assertions made in its motion to dismiss in a lawsuit brought by security researchers and the ACLU against the much-hated CFAA. Once again, the DOJ recognizes that Green's book may be covered by the First Amendment, but actions taken during its compilation may not be.

In both cases, though, the statutes lend themselves to punishing security researchers for performing security research. While the DOJ may have no intention of prosecuting Green for his work, the anti-circumvention clause allows it to hold onto that option for as long as it wants to. The only way to guarantee this won't happen is to obtain an injunction, but chances are the court won't be as interested in staving off the theoretical as it will be in examining the First Amendment claims.

Filed Under: anti-circumvention, copyright, dmca, dmca 1201, doj, matthew green, research
Companies: eff

Scientists Realizing That EU Ruling On Copyright & Links Just Made Science Much More Difficult

from the to-promote-the-progress-of-science dept

Last week, we wrote about a terrible copyright ruling from the Court of Justice of the EU, which basically says that any for-profit entity that links to infringing material can be held liable for direct infringement, as the "for-profit" nature of the work is seen as evidence that they knew or should have known the work was infringing. We discussed the problems with this standard in our post, and there's been a lot of commentary on what this will mean for Europe -- with a variety of viewpoints being expressed. One really interesting set of concerns comes from Egon Willighagen, from Maastricht University, noting what a total and complete mess this is going to be for scientists, who rarely consider the copyright status of various data as databases they rely on are built up:

Now, realize that in many European Commission funded projects, with multiple partners, sharing IP is non-trivial, ownership even less (just think about why traditional publishers require you to reassign copyright to them! BTW, never do that!), etc, etc. A lot of funding actually goes to small and medium sized companies, who are really not waiting for more complex law, nor more administrative work.

A second realization is that few scientists understand or want to understand copyright law. The result is hundreds of scholarly databases which do not define who owns the data, nor under what conditions you are allowed to reuse it, or share, or reshare, or modify. Yet scientists do. So, not only do these database often not specify the copyright/license/waiver (CLW) information, the certainly don't really tell you how they populated their database. E.g. how much they copied from other websites, under the assumption that knowledge is free. Sadly, database content is not. Often you don't even need wonder about it, as it is evident or even proudly said they used data from another database. Did they ask permission for that? Can you easily look that up? Because you are now only allowed to link to that database until you figured out if they data, because of the above quoted argument. And believe me, that is not cheap.

Combine that, and you have this recipe for disaster.

A recipe for disaster indeed.

This is, of course, not the first time we've noted the problems of intellectual property in the science world. From various journals locking up research to the rise of patents scaring off researchers from sharing data, intellectual property keeps getting in the way of science, rather than supporting it. And that's extremely unfortunate. I mean, after all, in the US specifically, the Constitution specifically says that copyrights and patents are supposed to be about "promoting the progress of science and the useful arts."

Over and over again, though, we see that the law has been twisted and distorted and extended and expanded in such a way that is designed to protect a very narrow set of interests, at the expense of many others, including the public who would benefit from greater sharing and collaboration and open flow of data among scientific researchers. Having the CJEU make things worse in Europe isn't going to help Europe compete -- and, unfortunately, it does not look like those in Europe looking to update its copyright laws understand any of this yet.

Filed Under: copyright, eu, links, research, science

DOJ To Researchers: First Amendment Does Not Protect Violating Websites' Terms Of Services

from the SRO-only-in-the-court-and-not-much-here-to-grab-floor-space dept

The woefully out-of-date CFAA -- the product of panicked early-80s legislating in response to underdeveloped hacker fears -- continues to hold back research (both of the security and non-security kind) when not being wielded like the prehistoric weapon it is by the DOJ and multiple entities who prefer bludgeoning the messenger to fixing their broken systems.

Because of the ongoing misuse and abuse of a badly-written law (aided and abetted by some terrible court decisions), a group of academic researchers has decided to proactively sue the government over its terrible legislation, rather than wait around to get sued/indicted for attempting to determine if individual websites exhibit bias against certain users.

They've enlisted the help of the ACLU, which filed its suit against Attorney General Loretta Lynch back in June. The DOJ has responded with a motion to dismiss [PDF] that claims everything is wrong with the lawsuit, from the issue of standing to multiple failures to state a claim under the First and Fifth Amendments.

Plaintiffs fail to allege an injury in fact sufficient to meet the constitutional minimum of standing. Standing to assert pre-enforcement statutory challenges under the First and Fifth Amendments may exist where the statute in question regulates constitutionally protected conduct and a credible fear of prosecution exists. The challenged provision of the CFAA, however, does not facially regulate protected conduct, and the conduct in which plaintiffs intend to engage—deploying information-gathering software on the websites of non-consenting private entities—is not activity that the First Amendment protects. Moreover, plaintiffs fail to provide any facts indicating a credible threat that the challenged provision will be enforced against them: plaintiffs do not allege to have been investigated by law enforcement or threatened with an enforcement action; plaintiffs do not identify any cases in which the government has sought to enforce the CFAA for harmless terms of use violations that were not in furtherance another crime or tort; and the government has affirmatively stated that it has no intention to enforce the CFAA under the circumstances alleged here. Accordingly, plaintiffs are unable to assert an objectively credible threat of prosecution and, as a result, their complaint must be dismissed on standing grounds.

It is indeed difficult to sue to prevent things from happening, rather than suing to seek recourse after damage has been done. Speculating about future Constitutional violations is even less likely to succeed, as many courts tend to avoid tangling with any civil liberties questions not directly implicated by the case at hand. These two issues alone may find the court agreeing with the DOJ's assertions.

However, other assertions made by the government aren't as solid. While it is true the DOJ tends not to prosecute simple CFAA violations without a connection to other criminal activity, when it does choose to do so, it tends to respond with zealous, fear-based prosecution and incredibly severe sentence recommendations.

That the DOJ has magnanimously offered to not enforce the CFAA against the researchers at this point is heartening, as far as that promise goes. The DOJ may have no intention of doing so now, but if the researchers roll up on the wrong website and set some influential wheels to squeaking, that could change.

The DOJ is on less solid ground when it argues the CFAA does not create a chilling effect. It may be that the research effort (deploying bots to simulate job seekers, home buyers, etc.) is not a form of protected speech, but that doesn't mean speech -- and research efforts -- aren't being deterred by the badly-written and vaguely-interpreted law.

The government doesn't contend, however, that the results of the research won't be protected under the First Amendment -- just that the method of gathering the data isn't.

Here, plaintiffs allege that the challenged provision of the CFAA has chilled their desire to deploy software technology designed to gather information from the websites of private corporations without the permission of those corporations and in a manner that the relevant website terms of use expressly prohibit. The systemic collection of information from the websites of non-consenting private entities is not conduct the First Amendment protects, and thus plaintiffs are unable to assert a reasonable First Amendment chill with respect to that conduct.

[...]

Thus, just as there is no First Amendment right to gather information by personally travelling to a sanctioned country, and no First Amendment right to gather information by visiting a jail without the permission of the warden, and no First Amendment right to access information in electronic form rather than paper form, there is likewise no First Amendment right to gather information controlled by private entities by deploying a data-scraping computer program on the websites of those entities without their permission and in a manner that the entities explicitly prohibit.

And there's the chicken-egg problem with the First Amendment, which follows after the other chicken-egg dilemma of having to wait to be prosecuted (or threatened with prosecution) before being granted standing to challenge the government's enforcement efforts. To use the DOJ's cited equivalents, delivering the news is protected under the First Amendment. Gathering it, however, may not be.

What the DOJ doesn't spend any time explaining is why researchers might get the idea the government would come after them for performing this research. The DOJ has explicitly stated in the past that violating a website's terms of use violates the CFAA, making criminals of millions of pre-teens with Facebook or Twitter accounts. And the DOJ's own suggested rewriting of the CFAA looks to turn previous misdemeanors into felonies, including the sort of activity the researchers are proposing.

...knowingly and willfully traffics... in any password or similar information, or any other means of access, knowing or having reason to know that a protected computer would be accessed or damaged without authorization in a manner prohibited by this section…

The rewrite removes a key phrase: "with intent to defraud." This excision turns the researchers' plan to search for bias in websites into an admission of felonious intent.

That being said, there's a good chance this lawsuit will be tossed quickly. The route to CFAA reform still flows (slowly and sometimes, stupidly) through Congress. Unfortunately, the stakeholders with the loudest voices are those who prosecute under the law, rather than those punished by it. Because of that barrier to true reform, efforts to attack the law from oblique angles are likely to appear periodically until the law is overhauled… or replaced with something worse.

Filed Under: cfaa, chilling effects, doj, first amendment, hacking, research
Companies: aclu