UK Court Says Lauri Love Can Be Extradited To Face Hacking Charges In The US

from the big-brothers-gotta-stick-together dept

Lauri Love, the British hacker the DOJ has been dying to get its hands on, has just been handed over to the US by his own government. The decision issued today [PDF] basically states that honoring extradition agreements is more important than any concerns issued about Love's health and well-being once handed over to US federal agents.

Mr Love’s Article 8 rights are clearly engaged. In balancing the factors for and against extradition I am satisfied that the very strong counter-balancing factors required to find extradition would be disproportionate are not found in this case. Mr Love faces extremely serious charges for offences of computer hacking over a period of one year from October 2012 to October 2013. I accept Mr Love suffers from both physical and mental health issues but I have found the medical facilities in the United States prison estate on arrival and during any sentence if he is convicted available to him, are such that I can be satisfied his needs will be comprehensively met by the US authorities.

I am satisfied Mr Love’s extradition would be compatible with his Convention rights and I send this case to the Secretary of State for her decision as to whether or not Mr Love should be extradited.

Once in the US, authorities have promised to address Love's mental and physical health concerns by placing him in "segregated housing" while determining if he's capable of being housed in the general population. As anyone who's followed prosecutions of whistleblowers and hackers knows, "segregated housing" is just a colorful term for "solitary confinement" -- not generally known to improve the mental well-being of people who've already expressed suicidal thoughts.

On top of a trip to solitary, Love will be facing charges from three jurisdictions related to the alleged hacking of multiple government/government contractor websites and databases.

Mr Love is accused in three indictments in three districts as follows:

(i) Southern District of New York – Mr Love faces two counts on Indictment, one of computer hacking (maximum sentence of 10 years imprisonment) and one of aggravated identity theft (maximum sentence of 2 years imprisonment to be imposed consecutively to the sentence for count 1).

(ii) The New Jersey request details two counts on one indictment. One count is conspiracy to access a computer without authorisation and obtain information from a department or agency of the United States (maximum sentence of 5 years imprisonment) and one of accessing a computer without authorisation and obtaining information from a department or agency of the United States (maximum sentence of 5 years imprisonment).

(iii) The Eastern District of Virginia request contains nine counts on an Indictment, count 1 – conspiracy to cause damage to a protected computer and to commit access device fraud (maximum sentence of 5 years imprisonment); counts 2 -7 – causing damage to a protected computer and aiding and abetting (maximum sentence of 5 years imprisonment); count 8 – access device fraud and aiding and abetting (maximum sentence of 10 years imprisonment) and count 9 – aggravated identity theft and aiding and abetting (maximum sentence of 2 years imprisonment).

There's little to be gained by adding up the maximum possible jail sentence facing Love. Rest assured, if convicted, it will likely be over a decade. Consolidation of the cases and charges is likely, but more than one of the charges carry possible 10-year sentences.

Meanwhile, back in the UK, Love has managed to escape being jailed for refusing to turn over passwords and encryption keys to law enforcement. UK investigators fought hard to force Love -- who they've never formally charged -- to crack open multiple seized devices for them. This attempt was shot down in May by a judge who viewed this as an end run around protections built into RIPA, the laws governing law enforcement's investigatory powers.

The final decision on Love's extradition is in the hands of Elizabeth Truss, the recently-appointed Secretary of State for Justice. Truss' previous government work doesn't really provide much guidance on which side she'll come down on this, but her voting record tends to indicate she's more sympathetic to national security/law enforcement interests than those of her constituents. Considering the UK and US have a very cozy surveillance relationship, it stands to reason Truss will likely decide to appease the DOJ, rather than overturn the court's decision.

Filed Under: cfaa, extradition, hacking, lauri love, uk, us

Treaty For The Blind Comes Into Force... But US Refuses To Ratify Because Publishers Association Hates Any User Rights

from the shameful dept

For many, many, many, many years, we've followed the rather crazy trials and tribulations of trying to get an international treaty signed to make it easier for the blind to access copyright-covered works (basically requiring countries to allow visually-impaired accessible versions to be reproduced and distributed). This is a treaty that people have tried to get in place for years and years and years, and it was blocked again and again -- often by legacy copyright industries who flat out refuse to support any kind of agreement that could be seen as strengthening user rights, which they see (ridiculously, and incorrectly) as chipping away at copyright. Amazingly, despite a last minute push by the MPAA and the Association of American Publishers, an agreement was reached and signed in 2013, called the Marrakesh Agreement. As we noted at the time, we fully expected the legacy copyright industries to refocus their efforts on blocking ratification in the US, and that's exactly what's happened.

Hell, it took almost three years for the White House to finally send over the treaty to the Senate for ratification. That happened back in February, and they sent it together with another copyright-related treaty, the very troubling Beijing Treaty that creates an entirely new form of copyright for performers. So far, the Senate has moved on neither issue. However, to have the Marrakesh Treaty go into effect, it needed 20 countries to ratify it. And while the US has sat still, a few weeks ago, Canada became the 20th country to complete the ratification process. That means the agreement officially goes into effect on September 30th of this year. As the EFF noted:

That’s another significant step for a treaty that has already made some important breakthroughs as the first international treaty focused exclusively on the rights of users of copyrighted material. Typically, if user’s rights are considered at all, they’re relegated to a section on “limitations and exceptions” or even as non-binding introductory text. In the Marrakesh Agreement, they are front and center.

That post also noted that it should be a no brainer for the US to ratify this:

United States law is already compliant with Marrakesh, but the government has not yet ratified the agreement. To do so requires a two-thirds vote from the Senate, and then a formal ratification from the President. Even at a time when passing legislation has proven exceedingly difficult, the Marrakesh Agreement would be a relatively easy and uncontroversial way to demonstrate leadership internationally and help bring books to millions of blind, visually impaired, and print-disabled people around the world.

But why hasn't it happened? According to KEI, a group that fought hard for many years to get the agreement in place, the legacy copyright industries are working hard to block it in Congress:

The Obama Administration has asked the US Congress to ratify the treaty... but Congress has yet to act, in large part due to lobbying from the Association of American Publishers.... The AAP lobbied the Administration for changes in the U.S. ratification package, and now have asked the Congress for changes that they failed to obtain in the interagency review process. The U.S. ratification already represents compromises, including limitations of exports to countries that have ratified the treaty, a provision that currently excludes all of Africa and Europe. But the AAP continues to press for additional amendments to the ratification legislation.

This isn't a huge surprise, the AAP more or less admitted that they would refuse to support anything that established greater user rights, since that would be seen as an attack on "their rights." And, of course, the MPAA has also been working hard to block it, whining that this treaty could (gasp!) "affect other future treaties."

All of that is just shameful. This is a no-brainer situation. Helping the visually impaired get access to these works is something everyone should agree is a good thing. And yet, because they're so scared of user rights expanding in any way at all, the legacy industries have to block it.

Filed Under: blind, canada, copyright, marrakesh treaty, treaty for the blind, us, user rights, wipo
Companies: association of american publishers, mpaa

TAFTA/TTIP Just Got Harder: Brexit Is 'A Midsummer Night's Nightmare' Says EU Trade Commissioner

from the massive-potential-win-for-humanity dept

After the dramatic and largely unexpected victory of the "Brexit" (Britain Exit) camp in the UK -- those who want the country to leave the European Union -- politicians around the world are trying to work out what the implications will be. For the UK, of course, it meant an immediate trashing of the UK pound against the US dollar; for the US, it meant the loss of a reliable ally within the EU camp. As The New York Times puts it:

No country shares Washington's worldview quite the way Britain does, they say; it has long been the United States' most willing security ally, most effective intelligence partner and greatest enthusiast of the free-trade mantras that have been a keystone of America's internationalist approach. And few nations were as willing to put a thumb as firmly on the scales of European debates in ways that benefit the United States.

Now that quiet diplomatic leverage -- including moderating European trade demands and strong-arming nations to contribute more to NATO military missions -- is suddenly diminished.

As that mentions, trade is one area where the UK played a key role for the US, and its departure from the EU will make negotiations for the TAFTA/TTIP deal, now dragging on into their fourth year, even harder, since the UK was one of the main countries pushing for it. The European Commission is worried: after the results of the Brexit vote were known, the EU's commissioner for trade, Cecilia Malmström, called it "A midsummer night's nightmare," (original in Swedish.) However, she also insisted that she would press on regardless:

I am determined to make as much progress as possible in the months to come. This is particularly true for our negotiations with the United States on a Transatlantic Trade and Investment Partnership.

But as Politico.eu points out, once the UK leaves the EU, TTIP won't be such an attractive deal for the US:

"We certainly lose an important market," said MEP Bernd Lange, the chair of the European Parliament's international trade committee, of the U.K. "In a way, that means losing leverage."

Losing that leverage will make it harder to wring concessions out of the US, which was not particularly keen on offering any even before. The USTR's lukewarm post-Brexit statement hardly gives the EU much hope of the US meeting its main demands:

The importance of trade and investment is indisputable in our relationships with both the European Union and the United Kingdom. The economic and strategic rationale for T-TIP remains strong. We are evaluating the impact of the United Kingdom's decision on T-TIP and look forward to continuing our engagement with the European Union and our relations with the United Kingdom.

The problem is that without some clear wins for the EU, it will be very hard to sell the TAFTA/TTIP deal to Europeans and the Members of the European Parliament (MEPs) who must ratify the deal once it is finished. A report on Reuters is already pessimistic about TTIP's chances:

The historic divorce launched by Thursday's vote will almost certainly further delay substantial progress in the Transatlantic Trade and Investment Partnership (TTIP) talks as the remaining 27 EU states sort out their own new relationship with Britain, trade experts said on Friday.

With French and German officials increasingly voicing skepticism about TTIP's chances for success, the United Kingdom's departure from the deal could sink hopes of a deal before President Barack Obama leaves office in January.

That view was backed up by the following new report:

French Prime Minister Manuel Valls on Sunday blasted a planned EU-US trade treaty, saying the ambitious deal was against "EU interests."

"No free trade agreement should be concluded if it does not respect EU interests. Europe should be firm," Valls told members of the governing Socialist Party, adding "France will be vigilant about this."

"I can tell you frankly, there cannot be a transatlantic treaty agreement. This agreement is not on track," Valls said.

Meanwhile, in an open letter to the EU heads of state and government, 240 European organizations have called for the TTIP negotiations to be abandoned now:

People across the continent have a greater awareness of trade deals than at any previous time. Any move to express renewed support for TTIP will be highly publicised and scrutinised across Europe. We therefore appeal to you to use this opportunity to heed public opinion and urgently withdraw the mandate for TTIP.

The UK probably does not care about the havoc Brexit is wreaking on TAFTA/TTIP, not least because it has its own huge problems in the area of trade. Once it leaves the EU, it will need to renegotiate all the trade deals that it currently enjoys as a result of being part of the European Union, as well as striking some new ones. Naturally, the most important of those would be with the US. Even if some kind of TAFTA/TTIP deal is achieved at some point -- possibly years down the line -- the UK will not be part of it. As a result, it needs to agree something with the US on its own.

That's not going be easy. A spokesperson for President Obama confirmed that the UK would not be getting any preferential treatment when it came to trade deals, and that it would have to wait its turn. As people are already pointing out, the UK's extremely weak negotiating position means that it is likely to end up with a really bad US deal:

Nick Dearden, director of Global Justice Now, said the "right-wing lurch of Brexit" could result in Britain signing up to "TTIP on steroids".

As well as its inability to haggle, there's another reason why the UK may sign up to something that is far worse than the current TAFTA/TTIP: the person seen as a likely successor to David Cameron as UK prime minister, Boris Johnson, thinks such a deal with the US would be an unalloyed boon. In 2014, he wrote a prophetic article in which he gushed as follows:

This pact is a massive potential win for humanity -- the closer economic union between two vast territories that share a tradition of democracy, free speech, pluralism: the Western values that are under threat in so many other parts of the world; and where almost everyone has English as a first or second language.

Trade between Europe and the US is already worth $4.7 trillion; this is the chance to go further. If the EU can't pull it off, we in Britain should offer to go first and do it ourselves.

It now looks increasingly likely that the UK will do precisely that. The big question is: will the US care?

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: brexit, eu, eu commission, trade agreements, ttip, uk, us

US Suddenly Discovers Why Supranational Tribunals Are A Problem, Just As It Starts Losing In Them

from the probably-just-a-coincidence dept

There's a bit of a battle going on in an obscure part of the World Trade Organization (WTO) called the Appellate Body, which has extremely wide-ranging powers within the WTO:

It is a standing body of seven persons that hears appeals from reports issued by panels in disputes brought by WTO Members. The Appellate Body can uphold, modify or reverse the legal findings and conclusions of a panel, and Appellate Body Reports, once adopted by the Dispute Settlement Body (DSB), must be accepted by the parties to the dispute.

Here's what's been happening, as reported by Bloomberg:

The U.S. won't support the reappointment of Seung Wha Chang of South Korea to the World Trade Organization (WTO) appellate body, a U.S. official said at a meeting in Geneva.

"We do not consider that his service reflects the role assigned to the appellate body by WTO members in the WTO agreements," Deputy U.S. Permanent Representative Chris Wilson told members of the WTO dispute settlement body (DSB) May 23. "Any failure to follow scrupulously the role we members have assigned through these agreements undermines the integrity of, and support for, the WTO dispute settlement system."

As the article explains, that's not going down too well with other WTO members, including Brazil, the European Union, Japan, and South Korea, who are traditionally allies of the US in trade matters. So what exactly has Chang done to incur the wrath of the US?

The U.S. said it was troubled by four recent panel decisions that Chang was involved in because they "raised systemic concerns about the disregard for the proper role of the appellate body and the WTO dispute settlement system."

Which seems to be a polite way of saying that Chang hasn't been toeing the US line. That's confirmed by the following section from a WTO news item about the DSB meeting where this argument took place:

Canada, the European Union, India and Viet Nam added that the United States' statement of opposition [to Chang] based on previous Appellate Body decisions could create a dangerous precedent for other reappointment proceedings and affect an Appellate Body member's decision-making during their first term.

Here's one of those panel decisions that the US doesn't like:

In the fourth ruling -- which upheld China's allegations about U.S. duties on non-market economies -- the appellate panel "took a very problematic and erroneous approach" that risks turning the DSB into "one that would substitute the judgment of WTO adjudicators for that of a member's domestic legal system as to what is lawful under that member's domestic law," Wilson said.

The interesting part is the bit at the end there, where the US complains that the WTO's dispute settlement system is effectively overruling national law. Techdirt readers will recognize that as a common complaint about the tribunals that adjudicate on disputes between investors and governments -- the so-called "investor-state dispute settlement" (ISDS) system, aka corporate sovereignty. Until now, the US has been a solid supporter of these tribunals, so it's rather significant to see it moaning about the problem of uppity adjudicators here. It raises the question why the US is unhappy with the DSB tribunal, but doesn't seem to have a problem with those used in ISDS.

It might have something to do with the fact that the US has never lost a corporate sovereignty case -- something it uses to justify the inclusion of ISDS in TPP and TAFTA/TTIP -- but is increasingly on the wrong end of decisions at the WTO. As to why the US never loses ISDS cases, Ante Wessels, writing on the FFII.org blog, has a provocative theory: he says the "Investor-to-state dispute settlement is a rigged system" that is tilted in favor of the US. Whether or not you agree with his analysis, it's certainly interesting to see how the US seems to be changing its mind on the value of supranational tribunals that can ride roughshod over domestic legal systems now that it finds itself on the losing side.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: corporate sovereignty, isds, seung wha chang, trade agreements, tribunals, us, wto

UK Law Enforcement Trying To Force Man They've Never Charged With A Crime To Decrypt His Computers

from the see-smoke,-presume-arson dept

British hacker Lauri Love stands accused of causing "millions of dollars" in damages to US government computers -- charges he's been facing for more than two years. These charges originate in the US, but it's the UK that's been trying to get Love to give up his encryption keys for the past couple of years.

Under RIPA (Regulation of Investigatory Powers Act of 2000), the UK government can charge Love with "failure to cooperate" by refusing to comply with the order to decrypt files. To date it has not done so, despite Love blowing off its demands since the middle of February 2014.

The only charges Love is facing have been levied by the US Department of Justice. He has fought extradition for the past couple of years and the UK government has yet to make any progress on that front. However, UK law enforcement has stepped up its efforts to force Love to turn over passwords and keys. J.M. Porup at Ars Technica has seen a copy of the request and has more details.

In the NCA's submission to the court, which Ars has seen a copy of, the government demanded that Love turn over the passwords and encryption keys to his confiscated devices. The devices in question include a Samsung laptop, a Fujitsu Siemens laptop, a Compaq computer tower, an SD card, and a Western Digital hard drive. The NCA in particular wants Love to decrypt TrueCrypt files on the SD card and external drive.

This seems like a very severe demand from the National Crime Authority, considering it still hasn't -- despite two years and two arrests -- seen fit to bring criminal charges against Love. This is also its second attempt -- one using a separate legal authority (not RIPA Section 49, as was used earlier) -- to compel Love to comply with its demands.

Meanwhile, Love is (logically) suing the UK government for the return of his devices.

Love's argument in his civil case is that if the police aren't going to charge him with a crime, they should return his property. "The problem is that the NCA are effectively arguing that any information that cannot be read and comprehended by the police has a presumption of guilt," Love told Ars in an e-mailed statement.

As Love points out, equating encryption with guilt has severe ramifications for anyone who uses it.

"This has clear and troubling implications for groups that handle sensitive communications or other data—journalists, advocates, activists and whistleblowers, and members of the legal profession.

"An executive body of the state is saying that any information to which they are not privy... cannot be owned and kept securely but instead confiscated and access denied," Love added. "This is a fundamental reversal of rights and the potential for abuse is alarming."

The NCA claims it wants Love to decrypt his devices so he can prove his ownership of any information or data found on them -- which allegedly includes pirated film and documents obtained (without permission) for US government websites. Love sees this as nothing more than the NCA trying to help out its American counterparts by using the UK's more permissive laws to obtain information about Love's hacking activities. And, it must be pointed out again -- the NCA wants to force the uncharged Love to crack open his devices so it can find something to charge him with.

Maybe there's something incriminating stored on Love's computers. Maybe not. But either way, UK law enforcement is working backwards from a presumption of guilt. And it's basing this all on things it can't see. This belief system is similar to that held by many law enforcement agencies, which have spent much of the last few months claiming an encrypted phone is a "guilty" phone in front of judges, Congress and to members of the media.

Filed Under: decrypt, doj, encryption, lauri love, nca, passcode, ripa, uk, us

UK Investigative Agencies Want To Be Able To Send Warrants To US Companies

from the lots-of-'solutions,'-all-of-them-terrible-in-different-ways dept

Because citizens are localized but their data isn't, things aren't going to get any less weird as time progresses. Or any less legally troublesome. Ellen Nakashima and Andrea Petersen of the Washington Post have seen a copy of a draft negotiating document between UK and US representatives that would allow MI5 (and presumably other agencies) to access data and communications held on US servers.

The transatlantic allies have quietly begun negotiations this month on an agreement that would enable the British government to serve wiretap orders directly on U.S. communication firms for live intercepts in criminal and national security investigations involving its own citizens. Britain would also be able to serve orders to obtain stored data, such as emails.

UK agencies would still be locked out of obtaining information or data on US persons and it would take legislation to actually make this access a reality, but it's apparently being considered, as UK officials feel this issue is standing in the way of investigations/counterterrorism efforts.

As it stands now, UK agencies must make formal diplomatic requests which rely on a Mutual Legal Assistance Treaty -- a process that can take months. That's not good enough, apparently. Everyone wants instant access, including UK agencies, and a strong streak of entitlement (the same entitlement guiding FBI director James Comey's one-sided "debate" on encryption) runs through the arguments for this expansion of the UK's legal powers.

“Why should they have to do that?” said the administration official. “Why can’t they investigate crimes in the U.K., involving U.K. nationals under their own laws, regardless of the fact that the data happens to be on a server overseas?”

Why indeed? Why comply with existing laws or territorial restrictions? After all, the FBI is working toward the same end, pushing for the right to hack servers located anywhere in the world when pursuing criminals.

Several issues need to be addressed before UK agencies can be granted permission to demand communications and data from US companies. For one thing, a warrant issued in the UK is not exactly the same thing as a warrant issued in the US. The legal standards may be similar, but they're still a long ways from identical.

The negotiating text was silent on the legal standard the British government must meet to obtain a wiretap order or a search warrant for stored data. Its system does not require a judge to approve search and wiretap warrants for surveillance based on probable cause, as is done in the United States. Instead, the home secretary, who oversees police and internal affairs, approves the warrant if that cabinet member finds that it is “necessary” for national security or to prevent serious crime and that it is “proportionate” to the intrusion.

Note the "silence" on the differences between the legal standards. It appears no one involved in this discussion is interested in digging into these disparities.

A second administration official said that U.S. officials have concluded that Britain “already [has] strong substantive and procedural protections for privacy.” He added: “They may not be word for word exactly what ours are, but they are equivalent in the sense of being robust protections.”

As a result, he said, Britain’s legal standards are not at issue in the talks. “We are not weighing into legal process standards in the U.K., no more than we would want the U.K. to weigh in on what our orders look like,” he said.

That's great. Both countries won't examine each other's legal standards because they don't want to upset the reciprocity implicit in the draft agreement. The UK can ask for stuff from US companies and vice versa, with neither country playing by the other country's rules. In between all of this are citizens of each respective countries, whose data and communications might be subjected to varying legal standards -- not based on where the data is held, but who's asking for it.

Of course, the alternatives are just as problematic. If an agreement like this fails to cohere, overseas governments will likely demand data and communications generated by their citizens be stored locally, where they would be subject only to local standards.

Then there's the question of what information these agencies already have access to, thanks to the surveillance partnership between the NSA and GCHQ. Although neither agency is supposed to be focused on domestic surveillance (although both participate in this to some extent), the NSA is allowed to "tip" domestic data to the FBI for law enforcement purposes. Presumably, GCHQ can do the same with MI5. The tipped info may not be as comprehensive as what could be obtained by approaching a provider directly, but it's certainly more than the black hole the current situation is being portrayed as. (Especially considering GCHQ already has permission to break into any computer system located anywhere in the world...)

No matter what conclusion the parties come to, legislation addressing it is likely still several months away, if it ever coheres at all. Congress -- despite its occasional lapses into terrorist-related idiocy -- is likely not interested in subjecting US companies to foreign laws, no matter the stated reason for doing so. But if it doesn't oblige the UK (and others who will jump on the all-access bandwagon), it's safe to assume the British government will move towards forcing US companies to set up local servers and segregating communications and data by country of origin.

Filed Under: surveillance, uk, us, warrants

EU And US Come To 'Agreement' On Safe Harbor, But If It Doesn't Stop Mass Surveillance, It Won't Fly

from the separate-out-the-issues dept

Back in October, we noted that it was a really big deal that the European Court of Justice had said that the EU/US Safe Harbor framework violated data protection rules, because it had become clear that the NSA was scooping up lots of the data. The issue, if you're not aware of it, is that under the safe harbor framework, US internet companies could have European customers and users, with their information and data stored on US servers. Without the safe harbor framework, there are at least some cases where many companies would be forced to set up separate data centers in Europe, and make sure European information is kept there.

Many privacy activists are actually supportive of keeping the data in Europe altogether, but I still think that would be a disaster for lots of internet companies and services -- especially smaller ones. The big guys -- Google, Facebook, Microsoft, Yahoo, Twitter, etc. -- can afford to have separate European data centers. A small company -- like Techdirt -- cannot. Requiring separate data centers and careful separation of the data would ensure less competition and fewer startups to take on the big guys. That's a problem. Beyond that, having those separate data centers could actually lead to even less privacy in the long run, because having many jurisdictions in which data is kept means that, inevitably, some of those jurisdictions will fall into states that have even worse surveillance and fewer data protections -- and also leaves open the opportunity for different data center setups, which may lead to more vulnerabilities. Remember, when the NSA broke into Google and Yahoo's datacenters, they were the ones outside the US, which may have had weaker security. And, despite many Europeans not wishing to believe this, many European countries have many fewer restrictions on the kind of surveillance their intelligence agencies are able to do on local data and citizens.

The real issue here is mass surveillance overall. The only real way to fix this issue is to stop mass surveillance and go back to saying that intelligence agencies and law enforcement need to go back to doing targeted surveillance using warrants and true oversight. But, instead, the EU and the US keep trying to paper over this by coming up with a new agreement. That agreement was supposed to have been concluded by a fake "deadline" set for yesterday, but after missing that and claiming that progress had been made on a new agreement, a new deal was finally announced a few hours ago, with the ridiculous name "The EU-US Privacy Shield."

Here's the key part of the announcement:

• Strong obligations on companies handling Europeans' personal data and robust enforcement: U.S. companies wishing to import personal data from Europe will need to commit to robust obligations on how personal data is processed and individual rights are guaranteed. The Department of Commerce will monitor that companies publish their commitments, which makes them enforceable under U.S. law by the US. Federal Trade Commission. In addition, any company handling human resources data from Europe has to commit to comply with decisions by European DPAs.
  

• Clear safeguards and transparency obligations on U.S. government access: For the first time, the US has given the EU written assurances that the access of public authorities for law enforcement and national security will be subject to clear limitations, safeguards and oversight mechanisms. These exceptions must be used only to the extent necessary and proportionate. The U.S. has ruled out indiscriminate mass surveillance on the personal data transferred to the US under the new arrangement. To regularly monitor the functioning of the arrangement there will be an annual joint review, which will also include the issue of national security access. The European Commission and the U.S. Department of Commerce will conduct the review and invite national intelligence experts from the U.S. and European Data Protection Authorities to it.
  

• Effective protection of EU citizens' rights with several redress possibilities: Any citizen who considers that their data has been misused under the new arrangement will have several redress possibilities. Companies have deadlines to reply to complaints. European DPAs can refer complaints to the Department of Commerce and the Federal Trade Commission. In addition, Alternative Dispute resolution will be free of charge. For complaints on possible access by national intelligence authorities, a new Ombudsperson will be created.

The key thing here? The claim that the US "has ruled out indiscriminate mass surveillance on the personal data transferred to the US." I'm curious about how much bullshit the NSA will be able to sneak under "indiscriminate." I'm also curious as to what kind of real oversight there will be. The EU Commission and the Department of Commerce will be able to review, but we all know how good the NSA is at hiding what it's actually doing from oversight bodies. Finally, the "ombudsperson" only matters if they have actual power, and that seems incredibly unlikely.

And as Max Schrems, who brought the original case that took down the safe harbors, is saying (over and over again), as it stands right now, it looks like this new deal will lose again in the EU courts.

And that brings us back to the underlying point. The effort to kill off the safe harbor agreement wasn't really about the safe harbor agreement at all, but to force the hand of the US government (and hopefully European governments as well) to recognize that they need to stop doing mass surveillance. The claim above about no indiscriminate mass surveillance pays lip service to that idea, but there needs to be some real and concrete change to make that happen. And that's going to take more than an "exchange of letters" between the EU and the US, as the basis of this deal. It's going to need actual surveillance reform, not just the "surveillance reform lite" we saw with the USA FREEDOM Act.

Again, I think having the ability to transfer data from the EU to the US is hugely important -- which not everyone agrees with. Fragmenting the internet by requiring that data stays in certain countries seems as silly to me as geoblocking content. But the underlying issue here is not about where the data is stored -- it's about mass surveillance. Focusing the agreement on how to allow data transfers without actually tackling how to stop mass surveillance is inevitably a fake solution.

Filed Under: data protection, data transfers, eu, mass surveillance, privacy, privacy shield, safe harbor, us

DOJ Agrees To Hand Over Document To EPIC, But Only Because The Document Has Already Been Made Public

from the damn-foreigners dept

EPIC is reporting that the DOJ has finally caved and is handing over a document it requested last fall. The document EPIC sought was the "Umbrella Agreement" between the US and Europe on the handling of each entities' citizens' data.

On September 8, 2015, European and US officials announced that they have concluded an agreement, the so-called Umbrella Agreement, which is a framework for transatlantic data transfer between the US and the EU. The proposed goal of the Agreement is to provide data protection safeguards for personal information transferred between the EU and the US. Despite the announcements, neither US officials nor their European counterparts made the text of the Agreement public.

Two days after this announcement, EPIC filed expedited FOIA requests on both sides of the pond for the text of this agreement, arguing (logically) that the people this would affect had a right to know what their governments were agreeing to. EPIC specifically had concerns that the US would offer less protection to foreign citizens' data than to its own citizens, given that it has historically refused to extend these niceties to those residing elsewhere on the planet.

The DOJ has provided EPIC with a copy of the agreement. In doing so, it hopes to bring to an end EPIC's FOIA lawsuit against the agency. But the DOJ notes in the letter attached to the agreement that it's only doing so in the most begrudging fashion. If only its partners on the other side of the Atlantic hadn't blinked first…

After carefully reviewing the record responsive to your request, I have determined that, as a matter of discretion, this document may be released in full. While this record is likely subject to Exemption 5, which concerns certain inter- and intra-agency communications protected by the deliberative process privilege, given the fact that the European Commission has provided you with a copy of the record and is making the file publicly available on its website, I have determined to release the record as a matter of discretion.

That's the "most transparent administration" at work. The European Parliament released the agreement on September 14, 2015 -- six days after the announcement. The DOJ, on the other hand, held out for nearly six months and is only releasing it because it's already in the public domain. And it's arguing that it should still be exempt as a "deliberative document" -- using the government's most-abused FOIA exemption -- even when another, larger government agency has determined the document deserves no such protection.

Filed Under: data sharing, doj, eu, privacy, surveillance, umbrella agreement, us
Companies: epic

NZ Newspaper: An 'Honor' To Welcome Small Pacific Rim Countries As They Sign Away Much Of Their Sovereignty

from the most-comprehensive-and-far-sighted-economic-agreement-of-all-time dept

As we've written recently, a report from the World Bank suggests that the economic benefits from TPP will be slight for the US, Australia and Canada. New Zealand is predicted to do better, but not much: the econometric modelling predicts a 3.1% boost to its GDP by 2030 -- roughly 0.3% extra GDP per year. That's a pretty poor payback given the price participant countries will have to pay in terms of copyright, biologics and corporate sovereignty. Such details have not prevented one of the main newspapers in the country, the New Zealand Herald, from banging the drum for TPP's signing ceremony, which is probably going to take place quite soon:

New Zealand is about to have the honour of hosting the formal signing of the Trans-Pacific Partnership agreement by trade ministers from 12 nations of the Pacific rim. And it is an honour. This is the most comprehensive and far-sighted economic agreement the world has seen in our lifetime, possibly of all time.

Rather bizarrely, the editorial goes on to list TPP's many problems:

The TPP's intellectual property discussions raised the risk that US patent law and copyright protection of pharmaceuticals and other products of investment in science and research could be strengthened at considerable cost to public purchasing agencies, such as Pharmac, and innovation in digital technology in other countries. Medical professionals and IT developers have been among those fearful of the TPP during the course of its negotiation. So were environmentalists and public health promoters. They feared the inclusion of investor-state dispute settlement procedures could stop governments taking action in the interests of public health or the environment that would reduce the value of commercial investments.

At this point, you might expect a refutation from the editorial, and a compelling explanation why all those concerns proved misguided. Instead, it notes that many of these fears were stoked by the insane secrecy surrounding the negotiations, and suggests that since the text was released two months ago, everything's OK now. The editorial has to admit that yes, there are 6000 pages that need to be read, but points out that the final text has provided great summer holiday reading for those in the Southern Hemisphere. It then makes the following claim:

The precise terms seem to have survived scrutiny so far.

In fact, the release of the TPP text has amply confirmed the main worries regarding just about every aspect of the deal. For anyone wanting a quick catch-up on the major problems there, Michael Geist is running a helpful series with the self-explanatory title "The Trouble with the TPP":

[I] wanted to expand on the trouble with the TPP in more detail. With that goal in mind, I plan to post each weekday until February 4th on problems associated with the TPP. The series will include posts on copyright, privacy, Internet governance, and many other issues.

Maybe the editors at the New Zealand Herald should read the series before the TPP signing ceremony, so that at least they understand why the following is not going to happen:

It is too much to hope any fears now assuaged [sic] will reduce the scale of protest at the signing. But it should not be too much to ask that those philosophically opposed to free trade respect the views of those who disagree with them, and let this country host the occasion with dignity and pride.

Dignity, maybe. But pride? That's hardly appropriate given what is really happening here.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, canada, corporate sovereignty, new zealand, signing, tpp, us

World Bank Report: TPP Will Bring Negligible Economic Benefit To US, Canada And Australia

from the well,-that's-awkward dept

Supporters of TPP generally insist it's absolutely worth doing, despite any infelicities it might contain, because of the huge overall economic benefit it will bring to participants. But when challenged, they are unable to cite any credible evidence for that claim. That's because there isn't any: despite the impact that TPP's measures will have on how the US and other countries do business, there are astonishingly few studies on whether it will indeed have a positive impact overall. Just over a year ago, we wrote about one of the rare attempts to model TPP, commissioned by the US Department of Agriculture, which came up with the following result for countries like the US and Australia:

TPP is projected to have no measurable impacts on real GDP

However, that particular study only looked at the effect of removing traditional tariffs; as it pointed out, TPP includes other elements that might also boost GDP. Fortunately, we now have a new report from the World Bank, no less, which took into account all aspects of the proposed deal. Here's the summary of what it found (pdf):

The model simulations suggest that, by 2030, the TPP will raise member country GDP by 0.4-10 percent, and by 1.1 percent, on a GDP-weighted average basis.

That's a little vague: 10% GDP increase is very different from only 0.4%, so it really matters who gets what. The detailed figures are as follows:

Vietnam -- 10%
Malaysia -- 8%
Brunei -- 5%
New Zealand -- 3.1%
Singapore -- 3%
Japan -- 2.7%
Peru -- 2.1%
Mexico -- 1.4%
Canada -- 1.2%
Chile -- 1%
Australia -- 0.7%
US -- 0.4%

But those figures too are misleading, because they refer to the cumulative GDP gain from TPP by 2030. It's not clear when the World Bank econometric model assumes TPP will come into effect, but by 2030 it's clearly been running for at least ten years, and maybe even 12. That means all of the figures above need to be divided by at least a factor of 10 in order to arrive at the annual boost to growth, which provides a better measure of TPP's impact than the overall figure.

So according to the World Bank's figures, the US will gain an extra 0.04% GDP per year on average, as a result of TPP; Australia an extra 0.07% annually, and Canada a boost of 0.12% per year. In other words, they differ from the USDA's earlier projection of "no measurable impacts on real GDP" by amounts that are so small they will be swamped by the general imprecision of the model -- trying to predict what will happen to a big chunk of the global economy out in 2030 is hard, and that's putting it mildly.

The fact that two econometric models of TPP's effects, both from highly-respected institutions, predict that TPP will produce vanishingly-small economic benefits for key countries, including the US, could explain why there are so few such studies. A cynic might suggest that others were started but generated such inconveniently-awful outcomes that they were quietly dropped and never published.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, canada, economics, tpp, us, world bank