Good Ruling In California Protects Anonymity Of Online Critics -- Even When The Information Was False

from the anonymity-is-important dept

Over and over again we've seen people try to interpret anything someone says about them that they don't like as defamatory. But just because you don't like what's said, that doesn't make it defamatory -- and that can also apply even if the statements actually were false.

We've written a lot in the past about the importance of protecting anonymous speech online, so it's good to see a good ruling in California protecting the anonymity of an online critic (found via Eriq Gardner's story at The Hollywood Reporter). The story involves an anonymous email that was sent to a Sony exec and a producer working on the movie Goosebumps, raising some issues about a visual effects company, named Vitality, doing work on the film. There's a lot of background here that can get confusing so I'll try to detail it here as simply as possible:

1. A few years ago, a special effects house named Hydraulx did visual effect work on a Sony Pictures film, Battle: Los Angeles.
2. At the same time, Hydraulx was producing an entirely separate (non-Sony) film Skyline that had some similar plot points (aliens invade LA).
3. There was a fairly public dispute in which Sony accused Hydraulx of a variety of things stemming from this apparent conflict of interest. Eventually that dispute was settled.
4. Sony and the producers of Goosebumps hired a visual effects company named Vitality to work on the effects in that movie.

There's some more in there, but that should cover the key establishing facts. This lawsuit was against an anonymous person who sent an email to Sony and a producer of Goosebumps suggesting Vitality is actually the same company as Hydraulx and expressing surprise that Sony would work with them again after the earlier dispute -- and also wondering if perhaps Vitality had hidden the Hydraulx connection in getting the job. Here's the email:

I hoped I might whistle-blow on Vitality Visual Effects and Hydraulx. I was surprised to see ‘Goosebumps’ on Vitalitys [sic] IMDB as Vitality is co-owned by Greg and Colin Strause of Hydraulx and I thought neither you nor Sony had a good relationship with the Brothers after Skyline/Battle L.A.

Vitality and Hydraulx share owners (Greg & Colin), their Exec Guy Botham works for both companies - Vitality and Hydraulx even share L.A. and Vancouver offices, hardware, and infrastructure.

If Vitality misinformed you or Sony as to its ownership or profit participants in any way, please take my email into consideration.

I am a concerned vfx professional whom, myself, has been burned by Greg and Colin and I do not like people perpetuating what I consider bad business practices.

Thank you for your time in reading. I hope this email helps.

Regards,
A concerned VFX recruit.

Separately, Hydraulx and the Strauses were already engaged in a defamation lawsuit against some anonymous critics who had sent emails to a movie studio that Hydraulx was working with, claiming that the company was on the verge of financial collapse. Perhaps thinking this new email was from the same, or a related, individual Hydraulx added this person "Doe 2" to that lawsuit and went about trying to discover who it was. Doe 2 filed an anti-SLAPP claim under California's (pretty good) anti-SLAPP law.

A state trial court recognizing (correctly) that you can't reveal anonymous speakers without showing a prima facie case of defamation looked at the various statements in the email and determined that they were enough to show defamation -- and then ordered discovery to go forward to identify Doe 2. To establish the defamation case, there were statements from the various people behind Hydraulx and Vitality insisting that the Strause brothers had no ownership at all in Vitality (there are separate statements in the ruling suggesting that Hydraulx had sold its old equipment to Vitality, but it's never addressed if that's true or not) On appeal, the appeals court has rejected that pretty soundly, noting that a variety of points. But, most importantly, it finds that even though the statement about the same ownership may be false, that isn't enough to reveal an anonymous speaker.

The key to rejecting the defamation claim: most of the statements aren't actually about Hydraulx, but Vitality. On top of that, all of the statements can be seen as either statements of opinion or simply not defamatory at all. There's a big discussion on whether or not the use of the word "whistle-blow" implied some sort of criminal activity on the part of Hydraulx, but the court says it does not:

The trial court expressed a concern that “in the language of the law,” “whistleblower” implied Hydraulx engaged in criminal or wrongful conduct: “People don’t whistle-blow fun, nice things that are meaningless. People whistle-blow wrongdoing. . . . And the word whistle-blow . . . causes me to read it in a different light.” While we agree that, in the context of litigation, the term “whistle-blow” can imply an allegation of criminal or wrongful conduct, we must consider the word in the context of Doe 2’s emails and measure its use “not so much by its effect when subjected to the critical analysis of a mind trained in the law, but by the natural and probable effect upon the mind of [the] reader.”...

The specific wording of the emails, and the order in which the information is communicated, are instructive. Doe 2 opened his emails with cautionary language, saying, “I hoped I might whistle-blow on Vitality Visual Effects and Hydraulx.”... The words “hoped” and “might” before “whistle-blow” signal that Doe 2 is using the term hyperbolically to introduce a communication of specific information that the recipients may not know. In context, the term explains why he is writing and introduces the information about Vitality and Hydraulx’s supposed shared ownership, which, in and of itself, is not defamatory.

The court also notes that just because the common ownership of the two companies, even while false, is not defamatory:

Although Greg Strause’s and Bothman’s declarations were sufficient to make a prima facie showing of falsehood with respect to the statements associating Hydraulx with Vitality, the allegation of common ownership is not defamatory on its face and Hydraulx has not offered any extrinsic facts supporting a defamatory innuendo. To the contrary, because Hydraulx’s complaint and declarations portray both companies in a positive light, there is no indication that the inaccurate attribution of common ownership was defamatory.

On top of that throughout the email, it's pretty clear that the individual is sharing information that he felt that producers/studio might not know, rather than making defamatory claims. Specifically, the emailer wasn't making new claims that were defamatory but calling attention to previously known information:

Hydraulx argues that Doe 2’s offer to “whistle-blow” and references to “bad business practices” and being “burned” imply a defamatory accusation Hydraulx engaged in dishonesty or wrongful conduct beyond the conflicts of interest addressed in the emails. We find that in context, the term “whistle-blow” was used hyperbolically to introduce the disclosed and non-defamatory allegation of common ownership and that Doe 2’s reference to “bad business practices” reasonably referred to the known or disclosed facts: Hydraulx’s Skyline conflict of interest and Vitality’s potential conflict if it failed to disclose common ownership. In context, the only reasonable interpretation of “bad business practices” is in reference to facts known to the recipients of the emails (Hydraulx’s prior conflict of interest) and facts disclosed in the emails (the false allegation of common ownership and Vitality’s potential conflict of interest involving Goosebumps .)

Got that? Because the only bad behavior the emailer was referencing by Hydraulx was the already known dispute -- and the only false claim wasn't defamatory, there's no defamation here. Hydraulx isn't claiming that the original stories of conflict of interest around Skyline/Battle:LA are defamatory (because it probably can't), so it can't really say this is defamatory here.

Also hurting the defamation case -- the emailed discussions among the folks working on Goosebumps in response to these emails was basically that they didn't even believe it in the first place.

The court also finds that the phrase "bad business practices" is so broad and vague that it also cannot be found to be defamatory:

The same is true in this case because behavior one person regards as a “bad business practice” may be acceptable to another person and conduct causing one person to feel “burned” may not affect another person at all. Someone might regard something as trivial as failures to return telephone calls as “bad business practices.” Another person might use “bad business practices” to describe fraudulent or unlawful conduct. Similarly, a person might feel “burned” by any range of behavior, from a social snub to a fraudulent transaction. Without some reference to the type of undisclosed misconduct, e.g., “In my opinion, John Jones is a liar,” these comments are too vague and uncertain to be actionable as conveying a defamatory accusation.

This is potentially an important ruling on a number of different levels. Sometimes we get so caught up in the "true/false" dichotomy that we don't step back and look at the bigger picture. Indeed, my first impression on reading through the ruling was that the email might, in fact, be defamatory because of the false claims of ownership in Vitality. It was only after walking through the court's careful reasoning that I realized that the court is right here. Just because that claim is false, that doesn't automatically make it defamatory. Defamatory speech needs to not just be false, but false and injure someone's reputation. In this case, the email was clearly trying to portray Vitality in a bad light (and, to a lesser extent, Hydraulx), but the statements making them look bad were either based on factual claims or statements of opinion. The only statement deemed as false didn't harm Hydraulx's reputation at all.

It's good to see the court take the time to carefully parse the email this way and break it out. This will provide more protections for anonymous online critics in the future as well.

Filed Under: anonymity, california, critics, defamation
Companies: hydraulx, sony pictures, vitality

Study: Trolls Are Even Worse When Using Real Names

from the it's-not-the-anonymity dept

It's a bit of "common wisdom" on the internet that you hear people repeat all the time, even though it's hogwash: the idea that people act trollishly online because they're anonymous. So many people want to blame the anonymity and demand real name policies. Yet, as we've been pointing out for many years, plenty of people troll under their real names -- and tons of valuable content is posted by anonymous users (including right here at Techdirt).

And now we've got a bit of research to back that up. Some recent research found that trolls can actually act even worse when they troll under their real name. From the research:

Results show that in the context of online firestorms, non-anonymous individuals are more aggressive compared to anonymous individuals. This effect is reinforced if selective incentives are present and if aggressors are intrinsically motivated.

Now, this is just one report on one dataset, and there may be a variety of other factors at play. But it certainly matches with our own experience here as well. The idea that people only act like jackasses because they're anonymous just doesn't fit with the pattern we've seen in the over 1 million comments we have on this site. Yes, sometimes there are anonymous jerks, just like there are sometimes named jerks. But on the whole, anonymity doesn't seem to magically lead to worse comments.

Filed Under: anonymity, real names, trolls

Anonymized Data Really Isn't Anonymous: Vehicle Data Can Easily Be Used To Identify You

from the building-a-surveillance-supernova dept

Companies increasingly hoover up larger and larger oceans of consumer data, promising that security and privacy aren't much of a worry because data is "anonymized." But as research has shown time and time again, anonymous data isn't all that anonymous -- since it takes only a modicum of effort to either analyze the data -- or cross reference it with other data -- to ferret out personal identities. It doesn't really matter whether we're talking about NSA surveillance troves or social networking data: anonymous data just isn't anonymous.

As yet another example of this, researchers from the University of Washington and the University of California at San Diego have found that the data collected by a car's onboard computer can be surprisingly personal. In fact it's so personal, the researchers found that they could identify a driver -- from a possible list of fifteen drivers -- just by looking at data collected from the brake pedal alone:

"The research team found that 15 minutes’ worth of data from the brake pedal — and only the brake pedal — could lead them to choose the right driver, out of 15 options, 90% of the time. Again, with just the brake pedal data, upping that collected data to 90 minutes’ worth, allowed them to pick the correct driver 100% of the time. For a 100% hit rate with 15 minutes’ worth of data, they just had to collect records from more than one car part.

By itself, especially with the fifteen person pool, this isn't really all that alarming. But as we shift toward self-driving automobiles or just highly connected vehicles, this data is going to increasingly find its way into the hands of insurance companies and others. Verizon, for example, is making a significant push toward selling a $15 per month subscription "Hum" service -- comprised of a device that plugs into the vehicle's OBD port and a Bluetooth-enabled device that is clipped to the vehicle visor. The service not only makes a dumb car smart by providing emergency and other services, it gives Verizon -- a company already awash in consumer cellular location and other behavior data -- a huge amount of additional data to ferret through and monetize.

Especially when cross-referenced with other datasets already in government or corporate collection piles, researchers warn that this opens up the door to allowing insurance companies to dictate rates based on everything from emerging medical problems to when you let your kid drive the car (warning: Wired's ad block blocker still doesn't work properly and may block all users):

"...the fingerprinting study, Enev argues, should serve as a more general warning to car owners about the sensitivity of the data that travels across their vehicles’ internal networks. The same data that tells their insurance company when they’ve let their 16-year-old kid take their car to prom might just as easily be used to identify drunk driving or a medical condition that’s altered someone’s driving ability, tests Enev claims would actually be simpler than trying to distinguish a driver’s identity."

Those examples are likely just the tip of the iceberg, as companies cooperate to use that data to their collective, coordinated advantage in ways we haven't even thought of yet -- while consumers are increasingly treated like criminals should they want to control or access much of this data. And given that the "internet of things" continues to have embedded security that's about as good as no security at all, it's inevitable that this collected data will increasingly find its way into the public domain.

Filed Under: anonymity, automobile data, indentity, privacy, vehicle data

Law Firm Subpoenas Glassdoor For Negative Anonymous Reviews, Supercharges Streisand Effect With Its Response

from the whoo-boy dept

Many of you likely know about Glassdoor.com, which is a website used by both employers and propsective employees for recruiting, job applications and reviews of companies by former employees as to what it's like to work at a given company. As with any source of crowdsourced reviews, it is not without its pitfalls and controversy, but most of that has to do with different methods by which companies and former employees try to promote or slam a partricularly workplace with anonymous reviews. Anyone who has done job placement research, however, knows how valuable the site is.

Yet the use of anonymous reviews, as is typical of other sites, breeds discontent amongst some. Typically you will hear complaints from companies being reviewed negatively about these anonymous reviews being unfair, untrue, or ginned up by a limited number of ex-employees. That's usually the end of it. Occasionally, however, you get a company that wants to sue over reviews like this. California law firm Layfield & Barrett is apparently one such firm.

California trial attorney Philip Layfield, joined by his firm, has filed a defamation claim against 25 John Does over anonymous comments they left online about Layfield, his current firm of Layfield & Barrett, and his former firm of Layfield & Wallace. Our network of tipsters is mighty, and we’ve gotten our hands on a third-party subpoena served upon Glassdoor.com, a jobs and recruiting website, that allows users to post anonymous reviews of places they are current or former employees of, in order to provide an assessment of the working environment for job seekers. The subpoena seeks the identifying information of several users who have taken to this anonymous online forum to complain about their allegedly miserable work.

You can see the full subpoena below, but it does indeed seem that some of the reviews left for the firm were quite nasty. Titles for some of the posts include "Deceptive, Unethical, Poorly Managed, No Sense Of Direction," "Working Here is Psychological Torture," and my personal favorite "For the love of God, do NOT work here." One can understand why an employer would be unhappy about the existance of these reviews.

Suing over them, however, is likely to be as feeble as it is misguided. This is typically the part of the post where we talk first about the difficulty of suing successfully over these types of opinion-based reviews, move on to then talk about the importance of sites like Glassdoor.com honoring its users' anonymity, before finally coming around to explain that the Streisand Effect will now take hold of this whole thing, with the lawsuit serving mostly to catapult the negative opinions the firm disliked into the forefront of more people's minds than otherwise would have been. And that would usually be the end of the post.

That is not the end of this post, in part because Glassdoor has promised to fight the attempt to out its anonymous contributors, but even more so because Philip Layfield agreed to comment on the story for Above The Law, and Oh. My. God.

With respect to the lawsuit filed, here is the reality. Our law firm has approximately 150 employees and 35 attorneys. We demand the best of the best. Many people lie about their skills, their experience and their desire to be the best when the interview. We pay top dollar for candidates and many of our attorneys earn in excess of $1 million per year. When people are lazy or incompetent, they either quit because the writing is on the wall or they are terminated. Unfortunately, most of those people are unwilling to recognize their shortcomings and they turn to anonymous blogs to spit their venom. The reality is that they should be upset with their parents for raising lazy and incompetent young adults, but they choose to spew false information on blogs such as Glassdoor. The majority of these posts contain blatantly false information. We are going to obtain the identities of these cowards and bring them to justice.These people are going to have to answer for their conduct and we will shine a light on this very cowardly practice that has become an epidemic. People need to realize that just because you are sitting anonymously behind a keyboard, you can’t break the law. Ultimately, future employers will have to decide whether they want to employ people who post false and hateful information about former employers. The same way that Glassdoor operates as a hate forum for disgruntled employees, employers have a right to know information about job applicants.

Unfortunately, most employers are too busy to spend time posting negative information about former employees on job sites, although that would probably do a lot of good for society. For example, I would love to post information about employees who graduated law school, but can’t put two sentences together, or those that are sick at least one day every week.

We will not give any further comments until the case is over.

Imagine yourself for a moment as someone who was willing to give Layfield and his firm the benefit of the doubt thus far. Are you any longer? Probably not. This comment does nothing to verify the accuracy of the complaints at Glassdoor, but it does solidify them in the mind to some degree, does it not? In addition to the demeaning nature with which Layfield addresses his former employees, the aggrandizing tone with which he describes his own firm, and his silly labeling of Glassdoor as a hate forum, he does us all a service by outlining his desire to have employers act every bit as vindictively towards former employees as he complains about in reverse. That kind of delicious hypocrisy isn't in rare supply, of course, but that doesn't make it any less scrumptious to behold.

And, to the previous point, whatever Streisand-y Effect might have resulted from the legal action the firm had already taken will now be supercharged by this boorish comment at a well-read legal industry blog. And here at Techdirt. Any likely many other places as well. If the goal was to make the firm a more attractive place to work, it's difficult to think of a better strategy than this to achieve the opposite.

Filed Under: anonymity, anonymous reviews, comments, law firm, lawsuit, philip layfield, reviews, slapp, streisand effect
Companies: glassdoor, layfied & barrett, layfied & wallace

Rep. Speier Wants To Register Every Prepaid Phone Purchase, In Case Someone Bad Uses One As A Burner Phone

from the post-Paris-panic-continues dept

First, the legislators came for encrypted phones, because terrorists were apparently using encryption. (Except they weren't.) Now, they're coming for prepaid phones. Sure, customers will still be able to buy prepaid phones. They'll just have to "register" with their local retailer in order to do so.

A bill proposed in congress this week would require that all users provide identification and register prepaid ‘burner’ phones upon purchase.

[...]

Representative Jackie Speier, the congresswoman who introduced the bill, called the prepaid phone “loophole” an “egregious gap in our legal framework,” one that allowed terrorists and criminals near-complete autonomy and a means for private, anonymous communications.

This "loophole" has existed for years. There's nothing new about burner phones. The only thing "new" is that these were used by the terrorists who attacked Paris. So, of course, a legislator has decided to do something about it.

What exactly will be done remains unclear. The bill has yet to arrive in written form. But it has, sight unseen, been referred to three House committees and enjoyed a full-page press release from Rep. Speier.

The Closing the Pre-Paid Mobile Device Security Gap Act of 2016 would place the same identification and record-keeping standards on pre-paid mobile devices as the ones that already exist on traditional contract mobile devices. When customers buy a traditional contract-based phone, they provide basic information such as a name, address, and date of birth, which law enforcement can request with a warrant in order to stop terrorist attacks or other illegal activity.

This bill would direct pre-paid cell phone retailers to collect basic ID information at the time of purchase and share that information with the cellular provider for that individual device. The information would be verified using a credit card, debit card, social security number, driver’s license number, or other information that the Attorney General finds adequate in order to have some record of the transaction. Pre-paid “burner phones” were used in the 9/11 attacks, the failed Times Square bombing, and the Paris attacks. Failure to hold them to the same standard as regular contract phones poses a serious risk to national security.

GIven that burner phones have been associated with criminal activity since forever, if anyone seriously felt the need to close the "loophole," you'd think they'd have accomplished it already. (Here's a failed attempt from 2010, made by Sens. Chuck Shumer and John Cornyn post-Times Square bombing.) What Speier wants to do is generate yet another set of third-party records to be housed by phone providers that can be accessed without warrants.

Even if this passes, it will do little to allow law enforcement agencies to follow up on burners recovered after attacks. Criminals and terrorists won't be presenting identification -- at least not theirs -- to retailers. In fact, they're going to do what they've done before: use straw purchasers or buy directly from resellers who fall outside of the bill's likely purview -- like individuals or online retailers.

This will have little investigative worth, but it will generate a ton of records on people who don't have any option but to buy prepaid phones, whether it's due to credit issues or a lack of verifiable identification. Many won't have the ID options requested, like credit/debit cards. Some may not have state ID/Social Security cards either. Adding this requirement will just inflict further difficulties on people whose lives are filled with difficulties already.

Then there are those who do have these things but would prefer to use a "burner" for conversations/communications they don't want to have linked to a phone that, for all intents and purposes, identifies them. Activists and journalists are two groups that immediately come to mind. So do philandering spouses, but that sort of activity is really none of the government's business -- nor the retailers acting as prepaid phone dragnets on the government's behalf.

And then there will be any number of people who buy prepaid phones simply to leave less of a personally-identifiable digital footprint -- without having to surrender most of their communication options.

In addition to these issues, requiring registration for prepaid phones will both lead to more criminal activity (in the form of a new black market for unregistered phones) and adversely affect smaller retailers who will now be shouldering additional burdens for the government. From a 2013 GSM (Groupe Speciale Mobile) report on registration requirements for SIM cards: (h/t Glyn Moody)

In countries where prepaid users represent the majority of the mobile communications market, the costs to mobile operators of implementing new registration processes can be significant including:

• Training staff and retailers i.e. on how to register users, what the acceptable forms of identity are and how to verify them;
• Investing in public awareness campaigns to inform their customers about the need to register;
• Ensuring that customer data databases are accurately updated, maintained and secured;
• Monitoring compliance and deactivating all unregistered SIM cards after the imposed deadline; and
• Verifying, copying and storing users’ identity documents.

The report also recommends:

Governments considering mandating the registration of prepaid users should seek to consult with industry stakeholders and conduct impact assessments before introducing regulation.

Right now, the only entity that has been consulted is Rep. Speier's gut instinct. It says, "Do something!"

Certainly a cell provider can gather any information it wants in exchange for providing phone service, but third parties like Wal-Mart and Target shouldn't be put in the position of tracking certain people who make certain purchases. As useful as it may be to have this information lying around (and that's certainly disputable), Speier's proposal will do little to prevent attacks and criminal activity while harming the privacy interests (and more) of her constituents.

Filed Under: anonymity, burner phones, fear, fud, jackie speier, prepaid phones, registration

Silk Road 2.0 Court Docs Show US Government Paid Carnegie Mellon Researchers To Unmask Tor Users

from the you-can-browse-privately,-just-don't-expect-your-privacy-to-hold-up-in-court dept

Rumors that the US government used a university's research institute to uncloak Tor users began floating around nearly two years ago. In July of 2014, the first hint that something weird was going on at Carnegie Mellon took the form of a hastily-cancelled Black Hat Conference talk on the subject of de-anonymizing Tor users. Carnegie Mellon's lawyers stepped in and called the whole thing off at the last minute. The thought process at the time was that CMU's legal team may have been concerned the researchers' actions had broken wiretap laws.

Nearly a year-and-a-half later, hints were dropped that CMU's Tor-related efforts may not have been for research purposes only. An anonymous tipster claimed the FBI had paid CMU $1 million to unmask Tor users. A quasi-confirmation popped up during the DOJ's prosecution of Brian Ferrell, who was allegedly assisting Blake Benthall in running Silk Road 2.0. Ferrell and Benthall were both swept up in the wake of a Tor-related FBI raid known as "Operation Onymous," which began a few months after the hastily-cancelled Black Hat talk.

Included in the information handed over to Farrell's legal representative was the following:

On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0.

Tor Project itself claimed it had noticed a series of attacks during the first six months of 2014, seemingly aimed at de-anonymizing users. The unmasking efforts it noticed occurred shortly before the FBI Silk Road 2.0 raids. All of this was disturbing but also very circumstantial. Both CMU and the FBI (very weakly) denied any involvement in the unmasking effort. Notably, both parties only specifically denied the payment aspect, with CMU reps saying they "were not aware of any payment" and the FBI stating the allegation it had paid CMU $1 million was "inaccurate" -- which is not nearly the same thing as saying the allegation was false.

Three months after the FBI rumor/tip, the government's use of CMU to de-anonymize Tor users has been confirmed. The only aspect that appears to be incorrect is the agency behind the effort. Joseph Cox at Motherboard has the details.

[B]oth the name of the university and the existence of a subpoena have been confirmed in a recent filing in one of the affected criminal cases.

“The record demonstrates that the defendant's IP address was identified by the Software Engineering Institute (“SEI”) of Carnegie Mellon University (CMU”) [sic] when SEI was conducting research on the Tor network which was funded by the Department of Defense (“DOD”),” an order filed on Tuesday in the case of Brian Farrell reads. Farrell is charged with conspiracy to distribute cocaine, heroin, and methamphetamine due to his alleged role as a staff member of the Silk Road 2.0 dark web marketplace.

“Farrell's IP address was observed when SEI was operating its computers on the Tor network. This information was obtained by law enforcement pursuant to a subpoena served on SEI-CMU,” the filing continues.

So, the DoD "hired" CMU researchers to find ways to unmask Tor users. It's probably worth noting here that the NSA... is a part of the DoD. The FBI was not directly involved, as alleged earlier, nor did it hand $1 million to CMU to facilitate its efforts. However, it was Johnny-on-the-Spot when it came to issuing subpoenas for Tor user info. Not that it's interested in discussing its fortuitous timing…

When asked how the FBI knew that a Department of Defense research project on Tor was underway, so that the agency could then subpoena for information, Jillian Stickels, a spokesperson for the FBI, told Motherboard in a phone call that “For that specific question, I would ask them [Carnegie Mellon University]. If that information will be released at all, it will probably be released from them.”

The buck has been passed, but CMU refuses to touch it.

Kenneth Walters, a spokesperson from CMU, told Motherboard in an email, "We have nothing to add beyond our Nov. 18 statement."

This statement says nothing more than CMU receives subpoenas from time to time and hints that everybody is probably wrong about everything because "inaccurate media reports."

Farrell's lawyers have tried to obtain more details on CMU's DoD-funded de-anonymization efforts, but the judge has denied further discovery along these lines. Judge Richard A. Jones, echoing the judge presiding over the FBI's now-infamous "Playpen" case (where the FBI ran a seized child porn site as a honeypot for two weeks), says there's no expectation of privacy in an IP address, even if said IP address was obscured by the use of Tor.

“SEI's identification of the defendant's IP address because of his use of the Tor network did not constitute a search subject to Fourth Amendment scrutiny,” the order reads.

In short, there's no expectation of privacy in the use of a service specifically designed to protect users' privacy. Users may believe they have an expectation of privacy but it's a belief that won't be upheld by this nation's courts. Efforts made by the government to strip this protection away are not viewed as intrusive -- at least not in the Fourth Amendment sense of the word.

So, nearly two years later, the story coheres: the Department of Defense has been seeking ways to unmask Tor users with the assistance of CMU's researchers. And all the while, the FBI has apparently been looking over the DoD's shoulder and firing off subpoenas. No one involved wants to talk about it and now it appears they won't have to, thanks to Judge Richard Jones.

Filed Under: anonymity, defense department, dod, fbi, tor, unmasking
Companies: carnegie mellon, silk road 2.0

Judge Changes Mind, Says James Woods Can Likely Unmask Guy Who Made Fun Of Him On Twitter

from the clownboy dept

Last summer, we noted a crazy case in which the famous Hollywood actor James Woods sued a random Twitter troll who had been making fun of Woods. The anonymous troll, who went by the name Abe List, mocked some of Woods' own nonsensical tweets about Caitlyn Jenner and Planned Parenthood by saying:

"@RealJamesWoods @benshapiro cocaine addict James Woods still sniffing and spouting."

-- Abe List (@abelist) July 15, 2015

As the lawsuit noted, Abe List had also mocked Woods in the past, such as calling him a "clown-boy." Of course "clown-boy" is not something than a statement of fact and thus can't be defamation. The real issue is whether or not saying "cocaine addict James Woods" is a statement of fact that is defamatory. Of course, considering that Woods is a public figure, this seemed like a really high bar to cross. With a public figure, the statements need to be made "with actual malice" or a "reckless disregard for the truth." In other words, it needs to be a case where Abe List knew those things weren't true, but said them anyway. That seems unlikely here. Oh yeah, and also, hyperbolic statements that are obviously hyperbole are not considered defamation, and this one seemed to qualify.

On top of all that, once Abe List got some lawyers (including Ken "Popehat" White), they pointed out that Woods himself had a rather long history of making similarly hyperbolic statements about people on Twitter. In fact, nearly identical ones: Twitter also stepped in and refused to comply with the subpoena to identify Abe List, agreeing that we have a First Amendment right to speak anonymously, and that it did not think that Woods had a legitimate defamation case to unmask Abe List.

Abe List made an anti-SLAPP claim in California, which should stop all discovery and hopefully get the case tossed -- and things seemed to be going his way. Back in November, Woods' lawyers tried to move forward in discovering Abe List's identity but the judge rejected that plan.

Then, earlier this month, there was a hearing, and LA Superior Court judge Mel Recana, appeared to side with Abe List, issuing a 10-page tentative ruling dismissing the case. In that tentative ruling, Judge Recana noted:

The court finds that as a matter of law, in consideration of the totality of the circumstances, the tweet at issue is not a statement of fact but rather "rhetorical hyperbole, vigorous epithets, lusty and imaginative expressions of contempt and language used in a loose figurative sense" that does not support a defamation action.... The tweet cannot be reasonably interpreted as stating actual facts about James Woods. Both tweets were in the context of expressing inflammatory opinions. There was no indicia of reliability as to defendant's tweets.

That was February 2nd. So, you can imagine basically everyone's surprise, when less than a week later, Judge Recana released a 1-page final order that says the exact opposite:

As contended by plaintiff: Applying the totality of circumstances test, and examining the plain language of the Tweet, it is clear that any reader of the AL False Statement could and indeed must view it as a statement of fact. As described by Professor Finegan, AL's use of a prenomial characterization (i.e., "cocaine addict") followed by a proper noun (i.e., "James Woods") is a well-established linguistic structure widely used to characterize people with shorthand factual information. Prof. Finegan's opinion that "many if not all readers of the 'cocaine addict' Tweet will understand and interpret Abe List to be making a factual claim about James Woods -- namely that he is a cocaine addict' is on an issue of fact. His opinion is sufficiently beyond common experience and assists the trier of fact.

It's hard to underscore how surprising and ridiculous this ruling is. Yes, putting a descriptive term in front of a name can be viewed as a factual statement, but the law requires you to put them into context, and here the judge is completely ignoring that, and bizarrely claiming that people literally "must view it as a statement of fact" even though basically no one would do so. It's also bizarre given the original tentative ruling that a judge would so completely flip positions within a matter of days.

One of Abe List's lawyers, Lisa Bloom, has put out a statement saying that they will be appealing this ruling:

On Twitter, Mr. Woods enjoys calling strangers "clown," "rat," "scum," and other epithets. Mr. Woods insults gay Americans and immigrants. he brags that he could murder a man whose shirt offends him. He claims a prominent publisher "whacks off" to a picture of a terrorist. When Twitter users challenge him, he tells them to "put down your crack pipe." He's mockingly accused at least three other Twitter users of using crack cociane.

Mr. Woods dishes it out, but he can't take it. When not-famous, not-wealthy John Doe responded to a James Woods slur on Caitlyn Jenner and Planned Parenthood in kind, calling him a cocaine addict, Mr. Woods sued. Mr. Doe's suggestion that Mr. Woods was on drugs was not meant to be taken literally, just as Mr. Woods' "put down your crack pipe" and other mocking language was not serious. This is his simple defense.

Twitter is a wide open forum where wisecracks are the norm. It exists not only for the rich and powerful to lambast others, but for all users to express themselves, often colorfully, without fear of being dragged into expensive, stressful litigation. It is frightening to be sued for $10 million by Mr. Woods, but Mr. Doe is fighting back.

Today the Court rejected our request to dismiss the case. We strongly disagree with the denial of the motion, and agree with the Court's tentative ruling that granted the motion. We look forward to presenting the issues to the Court of appeal. Mr. Doe is resolved to fight this case for as many months or years as it takes.

The statement also notes that Abe List filed some sort of "formal complaint" with Twitter, though the details there are not entirely clear. Either way, what should have been a simple case with a simple dismissal has now gotten a lot more complicated. It may be tempting to mock the judge, but be careful what you say, because apparently he believes that obvious hyperbole must be interpreted as fact if you put the statement in front of someone's name.

Filed Under: abe list, anonymity, clown-boy, clownboy, cocaine addict, defamation, free speech, hyperbole, james woods, mel recana, social media
Companies: twitter

Honda Tried To Get Jalopnik To Dox Commenter, Delete Posts, Meets The Streisand Effect Instead

from the hi-honda dept

Criticism is part of life, of course, and I tend to believe that people show their true selves most transparently when they show how they deal with criticism. Unfortunately, we've covered entirely too many stories involving people and companies responding to online criticism poorly here at Techdirt. Typically, these unfortunate responses amount to trying to censor the criticism, but it can more dangerously involve the attempted silencing of journalism as well as threats of legal action against those making the critical comments.

Too many times, websites and web services cave to this sort of censorship. But not everyone. Gawker Media, about whom I could fill these pages with criticism, appears to be pushing back on once such attempt levied against its site Jalopnik. Apparently, car-maker Honda took a negative view of some comments made at the site, purportedly by a Honda employee. For some reason, Honda decided that this distinction meant that it could not only silence the comments, but that it should receive help from the site in outing the commenter. The whole thing starts off, as seems so often the case, with some rather mild criticism in the form of a comment.

In December, a commenter calling him or herself HondAnonymous, posted a string of comments on these posts claiming to be a technician at Honda’s research and development facility. People on the Internet make claims like that all the time, but HondAnonymous seemed able to back them up with actual information about the development of the NSX and other cars. The most interesting bits were complaints about the NSX’s Continental tires (“they are garbage”) and how newer Honda engines have an issue “with the studs on the cat either backing out of the head or snapping altogether.”

Interesting, if not earth-shattering. A lot of it sounds like normal car development. The first one is a complaint we’ve seen in various early NSX tests, and the last is probably a recall waiting to happen. But earlier this month, Honda’s lawyers contacted us to say that information posted by HondAnonymous “is confidential information owned by Honda R&D Americas, Inc., and posts by that user of such confidential information breaches a contractual obligation of confidentiality owed to Honda R&D Americas, Inc.”

As Jalopnik notes, it wasn't them that posted the information. Instead, it was a commenter within the open commenting system Gawker Media uses. Regardless, apparently Honda's attorneys requested not only that all comments by the user be taken down immediately, but they also requested that the site turn over all identifying information about the user to them so that they could hunt down the leak. Think about this for just a moment and you'll see the problem: Honda wants Jalopnik's help in figuring out who this commenter is, while also demanding that the content be taken down because it violates a contractual confidentiality agreement. However, Jalopnik isn't obligated in any way to help Honda, regardless of what private contracts may or may not have been violated.

In typical Gawker fashion, Jalopnik gleefully is posting about all this, Streisanding the issue back into the news when it might otherwise have died off quickly.

It’s pretty egregious for a corporation to try to bully a news organization into deep-sixing comments from its own readers. It’s far more egregious to threaten to subpoena us if we don’t dox one of those readers. The good news is we couldn't dox HondAnonymous even if we somehow wanted to. He or she used an anonymous burner account, and we don’t track passwords, logins, or IP addresses for any of our users. HondAnonymous’ posts will stay up.

To Honda, or any other automaker: If you would like us to delete the comments of our readers or expose their identities (which, again, we can’t do anyway) again, please let me know! I am more than happy to drag your intimidation tactics into the public eye for all your customers and prospective buyers to see. Govern yourselves accordingly.

So, in trying to silence and out a critic, Honda instead finds themselves the subject of reports about the attempted silencing of the critic, whose criticism is once more in the public light. Bang up job, lawyers!

Filed Under: anonymity, comments, contracts, doxxing, jalopnik, news sites, streisand effect
Companies: gawker, honda

DHS Official Thinks People Should Have To Give Up Their Anonymity To Use The Internet

from the screwing-the-nation-for-the-good-of-the-nation dept

Apparently, the only way to stop terrorists from hating us for our freedom is to strip away those offensive freedoms.

Erik Barnett, the DHS's attache to the European Union, pitched some freedom-stripping ideas to a presumably more receptive audience via an article for a French policy magazine. Leveraging both the recent Paris attacks and the omnipresent law enforcement excuse for any bad idea -- child porn -- Barnett suggested victory in the War on Terror can be achieved by stripping internet users of their anonymity. You know, all of them, not just the terrorists.

After a short anecdote about a successful child porn prosecution in Europe. Barnett gets straight to the point. Here's Kieren McCarthy of The Register.

Before we have an opportunity to celebrate, however, Barnett jumps straight to terrorism. "How much of the potential jihadists' data should intelligence agencies or law enforcement be able to examine to protect citizenry from terrorist attack?", he poses. The answer, of course, is everything.

Then the pitch: "As the use of technology by human beings grows and we look at ethical and philosophical questions surrounding ownership of data and privacy interests, we must start to ask how much of the user's data is fair game for law enforcement to protect children from sexual abuse?"

In short, if you value internet-related freedoms, you're basically supporting terrorism and child porn. No person -- especially no legislator -- would want to be seen as valuing personal freedoms over the good of the nation's infrastructure/children. And, because terrible ideas must be buttressed by terrible analogies, Barnett theorizes that the internet is basically a car.

"When a person drives a car on a highway, he or she agrees to display a license plate. The license plate's identifiers are ignored most of the time by law enforcement [unless] the car is involved in a legal infraction or otherwise becomes a matter of public interest. Similarly, should not every individual be required to display a 'license plate' on the digital super-highway?"

To use the Fourth Amendment for a moment, a lowered expectation of privacy is in play when operating a vehicle on public roads. However, the Fourth Amendment affords a great deal of privacy to the interior of people's homes. Because the government (in most cases) does not provide internet access, it has no basis to demand ongoing access to citizens' internet activities. It may acquire this information (along with subscriber info) using search warrants and subpoenas during the course of investigations, but it cannot demand (or at least shouldn't) -- for national security reasons or otherwise -- that every internet user be immediately identifiable.

Discussions of requiring a license for internet usage have been raised previously but rarely go anywhere. To do so is to start heading down the path to totalitarianism. Unfortunately, being in a constant state of war against an ambiguous foe often results in legislators and government officials declaring their interest in seeing this path not only surveyed, but the first layer of asphalt applied.

Barnett is one of this number, and he wants a strawman to serve as construction foreman.

"Social media is used to generate support for terrorist groups ... How appropriate is the law enforcement engagement of the social media companies to reveal digital fingerprints of these extremist groups? Who determines the level of 'extremism' of a group? Few would disagree that law enforcement and intelligence services should have the ability..."

Actually, lots of people would disagree, starting with many citizens and running all the way up to their service providers. On top of that, the nation's courts would find the institution of a law that strips the anonymity of internet users to be unconstitutional, so that's another hurdle Barnett and like-minded officials would not be able to clear, no matter their stated justification.

Filed Under: anonymity, dhs, erik barnett, internet, internet license, surveillance

Disgraced Georgia Dentist Files Bogus Defamation Lawsuit To Go After Person Who Posted News Report To YouTube

from the dr.-streisand? dept

Years back, Georgia dentist Gordon Austin was indicted on 12 counts "with multiple counts of simple battery, aggravated assault, and cruelty to children." The details of the case were pretty horrifying, involving claims of Medicare fraud, along with multiple claims that Austin hit his patients when they would complain loudly (apparently after the anesthesia did not work properly). When he was indicted, the local news covered the story as you can see below: That video was uploaded by a user named "gordonaustinsacoward," and it was uploaded on March 1, 2009, while the case was still ongoing. Eventually, Austin appeared to have worked out a plea deal, in which he pled guilty to Medicare fraud, while the assault and cruelty to children charges were dropped. His dental license was pulled and he got five years probation, along with $15,000 in fines.

For reasons unknown, apparently Austin is not happy about that news video being online. According to Paul Levy, Austin hired some lawyers to file a highly questionable defamation claim over the video, and (of course) to issue a subpoena to YouTube to try to uncover who uploaded the video.

Everything about this is ridiculous. The statute of limitations (1 year for defamation) is long past. From everything that's been reported, it's not clear that anything in the video is even defamatory anyway. And, of course, in just reposting someone else's video, there are Section 230 protections as well. This seems like Austin deciding he wants to find out who uploaded the video and this is the way he wants to do so. Paul Levy from Public Citizen has filed a motion to quash the subpoena.

It is settled law that, when a subpoena seeks to identify an anonymous Internet speaker so that the speaker can be served as a defendant in a lawsuit, the plaintiff has the burden of showing both that he has filed a valid complaint and that he has admissible evidence establishing the elements of his claims.... No such evidence has been provided here. Moreover, settled law also establishes that the complaint cannot possibly succeed for several reasons, including that the suit was filed six years after the allegedly defamatory statements were made, long after the statute of limitations expired, and that, because Doe only posted a video that somebody else had created, section 230 of the Communications Decency Act immunizes him from being sued.

The motion notes that the defamation complaint has all the hallmarks of someone just trying to censor -- mainly a total lack of calling out any actually defamatory claims:

The complaint repeatedly refers to “false” statements but never specifies what the alleged falsities are and how they are false. And although the complaint alleges actual malice in very conclusory terms, it never explains why an ordinary citizen would not be justified in accepting the word of the prosecution as well as Fox News in repeating the gist of the indictment and republishing the TV story.

Of course, in the end, all this can serve to do is bring Gordon Austin's previous guilty plea and indictment back into the public's attention. And it may end up costing him -- both in bringing the case back into the public's view, but also because California recently made attorneys' fees mandatory on subpoenas that are quashed, something that Paul Levy will now be testing -- including seeking fees from the lawyers who filed the bogus lawsuit and subpoena in the first place:

Several years ago, the California Court of Appeal ruled, in a case we handled involving a subpoena from the so-called “randy rabbi,” Mordecai Tendler, that California’s anti-SLAPP statute cannot be used to strike subpoenas sought in support of litigation in a different state. The California legislature responded by amending its Code of Civil Procedure to provide that, when the target of such a subpoena successfully moves to have the subpoena quashed, the court "shall" award attorney fees. This statutory provision can help encourage lawyers to take subpoena cases as, for example, the inclusion of a “special motion to quash” in DC’s anti-SLAPP law has encouraged lawyers to take on such motions pro bono. And equally important, it can create a disincentive for the issuance of groundless subpoenas to the California ISP’s that can only be subpoenaed in California. But, so far as I have been able to determine, that statute has not yet been applied. In order to fortify the disincentive, we intend to argue that, like any other attorney fee award under the discovery rules, that the lawyer can be held responsible along with the client.

As Levy notes, it appears that Austin's lawyer, John Autry, refused to withdraw the subpoena when asked, and appeared to know that he was filing a lawsuit well after the statute of limitations had run out:

I personally urged the lawyer who signed the subpoena, John Autry (whose name does not appear on his firm’s web site), to withdraw the subpoena. I am willing to assume that, given the nature of the legal practice described on the Coles Barton web site, their research might never have brought section 230 immunity to their attention, but Mr. Autry certainly knew that the defamation action was time-barred; he was defensive about that aspect of the case when I first spoke to him. Moreover, however much Mr. Autry might be willing to let his client proclaim his innocence when not speaking under oath, he cannot possibly doubt that the anonymous poster had at least some reason to believe that Austin was guilty of the charges for which he was indicted, and which were described in detail during the television broadcast. I don't see how he can possibly expect to make out a prima facie case in support of his client’s causes of action, and he can fairly be held responsible for not having noticed that California requires the plaintiff to present sufficient evidence to make out a prima facie case before an online poster can be outed. Thus Austin’s lawsuit has no realistic chance of success, and Mr. Autry can be faulted for lending his position as an officer of the court to obtain issuance of a subpoena that represents pure bullying, perhaps undertaken in the hope that the anonymous user might be unable to find and afford counsel to have it quashed in California.

It is a shame that Austin’s lawyer was neither able to persuade his client to drop the subpoena, nor willing to withdraw his own participation in this travesty. At this point, however, it seems likely that the lawyer will have to join his client in paying a financial price for that bullying.

Filed Under: anonymity, defamation, dentist, free speech, gordon austin, intimidation
Companies: youtube