DOJ Says Encryption Is Just For Criminals As It Goes After Another Secure Phone Purveyor

from the dark-mode-engaged dept

The DOJ has indicted another company for supposedly making it easier for criminals to elude law enforcement. The true target, though, isn't the company whose principals have been indicted, but encryption itself.

A couple of years ago the DOJ decided to bring RICO charges against Phantom Secure, a cellphone provider that catered to the criminal element with "uncrackable" phones/messaging services built on existing Blackberry hardware/software.

The FBI approached Phantom Secure, asking for an encryption backdoor that would allow it to snoop on its customers. Phantom Secure declined the FBI's advances. Its phones -- originally marketed to professionals desirous of additional security -- were soon marketed to criminals, a market sector that truly valued the security options offered by Phantom.

But rejecting the FBI and selling to criminals causes problems. The DOJ went after Phantom Secure, arresting the owner and charging him with a bunch of RICO and RICO-adjacent crimes.

It is happening again. The DOJ has decided encryption is a crime when companies offering encrypted communications choose to sell to people the DOJ considers to be criminals.

Here's the DOJ's portrayal of its crime-fighting efforts -- one supported by people who rarely find a sandwich they don't think can be criminally charged.

A federal grand jury today returned an indictment against the Chief Executive Officer and an associate of the Canada-based firm Sky Global on charges that they knowingly and intentionally participated in a criminal enterprise that facilitated the transnational importation and distribution of narcotics through the sale and service of encrypted communications devices.  

Jean-Francois Eap, Sky Global’s Chief Executive Officer, and Thomas Herdman, a former high-level distributor of Sky Global devices, are charged with a conspiracy to violate the federal Racketeer Influenced and Corrupt Organizations Act (RICO). Warrants were issued for their arrests today.

But here's where it gets sketchy. The DOJ is basically trying to hold a phone provider responsible for the criminal acts of its customers. In order to do that, it needs to depict encryption as an unnecessary evil that serves mainly to allow criminals to escape justice.

According to the indictment, Sky Global’s devices are specifically designed to prevent law enforcement from actively monitoring the communications between members of transnational criminal organizations involved in drug trafficking and money laundering. As part of its services, Sky Global guarantees that messages stored on its devices can and will be remotely deleted by the company if the device is seized by law enforcement or otherwise compromised.

"Or otherwise compromised." There are plenty of non-criminal reasons to want to remotely wipe a phone that has ended up in the hands of someone other than its owner. Some of those reasons are ones even the DOJ finds legitimate, like the protection of trade secrets. But in this case, the DOJ only sees an evil that must be stopped. And the fact that Sky Global's market share is so small it amounts to a rounding error isn't stopping the DOJ from attempting to make the company pay for the sins of some of its users.

There are at least 70,000 Sky Global devices in use worldwide, including in the United States. The indictment alleges that for more than a decade, Sky Global has generated hundreds of millions of dollars in profit by facilitating the criminal activity of transnational criminal organizations and protecting these organizations from law enforcement.

Allegations are just that: allegations. Sky Global may have had some legitimate customers who felt vanilla phone offerings by Google, Apple, and a host of Android-based manufacturers weren't secure enough, but those people's concerns don't matter when criminals are also using the same phones to conduct criminal activity.

The real enemy is encryption, according to the DOJ. The DOJ says preventing law enforcement from "actively monitoring communications" is its own evil, even while multiple messaging services now offer end-to-end encryption that prevents law enforcement from listening in. This is the foot in the door. If the FBI and DOJ can make enough noise about a company that supposedly marketed its product to criminals, it can make further inroads towards demonizing encryption as a threat to the security of the nation, if not an aider and abettor of criminal activity.

This is the ongoing PR war being fought by our government against a feature that provides more security to phone users. And it's being done by an agency that has yet to be completely honest about how much of a problem encryption actually poses to criminal investigations. For that reason alone, the DOJ's accusations shouldn't be granted credence. Its efforts to undermine the safety of millions of non-criminal phone users shouldn't be ignored either, because it's clear at this point the security concerns of the American public mean nothing to it.

Filed Under: backdoors, criminal, doj, encryption, fbi, jean-francois eap, rico, secure phones, thomas herdman
Companies: sky global

Ninth Circuit Appeals Court May Have Raised The Bar On Notifying Defendants About Secretive Surveillance Techniques

from the PARALLEL-CONSTRUCTION-INTENSIFIES dept

Recently -- perhaps far too recently -- the Ninth Circuit Appeals Court said the bulk phone records collection the NSA engaged in for years was most likely unconstitutional and definitely a violation of the laws authorizing it. The Appeals Court did not go so far as to declare it unconstitutional, finding that the records collected by the government had little bearing on the prosecution of a suspected terrorist. But it did declare it illegal.

Unfortunately, the ruling didn't have much of an effect. The NSA had already abandoned the program, finding it mostly useless and almost impossible to comply with under the restrictions laid down by the USA Freedom Act. Rather than continually violate the new law, the NSA chose to shut it down, ending the bulk collection of phone metadata… at least under this authority.

But there's something in the ruling that may have a much larger ripple effect. Orin Kerr noticed some language in the opinion that suggests the Ninth Circuit is establishing a new notification requirement for criminal prosecutions. For years, the government has all but ignored its duty to inform defendants of the use of FISA-derived evidence against them. The DOJ has considered FISA surveillance so secret and sensitive defendants can't even be told about it. Defendants fight blind, going up against parallel construction and ex parte submissions that keep them in the dark about how the government obtained its evidence.

The language in the Ninth Circuit ruling changes that. It appears to suggest (but possibly not erect, unfortunately) an affirmative duty to inform defendants about surveillance techniques used by the government.

In Moalin, the question was whether defendants had to be notified about a warrantless national security program involving telephone metadata that had been collected about them as part of the investigation. I would have thought the answer is no. Most obviously, there was no search warrant about which to give notice. And beyond that, I would have thought the program under then-existing precedent not to be a search at all.

The Ninth Circuit imagines a different kind of notice requirement, though. Instead of a notice requirement that a warrant was executed, flowing from the warrant itself, this is a notice requirement that appears to be triggered only if and when criminal charges are filed providing notice that evidence about a person was collected using a surveillance practice that may or may not be a search. In effect, it’s a notice to criminal defendants to consider filing a motion to suppress to challenge the investigation and vindicate any Fourth Amendment rights that may or may not have been at stake.

Huge if true. This is the court giving defendants an opportunity to suppress evidence derived from surveillance efforts courts may not (at this point) consider searches under the Fourth Amendment. The Constitutionality may be unsettled, but that shouldn't limit defendants' ability to raise challenges. This is from the opinion:

The principal remedy for a Fourth Amendment violation is the exclusionary rule: a criminal defendant may seek suppression of evidence obtained from an unlawful search or seizure, as well as of the “fruits” of that evidence—additional evidence to which it led. See Wong Sun, 371 U.S. at 488. But criminal defendants who have no knowledge that a potentially unconstitutional search has played a part in the government’s case against them have no opportunity to vindicate any Fourth Amendment-protected rights through suppression.

Notice is therefore a critical component of the Fourth Amendment in the context of a criminal prosecution. And although the Fourth Amendment may apply differently to foreign intelligence surveillance than to searches undertaken in ordinary criminal investigations, notice of a search plays the same role in the criminal proceeding: it allows the defendant to assess whether the surveillance complied with the Fourth Amendment’s requirements, whatever the parameters of those requirements are. Indeed, the Supreme Court has recognized that the notice provisions in FISA and the FAA serve precisely that function.

According to the Ninth Circuit, the Fourth Amendment standard of providing notice to defendants also applies to searches that the government (and some courts) have considered to be outside of the Fourth Amendment's reach -- like the acquisition of third-party records and foreigner-targeting surveillance efforts.

The government can still provide notice without giving up its secrecy, which should (hopefully) limit the number of times the government claims national security trumps all other rulings, regulations, precedential decisions, and Constitutional amendments. The government can have its secrecy and its notification, says the court.

Given the need for secrecy in the foreign intelligence context, the government is required only to inform the defendant that surveillance occurred and that the government intends to use information obtained or derived from it. Knowledge of surveillance will enable the defendant to file a motion with the district court challenging its legality. If the government avers that disclosure of information relating to the surveillance would harm national security, then the court can review the materials bearing on its legality in camera and ex parte.

This would be breaking new ground, especially in cases where the government is using FISA-derived evidence. As Kerr points out, this isn't limited to settled Fourth Amendment precedent. This would allow defendants to challenge evidence derived from techniques and programs courts have yet to address. And this will (hopefully) force courts to confront unsettled Fourth Amendment issues, rather than dismiss them out of hand because no court has previously addressed novel (or secret) surveillance practices.

[N]ot only does it not require a warrant, it doesn’t even seem to require a search. The notice seems to be that evidence was obtained using a surveillance authority. It doesn’t appear to require that this authority is anything that has been understood to involve Fourth Amendment searches or seizures. Rather, the notice is provided so a person can bring a challenge and argue to a court that it’s a search or seizure, and an unreasonable search or seizure at that.

Put another way, this appears to be a Fourth Amendment notice requirement to alert criminal defendants that the government took steps that might constitute a search—but also might turn out not to be a search at all once a court reviews the matter closely. It has faint echoes to me of Miranda v. Arizona, in that it’s a judicially created notice about your rights potentially at stake so that you can take action to vindicate your rights.

If this is what the court is saying, the Ninth Circuit will be handling all sorts of interesting -- and precedent-setting -- cases in the near future. If the government has to be honest about its surveillance techniques, it will no longer be able to dodge Constitutional scrutiny by citing the Third Party Doctrine or claiming national security issues prevent it from informing defendants of the origin of evidence used against them.

This will have the most impact in cases where FISA evidence is in play and the government -- perhaps secure that its national security mantra will encourage the court to aid and abet in obfuscation -- hasn't bothered to engage in parallel construction. On the flipside, government lawyers have probably already parsed this latent threat to unearned secrecy and will be encouraging everyone involved to perform their surveillance in triplicate to prevent the establishment of warrant requirements in cases where reasonable suspicion can't even be met.

Filed Under: 9th circuit, criminal, due process, intelligence community, parallel construction, surveillance

DC Court Says Terms Of Service Violations Can't Trigger Federal CFAA Prosecutions

from the forcing-discretion-on-DOJ-prosecutors dept

In a win for researchers and the ACLU, a federal court has ruled that violating a site's terms of service is not a criminal violation of the CFAA.

The ACLU filed this lawsuit in 2016, representing researchers, scientists, and journalists who were looking into whether employment websites engaged in discriminatory behavior. To do so, the researchers needed to deliberately violate the terms of service of the websites they were studying by creating bogus accounts and providing other false information.

Since the CFAA has been the go-to law for companies seeking to silence security researchers and critics, the ACLU and its plaintiffs raised a pre-enforcement challenge, seeking a ruling declaring this work legal before the DOJ had a chance to abuse this terrible law to shut the research down.

The DC federal court doesn't go so far as to extend First Amendment protection to these actions, but it does hold, importantly, that the CFAA does not criminalize terms-of-service violations. From the decision [PDF]:

The Court agrees with the clear weight of relevant authority and adopts a narrow interpretation of “exceeds authorized access.” Without weighing in on the circuit split over employers’ computer-use policies, the Court concludes that violating public websites’ terms of service, as Wilson and Mislove propose to do for their research, does not constitute a CFAA violation under the “exceeds authorized access” provision.

The DOJ tried to argue the plaintiffs had no case because it would never in a million years even think about bringing a CFAA prosecution over terms of service violations. The court says the government's own words and actions contradict its assertions.

The government argues that plaintiffs fail to establish a credible threat of prosecution under the CFAA, contending that (1) plaintiffs’ testimony shows that they do not fear prosecution (and, indeed, already have engaged in such research); (2) past CFAA prosecutions do not establish a credible threat that plaintiffs’ proposed conduct will be prosecuted; and (3) the government’s charging policies and public statements undercut plaintiffs’ attempt to establish a credible threat of prosecution.

[...]

[E]ven assuming the absence of prior prosecutions, but see Sandvig, 314 F. Supp. 3d at 19–20 (discussing two previous prosecutions under the Access Provision), plaintiffs still are not precluded from bringing this pre-enforcement action. When constitutionally protected conduct falls within the scope of a criminal statute, and the government “has not disavowed any intention of invoking the criminal penalty provision,” plaintiffs are “not without some reason in fearing prosecution” and have standing to bring the suit.

It's not enough for the government to declare it probably won't pursue ToS-violation prosecutions, the court says.

[T]he government points to guidance from the Attorney General that “expressly cautions against prosecutions based on [terms-of-service] violations,” as well as statements to Congress by Department of Justice officials, as evidence that plaintiffs face no credible threat of prosecution. Gov’t’s Opp’n at 16–17. But the absence of a specific disavowal of prosecution by the Department undermines much of the government’s argument.

All we're left with is the DOJ's prosecutorial discretion, which is extremely suspect and not backed by any statements from officials that would assure the plaintiffs the government would not choose to take action against them in the future.

Discovery has not helped the government’s position. John T. Lynch, Jr., the Chief of the Computer Crime and Intellectual Property Section of the Criminal Division of the Department of Justice, testified at his deposition that it was not “impossible for the Department to bring a CFAA prosecution based on [similar] facts and de minimis harm…" Although Lynch has also stated that he does not “expect” the Department to do so, Aff. of John T. Lynch, Jr. [ECF No. 21-1] ¶ 9, “[t]he Constitution ‘does not leave us at the mercy of noblesse oblige...’”

This may keep the DOJ off researchers' backs but it won't shield them from lawsuits from the targeted sites.

The Court concludes that agreeing to such contractual restrictions, although that may have consequences for civil liability under other federal and state laws, is not sufficient to trigger criminal liability under the CFAA.

This at least will deter the DOJ from pursuing these prosecutions in its "home" court. Most CFAA action still takes place in the Ninth Circuit, where most tech companies are located. Opinions on civil CFAA cases have been hit and miss, but at least one major case (LinkedIn v. HiQ) saw the court come down on the side of the party doing the scraping, a violation of LinkedIn's terms of service. This decision is being appealed, but for now, it still stands.

The research can move forward without the threat of government prosecution dangling over its head. That's a start.

Filed Under: cfaa, criminal, doj, research, security research, terms of service
Companies: aclu

New Zealand Censors Declare Christchurch Shooting Footage Illegal; Start Rounding Up Violators

from the this-will-end-badly dept

Following the recent mass shooting in New Zealand, the county's government swiftly declared the live footage of the attack, along with the shooter's manifesto, "objectionable." This classification is more than a condemnation: it made both illegal to possess or distribute. Thanks to this response, New Zealand law enforcement is now rounding up and charging anyone who violates this post-tragedy decision to make newsworthy content the legal equivalent of child porn.

The first reported arrest occurred March 17th, two days after the shooter livestreamed his attack on local mosques.

A teenager has appeared in a New Zealand court charged with distributing the livestream video of a deadly mass shooting at Christchurch’s Al Noor mosque.

The 18-year-old, whose name was suppressed by the judge, was also charged with publishing a photograph of the mosque with the message “target acquired”, and for inciting violence.

He faces a maximum of 14 years in prison for each charge, prosecutors said.

On top of the stiff potential penalties, the judge also apparently believed the 18-year-old posed enough of a threat (for further violence or just simply disappearing) to deny him bail.

The arrests resulting from New Zealand's media censorship office's declaration continue.

A Christchurch businessman has appeared in court on charges of distributing footage of one of the mosque shootings.

Philip Neville Arps, 44, had his application for bail declined when he appeared in the Christchurch District Court today.

He was remanded in custody until his next appearance on April 15.

Another arrest for distributing "obscene" footage and another denial of bail.

In both cases, those arrested appear to be sympathetic (if that's the right word -- it seems so wrong) with the shooter's hatred of Muslims and preference for a whiter tomorrow. The 18-year-old's "target acquired" comment suggested, at minimum, they saw nothing wrong with targeting members of certain religions.

Philip Arps appears to be a long-time proponent of white nationalism -- even going so far as to use a symbol appropriated by neo-Nazis as the logo for his business. Arps apparently spent the days after the shooting praising the shooter and refusing to apologize for his views. A review of Arps' business by Stuff Magazine shows Arp hasn't exactly kept his personal beliefs and his company's public presence from intermingling.

Beneficial Insulation also charges $14.88 per metre for insulation – 14.88 is a hate symbol popular with white extremists.

The company's website www.BIIG.co.nz, is an acronym for the company's full name Beneficial Insulation Installs Guaranteed. BIIg was the name of a barracks at Auschwitz concentration camp, operated by Nazi Germany in occupied Poland during World War II and the Holocaust.

While it may seem like it's a good idea to take these people out of circulation, the fact that they're facing a possible 14 years for sharing content arbitrarily declared "obscene" is… well… obscene. These may appear to be clear-cut interpretations of the law, given the sympathies of the people arrested, but future arrests may not be so unambiguous. The footage declared illegal is still newsworthy and the media censorship board hasn't exactly made it clear it won't be sending cops after people who use the footage for journalism, research, or criticism.

The ban of the complete video does not automatically mean that any image or short extract from it is also banned. However any edited clips, screenshots or still images taken from the full video depicting scenes of violence, injury or death, or that promote terrorism, may also be illegal.

Violations will be in the eye of the government beholder. Some violators won't even know they've violated the law until they're being rung up on charges and denied bail. This is an overreaction to a pretty much unprecedented development: the livestreaming of a mass murder. The potential for misjudgment and abuse is huge, given the natural tendency of people to share and comment on newsworthy incidents.

Filed Under: attack, censorship, christchurch, criminal, free speech, massacre, new zealand, philip arps, sharing, video

Japanese Government Puts Restrictive Copyright Amendments On Hold Over 'Internet Atrophy' Worries

from the delay-delay-delay dept

Call me surprised. We have been recently discussing a proposal in Japan to alter copyright law in the country to criminalize every single instance of copyright infringement, rather than saving any of that for the civil courts. The bonkers proposal would take the current law, in which all instances of copyright infringement on movies and music carry criminal penalties and expand that to essentially all copyright infringement everywhere. This would include screenshots, posting lyrics to songs, and the like. Shortly after all of this was announced, a large group of Japanese academics wrote an open statement to the government indicating their concern that allowing the new law to move forward would result in an extreme chilling effect on internet usage in the country. At the time, I said it was a litmus test for whether the government would take any objection to the law seriously, tame as it was. It was also likely clear that I wasn't optimistic.

Well, surprise, the government has actually put the proposal on hold out of a concern for the very chilling effects those academics raised.

The planned copyright amendments were set to be submitted to the Diet on March 8, 2019 but according to local sources, Japan’s ruling Liberal Democratic Party (LDP or Jimintō) put the brakes on the proposals the day before they were due to be submitted.

Reports suggest that the party had such serious concerns over the scope of the law that its implementation might mean that “use of the Internet would be atrophied.”

Prime Minister Shinzo Abe reportedly held a telephone call with Keisya Furuya, the former National Public Safety Commissioner and chairman of the bipartisan MANGA (Manga-Animation-Game) parliamentary group on March 6, 2019. According to AnimeNewsNetwork, this led to the decision to remove the proposals from the agenda.

And so the law now goes back to the Ministry of Culture, Sports, Science and Technology for further discussion. The ultimate fate of the law is yet to be decided, of course, but this should be encouraging for the pessimists among us (Hi!) that tend to believe these restrictive laws in favor of content companies always get railroaded through no matter the people's protest. In this case, at least, it seems that protest worked.

Part of that may be because, again, those objecting to the law did so on only the mildest grounds.

Scholars and other experts are suggesting that the best route is to only criminalize actions that cause real financial damage to content owners.

The general consensus among the academics is that making infringement criminally punishable may be acceptable, but only when full copyright works – such as movies, music, manga publications, and books – are exploited in their entirety.

Which, you know, okay. That's probably still too onerous, but at least it's a step back from the truly insane route Japan was on.

Filed Under: copyright, criminal, japan

How Microsoft Convinced Clueless Judges To Send A Man To Jail For Copying Software It Gives Out For Free

from the fucking-microsoft dept

This story should make you very, very angry. Last month we had the basic story of how Microsoft had helped to get a computer recycler sentenced to 15 months in jail for "counterfeiting" software that it gives away for free, and which is useless unless you have an official paid-for license from Microsoft. Let me repeat that: Microsoft helped put someone in jail for criminal infringement over software that anyone can get for free (here, go get it), and which won't function unless you've paid Microsoft their due.

At issue are Windows recovery discs. Way back when, these were the discs that usually shipped with new computers in case you needed to reinstall Windows. You still needed your license to make them work, of course. Then people realized it was wasteful to ship all that -- combined with enough broadband to make it easy enough to download and burn the files, and Microsoft then just made it easy to do that. But, that's still complex enough, and Eric Lundgren had a solution. Lundgren is not some fly-by-night pirate. He's spent years doing amazing things, recycling computers and helping them last longer. And he had an idea. It might be helpful to manufacture a bunch of these recovery discs and offer them to repair shops to help people who were unable to download the recovery discs themselves. He was being helpful.

But Microsoft insisted that he was not just infringing on their copyrights civilly, but criminally. When we left things last month, we were waiting for the 11th Circuit Appeals Court to consider Lundgren's appeal -- and astoundingly this week the judges, demonstrating near total ignorance of technology and the actual legal issues -- rejected his appeal, which means Lundgren is going to jail for over a year for trying to do some good in the world, helping people get the exact same thing that Microsoft is offering for free, and which no one could use unless they'd already paid Microsoft its tax.

Lundgren was arrested as part of a government sting when the customs officials spotted the thousands of discs he'd manufactured and just assumed they were pirated. Here's where Microsoft should have stepped in and said "this is all a mistake" and noted that Lundgren was actually doing a good thing and exactly what Microsoft should be encouraging. Instead, Microsoft sided with the US government and continues to do so to this day.

But beyond being pissed off at Microsoft, we should be pissed off at clueless judges: 11th Circuit Judges William Pryor, Beverly Martin and Lanier Anderson (average age: 66) rejected Lundgren's appeal in 8 short pages of wrongness. It is depressing that vindictive, idiotic Microsoft combined with technically clueless judges can lead to a result that puts a good man in jail for doing nothing wrong. But that's where we're at.

The key issue in the appeal was over the actual "value" of the discs that Lundgren made. He argued, reasonably, that the value is zero. Again, Microsoft gives these away for free. Prosecutors, idiotically, initially argued they were worth the full price of Windows itself ($300). Eventually, the lower court went with a $25 fee after a government "expert" said each disc was worth that much:

To arrive at this amount, the PSR relied on evidence put forward by the government that “Microsoft had a certified computer refurbisher program that made genuine authorized reinstallation discs available to computer refurbishers for about $25,” and multiplying that amount by the 28,000 discs produced.

But that's wrong. Microsoft sells discs with a license for $25 to repair shops. Again, the discs that Lundgren was offering had no license. You had to supply your own. But the judges (and the prosecutors) can't seem to grasp this simple fact.

The district court did not err in concluding the “infringement amount” in this case was $700,000. First, the district court did not clearly err in concluding that the discs Lundgren created were, or appeared to a reasonably informed purchaser to be, substantially equivalent to legitimate discs containing Microsoft OS software.... That conclusion was supported by the sentencing hearing testimony, in which the government’s expert witness testified that the software on the disks created by Lundgren performed in a manner largely indistinguishable from the genuine versions created by Microsoft. While experts on both sides may have identified differences in functionality in the discs, the district court did not clearly err in finding them substantially equivalent.

Second, the district court reasonably concluded that the proper value of the infringed item was $25 per disc. The government’s expert testified that the lowest amount Microsoft charges buyers in the relevant market—the small registered computer refurbisher market—was $25 per disc. Although the defense expert testified that discs containing the relevant Microsoft OS software had little or no value when unaccompanied by a product key or license, the district court explicitly stated that it did not find that testimony to be credible. We afford deference to a district court’s credibility determinations, and here, no evidence suggests that the district court erred in concluding that the defense expert’s valuation was not worthy of credence.

Got that? No one seems to care that an expert pointed out that Lundgren's discs, sans license, are effectively worthless. They dismiss that as not credible. Again, here was a situation where Microsoft should have said something. And it didn't. It helped the prosecutors. And this week it issued this completely bullshit statement to the Washington Post:

Microsoft actively supports efforts to address e-waste and has worked with responsible e-recyclers to recycle more than 11 million kilograms of e-waste since 2006. Unlike most e-recyclers, Mr. Lundgren sought out counterfeit software which he disguised as legitimate and sold to other refurbishers. This counterfeit software exposes people who purchase recycled PCs to malware and other forms of cybercrime, which puts their security at risk and ultimately hurts the market for recycled products.

Look, that statement is pure hogwash. The software is not counterfeit. It's legit. It's the same thing that anyone can download from Microsoft for free. It didn't expose anyone to malware or cybercrime, and Microsoft knows that.

So much of this comes down to a fundamental misunderstanding, driven by copyright maximalists of all stripes, including Microsoft. And it's the idea that all of the following are equivalent: a copyright, a piece of software, a license, and "intellectual property." Many people like to use all of those things indistinguishably. But they are different. The issue here is the difference between the software and the license. And Microsoft, prosecutors and the judges either do not understand this or just don't care.

The best explanation of all of this comes from Devin Coldewey over at TechCrunch who dives deep into just how fucked up this situation is. Read Coldewey's whole piece because it breaks down just how insane this ruling is piece by piece, but here's one key part:

The “infringing” item is a disc. The “infringed” item is a license. The ones confusing the two aren’t purchasers but the judges in this case, with Microsoft’s help.

“[Defendants] cannot claim that Microsoft suffered minimal pecuniary injury,” wrote the judges in the ruling affirming the previous court’s sentencing. “Microsoft lost the sale of its software as a direct consequence of the defendants’ actions.”

Microsoft does not sell discs. It sells licenses.

Lundgren did not sell licenses. He sold discs.

These are two different things with different values and different circumstances.

I don’t know how I can make this any more clear. Right now a man is going to prison for 15 months because these judges didn’t understand basic concepts of the modern software ecosystem. Fifteen months! In prison!

Coldewey also hits Microsoft hard over all of this:

Microsoft cannot claim that it was merely a victim or bystander here. It has worked with the FBI and prosecutors the whole time pursuing criminal charges for which the defendant could face years in prison. And as you can see, those charges are wildly overstated and produced a sentence far more serious than Lundgren’s actual crime warranted.

The company could at any point have changed its testimony to reflect the facts of the matter. It could have corrected the judges that the infringing and infringed items are strictly speaking completely different things, a fact it knows and understands, since it sells one for hundreds and gives the other away. It could have cautioned the prosecution that copyright law in this case produces a punishment completely out of proportion with the crime, or pursued a civil case on separate lines.

This case has been ongoing for years and Microsoft has supported it from start to finish

There are lots of reasons to hate on Microsoft, but this one is one of the most sickening examples I've seen. Anyone at Microsoft who had anything to do with this should be ashamed.

But, of course, this is the world that companies like Microsoft (and the various Hollywood entities) have pushed for for years. They blur the lines between "license" and "content" and "copyright" and then use it as far as they can push it. And who cares if someone who is actually doing good in the world has his life destroyed?

Filed Under: 11th circuit, copyright, criminal, e-waste, eric lundgren, licenses, recovery discs, recycling, software
Companies: microsoft

The Legal Netherworld Of Traffic Cam Tickets, Where Everything Is Both Civil And Criminal, While Also Being Mostly Neither

from the American-Traffic-Systems-Multiverse dept

Adam MacLeod, law professor at Faulkner University, was the recipient of a traffic cam speeding ticket. The problem was that he wasn't driving the vehicle when the infraction occurred. So, it was his vehicle being ticketed, but he was being held responsible for someone else's infraction.

He decided to fight it, and that fight uncovered just how crooked the traffic cam system is. Not only are traffic camera manufacturers receiving a cut of every ticket issued, but tapping into this new revenue stream has prompted municipalities to undermine the judicial system.

MacLeod's detailed report of his fight against city hall is well worth reading in its entirety. But one hint of things to come reveals itself in MacLeod's conversation with the city's attorney when attempting to figure out how one goes about actually challenging a traffic cam ticket.

I asked her whether this was a criminal action or a civil action. She replied, “It’s hard to explain it in those terms.” I asked whether she intended to proceed under criminal procedural rules or in civil procedure. We would proceed under the “rules of criminal procedure,” she answered because this is a criminal case. I asked when I could expect to be charged, indicted, or have a probable cause determination. She replied that none of those events would occur because this is “a civil action.” So I could expect to be served with a complaint? No, no. As she had already explained, we would proceed under the criminal rules.

The attorney had no way of answering this question honestly, or even accurately. What MacLeod discovered during his speeding ticket battle is that his local government -- like many other local governments deploying traffic cameras -- had created a legal netherworld between civil and criminal law where tickets issued by software were allowed to operate.

[T]raffic cameras do not always produce probable cause that a particular person has committed a crime. To get around this “problem” (as a certain law-and-order president-elect might call it), several states have created an entirely novel phylum of law: the civil violation of a criminal prohibition. Using this nifty device, a city can charge you of a crime without any witnesses, without any probable cause determination, and without any civil due process.

In short, municipal officials and their private contractors have at their disposal the powers of both criminal and civil law and are excused from the due process duties of both criminal and civil law. It’s a neat trick that would have made King George III blush.

Once a government becomes reliant on a new, legally-questionable revenue stream, the "questionable" part tends to be buried under absurd claims about traffic safety and traffic accident deaths. At this point, the entire system is corrupted. Legislators like the money. Cops like the money. The camera company (in this case, American Traffic Solutions) likes the money. Everything that needs to be done to ensure the cashflow doesn't dry up is done, including engaging in perjury.

MacLeod was finally allowed to address the proxy accusing him of speeding: the local PD. Its testifying officer buried himself (along with the city and ATS) during cross-examination.

On cross-examination, I established that:

- He was not present at the time of the alleged violation.

- He has no photographic evidence of the driver.

- There were no witnesses.

- He does not know where Adam MacLeod was at the time of the alleged violation.

And so on. I then asked the question one is taught never to ask on cross—the last one. “So, you signed an affidavit under the pains and penalties of perjury alleging probable cause to believe that Adam MacLeod committed a violation of traffic laws without any evidence that was so?”

Without hesitating he answered, “Yes.” This surprised both of us. It also surprised the judge, who looked up from his desk for the first time. A police officer had just testified under oath that he perjured himself in service to a city government and a mysterious, far-away corporation whose officers probably earn many times his salary.

Once you're corrupt, it's all over. The officer MacLeod questioned seemingly didn't realize his complicity in this corruption until he was directly questioned. In all fairness, he'd likely been told everything about the ticketing system was above-board, legally and constitutionally.

But once the new system -- one that is neither criminal nor civil -- is challenged, it falls apart. MacLeod reports that Alabama residents fought back against the deployment of traffic cameras, resulting in the repeal of the state's traffic cam law. Not that his mattered to the city of Montgomery's (where MacLeod resides) governance.

[M]ontgomery’s defiant mayor announced that the city would continue to operate the program. Curiously, he asserted that to stop issuing tickets would breach the city’s contract with American Traffic Solutions.

That went on until the state's District Attorney stepped in to shut down the mayor's rogue traffic cam program. Or tried to. A compromise of sorts was reached. Car-mounted cameras were shut down, but stationary cameras already in place were allowed to keep issuing tickets summoning citizens to the city's judicial Kafka-esque criminal/civil intersection.

Unhappy with having to (sort of) comply with state law, the mayor made it clear that cameras may come and go, but newly-found revenue streams are here to stay.

In a fit of petulance, and belying his insistence that the program is motivated by safety concerns rather than revenue, the mayor announced that the amounts of fines for ordinary traffic violations will now be tripled.

That's how the system works. The money must flow from the citizens to their government. And if the pipeline has to run right through their civil rights and liberties, so be it. Traffic camera systems are sold as public safety enhancements, but all they're really doing is transferring more money -- and more power -- to governments willing to let contractual obligations with private companies take precedence over Constitutional amendments.

Filed Under: adam macleod, alabama, civil, criminal, due process, speed cameras, speeding ticket, tickets, traffic cameras
Companies: ats

Israeli Company Claims Its Software Can Look At Your Face And Determine If You're A Terrorist Or Murderer

from the no-it-can't dept

There is a regular experience I have that I assume is common for anyone that operates within the technology industry: I will often hear non-technical people make claims about a specific kind of technology that are wildly overstated. To clarify, I am technically proficient in the barest sense, mostly meaning that I have enough of an understanding of the underlying process by which things work that I can explain them, but not implement them. To those without even that barest understanding, I can understand how technology can simply seem like magic. That can open the doors for others who know better to try to take advantage of this.

Enter into the conversation Israeli startup company Faception, which claims its facial recognition software can look at your features and then determine if you're a terrorist, pedophile, or criminal.

An Israeli start-up says it can take one look at a person's face and realize character traits that are undetectable to the human eye. Faception said it's already signed a contract with a homeland security agency to help identify terrorists. The company said its technology also can be used to identify everything from great poker players to extroverts, pedophiles, geniuses and white collar-criminals.

"We understand the human much better than other humans understand each other," said Faception chief executive Shai Gilboa. "Our personality is determined by our DNA and reflected in our face. It's a kind of signal."

The practice of trying to figure out human tendencies and traits through facial features isn't new. It's been going on for centuries under the term "physiognomy", and its history is long and dubious. The overwhelming general consensus is that it's nonsense, with anecdotal evidence for its successes being more the result of confirmation bias and self-fulfilling prophecy than anything else. One might remember the man with the mean face who later robbed him at gunpoint, but doesn't think as often about the kind-faced man who bilked him out of his life savings with a confidence scheme. Alternatively, one might decide someone had an untrustworthy face, treat that person badly, and assume confirmation of the original theory when that person reacts negatively to such treatment.

What Faception claims to do is put the job in the hands of software, as though that solves the problem. Except software is both constructed by humans, with all of their biases, and is even programmed in a way to be intelligent like humans, making the whole thing a self-defeating enterprise. Even Gilboa knows that his claims of super-accuracy shouldn't be relied on.

The danger lies in the computer system's imperfections. Because of that, Gilboa envisions governments considering his findings along with other sources to better identify terrorists. Even so, the use of the data is troubling to some.

"The evidence that there is accuracy in these judgments is extremely weak," said Alexander Todorov, a Princeton psychology professor whose research includes facial perception. "Just when we thought that physiognomy ended 100 years ago. Oh, well."

And examples for the methodology of how this type of software will learn to identify traits often leaves much to be desired as well.

There are challenges in trying to use artificial intelligence systems to draw conclusions such as this. A computer that is trained to analyze images will only be as good as the examples it is trained on. If the computer is exposed to a narrow or outdated sample of data, its conclusions will be skewed. Additionally, there's the risk the system will make an accurate prediction, but not necessarily for the right reasons.

Domingos, the University of Washington professor, shared the example of a colleague who trained a computer system to tell the difference between dogs and wolves. Tests proved the system was almost 100 percent accurate. But it turned out the computer was successful because it learned to look for snow in the background of the photos. All of the wolf photos were taken in the snow, whereas the dog pictures weren't.

In that latest example, you see how a particular technology can appear to be almost magical in its accuracy until you get under the hood and see what actually occurred. There's no magic here, just software intelligent enough to separate wolves from dogs in a manner that didn't look at either the wolves or dogs at all. We can't tell if Faception's technology works the same way because, of course, Gilboa's company isn't sharing what's under the hood. Given the history of this practice, however, one feels safe rebutting the company's claim that it can tell if you're a terrorist by looking at your face by simply saying, "No you can't."

And that's not even digging into the question of the ethics of the use of this "technology." Faception claims it has already signed an agreement with an unidentified nation's homeland security organization. Were governments to begin using questionable technology that hasn't been vetted for accuracy and applying law enforcement actions with it, well, then we'd have delved into the kind of PreCrime dystopia typically reserved for bad fiction.

Software isn't magic. It strains the mind to believe that one company could undo centuries of consensus on physiognomy, just like that. Because it almost certainly can't.

Filed Under: criminal, facial recognition, terrorist
Companies: faception