Aaron's Law Finally Introduced: Reform The CFAA

from the it's-about-time dept

Today, Zoe Lofgren and Jim Sensenbrenner in the House and Ron Wyden in the Senate introduced "Aaron's Law," an attempt to reform the widely abused CFAA, so that it no longer sweeps up innocent activity.

Vagueness is the core flaw of the CFAA. As written, the CFAA makes it a federal crime to access a computer without authorization or in a way that exceeds authorization. Confused by that? You're not alone. Congress never clearly described what this really means. As a result, prosecutors can take the view that a person who violates a website's terms of service or employer agreement should face jail time.

So lying about one's age on Facebook, or checking personal email on a work computer, could violate this felony statute. This flaw in the CFAA allows the government to imprison Americans for a violation of a non-negotiable, private agreement that is dictated by a corporation. Millions of Americans — whether they are of a digitally native or dial-up generation — routinely submit to legal terms and agreements every day when they use the Internet. Few have the time or the ability to read and completely understand lengthy legal agreements.

The proposal tries to focus the law back to where it was intended when initially put in place:

It establishes a clear line that's needed for the law to distinguish the difference between common online activities and harmful attacks.

Among those specific lines, it notes that a "mere breach of terms of service, employment agreements, or contracts are not automatic violations of the CFAA." It also makes the penalties more reasonable, so people aren't facing many years in jail for doing something minor. It's well past due that the CFAA get fixed. Hopefully this is a start down that path.

Filed Under: aaron swartz, aaron's law, cfaa, cfaa reform, jim sensenbrenner, ron wyden, zoe lofgren

Bill Introduced To Fix Anti-Circumvention Provision Of DMCA

from the well-needed dept

While there was a lot of talk after the White House agreed with an awful lot of people that mobile phone unlocking should be legal, there's been little real action. Part of the problem might be that the White House suggested that this could be fixed via telecom law, when the whole issue had nothing to do with telecom law, but the broken anticircumvention provisions of the DMCA, also known as 17 USC 1201. While Congress did put forth a bunch of bills, they were all lacking, and none seemed to really tackle the underlying problem: 17 USC 1201 is completely broken. It makes circumventing a technical protection measure a form of infringement, even if the circumvention has nothing to do with actual copyright infringement. Furthermore, it makes it illegal to "manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof," that is primarily designed for circumventing digital locks even if the end use is not infringing.

Thankfully, Rep. Zoe Lofgren has finally introduced a real reform bill that tries to tackle this issue, along with Rep. Thomas Massie, Rep. Anna Eshoo and Rep. Jared Polis. The bill, called the Unlocking Technology Act of 2013, changes the law to make it clear: if you circumvent some sort of digital lock for a reason that has nothing to do with infringement, it would no longer be illegal. Basically, it would add the following:

It shall not be a violation of this section to circumvent a technological measure in connection with a work protected under this title if the purpose of such circumvention is to engage in a use that is not an infringement of copyright under this title.

Similarly, circumvention tools that have primarily non-infringing uses would also be legalized. It would still be illegal to do that big list of things above if the intent is to infringe, but merely creating the tools for non-infringing purposes would be legalized. Thus, tools for unlocking mobile phone, and the act of unlocking mobile phones, would be legal.

The bill also has two other key pieces. First, it makes it clear that it is not copyright infringement to switch networks and then access or load a copy of software that is stored in RAM. This seems very specific, but some operators have argued that by putting in a clause in a user agreement that forbids switching networks, those who do so could infringe by then accessing software stored in memory.

Finally, and perhaps most importantly, the bill addresses the claims that fixing the DMCA would violate trade agreements (we've heard seven different trade agreements would be violated with this simple fix of the DMCA) by telling the President that Congress says he needs to fix those agreements. Nice and simple:

The President shall take the necessary steps to secure modifications to applicable bilateral and multilateral trade agreements to which the United States is a party in order to ensure that such agreements are consistent with the amendments made by this Act.

This is actually really important. Because (just watch) copyright maximalists love to scream about how changes like this would "violate our international obligations" (while leaving out the fact that they were the ones who wrote half of those agreements in the first place). But the fact is that Congress has authority over international trade, not the executive branch. So if Congress wants, as would be the case with this bill, it can order the executive branch to change or fix any international agreements that get in the way of good law.

Filed Under: 1201, anna eshoo, anti-circumvention, circumvention, digital locks, dmca, jared polis, mobile phone unlocking, thomas massie, trade agreements, zoe lofgren

Congress Tries, Yet Again, To Fix Outdated Electronic Privacy Laws

from the that-4th-amendment-thing dept

We've been writing about ECPA reform for ages. In case you haven't been following this, ECPA is an incredibly outdated law concerning the privacy of electronic communications. As it stands now, thanks to some oddities in the law, the government can often access your online data with little oversight (among the many oddities in the bill, it considers emails on a server for more than 180 days "abandoned" and accessible by the government without a warrant). While many politicians in Congress claim that they're in favor of ECPA reform, little ever seems to happen with it. Late last year it had looked like a deal might have been worked out whereby Congress would approve strong ECPA reform that would respect the privacy of our data, in exchange for also reforming privacy laws concerning video rental data (basically a favor to Netflix and Facebook).

Law enforcement, as always, flipped out about the ECPA reform bit, and at the very, very end of Congress, the video rental reform stuff passed while ECPA reform was left on the cutting room floor.

This week, however, ECPA reform has been brought back once again, this time in the House, by Rep. Zoe Lofgren, along with Reps. Ted Poe and Suzan DelBene. The proposed bill, called The Online Communications and Geolocation Protection Act, is embedded below. It's a strong bill, meaning law enforcement folks are likely to flip out again. Among the reforms, it would set up a clear and consistent standard for requiring a warrant for government access to electronics communication. That is, it will get rid of the hodge podge of ECPA rules that change based on how old the communications are, if it's been opened, if it's a draft, etc. Now, we just get one rule, across the board, and that rule is get a warrant. It also requires (with a few exceptions) that notice be given to the user/account holder, so that people actually know when the government goes looking through their data.

In an attempt to appease law enforcement, the bill leaves in many "exceptions," that will allow law enforcement to bypass these rules in certain cases. The bill would be stronger without these exceptions, but there's no way the bill passes without something like that in there.

As you may have realized from the name, the bill also has a section dealing with "geolocation" information. This is important because there are a bunch of ongoing fights concerning the privacy of your location data (obtained via mobile phones, GPS devices and such). As we've covered here repeatedly, the courts have been ruling every which way on the legality of law enforcement accessing this kind of data, and so the bill tries to clarify that, and puts in place prohibitions on the government intercepting location info without a warrant (with, of course, a few key exceptions -- including in an emergency, if the person gives consent or if the data is already public).

It's a good bill that deserves support. While it may not be perfect, it's a hell of a lot better than what we have now. This would be a huge step up in protecting our privacy from government intrusion, which means it's going to be an uphill battle against law enforcement interests to get it passed. That said, maybe this is finally the year when all those elected officials who claim ECPA reform is important get their act together and vote to approve real reform.

Filed Under: congress, ecpa, ecpa reform, geolocation data, privacy, zoe lofgren

Global Free Internet Act Introduced In Congress

from the these-things-matter dept

Somehow, with little fanfare, last week Rep. Zoe Lofgren (along with Reps. Eshoo, Matsui and Honda) introduced the Global Free Internet Act of 2013, which appears to be a new version of a similar bill from last year. You should read the full bill yourselves, but it points to the importance of a "single, open, global internet," as well as certain things that might threaten that. Among the things it lists are important, are that we, as a country:

(A) encourage utilization on a global basis of technology standards set by international standards-setting organizations, including industry-led and other voluntary bodies, and selected by the market;
(B) respect the security of information, privacy, and speech of Internet users;
(C) promote investment in Internet-related innovation;
(D) refrain from compelling Internet service providers and other intermediaries to restrict the free flow of information on the Internet; and
(E) allow trade in Internet-related goods, services, information, and content.

And it worries about governments seeking to censor or constrain the internet by doing any of the following:

(A) mandating unique technology standards favoring domestic producers as a condition of market access or pursuing related policies regarding standard-setting that are discriminatory and subvert the open, global nature of the Internet;
(B) sponsoring or tolerating the use of Internet-related tools to gain unauthorized access to public-sector and private-sector networks in the United States to disrupt their operation;
(C) blocking, filtering, or otherwise restricting Internet communications in a manner that discriminates against Internet-based services and content originating in other countries;
(D) monitoring Internet use and communications in a manner that restricts individual privacy and freedom; and
(E) imposing market access requirements or liabilities that discriminate against or otherwise impede Internet-related goods, services and content from other countries.

It then goes on to create a task force to take on these issues, and to help the government promote the first list, while avoiding the second. It seems like a perfectly reasonable plan, with little controversial about it, which is why I wouldn't be surprised to see Congress ignore it.

Filed Under: anna eshoo, doris matsui, global internet freedom act, internet freedom, mike honda, zoe lofgren

Publishers Flip Out, Call Bill To Provide Open Access To Federally Funded Works A 'Boondoggle'

from the gotta-lock-it-up dept

A year ago, we wrote about Rep. Mike Doyle introducing an important bill to provide public access to publicly funded research. As we've been discussing for years, the academic journal business is a huge boondoggle. Unlike just about any other publication, the journals don't pay their writers (and in many subject areas, authors need to pay to submit), they don't pay the peer reviewers -- and then they charge positively insane amounts to university libraries, often knowing that those libraries feel obligated to pay. Oh yeah, and the journals keep the copyright on everything. I've heard of researchers having to redo basic experiments because they were worried they couldn't even reuse data from earlier experiments due to the copyright assignment agreement they had to sign.

Thankfully, for years, there's been a law on the books for any NIH-funded research to guarantee that 12-months after publication, those works also had to be published openly. While some publishers have tried to game this system (such as by demanding a mandatory fee to "deposit" the work in an open access database), on the whole this has been hugely important in making sure that taxpayer funded research is actually available and can be built upon. Over the years, there have been multiple bills introduced in both directions on this issue. There have been some bills that sought to take away this requirement under NIH funding and there have been bills that have tried to expand it to the rest of the federal government and any of the research they sponsor.

Last week, a new version of Doyle's bill was introduced and it's been improved. First off, it's got some nice bipartisan backing in both parts of Congress. On the Senate side, it was co-sponsored by Senators Cornyn and Wyden, while on the House side we've got Doyle along with Reps. Yoder and Lofgren. Also, it reduces the time to open publishing from one year down to six months (like a NY bill that came out last year). It doesn't spread the policy to all federal agencies, but the vast majority of federally funded resarch would qualify (all agencies that spend over $100 million on research are covered).

As the EFF notes in the link above, there are a few lingering concerns about the bill, including some broad language around exemptions for works that "generate revenue or royalties for authors." Also, it could go further in not just requiring open access, but open licensing to make sure such works can more easily be built on to create next generation research. However, those are small quibbles.

But, of course, the publishers are really not happy about all of this, calling it "different name, same boondoggle." This is quite incredible, really, since it's really the publishers who have been getting away with a giant boondoggle for ages. If that gives you an idea about just how ridiculous the publishers' claims are, read on. Nearly every claim they make in attacking the bill actually applies to the publishers themselves much more than to the bill:

It would add significant, unspecified, ongoing costs to those agencies’ budgets in the midst of ongoing federal deficit reduction efforts.

As opposed to keeping the works locked up, which adds significant, unspecified and ongoing costs to anyone trying to actually do research and be educated?

Finally, it would undermine publishers’ efforts to provide access to high-quality peer-review research publications in a sustainable way, while ignoring progress made by agencies collaborating with publishers to improve funding transparency.

No it wouldn't. We already have the NIH example. Nothing in that "undermined" the publishers' efforts. Again, all that "high quality peer review" stuff comes for free: both the content and the peer reviewing. Most other publications somehow, magically, get by paying their writers and editors and don't have to charge tens of thousands of dollars for a subscription.

“This bill would waste so much taxpayers’ money at a time of budgetary crisis, squander federal employees’ time with busywork and require the creation and maintenance of otherwise-unneeded technology,”

This is the funniest of all. The real "waste" of taxpayer money is in funding all this research that then gets locked up and is nearly useless to those taxpayers.

Basically, the publishers know that their current position with these journals is such a sweet deal that they don't want anything to mess with it at all. That's ridiculous. While they're fighting for ever bigger profits, we're talking about access to research that was funded with our own dollars. It's really sad that the publishers would fight such a thing, though it shows what they really think concerning education. To them, it's not about how best to disseminate information, but how to lock it up and charge insanely high prices for it.

Filed Under: faster, federally funded research, john cornyn, mike doyle, open access, publishers, ron wyden, zoe lofgren

Rep Zoe Lofgren Continues To Improve 'Aaron's Law' Via Reddit

from the the-new-way-to-do-legislation dept

A few weeks ago, we wrote about Rep. Zoe Lofgren announcing plans to via Reddit, to introduce CFAA reform, called "Aaron's Law." Since then, Lofgren has taken into account numerous concerns and thoughts from various stakeholders, many of whom discussed it directly on Reddit, and has now announced a second draft, also via Reddit. While the folks at EFF note that there are still some additional improvements needed, it is, certainly, an important step forward in much needed CFAA reform.

Of course, perhaps just as important is showing how this sort of public engagement in democracy can really work. The original draft of Aaron's Law did receive some criticism from some people (including mocking by some of our usual critics in our comments), without any hint of recognition that this is part of the process. It wasn't introduced on Reddit because it was complete, but in order to get feedback for these kinds of future drafts. That is an important point, and other legislators would do well in paying attention. And, of course, even this is not a finished product, but another snapshot as to where the process is now, with more ability for people to weigh in.

Thank you, Reddit and everyone else who provided feedback to the original rough draft bill to reform the Computer Fraud and Abuse Act (CFAA) and the wire fraud statute – the laws the government used to unfairly prosecute Aaron Swartz. With the help of Internet freedom advocates, computer and legal experts, the draft has been revised and is available here. I have been in communication with Aaron’s father who supports this draft bill and approves of the name “Aaron’s Law.”

Like the first draft, this revised draft explicitly excludes breaches of terms of service or user agreements as violations of the CFAA and wire fraud statute. This revised draft also makes clear that changing one's MAC or IP address is not in itself a violation of the CFAA or wire fraud statute. In addition, this draft limits the scope of CFAA by defining "access without authorization" as the circumvention of technological access barriers. Taken together, the changes in this draft should prevent the kind of abusive prosecution directed at Aaron Swartz and would help protect other Internet users from outsized liability for everyday activity.

As our discussions have continued, it is clear that many believe a thorough revision of the CFAA and substantial reform of copyright laws are necessary. I agree. “Aaron’s Law” is not this complete overhaul, but is a first step down the road to comprehensive reform. If we succeed in getting this draft bill enacted into law, it will be in honor of Aaron Swartz, and should be seen as a beginning of a concerted effort to bring reform to these broader issues. To be successful, that effort will likely take substantial time and require sustained and intense support from all of you in a push that will need to exceed our stoppage of SOPA.

I see “Aaron’s Law” as common sense fixes that should be enacted to stop the kinds of abuse Aaron was subjected to from affecting others. I intend to introduce a final version of "Aaron's Law" as legislation soon, and in talking with my friend Sen. Ron Wyden of Oregon, I understand he wants to introduce it in the Senate as well. I will be urging my colleagues in the House of Reps to become cosponsors. The chances of success – whether for "Aaron's Law" or other proposals – will depend greatly on the degree of positive public engagement and support to change the law. As SOPA showed, when the Internet speaks, lawmakers listen. I think with enough constructive support we can have an opportunity to pass "Aaron's Law."

Many thanks to all of you – Zoe

Whether or not this actually works for this bill -- or whether or not this really is the full type of CFAA reform that we need (and I do think it's as good step in the right direction), it's fascinating to watch the process itself.

Filed Under: aaron swartz, cfaa, crowdsourcing, reddit, reform, zoe lofgren
Companies: reddit

Rep. Zoe Lofgren Plans To Introduce 'Aaron's Law' To Stop Bogus Prosecutions Under The CFAA

from the one-step dept

There's been talk for years about fixing the Computer Fraud and Abuse Act (CFAA), which has been widely abused by law enforcement/prosecutors to claim that basically any use of a computer that did not fall under the explicitly allowed uses was a form of "computer hacking" -- and potentially a felony. This allowed for law enforcement to go after all sorts of people -- including anyone who did anything on a computer that their employer didn't like. Or anyone whosent spam. Or anyone who reported on a data vulnerability. Or anyone who just senta too many emails. These and many more cases mostly revolved around a stretched interpretation of the (outdated) CFAA, which suggested that simply violating a terms of service was the equivalent of "unauthorized access," and thus a "hacking" violation. Courts have so far been somewhat split on this interpretation, with some buying it and others not buying it at all.

The abuse of the CFAA has been seen in some high profile cases, including the one against Lori Drew, after a young girl, who was a friend of Drew's daughter, killed herself following a "dispute" with a fake profile of a boy that was really set up by Drew and some others. The court eventually tossed that out (though a jury convicted her). But it seems tragically ironic that a law that prosecutors once used (they claimed) to go after someone for bullying someone to commit suicide, is now itself being blamed for prosecutors' own bullying tactics, which many (including his parents) now insist led to the suicide of Aaron Swartz.

Congress has approved fixes for the CFAA in the past, but they've never made it all the way into law. The unfortunate, untimely and tragic death of Aaron Swartz may have brought back politicians' interest in making such a fix. Rep. Zoe Lofgren announced on Reddit her plans to introduce "Aaron's Law" to fix one glaring weakness in the CFAA: the idea that any terms of service violation is akin to hacking and fraud under the law. The draft bill rejects such an interpretation explicitly:

Section 1343 of title 18, United States Code, is amended by inserting after the first sentence the following: ‘‘A violation of an agreement or contractual obligation regarding Internet or computer use, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or employer is not in itself a violation of this section.’’

Hopefully, this new Congress can look at the unfortunate situation with Aaron (and many others) and how prosecutors are using the CFAA as a weapon to browbeat people they don't like into guilty pleas on garbage charges, and finally pass this much needed fix to the CFAA.

Filed Under: aaron swartz, cfaa, computer fraud and abuse act, zoe lofgren

Rep. Lofgren Looks To Reddit To Help Crowdsource Anti-SOPA

from the not-sure-that-will-work dept

Rep. Zoe Lofgren, who has been one of the few leaders in Congress when it comes to pushing for real copyright reform and pushing back against the bad proposals of Hollywood, is apparently looking to use Reddit to crowdsource a new bill concerning internet freedom. Earlier this year, we noted that Lofgren had introduced two good bills -- one on ECPA reform (pushing for more privacy for your communications) and one called the Global Internet Freedom Act to create a task force designed to ensure internet freedom. It will be interesting to see how well this works.

Of course, post-SOPA, some on Reddit sought to crowdsource a bill on internet freedom themselves, and the process went a bit off the rails. I don't know that crowdsourcing is the best way to create a bill. I could see how it would be very handy in critiquing and improving an existing bill -- or maybe just generating ideas for a bill -- but if it's just starting from scratch, quality control could be an issue. Either way, this seems like an interesting experiment that will be worth watching.

Filed Under: anti-sopa, copyright, crowdsourcing, internet freedom, zoe lofgren
Companies: reddit

Rep. Lofgren Gives USTR A Simple 3-Point Plan For Real TPP Transparency

from the let's-try-that-out dept

We've discussed, repeatedly, the incredible lack of transparency from the USTR regarding the TPP negotiations. Back in June, we noted that 130 Congressional Representatives all got together to send USTR Ron Kirk a letter, noting their concerns. At the end of August, Kirk replied (pdf) with his standard talking points. He insists that meeting with people is "transparency," even if they can't see the document. He insists that Congress has access to the TPP, even though the USTR locks out key staffers, and doesn't let the elected officials take notes or make copies. He insists that the document needs to be classified because it's the way things have always been done (which is generally a sign of someone not having much of a real argument).

Either way, Rep. Zoe Lofgren is unimpressed. She's now sent Kirk a letter, responding to Kirk's request for "suggestions" on how to improve transparency with some rather simple and straightforward ideas (pdf and embedded below), meaning that it's unlikely the USTR will pay much attention to them. You can read the full version at that link, but here's my summarized version, with commentary:

1. USTR should make the US positions (not those of other countries) open to the public. She doesn't even say the full text needs to be open, but merely summaries of the US's position. It's hard to see any reasonable argument against this. Since the USTR is negotiating on behalf of the American public (in theory, though the reality often seems so different), it seems ridiculous that the USTR would ever not put out at least summaries of its positions on what it's negotiating. Contrary to Kirk's claims, this does not weaken the US's negotiating ability at all. Quite the opposite, it strengthens it by making it subject to public scrutiny and input, while also highlighting to the world our resolve in coming up with a proposal that the public will accept.
2. Any IP section within TPP must have strong support for flexible "limitations and exceptions" for things like fair use and the public domain. While the USTR has shown a willingness to include some text on limitations and exceptions, the most recent leak raises questions since it appears to be rather inflexible and goes much further than is reasonable.
3. USTR should create more representative "trade advisory committees," which it consults on these issues. As it stands, the ITACs (International Trade Advisory Committee) is heavily, heavily biased in favor of older legacy industries, rather than innovators or the public. Lofgren reasonably suggests that a lot more thought and effort should go into fixing how unbalanced these committees are, since they have tremendous influence over the text.

These three basic changes won't fix all the problems -- not by a long shot -- but they would, at the very least, provide a bit more transparency and involvement, while also guaranteeing that we don't push a solely maximalist agenda in other countries. And, because of that, I fully expect the USTR to ignore all of these suggestions.

Filed Under: copyright, ron kirk, tpp, transparency, ustr, zoe lofgren

Rep. Lofgren Introduces Global Free Internet Act

from the needed,-but-unlikely dept

Rep. Zoe Lofgren has recently announced two brand new, but important bills (pdf): there's HR 6529, which is an ECPA reform act and HR 6530, the Global Internet Freedom Act. The ECPA reform effort is one we've discussed a few times recently. It's much needed, but law enforcement officials are pushing back against it because it would require them to get warrants before spying on electronic communications -- which is something they don't want at all. Here's what the bill would do according to Lofgren's fact sheet:

1. The government should obtain a warrant before compelling a service provider to disclose an individual’s private online communications.
2. The government should obtain a warrant before it can track the location of an individual’s wireless communication device.
3. Before it can install a pen register or trap and trace device to capture real time transactional data about when and with whom an individual communicates using digital services (such as email or mobile phone calls), the government should demonstrate to a court that such data is relevant to a criminal investigation.
4. The government should not use an administrative subpoena to compel service providers to disclose transactional data about multiple unidentified users of digital services (such as a bulk request for the names and addresses of everyone that visited a particular website during a specified time frame). The government may compel this information through a warrant or court order, but subpoenas should specify the individuals about whom the government seeks information.

All of these seem perfectly reasonable -- but given how hard law enforcement has fought against earlier ECPA reforms, it seems unlikely it'll go anywhere.

The Free Internet effort is also important, obviously, if a bit more vague. Lofgren's summary:

The Global Free Internet Act would create a Task Force on the Global Internet that identifies, prioritizes, and develops a response to policies and practices of the U.S. government, foreign governments, or international bodies that deny fair market access to Internet-related goods and services, or that threaten the technical operation, security, and free flow of global Internet communications. Members of the Task Force include the heads of several executive branch agencies, four U.S. persons nominated by Congressional leadership, and four U.S. persons who are not government employees nominated by the Internet itself. The Task Force would hold public hearings, issue reports no less than annually, and coordinate the activity of the U.S. government to respond to threats to the Internet. When the next SOPA-like legislation, restrictive international trade agreement, or overbroad treaty from an international body becomes a threat, it is the job of this Task Force to sound the alarm and propose a course of action

This is basically something that the government probably should have done a while ago, if it truly believed in the importance of an open and free internet... which is exactly why it, too, seems unlikely. And, of course, bills introduced at this point are unlikely to go very far, seeing as Congress is out of session for election season, only to come back briefly for a lame duck session after the election. It would be great if these bills got some attention, but unfortunately they're unlikely to do much this time around. Hopefully Lofgren introduces similar bills next year too.

Filed Under: ecpa, innovation, internet freedom, privacy, reform, zoe lofgren