GEMA Takes Kim Dotcom's Mega Launch Party Video Down, Despite All Songs Being Cleared

from the gema-again dept

GEMA and MEGA may have the same letters arranged differently, but you have to imagine that the hardline copyright maximalists at GEMA aren't at all pleased by Kim Dotcom's new Mega outfit, even if it's really not all that different than tons of other online cloud storage platforms. Still, it is a bit odd to see that GEMA had Mega's launch video removed from YouTube. There was music in the video, but as Dotcom notes, it was either his own music, or music by musicians who all gave permission to use it. My guess is that it may have more to do with the ongoing dispute between GEMA and YouTube, which means that any video with GEMA content is blocked in Germany. However, Dotcom filed a dispute, and notes that he plans to have his lawyers discuss the matter with GEMA.

Filed Under: kim dotcom, music, takedowns, youtube
Companies: gema, mega

Anti-Piracy Group Already Demanding That Kim Dotcom's New Mega Service Be Shut Down

from the but-of-course dept

This probably isn't a huge surprise, but with the launch of Kim Dotcom's new Mega cloud drive system, many in the entertainment industry have assumed that he must be relaunching Megaupload and a way to infringe. However, it seems pretty clear that Mega is quite different and mostly resembles other well known legitimate services, like Google Drive, Dropbox and Amazon's cloud offerings. Still that hasn't stopped some in the "anti-piracy" community from trying to shut down the site already:

Robert King is the lead figure behind StopFileLockers (SFL), an anti-piracy group dedicated to bringing file-hosting services to their knees by strangling their finances. Last year King claimed his group had a hand in disrupting the cash flow to hundreds of sites and actually shutting down dozens more. Now he has a very big scalp on his mind.

King, an Australian and adult industry player, says that StopFileLockers have just begun a “campaign to have the payment processing of all Mega resellers terminated.”

Apparently waiting for actual evidence of infringement, or even specific liability for Mega, is too much to ask. This is silly. While we may have doubts about how Mega is running, shutting it down without even understanding what it's about seems incredibly short-sighted. Plenty of successful legitimate companies have been built out of those who were earlier sued for "infringement." Isn't it worth at least making sure he's breaking the law before insisting he must have done so?

Filed Under: anti-piracy, cloud storage, copyright, kim dotcom, legality, robert king
Companies: mega, stopfilelockers

Mega's Security Appears To Be Surprisingly Bad

from the trial-by-fire dept

We were a little skeptical of Kim Dotcom's new Mega cloud storage offering, in part because the claims of security and privacy seemed somewhat dubious upfront. We didn't see how it would be reasonably possible to do everything the service claimed it was doing in a manner that really kept the data secret. And, indeed, it has not taken long for security researchers around the globe to raise questions. Right away there were significant questions about the security design choices, including some questions about how random the random key generation really was, as well as significant concerns about Mega's claims that it offered deduplification (if things were really encrypted correctly, there would be nothing to deduplicate).

While Mega has responded to some of those criticisms, a whole host of other security questions have been raised, leading cryptographer Nadim Kobeissi to tell Forbes: "Quite frankly it felt like I had coded this in 2011 while drunk." A big part of the problem is that, by doing everything in the browser, you're really still trusting Mega, even as Mega implies that you have full control over the encryption.

And, then comes the news that when you first sign up, while Mega hashes your password, it sends you an email that includes the hash in plain text along with other data, such that one hacker has already released a tool to extract passwords from Mega's confirmation emails:

Steve "Sc00bz" Thomas, the researcher who uncovered the weakness, has released a program called MegaCracker that can extract passwords from the link contained in confirmation e-mails. Mega e-mails a link to all new users and requires that they click on it before they can use the cloud-based storage system, which boasts a long roster of encryption and security protections. Security professionals have long considered it taboo to send passwords in either plaintext or as cryptographic hashes in e-mails because of the ease attackers have in intercepting unencrypted messages sent over Internet.

Despite that admonishment, the link included in Mega confirmation e-mails contains not only a hash of the password, but it also includes other sensitive data, such as the encrypted master key used to decrypt the files stored in the account. MegaCracker works by isolating the AES-hashed password embedded in the link and attempting to guess the plaintext that was used to generate it.

Users still need to crack the hashed password, but that's a relatively easy brute force effort, especially for those who use weaker passwords (i.e., most people). There are, of course, much more secure ways of handling this, such as not including the plain text hash in the email.

All that said, many of these problems can be fixed, but when your whole pitch to the public is about how secure and private you are -- and some have been falsely implying that such a system allows individuals to avoid copyright infringement claims -- it seems reasonable to suggest that better security should be in place from the beginning.

Filed Under: encryption, kim dotcom, privacy
Companies: mega

Kim Dotcom Hires Human Rights Lawyer To Claim MPAA's Chris Dodd Targeted Him In 'Contract Prosecution'

from the seems-like-a-longshot dept

Lost in all of the hype about the launch of Kim Dotcom's new Mega service was the fact that he's hired a new high profile lawyer, with a different focus. Some of the details were buried in Ars Technica's coverage of the Mega launch party, in which they mention the adding of Robert Amsterdam to the legal team:

Also circling is the latest addition to Dotcom’s ever-expanding legal team: Robert Amsterdam of Washington, DC and London-based Amsterdam & Partners. The human rights lawyer says his key work has been in Venezuela, Russia, and Nigeria. Now he's contracted by Kim Dotcom to investigate a possible human rights angle on the Megaupload case—in particular whether one human, former Senator and current MPAA head Christopher Dodd, breached Dotcom’s rights by going out of his way to engineer what Amsterdam said could be seen as a “contract prosecution.”

Amsterdam agrees his work could help Dotcom seek redress from the US government down the track. But his immediate aim is to publicize Dodd’s role. “This prosecution should not be afforded the presumption of regularity," he says. "The way this was done—the helicopters; the rappelling down the buildings [of Dotcom mansion]; the over-reaction—all of these are signs of a classic political prosecution.”

Amsterdam will spend the next two days interviewing the Megaupload team as part of his preparations for a “white paper” he will publish in around two months’ time.

This strikes me as a huge longshot for a variety of reasons, but it certainly makes for an interesting storyline to follow. If such an investigation actually does get somewhere, there could actually be blowback for those who led the charge against Dotcom. As it stood, it seemed unlikely that, even if the case fell apart, there would be any ramifications for those who championed the cause in the first place. Again, I find it highly unlikely that this exploration will lead anywhere, but Dotcom's legal team has done amazingly well on a variety of fronts to date, so perhaps they know more than has been made public already about all of this.

Filed Under: chris dodd, contract prosecution, human rights, kim dotcom, robert amsterdam
Companies: megaupload, mpaa

No, Kim Dotcom's New Mega Service Does Not 'Dismantle Copyright Forever'

from the a-step-forward dept

There's been lots of anticipation about Kim Dotcom's new "Mega" service. We've mostly held off commenting despite all the speculation and rumors, because, well, they were all speculation and rumors, and Dotcom has a history of hyping things way up. However, Gizmodo apparently got a sneak peak at the service, which is set to launch tomorrow, and has revealed the basic details, claiming that "this service could dismantle copyright forever." That statement is ridiculous and pure bluster, not at all supported by the service.

From the description, the service does look nice and potentially useful. It's really just a cloud storage system, not an online Dropbox or Box.net or Google Drive. It has a nicely designed file manager feature. The real "difference" is just that Mega has client-side encryption built in. So, basically, you encrypt anything you put into the Mega storage system before you upload it, and thus even Mega doesn't know what's there (mostly) and can't decrypt it. You could hack together something like this with other services, if you just encrypted stuff yourself before uploading it to other cloud drives. By building it in, however, Mega is clearly adding a significant level of convenience.

All in all, it does look like a pretty nice service, and one that may be worth checking out if you use cloud storage regularly. That said, the claims of destroying copyright seem overblown. If the claim that a file can be shared "with a single right-click" is accurate, then once that link is used, it would be simple for anyone with access to Mega's log files -- including Mega and, potentially, government agents -- to decrypt the file and see what's in it. If that claim is an exaggeration, and a key needs to also be shared separately, then it's no different than how encrypted data is shared already. And copyright still exists.

There may be some more details to come out once the product is officially launched tomorrow, but if the service is to be used for sharing, as implied, then there has to be a decryption process somewhere. The Gizmodo piece is as bit unclear, but it sounds like this likely involves two Mega users having their local clients talk to each other somehow to share the decrypt code. But, obviously, a government or Mega itself could potentially also be that local client on the other end. Basically, once you're sharing, the "encryption" issue is still handy, but not a huge deal. And the user may be very liable for infringement.

In the end, it sounds like there are some nice features, and some additional protections from liability for Mega specifically, but I don't see how this "dismantles copyright" even temporarily, let alone forever. Also, given the way the government likes to interpret things, you can bet that if it wanted to, it will make the case that this use of encryption is a form of "inducement" for infringement as well.

All in all, it looks like an interesting product, though hardly revolutionary.

Filed Under: cloud drive, copyright, encryption, file sharing, kim dotcom, mega, storage locker
Companies: mega

Music Company Asks For Permission To Pursue Its Delayed Civil Suit Against Megaupload; States Extradition 'May Never Occur'

from the when-even-the-'good-guys'-are-getting-sick-of-the-endless-delays... dept

It's not just Kim Dotcom that's tiring of the endless procedural delays in the US's prosecution of him and his service. Other plaintiffs who are looking to legally pursue Dotcom for infringement are getting fed up with the length of the process, which still has no end in sight.

Microhits, one of two copyright holders who filed civil suits against Megaupload two months after after the FBI raid on Dotcom's home, has just requested it be allowed to move forward on its civil lawsuit as it feels the DOJ's case is taking too long to proceed.

Microhits has asked the United States courts to stop delaying its case against Megaupload until the extradition issue is resolved - because it might never happen.

New papers filed with the US district court in Virginia say the extradition is "a mere possible future event but indeed an event which may in fact never occur."

Microhits, whose catalog includes Christina Aguilera, Rod Stewart, Marvin Gaye and Dr. Dre, had its original filing put on hold for six months to allow the US to proceed with its case, something the DOJ doesn't seem to be in any hurry to do. Megaupload's legal defense requested these two civil suits be put on hold for a number of reasons, while mentioning the close resemblance between Microhit's filing and the US government's indictment.

In its motion, Megaupload said the civil suit allegations "appear to be copied verbatim" from the indictment filed in January. If the civil suit progressed in parallel with the criminal case, Megaupload's defendants may be forced to assert their Fifth Amendment right against self incrimination but then waive it as part of the civil case, the motion said.

"This would be an unfair burden on their constitutional rights," the document contends.

Further, Megaupload argued it is broke, as its assets were frozen in January. The company has been asking the U.S. government to unfreeze some funds in order to pay for the preservation of upwards of 28 petabytes of data stored on the service and needed for the legal cases.

As it stands now, extradition hearings won't begin for another 8 months, and Microhit is worried it may never get to directly pursue Megaupload -- and that Megaupload may have its money safely out of reach by the time it gets the green light.

Microhits also pointed to the potential loss of any damages. They said Mr Dotcom had posted messages on his Twitter account in which he wrote about his new Mega business. In the posts, Microhits said he had "openly avowed to move their assets and operations out of reach of the United States".

Megaupload's lawyers fired back, stating that its assets weren't even under Dotcom's control at this point.

They said the US Government had seized the assets and were "doling out limited amounts for living expenses and foreign counsel".

"Defendants' assets are still sequestered and no amount of tweets and blog-posts will 'un-freeze them' - that requires a court order."

Mr Dotcom's team said facing the civil action would be difficult because of no access to seized funds, seizure of books and records and no access to the former Megaupload servers. The FBI has copied parts of the servers and wanted to delete the rest.

So, even if Microhits receives the go-ahead, its options are greatly restricted by the DOJ's previous actions against Megaupload. Microhits does have a point, though -- this case has dragged on far too long with very little progress being made by the prosecution. At this point, it almost looks as though the DOJ has settled in for a war of attrition -- one that will slowly bleed Dotcom, keeping his assets frozen, his business closed and any evidence contained on Megaupload's servers in the control of people who can't seem to decide whether to keep it or destroy it.

The longer this drags on, the less likely it seems that the DOJ has a strong case. But, as has been demonstrated by other site seizures, it really doesn't seem to matter whether there's a winnable case behind the shutdowns. Entities like the DOJ and FBI that are more than willing to seize first and ask questions later are probably not the kind that will step aside and let a civil suit take precedence. Microhits is going to find itself empathizing with Megaupload, as delay after delay push any sort of resolution back across the horizon.

Filed Under: civil case, copyright, doj, extradition, kim dotcom
Companies: megaupload, microhits

Kim Dotcom Cleared To Pursue Case Against New Zealand For Illegal Spying

from the opening-up-a-can-of-worms dept

The latest in the saga of New Zealand's Government Communications Security Bureau (GCSB) -- their version of the NSA -- illegally spying on Kim Dotcom, is that he's been cleared to file a lawsuit against the GCSB for its activities and the GCSB will be told to reveal some of the details of its secret electronic spying setup.

The order for the GCSB to reveal top secret details came as the High Court at Auckland ruled the spy agency would now sit alongside the police in a case probing the unlawful search warrant used in the raid on Dotcom's north Auckland mansion.

Chief high court judge Helen Winkelmann said the GCSB would have to "confirm all entities" to which it gave information sourced through its illegal interception of Dotcom's communications.

She said her order included "members of Echelon/Five Eyes, including any United States authority". The Echelon network is an international intelligence network to which New Zealand and the United States are members, along with Australia, Canada and the United Kingdom.

You have to imagine that New Zealand officials are seriously regretting falling for the DOJ's version of the Megaupload story without bothering to actually check the details, huh?

Filed Under: gcsb, illegal spying, kim dotcom, new zealand
Companies: megaupload

New Zealand Government Admits That Order To Suppress Illegal Spying On Kim Dotcom Only Such Order Issued In 10 Years

from the oops dept

You may recall that, back in September, the New Zealand government admitted that the GCSB (Government Communications Security Bureau), the local equivalent of the NSA had illegally spied on Kim Dotcom to aid American DOJ investigators. New Zealand's Prime Minister, John Key, apologized and ordered an investigation. Many were asking when Key actually knew about the illegal surveillance, which covered domestic communications, despite GCSB's mandate being focused on foreign communications. It's now come out that the order to "suppress" the information about GCSB's activities, signed by acting prime minister Bill English (normally the Finance Minister) while Key was abroad, was the only such document in 10 years:

The spy agency has stated that the certificate signed by Finance Minister Bill English as Acting Prime Minister was the only one found in "a thorough search of our files".

Mr English was asked by the GCSB to sign the "ministerial certificate" while Prime Minister John Key was overseas in August. The certificate said knowledge of the GCSB's involvement in the Dotcom investigation would damage its ability to detect or prevent serious crime.

The fact it was the only ministerial warrant in 10 years was discovered by the Green Party under the Official Information Act. Its rarity has led Green Party co-leader Russel Norman to question how Mr Key stayed ignorant of its existence until a month after it was signed.

Beyond the concern of who knew what and when, there should be continued outrage in New Zealand at its goverment's willingness to bend over backwards to break the law just because the US entertainment industry was putting pressure on the DOJ to "do something" about Megaupload. The fact that they appear to have not only broken the law, but then issued a one-of-a-kind order to try to hide the fact that they broke the law really says something about the lengths the NZ government were willing to go to please Hollywood.

Filed Under: bill english, gcsb, john key, kim dotcom, new zealand, secrecy, surveillance

German Court Sees Through The DOJ Fairy Tale, Rejects Attempt To Seize Megaupload Assets

from the a-string-of-failures dept

We've covered a series of embarrassing setbacks for the US government's case against Megaupload over the past few months. It's a pretty stunning trail of errors by US officials who seemed to think that a scary story about a "bad man" would trump a lack of actual evidence or following legal procedure. While the case may hold up in the long run, it seems like everywhere you look there's evidence of highly questionable activity by the government.

The latest setback comes from Germany, where the US sought assistance from officials in seizing various assets of Dotcom's or Megauploads. However, the court has now rejected the request:

The Frankfurt judges have since rejected this request, because it contains insufficient evidence. The US legal team failed to demonstrate that a web hosting service for the illegal upload of copyrighted files, amounts to a criminal offence.

According to the German 'Telemediengesetz' (communications legislation), a hosting service for foreign files will generally not be accountable unless the host had active knowledge of illegal activity. The judges also emphasised that the concept of knowledge is limited to positive knowledge. Therefore if the service provider believes that it is possible or likely that a specific piece of information is stored on their server, this is not sufficient evidence of knowledge of abuse.

According to the court ruling, there is no legal obligation to monitor the transmitted data or stored information or to search for any illegal activity.

Of course this was the same point that we raised the day that Megaupload was shut down. While it may be true that many Megaupload users have infringed on copyrights, there's a massive leap from that point to the idea that Megaupload is a criminal enterprise -- yet the US government's case basically skips over any details to make that leap. Thankfully cooler heads are recognizing that a significant amount of the US's case seems to be based on a fairy tale that US officials -- under the influence of Hollywood -- keep telling.

Tip to DOJ officials under the sway of Hollywood's version of the internet: remember, these people make their livings telling fairy tale stories. You know those opening credit lines about how something is "based on a true story"? Yeah, quite frequently the actual truth is a long way from what's shown. It seems that you may have been taken in by another such Hollywood "true" tale.

Filed Under: assets, copyright, criminal, doj, germany, hosting, kim dotcom, liability
Companies: megaupload

Me.ga Domain Pulled Out From Under New Kim Dotcom Venture

from the well-look-at-that dept

As we've noted, we've been avoiding stories about whatever "new" service Kim Dotcom is launching, because it all sounds like hype and vaporware to us. Until there's something real, it's all just rampant speculation, and it's a little silly how much adoration people have for an idea whose details have not been released at all. However, we will cover factual information related to the effort, and as was widely reported by others, the plan had been to use the domain name Me.ga. This had a few useful "features." First, it plays on the "mega" prefix that is so closely associated with Dotcom's offerings. Perhaps more importantly (at least, it's a key thing that many in the press covered), the .ga domain is not technically subject to control or seizure by the US (though, of course, SOPA/PIPA were intended to deal with just that kind of situation).

However, even without SOPA/PIPA, there is still the power of diplomatic pressure, and it didn't take long for the Communications Minister of Gabon to announce that the domain was being suspended:

"I have instructed my departments... to immediately suspend the site www.me.ga," announced Communication Minister Blaise Louembe, saying he wanted to "protect intellectual property rights" and "fight cyber crime effectively".

"Gabon cannot serve as a platform or screen for committing acts aimed at violating copyrights, nor be used by unscrupulous people," the minister said.

Of course, that seems pretty presumptuous on a number of levels. Since the service has not been launched -- and the actual details have not been revealed -- it's a bit premature to declare that the site must somehow violate intellectual property rights or be useful for cybercrime. And if government officials are stepping in to kill off cyberlockers based entirely on rumor and innuendo, will .ga block any other cyberlocker as well? Considering how popular such services are -- including those run by well-established companies like Amazon, Google and Dropbox -- it makes you wonder how Gabon decides who gets to use a .ga domain.

There may also be a separate issue at play here. As some have noted, the .ga top level domain is administered by Gabon Telecom, which just so happens to be a wholly owned subsidiary of Vivendi... the same company who owns the world's largest music label, Universal Music. I'm sure that's just a coincidence.

Filed Under: .ga, copyright, cyberlocker, gabon, kim dotcom, me.ga
Companies: mega, megaupload