Lenovo In Denial: Insists There's No Security Problem With Superfish -- Which Is Very, Very Wrong.

from the so-long-and-thanks-for-all-the-superfish dept

Late last night, people started buzzing on Twitter about the fact that Lenovo, makers of the famous Thinkpad laptops, had been installing a really nasty form of adware on those machines called Superfish. Many news stories started popping up about this, again, focusing on the adware. But putting adware on a computer, while ethically questionable and a general pain in the ass, is not the real problem here. The problem is that the adware in question, Superfish, has an astoundingly stupid way of working that effectively allows for a very easy man in the middle attack on any computer with the software installed, making it a massive security hole that is insanely dangerous.

Lenovo's response? Basically to shrug its shoulders and say it doesn't understand why anyone's that upset. This is because whoever wrote Lenovo's statement on this is completely clueless about computer security.

We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns.

Bullshit. That's really the only response that should be said to that line. Lenovo focuses on the reasons why many people normally hate adware: that it tracks what you're doing and sends info back to third parties. That's not what Superfish does, so Lenovo doesn't see what the big deal is. Superfish, which was just recently ranked 64th by Forbes in its list of "Most Promising American Companies," tries to watch what you're surfing, and when you see certain images, the service injects other offerings for similar (or the same) products. In theory, if one chose to use such a product, you could see why it could be useful. But automatically putting it on computers is a different thing all together.

The real problem is in how Superfish deals with HTTPS protected sites. Since, in theory, it shouldn't be able to see the images on those sites, it appears that Superfish came up with what it must have believed was a clever workaround: it just installs a root HTTPS certificate, that it signs itself, to pretend that any HTTPS page you're visiting is perfectly legitimate. For many years, we've pointed out why the HTTPS system with certificate authorities is open to a giant man in the middle attack via any certificate authority willing to grant a fake certificate -- and here we basically have Lenovo enabling this questionable company to go hogwild with this exact kind of MITM attack. Basically, EVERY SINGLE HTTPS SITE that you visit was a victim of this kind of MITM attack -- solely for the purpose of interjecting Superfish ads. In fact, some have suggested it could apply to VPNs as well. Basically this is a massively dangerous security hole with wide ranging implications. And Lenovo says they don't see why.

And, even beyond that, it's implemented incredibly stupidly -- in a way that is ridiculously dangerous. That's because it appears that the private key use for the Superfish certificate is the same on basically every install of this software. And it didn't take very long at all for security folks, such as Robert Graham, to crack the password, meaning that it's now incredibly easy to get access to information someone thinks is encrypted. As Graham notes, the password is "komodia" which just so happens to also be the name of a company that "redirects" HTTPS traffic (for spying on kids and such).

This is a massive and ridiculous security threat, and Lenovo is completely brushing it off as nothing big. As many have noted, people have been complaining about the adware components of the software for months now, and Lenovo announced that it was stopping installs, because some people didn't like the way the software created popups and such -- but with no mention of the massive security problems. And, even now, the company doesn't seem willing to admit to them.

Furthermore, the company doesn't even seem willing to say what machines it installed them on, or provide people with instructions on how to protect themselves (simply uninstalling Superfish won't do it). This is a huge mess. I've personally been a very loyal Lenovo Thinkpad customer for years, having bought many, many laptops. In fact, just a couple months ago -- right in the middle of the period of when Superfish was being preloaded -- I bought a new Thinkpad laptop, though it appears that mine is not one that includes Superfish. Still, Lenovo created a huge and dangerous mess, and they don't seem to recognize it at all. This kind of fuck up is much worse than the whole Sony rootkit thing from a decade or so ago, and as with Sony then, Lenovo doesn't seem to have the slightest clue of just how badly it has put people at risk.

It doesn't take much to kill off tremendous goodwill and trust, and Lenovo may have just done so with it's pitiful reaction here. It's one thing for Lenovo to have made the stupid decision to install this kind of adware/bloatware. It's a second thing to not realize the security implications of it. However, it's another thing entirely, once it's been pointed out to Lenovo to then deny that this is a security risk. Lenovo screwed up big time here, and mostly in the way it's responded to the mess it created.

Filed Under: adware, certificate authority, concerns, https, man in the middle, privacy, security, superfish, tls
Companies: komodia, lenovo, superfish

Public Concern Over NSA Spying Increasing Rapidly As Congress Discovers Their Constituents Care About This Issue

from the wake-up-congress dept

Ever since the Snowden leaks broke, we've been hearing from a variety of people about how the whole thing was likely to "blow over," that most Americans really aren't that concerned about the feds snooping through their stuff, and that everything would go back to normal before long. We've been suggesting that this was an unlikely storyline, but it's allowed some in Congress to more or less ignore the growing controversy. Of course, it appears they're starting to realize this was a mistake. A new poll that was conducted before the latest revelations (which are, by far, the worst revelations yet) show quite a lot of concern from the public:

A July Washington Post-ABC News poll — before the latest disclosures reported by The Post — found fully 70 percent of Democrats and 77 percent of Republicans said the NSA’s phone and Internet surveillance program intrudes on some Americans’ privacy rights. What’s more, Democrats and Republicans who did see intrusions were about equally likely to say they were “not justified:” 51 and 52 percent respectively. Nearly six in 10 political independents who saw intrusions said they are unjustified.

And, while some politicians seemed to believe that it was only the most extreme folks who were interested in this -- or, as Michael Hayden claimed "twentysomethings who haven't talked to the opposite sex in five or six years" -- it seems that Representatives from Congress, who are back in their home districts, are discovering that, why yes, massive NSA surveillance does seem to be a major issue their constituents care about. A variety of Representatives have been surprised at various townhalls to discover that many people wanted to discuss the surveillance and what (if anything) their elected officials were going to do about it all.

Filed Under: concerns, congress, nsa, nsa surveillance, politics, privacy

Obama's Response To NSA Was To Appease The Public, Not Reduce The Spying

from the total-failure dept

We've spent much of the afternoon detailing some of President Obama's statements concerning his response to the NSA surveillance revelations, combined with some of the documents released by the administration. But a key point in all of this is highlighted in the Associated Press's coverage of the press conference: President Obama flat out admitted that this was about appeasing a public that doesn't trust the administration, not about reducing the surveillance.

President Barack Obama made it clear Friday he has no intention of stopping the daily collection of American phone records. And while he offered "appropriate reforms," he blamed government leaks for creating distrust of his domestic spying program.

In an afternoon news conference, the president acknowledged the domestic spying has troubled Americans and hurt the country's image abroad. But he called it a critical counterterrorism tool.

Even more to the point, his comments represent a fundamental misunderstanding of why the public doesn't trust the government. That's because he keeps insisting that the program isn't being abused and that all of this collection is legal. But, really, that's not what the concern is about. Even though we actually know that the NSA has a history of abuse (and other parts of the intelligence community before that), a major concern is that scooping up so much data is considered legal in the first place. So, when President Obama says that we should blindly trust the government not to abuse the data, that's missing the point:

"Understandably, people would be concerned," the president said. "I would be, too, if I weren't inside the government."

That's not particularly comforting.

Filed Under: barack obama, bulk collection, concerns, ed snowden, nsa, nsa surveillance, public, trust

Discontent With Secrecy And One-Sided Nature Of TPP Spreads Among Participating Nations

from the partnership-of-the-unequal dept

Last week Mike wrote how frustration at the unremitting secrecy surrounding TPP, and the refusal to allow members of the public in whose name it is being negotiated to express their views, has led to the creation of a new participatory Web site by the "Fair Deal Coalition." Many of the best-known groups fighting for more balanced copyright laws in the US, Canada, Australia and New Zealand have signed up, including Techdirt.

But they are not the only ones that have had enough of this lack of transparency. An interesting article in the leading Malaysian newspaper The Star shows that people there too are getting fed up with being kept in the dark, even as negotiations are taking place in their country behind closed doors:

Based on a blog post last week, [former Malaysian Prime Minister Tun Dr Mahathir Mohamad] seems to be more vehemently opposed to the talks than the 70 other NGOs against it.

"A partnership of the unequal, of the strong to take advantage of the weak," he wrote.

Twelve countries, including Japan, the latest to join the group are involved in the 18th round of talks targeted to be concluded by October.

The United States and the others -- Malaysia, Singapore, Brunei, Vietnam, Australia, New Zealand, Peru, Chile and Canada -- are believed to have concluded discussions on 14 of the 29 chapters.

For those who are against it, the major point of contention is the lack of transparency.

But it's not just about the secrecy. The same article notes that another high-ranking figure has come out against TPP for different reasons:

Chile's former chief negotiator [for TPP], Rodrigo Contreras, who quit in February, dropped a bombshell by openly denouncing the pact.

"It is a threat to our countries. It will restrict our options for development in health and education, in biological and cultural diversity, design of public policies and the transformation of our economies," he wrote in Peru's Caretas weekly.

If enough influential people in other countries taking part in the negotiations start to voice their concerns, meeting that October deadline for finalizing the agreement will start to look even more unrealistic than it does now.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: concerns, malaysia, tpp

CISPA Sponsor Claims Opposition Is '14 Year Olds In Their Basement'

from the taking-the-high-road? dept

The House Committee on Rules has been debating CISPA and what will be covered in the official floor debate and what amendments will be presented tomorrow or the next day (whenever it hits the floor). Much of it was routine stuff, but there were some typical bogus grandstanding about the giant threat of a cyberattack that's going to kill us all (be afraid!) if we don't do something (no worry about if that something will actually help). Representative Mike Rogers, the sponsor of CISPA and its main backer, decided that he was going to take the lowest road possible in talking about the concerns of privacy advocates by saying that the only opposition is "14-year-olds in their basement." That statement followed the claim that "Silicon Valley CEOs support CISPA."

Update: Sina Khanifer has uploaded a video of Rogers making these comments. This is insulting on a whole variety of levels. First of all, it suggests that privacy advocates are nothing more than children. That's ridiculous. The White House, who have raised privacy concerns about the bill, are 14-year-olds in their basement? Rogers honestly thinks insulting the President is the way to get CISPA passed? The ACLU are 14-year-olds in their basement? Really? The tens of thousands of people who have contacted Congress in the past few weeks about this are all 14-year-olds in their basement? Rogers owes the public he represents a massive apology.

Second, the comment about Silicon Valley CEOs is not true. Yes, there are some tech companies who are in favor of CISPA, mainly because of the liability protections they would get. But it is hardly an across the board belief. Many, many tech companies are all quite concerned about CISPA and what it will mean for the privacy of their users. Both Mozilla and Reddit have strongly spoken out against CISPA. Do they not count?

Third, the idea that because some Silicon Valley CEOs support CISPA, it means that there couldn't possibly be any concern. This is a outgrowth of the myth that SOPA was only stopped because tech companies spoke out. As such, politicians like Rogers think all they need to do is appease tech CEOs, and not the public, whom they're supposed to represent. That Rogers would so outwardly admit that as long as a small group of tech CEOs favor the bill (which is already a highly questionable statement), that he can ignore the public and insult them, is really stunning.

Of course, what this really shows is Rep. Mike Rogers' absolute disdain for privacy. He doesn't take the concerns of the public, of privacy advocates, and even of the White House seriously. Instead, he sees privacy as something that should be mocked and those who support it insulted. Why should such a person be in charge of wiping out privacy laws on the internet?

Filed Under: cispa, concerns, congress, cybersecurity, mike rogers, opposition, privacy

Harry Reid Says He's Concerned PIPA Will Break The Internet, But We Must Move Forward With It, Because Of 'Jobs'

from the say-what-now? dept

In a short appearance on Meet the Press on Sunday, Senate leader Harry Reid continued to insist that the Senate intended to move forward with PIPA, despite the widespread concerns, despite the White House's statement against the bill, and despite multiple Senators -- including bill co-sponsors -- asking him to hold off putting the bill to a vote. What's stunning is how misleading Senator Reid is being here. First, he claims that the bill is about "jobs," despite a total lack of evidence that that's true. In fact, as has been noted plenty of times here, the part of the economy that is creating jobs -- the startup/tech sector -- is the one who gets burdened by this bill. David Gregory then responds by pointing out that people keep pointing out to him online that this bill isn't really about jobs, and will harm the internet. Reid then tries to pretend that this is a new revelation. He notes that it was "reported out of the committee unanimously" back in May. That's true, but that was back before most people understood the bill, or the internet had spoken out. Even then, many of us were quite clear in speaking out about why this bill was a problem. But Harry Reid pretends that it's "just in the last few weeks" that anyone has raised concerns." That's flat out ridiculous.

Next he claims that he's working with Senator Feinstein on this, since she's "in the middle" of the issue, representing both Northern and Southern California, where the issue is loudest. This would be the same Senator Feinstein who is so tone deaf to what's happening in her own state, that just weeks ago she insisted that she didn't know the tech industry was upset about the bill.

But the really stunning part? After these bizarre claims, he says, of those who have complained about the bill:

"I think they're right. I think it could create some problems. That's why I've spoken Senator Leahy, the Chairman of the Committee. I've written a letter to the ranking member Senator Grassley, saying that some issues have come up. I think this needs to be a winner for everyone -- not just for the content people.... so we need to work on this."

But then he still insists that they're going forward with the bill! He notes that he's expecting a "manager's amendment" from Leahy -- but Leahy has already said that the manager's amendment is just going to delay the implementation of the DNS issues. If Senator Reid really wants to make sure the bill is a "winner for everyone" then shouldn't we take some time to make sure that everyone's happy? It's doubly concerning that he appears to think these issues "just came up" in the past few weeks. That shows that he's totally and completely out of touch on the many months that people were speaking out against the problems of this bill. If anything that's even more reason to delay things, since Reid himself is admitting he's totally ignorant of the many, many, many problems that people have been discussing for months now.

It's such a politician's response: he pretends that he's in agreement with the concerns of everyone... but then immediately admits he's ignoring those concerns and pushing forward with a bad bill, which he clearly never understood, and which it appears he just found out there was criticism around, despite the fact it's been going on for months. Everything in this statement points to reasons not to vote on the bill on the 24th, and yet he wants to move forward with it. It's just stunning.

Filed Under: concerns, harry reid, interent, jobs, pipa, protect ip, senate, sopa

Hackers, ACLU, Consumer Rights Groups, Human Rights Groups, Many More All Come Out Against SOPA

from the an-avalanche-of-no-to-sopa dept

All day yesterday, we just kept getting more and more notifications of groups coming out against SOPA. Considering that SOPA-supporters keep trying minimize the complaints about SOPA, or pretend that it's "just Google" who's against it, the outpouring of anti-SOPA feelings really paints quite a different picture. Here are just a few of the anti-SOPA statements we've seen. First up, perhaps the most interesting of all, the folks at Hacker News -- basically home base to tons of techies -- have been getting together to send physical letters arguing against SOPA. The idea here is that physical letters are more likely to get attention than email (and this is true for some, but certainly not all, Congressional offices). If you'd like to send a physical letter, the link above makes it easy. And, as we've seen with most anti-SOPA letter writing systems, it lets you customize -- unlike every single pro-SOPA letter writing system, that only lets you submit existing text.

Next up, we have that bastion of "piracy," the ACLU. Yeah, that's a joke. The ACLU is hardly a defender of infringement, but is absolutely in favor of free speech, and quite concerned about the censorship mechanisms in the bill:

By their very nature, laws protecting copyrights constrain free speech and access to information. Unlike other speech restrictions, however, copyright laws may also advance the generation of information and ideas. A robust copyright system encourages free speech by giving speakers incentives to create and disseminate works of authorship. Such laws add to the marketplace of ideas by encouraging the creation of more content through the assurance that content producers will receive the fruits of their labor. But access to information of all kinds -- even disfavored information -- is a fundamental right that must be protected. Even more to the point, the mere existence of infringing content online does not justify the removal of non-infringing content in the course of attempting to rid the internet of the former. These established principles should not change or be treated differently just because technology has changed.

[....]

SOPA, unfortunately, is substantially worse than PROTECT IP. By eliminating the concept of sites 'dedicated to infringing activity', SOPA enables law enforcement to target all sites that contain some infringing content -- no matter how trivial -- and those who 'facilitate' infringing content. The potential for impact on non-infringing content is exponentially greater under SOPA than under other versions of this bill. As such, despite our support for the protection of the legitimate copyright interests of online content producers, we cannot support SOPA, and in fact we oppose it in its current form, given its broad sweep and its heavy hand that will land largely upon innocent content producers. We urge Committee members to focus not just on the goal of protecting copyright owners, but also protecting the speech rights of consumers and providers who are reading and producing wholly non-infringing content and to eliminate the collateral damage to such protected content. Only in that way will the Committee truly achieve its goal of protecting authors and allow the legislation to survive constitutional challenge.

The letter goes on to highlight exactly how and where SOPA infringes on the First Amendment. It also notes that passing SOPA would be setting a terrible precedent for the rest of the world.

Next up, there's a letter from over 40 different human rights groups, noting their concerns with SOPA and how it will create significant problems for human rights around the globe:

Through SOPA, the United States is attempting to dominate a shared global resource. Building a nationwide firewall and creating barriers for international website and service operators makes a powerful statement that the United States is not interested in participating in a global information infrastructure. Instead, the United States would be creating the very barriers that restrict the free flow of information that it has vigorously challenged abroad. By imposing technical changes to the open internet while eroding due process, SOPA introduces a deeply concerning degree of legal uncertainty into the internet economy, particularly for businesses and users internationally. Business cannot be conducted online when international users and businesses do not have faith that their access to payments, domain names, and advertising will be available, raising challenges to economic development and innovation. This is as unacceptable to the international community as it would be if a foreign country were to impose similar measures on the United States.

The provisions in SOPA on DNS filtering in particular will have severe consequences worldwide. In China, DNS filtering contributes to the Great Firewall that prevents citizens from accessing websites or services that have been censored by the Chinese government. By instituting this practice in the United States, SOPA sends an unequivocal message to other nations that it is acceptable to censor speech on the global Internet.

It still amazes me that SOPA's supporters don't realize what a big deal this is. Giving foreign nations the "ok" to censor the internet is a ridiculously stupid policy.

Next up on the tour of folks coming out against SOPA, we've got a bunch of public interest groups, including the American Library Association, Association of Research Libraries, Human Rights Watch, New America Foundation's Open Technology Initiative, TechFreedom, FreedomHouse, the Competitive Enterprise Institute, EFF, Public Knowledge and others.

We do not dispute that there are hubs of online infringement. But the definitions of the sites that would be subject to SOPA's remedies are so broad that they would encompass far more than those bad actors profiting from infringement. By including all sites that may -- even inadvertently -- "facilitate" infringement, the bill raises serious concerns about overbreadth. Under section 102 of the bill, a nondomestic startup video-sharing site with thousands of innocent users sharing their own noninfringing videos, but a small minority who use the site to criminally infringe, could find its domain blocked by U.S. DNS operators. Countless non-infringing videos from the likes of aspiring artists, proud parents, citizen journalists, and human rights activists would be unduly swept up by such an actions. Furthermore, overreach resulting from the bill is more likely to impact the operators of smaller websites and services that do not have the legal capacity to fight false claims of infringement.

Relying on an even broader definition of "site dedicated to theft of US property," section 103 of SOPA creates a private right of action of breathtaking scope. Any rightsholder could cut off the financial lifeblood of services such as search engines, user-generated content platforms, social media, and cloud-based storage unless those services actively monitor and police user activity to the rightsholder's satisfaction. A mere accusation by any rightsholder would be sufficient to require payment systems and ad networks to terminate doing business with the service; the accused service's only recourse would be to send a counter-notice, at which point it would be at the networks' discretion whether to reinstate the service's access to payments and advertising. This would bypass and effectively overturn the basic framework of the Digital Millennium Copyright Act (DMCA), by pushing user-driven sites like Twitter, YouTube, and Facebook to implement ever-more elaborate monitoring systems to "confirm," to the satisfaction of the most aggressive and litigious rightsholder, whether individual users are exchanging infringing content.

Had enough yet? Okay, well how about various consumer interest groups? Consumers Union, Consumer Federation of America and US PIRG sent a letter as well.

The bill would allow rights holders to send notices to payment processors and advertising networks, ordering them to cut off funding to sites the rights holders believe are "dedicated to the theft of U.S. property." However, this definition is extremely broad. Section 103(a)(1)(B)(ii) defines a "site dedicated to the theft of U.S. property" as including any site whose owner "takes active steps to avoid confirming a high probability" that it is being used (even by others) for infringement. This means that an entirely legitimate site can be defunded, and even enjoined entirely, merely because a few of its users may have infringed. Consequently, overzealous rights holders could shut down lawful exchange sites like craigslist, eBay, swap.com, or BookCrossing, closing off valuable outlets for small-scale buying and selling. For instance, a legitimate student-to-student textbook exchange site could be hampered or shut down by a publisher for the actions of just a few infringing users, raising the costs of an already-expensive education.

Secure online communication and commerce is also of critical importance to consumers. Yet, the bill could undermine the security of consumers. Section 102(c)(2)(A) allows for court orders that would block domain name system (DNS) operators from providing access to the Internet Protocol (IP) addresses of targeted sites. In other words, a consumer attempting to access an allegedly infringing site would get an error message or be redirected to another page. However, redirecting DNS queries (to phishing sites and other fraudulent websites) is also a common tactic used by malicious hackers to steal millions of dollars from consumers....

Finally, the bill grants complete immunity to a very large class of actors, including Internet service providers, advertising networks, advertisers, search engines, and payment networks, for cutting off access to a targeted site as long as they can claim their actions were taken in the reasonable belief that the site was suspected of encouraging infringement. This blanket immunity from all federal and state laws and regulations could allow the above actors to act in ways that would harm consumers. For example, Internet service providers could block access to online services that compete with their own telephone or video offerings under a justification of curbing alleged infringement, depriving consumers of legitimate alternatives to high-priced services. The broad immunity of the statute would prevent consumers or consumer protection agencies from policing or addressing such anti-consumer or anticompetitive.

Next on the list, we have a surprise entrant: the Brookings Institution. Unlike plenty of "think tanks" who are nothing more than lobbying shops in disguise, Brookings has an incredibly strong reputation for both intellectual honesty and credibility -- and thus it's widely viewed as one of the most influential public policy think tanks around. Not surprisingly, it's take may be a bit more measured, but it raises significant concerns about the cybersecurity impact of the bill:

I highlight the very real threats to cybersecurity in a small section of both bills in their attempts to execute policy through the Internet architecture. While these bills will not "break the Internet," they further burden cyberspace with three new risks. First, the added complexity makes the goals of stability and security more difficult. Second, the expected reaction of Internet users will lead to demonstrably less secure behavior, exposing many American Internet users, their computers and even their employers to known risks. Finally, and most importantly, these bills will set back other efforts to secure cyberspace, both domestically and internationally. As such, policymakers are encouraged to analyze the net benefits of these bills in light of the increased cybersecurity risks.

Also worried about the security angle is the respected security firm ESET, who makes clear the damage the DNS provisions will do:

Based on my work, and that of my team of researchers, I have to say that this legislation, if passed as currently written, would have a chilling effect on the economy of the United States.

More than 100 million Internet users in over 180 countries rely on ESET products to protect their personal and enterprise data systems. This gives ESET a unique perspective on the DNS filtering proposed by SOPA and PIPA. There is hardly any part of the United States economy today that does not depend upon the smooth operation of the Internet, which in turn relies upon the integrity of the Domain Name system (DNS). The DNS filtering proposed in SOPA and PIPA would seriously undermine that integrity.

While ESET fully supports the goals of protecting IP and reducing piracy, our experiences combating cybercrime for more than 20 years suggest that SOPA and PIPA will do little to advance these goals. What we are sure they will do is undermine valuable efforts to improve the security of the Internet. Without those improvements, expansion of the global digital economy, of which the United States is clearly a leader, as well as a leading beneficiary, will falter.

And, finally, we have TechAmerica, one of the biggest and most respected tech trade associations, representing over 1,200 companies -- and one of the most important organizations when it comes to helping to fundraise for politicians. I'd been disappointed that TechAmerica had been relatively quiet on this issue, so it's great to see it come out strongly against SOPA. After spending over a page agreeing that rogue sites and infringement are big problems, TechAmerica's letter notes:

Sadly, neither chamber of Congress has produced thoroughly acceptable legislation, but SOPA in particular marks a clear retreat from a history of Congressional support of the digital revolution. That support has often come in the form of not imposing regulation on the industry, and certainly never before has such a wholesale shifting of costs and responsibilities of property owners onto technology companies been contemplated -- a shift away from a careful balance and toward legislation that favors one industry over another.

Put another way, the approach taken in SOPA leads one to wonder why the DMCA would even be used in the future. Using SOPA’s proposed broad new inducement provision, one could simply ignore the current DMCA safe harbors and use intermediaries to accomplish the end goal, and if damages were warranted, merely later sue for infringement. Moreover, important measures to make sure that the proposals keep pace with technology, such as the DMCA requires with the triennial rulemaking on exceptions to the prohibition on circumvention of access and use controls, are non-existent. Along those same lines we are also dismayed that the proposed legislation relies on "simple" technical measures to address complex international issues that are likely better handled through diplomacy, negotiation, constructive dialog and coordinated action. The proposed "solutions" carry risk, perhaps significant, and are likely to be easily circumvented....

SOPA merely shifts costs from content owners, the rightful protector of their content, to various other parties, rather than making sure that costs are appropriately placed.

This is a philosophical issue that runs to the heart of both proposals. Do we really want government forcing one industry to subsidize another, to be required by force of law to assist another industry in being successful? More typically we expect industries to operate within a market framework and with the freedom of contract to solve such challenges. In this case, Congress seems determined to step in and force one industry to provide subsistence to another.

I'm sure there are some others that I've missed, but it's great to see so many organizations coming out so strongly against SOPA. Can defenders of the bill continue to pretend that it's just a small opposition now? Or that it's just those who wish to infringe who are opposed to SOPA's broad language and vague definitions?

Filed Under: concerns, consumer rights, copyright, human rights, protect ip, sopa
Companies: aclu, brookings, techamerica

Turns Out People Say They're Concerned About Privacy, But They're Not

from the indeed dept

Well, this shouldn't surprise very many people, but following on plenty of earlier studies that have made it clear that most people don't do much to protect their privacy, a new study out of the UK pretty much states the obvious: people say they're concerned about privacy, but they sure don't act that way. The study found 84% of users say they carefully guard their info online -- but when tested, 89% of people actually did give away info in the same exact survey. To be fair, the specific set of questions was first asking people if they carefully guard their income info, followed later by a question asking them what income bracket they fell into. It's reasonable to think that some folks believe that the bracket is not the same as giving away their actual income -- which is what the first question implied. Still, it does show how people do tend to be freer with info than they might expect, so long as the questions are worded properly. Or if someone gives them chocolate.

Filed Under: concerns, privacy