Ireland Becoming The Key Spot In Fights Over Data Privacy: Both Concerning Governments And Tech Companies

from the this-is-the-big-fight dept

There's a really big battle brewing concerning privacy protections online that involves some Silicon Valley tech companies, Ireland and the US government. And chances are this fight is going to get nasty. A few weeks ago, you might have heard that Twitter announced an interesting change in its privacy policy and terms of service, saying that all non-US users would technically now be managed under Twitter International Company, based in Dublin, Ireland. And, last week, Dropbox made a very similar announcement, noting that all non-North American users were now technically under Dropbox Ireland, while users in the US, Canada and Mexico remain under Dropbox in the US. Twitter's new terms go into effect on May 18th, and Dropbox's on June 1st (unless you're opening a new account before then, and the new terms apply immediately).

Over the last decade, Ireland has become a popular destination for US tech firms to set up international operations, in part because of Ireland setting itself up as sort of a tax haven for tech firms via its "Double Irish" tax dodge. A bunch of tech companies have been criticized for this, though the response of "we're following exactly what the law allows" is reasonable enough. Either way, that tax loophole is closing, though others may show up instead.

But this move doesn't seem predicated by that. Instead, there are two related elements that may be at work here. First: Ireland is also seen as having some of the most company-friendly privacy laws in the EU, though those are also coming under some amount of scrutiny. But, at the same time, by claiming that users are now under the Irish company, it gives Twitter and Dropbox at least some power to try to say no to US government requests for information. So, depending on if you're more afraid of government intrusions in your data than corporate intrusions (as I am), then these moves are probably good for your privacy.

Except... the US government still thinks that it can do whatever the hell it wants. First, in some ways, data inside the US has potentially more protections against the US government in a somewhat bizarre way. Whether you believe it or not, the NSA cannot "hack" its way into US computer systems. It can only use the various other processes it has to demand information from companies. Overseas, however, there are no such restrictions. The NSA has interpreted Executive Order 12333 to mean that it can hack into anything overseas, and this was the authority it used to break into the data centers of Google, Yahoo and likely more overseas (sneaking in via Level 3 and others).

But, that still requires hacking into stuff. If US tech companies believe they can successfully fend off such hacks, putting non-US users under Irish law does give them greater protection from the NSA. The NSA can no longer use its other authorities in the US to get the FISA Court to demand information (along with gag orders) from these companies. Or... maybe not. As we've been discussing, there's an ongoing court battle between the US Justice Department and Microsoft, over whether or not the DOJ can issue a warrant demanding Microsoft hand over information stored in Ireland. Microsoft has resisted, but the courts have so far sided with the DOJ. Ireland recognizes this is an important fight, and has asked for the EU to come out in support of Microsoft's position.

Meanwhile, with a new Attorney General in office, the DOJ has made it clear that it's going to continue this course of action:

US prosecutors will continue to seek data stored in Ireland using a federal search warrant, despite leadership changes at the Justice Department.

A spokesperson confirmed in an email that the department's position has "not changed," two weeks after Loretta Lynch, the Obama administration's choice to head up the federal agency, was confirmed by Congress as the new US attorney general.

This battle is going to be rather important for those other companies seeking to protect users under Irish law. Warrants aren't supposed to apply outside of the US. But the DOJ (and the courts) have been simply making up new laws, in arguing that if it's a US company, but the data is overseas, the warrant magically morphs into a quasi-warrant/subpoena hybrid. But that's ridiculous. Warrants and subpoenas have different purposes and different protections -- and the DOJ wants the best of both worlds. As Microsoft itself explained in one of its legal filings:

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this.

This fight is far from over -- and with companies like Twitter and Dropbox now trying to shift more non-US users under Irish laws, the fight with Microsoft is going to become even more important.

And, that's not even getting into the discussion of how all of this is, effectively, driving US businesses overseas. The US's efforts to spy on everyone is, once again, harming the US economy, rather than helping it.

Filed Under: data protection, ireland, lawsuits, privacy, surveillance, terms of service
Companies: dropbox, microsoft, twitter

Court Issues Highly Questionable Restraining Order Over Anyone Even Remotely Related To Streaming Mayweather/Pacquiao Fight

from the that's-not-right... dept

Last week, we wrote about HBO and Showtime teaming up to pre-emptively sue two websites that publicly claimed they were going to live stream video footage of the Floyd Mayweather/Manny Pacquiao boxing match that happened this weekend. As we noted, it seemed odd to sue someone for infringement prior to the copyrighted content even existing, but as some helpfully noted, US copyright law includes a weird provision, 17 USC 411(c), which notes that when you're talking about works where "the first fixation of which is made simultaneously with its transmission," then "the copyright owner may, either before or after such fixation takes place, institute an action for infringement" given a few, pretty basic, conditions. In other words, while rare, the law does allow for just that sort of lawsuit for anticipatory infringement.

Thus, it shouldn't be too surprising that the judge, in fact, granted the request for a temporary restraining order on the two sites in question, boxinghd.net and sportship.org. Frankly, I have no idea if either one of the sites carried through on their promise to stream the fight this weekend, though I imagine it would be fairly dumb of them to have actually done so. From a cursory check, as I type this, it appears both sites are completely offline, so perhaps they both just shut down rather than deal with the threats from HBO and Showtime (or, perhaps, just moved to alternate domains).

However, as EFF points out, the court's temporary restraining order issued in the case goes way, way beyond just restricting those two sites, and raises some really serious concerns. Specifically, the restraining order didn't just restrict those two sites from showing the streams of the boxing match, but basically anyone who is sent the order:

Each and every one of the Defendants and their agents, servants, employees, officers, attorneys, successors, licensees, partners, and assigns and all those acting in active concert or participation with any of them, including any and all service providers who receive notice of this Order, are temporarily restrained and enjoined...

As the EFF points out, this is de facto SOPA -- allowing copyright holders to simply point at a site they don't like, claim they're "bad" and basically order them off of the internet by merely sending a copy of the restraining order:

You may not feel much sympathy for the websites in question. But this kind of site-blocking, without real legal process, is essentially one of the worst parts of the ill-conceived, long-dead Stop Online Piracy Act (SOPA) being brought in through the courtroom back door. HBO got an order to block content against those who act as intermediaries, even though they have nothing to do with the alleged illegality of the sites, are simply providing normal business services, and almost surely had no notice that they were about to be enjoined.

This is not the way our legal system is meant to work, and the good news is that it actually doesn’t. Federal Rules only allow courts to issue injunctions against those who truly are in “active concert or participation” with bad actors. We doubt that those who offer hosting services and video delivery, without more, can properly be considered in “active concert or participation” with the unauthorized streamers.

As the article above points out, it may not seem all that sympathetic considering these kinds of sites, but take it a step further. As we already discussed, whether or not these sites actually streamed any parts of the fight, the fight was widely streamed -- but via Twitter's Periscope service. And, under the terms of this order, if HBO or Showtime had sent this order to Twitter, it could be found to have violated a court order despite not even remotely being a party to the case!

I don't care what you think about those who might have streamed the fight in an unauthorized way, you have to admit that there are clear due process concerns when a court pushes such a broad order, that ties the hands of those who might not even have been aware of the court case at all, let alone that it was legally restricting their ability to operate (in a way that might also be technically impossible). Yes, this may have been convenient for HBO and Showtime, but it's difficult to see how that temporary restraining order is even remotely constitutional (or sensible).

Filed Under: due process, floyd mayweather, free speech, lawsuits, manny pacquaio, restraining order, streaming
Companies: hbo, showtime, twitter

2 Hockey Players And Elisha Cuthbert Want Cash From A TV Station For Airing A Joke Tweet

from the streisand-shoots-and-she-scores! dept

I'm a little surprised to say that we have yet another Streisand Effect story involving NHL hockey players. The previous post had to do with a rookie hockey player who tried to trademark a nickname with some negative connotations to it in order to control how that nickname was being used. This one is a little bit different and, honestly, it sounds like the start to really bad joke: two hockey players and actress Elisha Cuthbert want an apology and cash from a sports station that aired a joke tweet about a love triangle between the three of them during the trade deadline coverage.

That's the joke tweet. It was part of a rolling tweet embed that sports stations do all the time, instructing viewers to use a particular hashtag and then pulling those tweets and putting them on the air. This particular tweet, concerning the Toronto Mapleleafs' Joffrey Lupul, Dion Phaneuf, and Phaneuf's wife, who happens to be Elisha Cuthbert, probably would have made it past any automated filters the station, TSN, had set up. After all, there's no obvious vulgar words or anything like that. So, whether such filters exist or not, the tweet pops up on air.

And the three subjects of the joke are pissed.

"On behalf of our clients Dion Phaneuf, his wife Elisha Cuthbert and Joffrey Lupul, we have sent a letter to TSN demanding that TSN issue a formal apology and pay a significant amount of damages to each of our clients for broadcasting a false and defamatory tweet during their trade deadline show yesterday. We are sending a similar letter to the author of the tweet, Mr. Anthony Adragna.

It is bad enough that there are people who spend their time using social media to publish such false and malicious stories, but it is made much worse when a reputable media outlet like TSN gives broad circulation and credibility to these false stories by republishing them as TSN did. If TSN and Mr. Adragna do not immediately comply with the demands set out in our letters, we have instructions from our clients to immediately commence a lawsuit against them. Our clients will not be discussing this matter with the media. Any questions should be directed to the undersigned."

So, a couple of things here. First, it's questionable how much validity a lawsuit against either party would be. The tweet itself is obviously a joke to anyone who bothers to read the wording of it, which makes a defamation case problematic. TSN has alreay issued an apology to the three of them and they clearly had no intention of defaming anyone at all.

But, finally, and most importantly, what the hell, you three? It was a flash of a joke tweet that was on a Toronto TV station for, like, a couple of seconds. But because you three freaked out about it and got the lawyers involved, there's been national media attention on the very thing you wanted to erase from our collective consciousness to begin with. Talk about Streisanding your way towards the opposite goal.

Filed Under: dion phaneuf, elisha cuthbert, hockey, joffrey lupul, jokes, lawsuits, streisand effect, threats, tv, tweets
Companies: toronto mapleleafs, tsn

Is America About To Experience The Billion-Dollar Pain Of Corporate Sovereignty First Hand?

from the not-your-parents'-ISDS dept

Readers of Techdirt have been hearing about corporate sovereignty -- the ability of foreign investors to sue governments directly in special courts over alleged losses, also known as Investor-State Dispute Settlement (ISDS) -- for a while now. For others who have yet to discover this particular feature of so-called trade agreements, Senator Elizabeth Warren has a good, approachable summary of the key issues in a Washington Post opinion piece. In fact, it was clearly so good that the White House Blog felt obliged to try to rebut its main arguments (there's also a great point-by-point response to that response by the Cato Institute's Simon Lester.). The White House Blogt post, written by Jeff Zients, Director of the National Economic Council, pretty much concedes that the criticisms of ISDS are valid, but would have us believe that everything has been fixed now:

ISDS has come under criticism because of some legitimate complaints about poorly written agreements. The U.S. shares some of those concerns, and agrees with the need for new, higher standards, stronger safeguards and better transparency provisions. Through TPP and other agreements, that is exactly what we are putting in place.

There are two massive problems with that assurance. First, the extreme secrecy of the TPP negotiations means that we have no idea just how strong those "safeguards" are. And secondly, in some sense it doesn't even matter: companies can use the mere threat of an ISDS action to cast a chill over future regulatory action. That's why the following comment is true but misses the point:

The reality is that ISDS does not and cannot require countries to change any law or regulation.

The ability to use ISDS to discourage governments from introducing inconvenient laws or regulations is no mere theoretical fear. As this important 2001 article in The Nation explains:

Carla Hills, the US Trade Representative who oversaw the NAFTA negotiations for Bush I and now heads her own trade-consulting firm, was among the very first to play this game of bump-and-run intimidation. Her corporate clients include big tobacco -- R.J. Reynolds and Philip Morris. Sixteen months after leaving office, Hills dispatched Julius Katz, her former chief deputy at USTR, to warn Ottawa to back off its proposed law to require plain packaging for cigarettes. If it didn't, Katz said, Canada would have to compensate his clients under NAFTA and the new legal doctrine he and Hills had helped create [ISDS]. "No US multinational tobacco manufacturer or its lobbyists are going to dictate health policy in this country," the Canadian health minister vowed. Canada backed off, nevertheless.

Nor was that an isolated incident:

A former government official in Ottawa told me: "I've seen the letters from the New York and DC law firms coming up to the Canadian government on virtually every new environmental regulation and proposition in the last five years. They involved dry-cleaning chemicals, pharmaceuticals, pesticides, patent law.Virtually all of the new initiatives were targeted and most of them never saw the light of day."

Zients goes on to say that corporate sovereignty chapters are needed because foreign courts can't be trusted to provide justice:

U.S. investors often face a heightened risk of bias or discrimination when abroad.

But Warren already answered that with several extremely powerful points:

Countries in the TPP are hardly emerging economies with weak legal systems. Australia and Japan have well-developed, well-respected legal systems, and multinational corporations navigate those systems every day, but ISDS would preempt their courts too. And to the extent there are countries that are riskier politically, market competition can solve the problem. Countries that respect property rights and the rule of law — such as the United States — should be more competitive, and if a company wants to invest in a country with a weak legal system, then it should buy political-risk insurance.

Zients also tries to argue that since the US hasn't suffered as a result of ISDS cases in the past, it'll be fine in the future:

There have only been 13 cases brought to judgment against the United States in the three decades since we’ve been party to these agreements. By contrast, during the same period of time in our domestic system, individual and companies have brought hundreds of thousands of challenges against Federal, state, and local governments in U.S. courts under U.S. law.

We have never lost an ISDS case because of the strong safeguards in the U.S. approach. And because we have continued to raise standards through each agreement, in recent years we have seen a drop in ISDS claims, despite increased levels of investment.

But that line of reasoning ignores why there have been so few cases in the past: because corporate sovereignty provisions were mainly included to protect US investments in developing countries with weaker legal systems. By definition, such nations are unlikely to have the resources to make many or significant investments in the US, and therefore have few opportunities to use the ISDS system. That is what will change dramatically with TAFTA/TTIP, as this analysis by Public Citizen explains:

TAFTA would vastly expand the investor-state threat, given the thousands of corporations doing business in both the United States and EU that would be newly empowered to attack public interest policies. More than 3,400 EU parent corporations own more than 24,200 subsidiaries in the United States, any one of which could provide the basis for an investor-state claim. This exposure to investor-state attacks far exceeds that associated with all other U.S. "free trade" agreement partners.

In fact, the US may be about to find out about the modern reality of billion-dollar corporate sovereignty lawsuits, thanks to the 21-year-old NAFTA agreement, and the controversial Keystone XL project, which President Obama recently vetoed. Here's Politico's explanation of how corporate sovereignty could enter the equation:

President Barack Obama may decide to kill Keystone XL for good, but that could be no easy task -- thanks in part to the North American Free Trade Agreement.

The 21-year-old free-trade pact allows foreign companies or governments to haul the U.S. in front of an international tribunal to face accusations of putting their investments at risk through regulations or other decisions. The CEO of Keystone developer TransCanada has raised the prospect as a potential last resort if Obama rejects the $8 billion project, although for now the company is focused on getting him to say yes.

Administration officials involved in reviewing the proposed Canada-to-Texas pipeline are aware of the potential for a NAFTA challenge and the importance of minimizing that risk in the event the president rejects Keystone.

So even though the President retains full powers to reject Keystone, it’s easy to see how the threat of a billion-dollar ISDS lawsuit might encourage him to approve it anyway. That would offer the perfect demonstration of how corporate sovereignty chapters can interfere with democratic decision-making -- at even the highest levels.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: corporate sovereignty, elizabeth warren, isds, jeff zients, lawsuits, tafta, tpp, trade agreements, ttip, ustr

EasyDNS Sued For Refusing To Take Down Website Without Court Order; Then Hit Again For Writing About The Lawsuit

from the this-is-not-a-good-idea dept

Oh boy. Back in August of last year, EasyDNS announced that it was being sued in an Ontario small claims court for refusing to take down a website. The lawsuit was filed by a guy named Andy Lehrer, who was upset about another website that makes fun of Andy Lehrer (and may, possibly, include defamatory statements). Whether or not that site is defamatory is between Lehrer and whoever made the site (and, potentially, a court of law). Lehrer demanded EasyDNS take the site down, but the company (rightfully) pointed out that it would need a court order before doing so. But, instead, Lehrer went after EasyDNS in a lawsuit, naming it as a "co-defendent" and demanding $25,000 and injunctive relief (i.e., that the site be taken down).

In November, EasyDNS wrote about the case again, pointing out that it was seeking to get out of the case, because it shouldn't be considered liable for what a user did on his own site just because EasyDNS hosts it. Also, small claims court doesn't provide injunctive relief as a remedy anyway. In response, it appears that Lehrer has decided to amend his complaint against EasyDNS, specifically arguing that the company further damaged him by writing about the case. Seriously. From the lawsuit:

54) Further, the Defendant EasyDNS has, on August 22, 2014, November 13, 2014 and December 10, 2014, posted publicly about this lawsuit on http:/blog.easydns.org and directed people to the Defendant Rourke's content despite knowing that the Plaintiff views this content as defamatory. According to a chart posted on the Defendant EasyDNS's November 13, 2014 posting, the earlier blog entry of August 22 resulted in substantial increase in the number of individuals viewing the causepimps.ca website. The postings by EasyDNS constitute egregious and non-content neutral behaviour which is contrary to the EasyDNS's claim of "innocent dissemination" and deserves the censure of this court.

55) In addition, in reaction to the within proceeding, the Defendants easyDNS and Rourke have both published the statement of claim on their respective websites. In addition, Defendant EasyDNS has published the statement of claim on the online publishing platform Scribd. The Defendants have thus furthered the libels after being put on notice of the defamation. Their conduct is egregious, is deserving of the censure of this court including the imposition of punitive damages.

56) The Plaintiff pleads that the Defendants deliberately, intentionally or recklessly harmed and damaged the Plaintiff by publishing and distributing the defamatory words and that they acted with actual malice by either publishing and distributing the defamatory statements with the knowledge that the information was false or with reckless disregard of whether it was false or not.

Got that? Merely writing about the case apparently is a cause of new action, as is, apparently, posting the public document filed in the lawsuit. But that's absurd. Lehrer's entire lawsuit is premised on the idea that the content is obviously defamatory, but as EasyDNS pointed out to him, that's a matter for the courts to decide, not a hosting provider.

In the US, thankfully, things like Section 230 of the CDA would immunize against any kind of legal attack like this -- but Canada doesn't have an easy out like that, which means it's likely that EasyDNS will have to go to court and defend itself using basic common sense on liability, noting that it's just the host and not responsible for the content, and that it would be absolutely insane to hold it liable for the content. Finally, as of this amended complaint, it will have to explain why talking about a lawsuit and filing the public documents related to that lawsuit is not some sort of egregious behavior that deserves "the imposition of punitive damages."

Once again, we're left amazed at how some people assume that anything they don't like online must be illegal, and everyone else must be responsible for it.

Filed Under: andy lehrer, canada, court order, defamation, hosting, lawsuits, secondary liability, takedowns
Companies: easydns