SoundCloud Has Given Universal Music Group The Ability To Directly Remove Content

from the more-power,-less-accountability dept

As Mike recently covered, SoundCloud's infringement takedown system has more than a few issues. The EFF's Parker Higgins had uploaded a recording of the Apollo 13 astronauts, something clearly in the public domain, but SoundCloud took it down and the "remedies" available to Higgins all assumed the removed content was covered by someone's copyright. And, like many takedown notices, there was no indication who had requested the removal, or if it was simply SoundCloud's automated infringement bot making bad assumptions.

Now, there's more bad news for users of SoundCloud's service. Apparently, Universal Music Group has the power to directly pull tracks without issuing a takedown request to SoundCloud. This has resulted in a paying customer of SoundCloud having his account deleted for copyright violations with the only recourse available being to contact Universal directly to dispute the takedown.

The user, Mr Brainz, pointed out to SoundCloud that he sees some inconsistencies in its copyright enforcement. His account is being targeted but other mixes from other users are being left alone, despite their inclusion of copyrighted tracks.

[click through for a larger versions of these screenshots]

SoundCloud's response to his complaints was basically, "It's out of our hands."

Your uploads were removed directly by Universal. This means that SoundCloud had no control over it, and they don't tell us which part of your upload was infringing. If you look at your tracklist it may help you find the Universal content they wanted blocked.

The control of removing content is completely with Universal. This means I can't tell you why they removed your uploads and not others, and you would really need to ask them that question.

I don't know what method they use to find infringing material unfortunately. Their anti-piracy team are based in the US.

SoundCloud now has a YouTube problem. In an agreement reached in 2011, YouTube gave UMG the same sort of direct access, which has resulted in abusive, bogus takedowns by the label. This looks like more of the same. While SoundCloud is certainly under a lot of pressure to police uploads for infringing content, handing direct control over to an entity that once declared SoundCloud to be a "pirate site" was never going to work out well.

Now that Mr Brainz's problems have gone public, SoundCloud has issued a statement in response… and it doesn't add anything to the discussion.

As a responsible hosting platform, we work hard to ensure that everyone's rights are respected. In the case of rights holders, that means having processes in place to ensure that any content posted without authorisation is removed quickly and efficiently.

In the case of users, that means having separate processes in place to ensure that any content removed in error can be reinstated equally quickly. If any user believes that content has been removed in error - for example, because they had the necessary permissions from Universal Music and/or any other rights holder - then they are free to dispute the takedown.

Translated from PR speak, the statement basically says that the end user is out of luck, especially in the case of Universal's direct takedowns. Does anyone seriously believe Universal will look into challenged takedowns? There's nothing in this unfortunate partnership that indicates Universal can be held accountable for bogus takedowns. Beyond that, there's nothing in the long history of the DMCA that indicates any rights holder will be held responsible for bogus takedowns, much less be willing to engage in a useful discussion about fair use or other edge cases.

If Universal orders a takedown, the content is gone and the user's account is one step closer to being shut down. End of story. In Universal's case, there's no consideration given ever for fair use. Other takedowns, some of them the result of a misfiring algorithm, can still be disputed, but the process SoundCloud has provided doesn't factor in fair use, public domain or other instances that aren't clearly cases of infringement. And if you get enough bogus takedowns, your account -- even your paid Pro account -- is dead and SoundCloud won't be handing out refunds.

When a service becomes popular enough that infringement detection needs to be automated, problems are necessarily going to arise. Bots aren't perfect, but that's the reality of the situation if you're going to retain your safe harbors. But giving rights holders the ability to directly pull the plug on content is a bad idea and providing no real avenue for dispute only makes it worse.

Filed Under: audio, copyright, direct access, dmca, fair use, music, removals, takedowns
Companies: soundcloud, universal music

Vodafone Reveals Government Agencies Have Direct Access To Its Network Around The World, No Warrants Required

from the even-worse-than-we-thought dept

One of the important results of Snowden's leaks over the last year is that the companies involved are not only becoming more open about how their services have been used by the NSA and GCHQ to spy on people, but they are even starting to push for less intrusion and more transparency. The latest to provide important information about what has been going on is Vodafone, with some fairly shocking news, as reported by the Guardian:

Vodafone, one of the world's largest mobile phone groups, has revealed the existence of secret wires that allow government agencies to listen to all conversations on its networks, saying they are widely used in some of the 29 countries in which it operates in Europe and beyond.

The company has broken its silence on government surveillance in order to push back against the increasingly widespread use of phone and broadband networks to spy on citizens, and will publish its first Law Enforcement Disclosure Report on Friday. At 40,000 words, it is the most comprehensive survey yet of how governments monitor the conversations and whereabouts of their people.

The company said wires had been connected directly to its network and those of other telecoms groups, allowing agencies to listen to or record live conversations and, in certain cases, track the whereabouts of a customer. Privacy campaigners said the revelations were a "nightmare scenario" that confirmed their worst fears on the extent of snooping.

The Guardian story has lots of new information, and is well-worth reading. It includes a table that shows the number of warrants issued last year for legal interception of content, on a country-by-country basis. There are some surprises here -- for example, the fact that the Australian government issued 685,757 warrants for metadata, which is even more than the UK's 514,608 warrants, despite the fact that Australia has well under half the population of the UK. There are other fascinating details in the Vodafone Law Enforcement Disclosure Report itself. For example, it contains this explanation about what exactly a warrant might encompass these days:

Each warrant can target any number of different subscribers. It can also target any number of different communications services used by each of those subscribers and -- in a modern and complex all-IP environment -- it can also target multiple devices used by each subscriber to access each communications service. Additionally, the same individual can be covered by multiple warrants: for example, more than one agency or authority may be investigating a particular individual. Furthermore, the legal framework in some countries requires agencies and authorities to obtain a new warrant for each target service or device, even if those services or devices are all used by the same individual of interest. Note that in the majority of countries, warrants have a time-limited lifespan beyond which they must either be renewed or allowed to lapse.

As people's digital lives grow more complex and the number of communications devices and services used at home and work on a daily basis continues to increase, the ratio of target devices and services accessed to warrants issued will continue to increase. To illustrate this with a hypothetical example:

a single warrant targets 5 individuals;

each individual subscribes to an average of eight different communications services provided by up to eight different companies: a landline phone line, a mobile phone, two email accounts, two social networking accounts and two "cloud"; storage accounts; and

each individual owns, on average, two communications devices fitted with a SIM card (a smartphone and a tablet) in addition to a landline phone and a laptop.

In the hypothetical example above, that one warrant could therefore be recorded as more than 100 separate instances of agency and authority access to individual services on individual devices used by individual subscribers.

That means that the number of warrants listed in the Vodafone report, and collected in the Guardian table mentioned above, is likely to be a significant underestimate of the total number of acts of surveillance being conducted. Alongside the main report, there is also an 88-page Legal Annexe (pdf):

This annexe to Vodafone's Law Enforcement Disclosure report seeks to highlight some of the most important legal powers available to government agencies and authorities seeking to access customer communications across the 29 countries of operation covered in this report.

Whilst the legal powers summarised here form part of local legislation in each of those countries and can therefore be accessed by the public, in practice very few people are aware of these powers or understand the extent to which they enable agencies and authorities to compel operators to provide assistance of this nature.

As that notes, very few people are aware of the powers that exist around the world, which makes this Annexe an extremely valuable contribution to charting the surveillance landscape, not least because it is being released freely. As well as for this research, Vodafone deserves credit for making the following call, as reported by the Guardian:

Vodafone's group privacy officer, Stephen Deadman, said: "These pipes exist, the direct access model exists.

"We are making a call to end direct access as a means of government agencies obtaining people's communication data. Without an official warrant, there is no external visibility. If we receive a demand we can push back against the agency. The fact that a government has to issue a piece of paper is an important constraint on how powers are used."

That's a hugely important point. Direct access, as revealed by Vodafone, not only allows governments real-time access to enormous quantities of private communications data, but does so in a way that hides the fact that the interception is taking place at all, even to the companies involved. As Vodafone notes, introducing the requirement for a warrant for all such interception would make it much easier for companies to resist, alert the public to the sheer scale of the surveillance being carried upon them, and probably act as a natural brake on governments. Direct access to the network represents a huge exacerbation of the dangers of government surveillance: it is simply too easy to "collect it all." Vodafone's disclosure report is an important step towards changing that; the "other telecoms groups" mentioned above should now follow suit by issuing their own.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: direct access, europe, surveillance, warrants, wiretaps
Companies: vodafone

More Details On PRISM Revealed; Twitter Deserves Kudos For Refusing To Give In

from the details-details-details dept

Late on Friday, the NY Times released the most detailed explanation to date of the PRISM system that was revealed on Thursday, claiming that nine of the biggest tech and internet companies were working with the NSA to give them "direct access" to servers. The explanation explains how both the original story was substantially true, as were the "denials," though the denials were (as predicted) a bit of doublespeak. Today, the Guardian revealed another slide from the presentation it has, which clarifies some more details.

Basically, it appears those companies all agreed to make it easier for the NSA to access data that was required to be handed over under an approved FISA Court warrant, and they appear to do this by setting up their own servers where they put that information (and just that information). From the NY Times report:

But instead of adding a back door to their servers, the companies were essentially asked to erect a locked mailbox and give the government the key, people briefed on the negotiations said. Facebook, for instance, built such a system for requesting and sharing the information, they said.

The data shared in these ways, the people said, is shared after company lawyers have reviewed the FISA request according to company practice. It is not sent automatically or in bulk, and the government does not have full access to company servers. Instead, they said, it is a more secure and efficient way to hand over the data.

This is significantly less worrisome than the original Washington Post report, which suggested full real-time access to all servers. That's not quite what has happened, according to this report. This involves cases where the companies really do need to hand over this information. We can disagree with whether or not the FISA Court should issue these warrants, but at some point there may be information that the companies do need to hand over to the government. As for the Guardian, they published the following slide: As you can see, it notes multiple programs where they can get data. The programs on top are the ones such as the NSA servers installed at telcos to collect all traffic running through them, which have been revealed before. The program on the bottom is PRISM, which clearly states: "collection directly from the servers of these U.S. Service Providers," followed by the already known list. That certainly confirms the "direct access" claim from the original WaPo report, but it could also be true in conjunction with the NY Times report, if you look at it as the companies setting up special servers where they place information they're ordered to hand over via FISA court orders. The "denials" from the companies are also substantially true, as they mean that the NSA isn't getting direct access to all their servers, but rather the ones set up for handing over this information.

The real question should be about what information the FISA Court is approving warrants over:

FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms, lawyers who work with the orders said. There were 1,856 such requests last year, an increase of 6 percent from the year before.

In one recent instance, the National Security Agency sent an agent to a tech company’s headquarters to monitor a suspect in a cyberattack, a lawyer representing the company said. The agent installed government-developed software on the company’s server and remained at the site for several weeks to download data to an agency laptop.

In other instances, the lawyer said, the agency seeks real-time transmission of data, which companies send digitally.

Note just how broad some of those searches may be. Staying around for weeks to download logs? We're not talking about narrowly focused searches here.

Of course, what's now also come out is that, despite Google and Microsoft releasing transparency reports about government requests for data, they don't include FISA requests because of the gag orders on them. It's only recently that both Google and Microsoft were able to include "range" numbers for how many national security letter requests they get. One hopes they're pushing to be transparent on FISA requests as well.

The article makes it clear that Twitter was alone among the companies in refusing to join this program. That does not mean that Twitter does not hand over data to the government when receiving a legitimate FISA order. I'm sure it does. But it does mean that they have not set up a special system to make it easy for the government to just log in and get the data requested. Some people have suggested that the government has little need for Twitter to join the program since nearly all Twitter information is public, but that's not true. There is still plenty of important information that might be hidden, including IP addresses, email addresses, location information and direct messages that the NSA would likely want. Besides, YouTube is a part of the program, and most of its data is similarly "public."

This is not, by the way, the first time that we've seen Twitter stand up and fight for a user's rights against a government request for data. Over two years ago, we pointed out that Twitter, alone among tech companies, fought back when a court ordered it to hand over user info. Twitter sought, and eventually got, permission to tell the user, and allow that user to try to fight back. It later came out that, as part of that same investigation, the government also had requested information from Google and Sonic.net, with Sonic.net fighting back and losing. It never became clear whether Google fought back.

Separately, however, Chris Soghoian has noted that an "unnamed company" fought back and lost against a FISA court order... and that, according to the PowerPoint presentation, Google "joined" PRISM just a few months later. It is possible that Google fought joining the program, and then only did so after losing in court. That said, Google's most recent denial insists that "the government does not have access to Google servers—not directly, or via a back door, or a so-called drop box." Perhaps they don't consider a special server set up for lawfully required information a "drop box," but others certainly might.

In the end, it appears that the initial Washington Post report was overblown in that it suggested direct access to all servers, rather than specific servers, set up to provide information that was required. That said, it is still true that the FISA Court appears to issue a fair number of secret orders for information from a variety of technology companies, some of them quite broad, and that many of the biggest tech companies have set up systems to make it easier to give the NSA/FBI and others access to that info -- though, they are often required by law to provide that information. The real outrage remains that all of this is happening in complete secrecy, where there is little real oversight to stop this from being abused. As we noted just a few weeks ago, the FISA Court has become a rubber stamp, rejecting no requests at all in the past two years.

Given the revelations of the past week, the public (and our representatives) need to demand much more transparency and oversight concerning these surveillance programs.

Filed Under: 4th amendment, direct access, fisa, fisa court, nsa, oversight, privacy, servers, surveillance
Companies: aol, apple, dropbox, facebook, google, microsoft, paltalk, skype, twitter, yahoo, youtube