Swedish Police Say Anti-Piracy Law Has Harmed Ability To Catch Criminals

from the consequences dept

We've pointed out many times in the past the "unintended" consequences of certain activities, and it looks like the entertainment industry's worldwide effort to push for more and more industry-favorable copyright laws is causing serious problems elsewhere. Apparently, Anders Ahlqvist, who runs the Swedish IT crime unit is noting that the response to the IPRED law in Sweden (pushed by the entertainment industry to crack down on unauthorized file sharing) means that it's now more difficult for him to do his job. Part of the issue, of course, is that various ISPs responded to the law by seeking to protect their users' privacy by deleting log files. Of course, that probably means it's only a matter of time before the industry pushes for new data retention laws, despite evidence that more data retention can actually make life trickier for law enforcement as well. Still, at some point people need to recognize that the entertainment industry's single-minded focus on "stomping out file sharing" rather than adding value through new business models has some serious costs elsewhere.

Filed Under: anti-piracy, encryption, log files, sweden, unintended consequences

VA Continues Its Annual Tradition Of Losing Laptop With Unencrypted Sensitive Data

from the the-ministry-of-data-leaks dept

When we last checked in with the Veterans Administration (VA) it was to suggest that it rename itself the "Ministry of Data Leaks." That's because every year or so they admit that they've lost a computer that happens to contain unencrypted personal data on VA members. And, each report seems to get worse than the previous one. So you would think that, by now, the VA would have at least put in place some system to encrypt and protect the data it stores. That would be wishful thinking. It's now come out that the VA has had two major data breaches in just the last month -- both involving laptops that had unencrypted data.

Of course, this comes after those earlier breaches cost taxpayers tens of millions of dollars in notifications and in response to a class action lawsuit, leading Congress to require the VA to encrypt its data. Apparently, the VA didn't bother to actually follow through on that requirement. Congress is now investigating again, with the following statement from Rep. Steve Buyer in kicking off the investigation:

"I attribute the continued lack of security to poor memory among VA's senior management, and its failure to realize the magnitude of the problem that could have been prevented," Buyer writes. "This is an inexcusable abrogation of responsibility that would not be tolerated in any private company. Veterans and American taxpayers expect a higher standard from the VA...."

Not that I expect a Congressional investigation to be very effective, but at some point you have to wonder what folks at the VA are thinking.

Filed Under: data leak, encryption
Companies: va, veterans administration

Bunch Of Companies Sued Over Encryption Patents

from the but-of-course dept

Another day, another story of a company no one's heard of who seems to produce nothing but patents, filing a lawsuit against a ton of companies in East Texas (of course). This one, sent in by the Bored SysAdmin, involves a company called The Pacid Group, suing Asus, Samsung, Sony, Sony Ericsson, Fujitsu, LG, Gigabyte, GBT, MSI, Motorola, Research in Motion, Nikon, Microsoft, Nintendo, HTC and Palm, claiming that they all violate two of its patents (5,963,646 and 6,049,612) on encryption. While it's often difficult to find any information on the no name companies who sue big companies for patent infringement, at least The Pacid Group has a website, where it clearly shows the company's only products: patents.

As we've seen in other similar lawsuits, the company appears to think that pretty much every bit of modern technology violates its patents. According to the lawsuit, all of the following types of products may violate these patents: laptops, mobile phones, printers, routers, digital cameras, Blu-ray disk players, gaming devices, wireless adapters and portable media players. Now, sure, you could make the claim that all of these companies found these patents from a company no one had heard of, and decided to "copy" the idea into their product. Or, the fact that this basic idea appears in so many places might lead you to conclude that the idea was the natural progression of the technology and obvious to those skilled in the art, and thus not deserving of a patent. But that would make sense.

Filed Under: encryption, patents
Companies: asus, fujitsu, gbt, gigabyte, htc, lg, microsoft, motorola, msi, nikon, nintendo, palm, rim, samsung, sony, sony ericsson

BPI Says That UK Spies Are Against Digital Economy Bill

from the strange-bedfellows dept

The debate over the Digital Economy Bill in the UK (the attempt to ratchet up copyright law to repay favors to an entertainment industry that is slow to adapt) has taken an odd twist. Cory Doctorow over at Boing Boing has the details of a leaked memo from the BPI (pdf) to a bunch of recording industry execs and lobbyists, that details the state of the bill and the ongoing strategy for getting it approved. There are a few items worth noting:

1. The BPI seems to think that the UK intelligence community is now the biggest threat to stopping the bill. Seriously. Apparently, UK spies are afraid that passing this bill will drive a very large number of people to switch to using encrypted internet tools, making it that much more difficult to spy on them. This may be an accurate concern, but it's surprising to hear that the intelligence community is now considered the biggest hurdle to getting the bill passed. Apparently, the BPI is fairly unconcerned with consumer rights groups. The BPI seems so paranoid about the intelligence community, that it actually suggests in the memo that the British spying agency MI5 may have paid for a recent survey released by the ISP Talk Talk, saying that 71% of those 18-34 years old would continue to file share, using "undetectable means."
   
   The memo also mocks the fact that this particular bill now has the Open Rights Group on the same side of an issue as MI5 -- when the two are normally somewhat diametrically opposed.
   
   
2. While the BPI sounds fairly confident that the bill will get through, it recognizes that it could get stalled if enough Members of Parliament start asking questions about the speed with which the bill is being pushed through:

   As for the House of Commons -- which will be sent the Bill next week -- there is a strange sense of detachment. MPs with whom we spoke back in Autum are already resigned to the fact that they will have minimum input into the provisions from this point on, given the lack of time for detailed scrutiny. One leading backbencher has told us that there is "little point in meeting, since the Bill will be determined at wash-up". That said, John Whittingdale -- an inveterate "timing sceptic" (i.e. he's for the Bill but doesn't think it will get through in time) has said this week that he still thinks it could be lost if enough MPs protest at not having the opportunity to scrutinise it. Whilst true in constitutional theory terms, the hard politics of the situation makes it seem unlikely. And inveterate opponents like Derek Wyatt and Tom Watson continue to blog and tweet with critical comments, but there is not the sense of a groundswell of massive opposition to the Bill.

   In other words: if you live in the UK, now is the time to start speaking up and contacting your elected officials, as well as letting others know that a bill to greatly take away your rights is about to be pushed through the House of Commons, unless you speak up now.
   
   
3. Finally, among the "upcoming" activities, the memo mentions that on Wednesday the 18th, there will be a release of a report from TERA on "The importance of saving jobs in the EU's Creative Industries." We see these types of reports all the time, and they're usually poorly thought out and poorly argued, assuming, incorrectly, that a loss of jobs in one part of an industry might not be made up elsewhere, and rarely (if ever) paying attention to the fact that artificially propping up one part of the industry has massive negative consequences for other areas in the economy. So let's see what this report says. But assuming you start seeing press reports about this later this week, make sure to read through them with a critical eye.

Filed Under: bpi, copyright, digital economy bill, encryption, intelligence, mi5, security
Companies: bpi, mi5, open rights group

Copyright Damages Out Of Control: $51 Million For Satellite Cracking App?

from the seems-a-bit-extreme dept

It continues to amaze me that there's anyone out there who thinks that the damages awarded in many copyright suits are anywhere close to reasonable or proportional to the "crime" at hand. Copycense points us to an article about a guy who was found guilty of putting software on the internet that allowed people to unlock Dish Network programming on unauthorized receivers. Because of this, Dish and another satellite TV provider, NagraStar, were awarded $51 million. $51 million -- for putting the software on the internet. That's all. The amount was determined based on the number of people who downloaded the software, even though, in all likelihood, a much, much smaller percentage would have ever actually paid for an authorized satellite TV account. Furthermore, this guy did not do the actual act of accessing the unauthorized signal, or breaking any encryption. He merely provided the tools to do so. Charging him with the bogus "cost" of each user of his software makes no sense at all. Even if you accept what he did was wrong and clearly illegal, it's difficult to see how that justifies the ridiculousness of the award.

Filed Under: copyright, damages, encryption, satellite
Companies: echostar, nagrastar

GSM Encryption Cracked... GSMA's First Response? That's Illegal!

from the yeah,-because-the-eavesdroppers-care dept

The big news in security circles this week is the fact that a security researcher claims to have cracked the encryption used to keep GSM mobile phone calls private. It looks like he and some collaborators used a brute force method. He admits that it requires about $30,000 worth of equipment to de-crypt calls in real-time, but that's pocket change for many of the folks who would want to make use of this. What's much more interesting (and worrisome) is the GSM Association's (GSMA) response to this news:

"This is theoretically possible but practically unlikely," said Claire Cranton, an association spokeswoman. She said no one else had broken the code since its adoption. "What he is doing would be illegal in Britain and the United States. To do this while supposedly being concerned about privacy is beyond me."

There are so many things wrong with that statement it's hard to know where to begin. First, claiming it's "theoretically possible, but practically unlikely" means that it's very, very possible and quite likely. To then say that no one else had broken the code since its adoption fifteen years ago is almost certainly false. What she means is that no one else who's broken the code has gone public with it -- probably because it's much more lucrative keeping that info to themselves. Next, blaming the messenger by announcing that cracking the code is "illegal in Britain and the United States" is not what anyone who uses a GSM phone should want to hear. They should want to know how the GSMA is responding and fixing the problem -- not how they're responding to the public release. Finally, if it's "beyond" her why cracking a code used for private conversations and showing that it's insecure is all about being concerned about "privacy" -- she should be looking for a different job. This has everything to do with privacy. The GSMA claims that the code is secure for private conversations, and this group of folks is showing that it is not. That seems to have everything to do with privacy.

Filed Under: encryption, gsm, privacy, reaction, security
Companies: gsma

Attacks On File Sharing Simply Drive People Further Underground

from the it-doesn't-make-them-buy dept

Admittedly it's just an estimate, but reports coming out of Sweden suggest that, rather than stop file sharing, under the new IPRED law, a growing number of file sharing users have simply gone further underground using anonymizing services. Of course, this shouldn't surprise anyone, as plenty of people have been predicting that's exactly that would happen for the better part of a decade. You would think that folks in the entertainment industry might actually pay attention since those predictions from years back have come true. But instead, they'd rather attack those of us who have pointed out why their strategy isn't working. At what point do they stop and realize that their critics actually are giving them good advice?

Filed Under: encryption, file sharing, underground

No Surprise Here: Three Strikes Law Creates Opportunity For Encrypted VPN Services In France

from the as-expected dept

Just as we saw how stricter laws on unauthorized file sharing increased the demand for encryption services in Sweden, Dan alerts us to the news that new encryption services are popping up in France in response to that country's recent approval of a law to kick file sharers off the internet. And so the cat and mouse game continues. Perhaps at some point, rather than fighting new technologies and consumer wishes, some of these politicians and copyright holders will decide to embrace the technology and use it to their advantage. Otherwise, they're just going to find that they'll keep passing ever more useless laws, driving people to newer and newer technologies to get around those laws.

Filed Under: encryption, france, three strikes

Encrypting Data Doesn't Do Much Good If You Tape The Password To The Storage Device...

from the just-saying... dept

In the early days of large scale data leaks online, the mantra one heard over and over again was "encryption, encryption, encryption!" Yet, encryption alone doesn't do much good, if you tape the passwords to decrypt the data to the storage device itself (found via Michael Scott). Yet, whaddaya know? That's exactly what happened in a recent data breach in the UK, though I'm sure similar breaches happen all over the world. This is what happens when someone preaches a specific action in security, rather than actual secure thinking and planning.

Filed Under: encryption, leaks, passwords

Sweden's Anti-Piracy Law Boost Market For Encryption Technology

from the keep-whac'ing-that-mole dept

With Sweden's new antipiracy law in effect, it seems that one industry is getting a nice boost: apparently there's a lot of new interest in encrypting your internet traffic, and services that provide encrypted VPN services are getting lots of new business. This, once again, points out that near total pointlessness in playing Whac-A-Mole over file sharing. It just become an endless game where each side continues to elevate itself, and it makes it that much more difficult in the end for the entertainment industry to do what it will inevitably be forced to do anyway: start building business models that embrace file sharing. But the further they push users of such services underground, the more and more difficult they'll find it to embrace these services down the road. Each attempt to knock out these services or their users only comes around to backfire on the industry itself.

Filed Under: antipiracy, encryption, ipred, sweden