Sony Music Says DNS Service Is Implicated In Copyright Infringement At The Domains It Resolves

from the first-they-came-for-the-resolvers dept

One of the characteristics of maximalist copyright companies is their limitless sense of entitlement. No matter how much copyright is extended, be it in duration, or breadth of application, they want it extended even more. No matter how harsh the measures designed to tackle copyright infringement, they want them made yet harsher. And no matter how distantly connected to an alleged copyright infringement a company or organization or person may be, they want even those bystanders punished.

A worrying example of this concerns Quad9, a free, recursive, anycast DNS platform (Cloudflare has technical details on what "recursive" means in this context). It is operated by the Quad9 Foundation, a Swiss public-benefit, not-for-profit organization, whose operational budget comes from sponsorships and donations. In other words, it's one of the good guys, trying to protect millions of users around the world from malware and phishing, and receiving nothing in return. But that's not how Sony Music GmbH sees it:

In June, Quad9 was served with a notice from the Hamburg Germany court (310 O 99/21) stating that Quad9 must stop resolving certain domain names that Sony Music GmbH believed were implicated in infringement on properties that Sony claims are covered by their copyrights. Quad9 has no relationship with any of the parties who were involved in distributing or linking to the content, and Quad9 acts as a standard DNS recursive resolver for users in Germany to resolve those names and others.

Sony Music is not alleging that Quad9 is infringing on copyright directly, but that its DNS service allows people to access a Web site that has links to material on a second Web site that infringes on copyrights. On this basis, the Hamburg Court has used Germany's law on indirect liability to order Quad9 to cease resolving the names of those sites. But as the Gesellschaft für Freiheitsrechte explains, there's a crazy twist here. Under German law:

[Internet] service providers who provide access to unlawful information or transmit such information are expressly no longer liable for damages or responsible for removal, nor can an injunction be granted against them. However, the Hamburg Regional Court assumes that Quad9 cannot invoke this liability privilege because it does not itself route the copyright-infringing information from A to B, but merely provides indirect access to it. This understanding of the law leads to the contradictory result that Quad9 is deemed liable for copyright infringements precisely because it has even less to do with the copyright infringements than Internet access providers, who are equally not involved in copyright infringements but at least do transmit the data in question.

Quad9's FAQ on the case points out that if allowed to stand:

this would set a dangerous precedent for all services used in retrieving web pages. Providers of browsers, operating systems or antivirus software could be held liable as interferers on the same grounds if they do not prevent the accessibility of copyright-infringing websites.

The past history of media companies suggest that, given such a capability, they would indeed go after all of these incidental operators, as part of an insane quest to put every aspect of the Internet at the service of copyright.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: copyright, dns, germany, infrastructure, recursive dns, resolving
Companies: quad9, sony music

Apple, Cloudflare Join Forces To Encrypt DNS

from the long-overdue dept

Each time you visit a website, your browser interacts with a domain name system (DNS) resolver that converts web addresses to an IP address understood by the machines along your path. Historically however this traffic exchange isn't encrypted, making it possible for your broadband provider or another third party to monitor your browsing data based on your DNS queries. DNS inventors in the 80s didn't really bet on a future where all DNS queries would be tracked, monetized, or weaponized by third parties.

Experts for a while have been arguing (including here at the Techdirt Greenhouse policy project) that it's important that we start encrypting these pathways to bring a little more security and privacy to the equation. Companies like Mozilla have been at the forefront of implementing "DNS over HTTPS," a significant security upgrade to DNS that encrypts and obscures your domain requests, making it more difficult (though not impossible) to see which websites a user is visiting. Recently, even Comcast (a company that's no stranger to monetizing your online habits) joined Mozilla's efforts to take the idea mainstream.

But even DNS over HTTPS (DoH) doesn't fully thwart DNS resolvers from seeing your browsing activity. Enter a new joint effort from Cloudflare and Apple, who say they have joined forces to back a new internet protocol dubbed ODOH, based in turn on existing research out of Princeton (pdf). Cloudflare explains how it works this way:

"ODoH is an emerging protocol being developed at the IETF. ODoH works by adding a layer of public key encryption, as well as a network proxy between clients and DoH servers such as 1.1.1.1. The combination of these two added elements guarantees that only the user has access to both the DNS messages and their own IP address at the same time."

The changes shouldn't add any perceptible latency to browsing speed, but should notably improve user and overall internet security. A good thing in a country that still doesn't seem to think even a modern, simply privacy law for the internet era is necessary to protect the security of the internet and public safety. But as Zack Whitacre at TechCrunch notes, steps still need to be taken to ensure no single party controls both the DNS resolver and proxy:

"A key component of ODoH working properly is ensuring that the proxy and the DNS resolver never “collude,” in that the two are never controlled by the same entity, otherwise the “separation of knowledge is broken,” Sullivan said. That means having to rely on companies offering to run proxies."

Cloudflare told TechCrunch that several partner organizations are already running proxies, allowing for folks to give the system an early spin if they use Cloudflare's security-focused 1.1.1.1 DNS resolver. Everybody else will need to wait until the new protocol comes standard as part of your OS or browser, which depends on how long it takes for the Internet Engineering Task Force to finalize the proposal. That could take months or years, but in a world where your every waking online movement is increasingly tracked and monetized, it should be a welcome shift whenever it finally drops.

Filed Under: dns, dns over https, doh, encrypted dns, odoh
Companies: apple, cloudflare

Comcast And Mozilla Partner Up To Help Encrypt DNS

from the strange-bedfellows dept

Over at our Tech Policy Greenhouse, Article19's Joey Salazar and Consumer Reports' Benjamin Moskowitz just discussed how it's long past time to encrypt the Domain Name Server (DNS) system at the heart of the internet. Thanks to the GOP demolishing of FCC broadband privacy rules in 2017, ISPs have carte blanche to monetize this data as they see fit, storing and selling access to your DNS browsing data to data brokers who continue to build detailed user profiles with little to no meaningful oversight.

At the forefront of encrypting DNS have been Google and Mozilla, both of which have been pushing for a standard known as "DNS over HTTPS," a significant security upgrade to DNS that encrypts and obscures your domain requests, making it more difficult (though not impossible) to see which websites a user is visiting. The proposal doesn't come without downsides, and has seen opposition from ISPs that are either eager to continue to profit off of this data, or are worried that somebody else will (usually Google) if they can't.

Comcast, AT&T, and others had previously been trying to demonize the Google and Mozilla efforts any way they could, from insisting the move constitutes an antitrust violation on Google's part (it doesn't), to saying it's a threat to national security (it's not), to suggesting it even poses a risk to 5G deployments (nah).

After Mozilla claimed to Congress that ISPs were being disingenuous with their opposition to the plan, at least one major ISP appears to have come around to the proposal. This week Mozilla announced that Comcast had joined the Firefox Trusted Recursive Resolver (TRR) program, which requires encrypted-DNS providers to not only meet privacy and transparency standards, but to promise not to block or filter domains by default "unless specifically required by law in the jurisdiction in which the resolver operates." From the blog post:

"This program aims to standardize requirements in three areas: limiting data collection and retention from the resolver, ensuring transparency for any data retention that does occur, and limiting any potential use of the resolver to block access or modify content. By combining the technology, DoH, with strict operational requirements for those implementing it, participants take an important step toward improving user privacy."

While Comcast has a well-deserved and terrible reputation for anti-competitive behavior, lobbying shenanigans and comically awful customer service, the company's engineering folks remain top notch, and obviously appreciate the benefits of encrypting the DNS in the wholesale snoopvertising age. In conversations, the company continues to insist to be they've never monetized this data (not that anybody in government would ever have the ability or courage to confirm this), and had been running a beta version of its own encrypted DNS offering since last year.

Mozilla helping to standardize this and forming a coalition with Comcast is foundational, and under the partnership, Comcast is promising to not "retain, sell, or transfer to any third party (except as may be required by law) any personal information, IP addresses, or other user identifiers, or user query patterns from the DNS queries sent from the Firefox browser." Now it's just a matter of Comcast transparently proving that they're actually adhering to those standards.

Filed Under: dns, dns over https, encryption
Companies: comcast, mozilla

Hoping To Combat ISP Snooping, Mozilla Enables Encrypted DNS

from the encrypt-ALL-the-things! dept

Historically, like much of the internet, DNS hasn't been all that secure. That's why Mozilla last year announced it would begin testing something called "DNS over HTTPS," a significant security upgrade to DNS that encrypts and obscures your domain requests, making it more difficult (though not impossible) to see which websites a user is visiting. Obviously, this puts a bit of a wrinkle in government, telecom, or other organizational efforts to use DNS records to block and filter content, or track and sell user activity.

As a result, a lot of these folks have been throwing temper tantrums in recent weeks.

The telecom sector, which makes plenty of cash selling your daily browsing habits, have spent much of the last year trying to demonize the Google and Mozilla efforts any way they can, from insisting the move constitutes an antitrust violation on Google's part (it doesn't), to saying it's a threat to national security (it's not), to suggesting it even poses a risk to 5G deployments (nah, that's an entirely different mess). Mozilla's response to telecoms' face fanning? To first urge Congress to investigate telecom's long history of privacy abuses, then proceeding this week to enable the feature by default in the Mozilla browser.

In a blog post, Mozilla explains its thinking as such:

"At the creation of the internet, these kinds of threats to people’s privacy and security were known, but not being exploited yet. Today, we know that unencrypted DNS is not only vulnerable to spying but is being exploited, and so we are helping the internet to make the shift to more secure alternatives. We do this by performing DNS lookups in an encrypted HTTPS connection. This helps hide your browsing history from attackers on the network, helps prevent data collection by third parties on the network that ties your computer to websites you visit."

While there's a lot of overheated rhetoric about the risk of DNS over HTTPS from the likes of big telecom and government surveillance aficionados, there are some legitimate concerns about the standard from more above-board cybersecurity professionals. They'll be quick to note there's several other points at which ISPs can still engage in data surveillance and sales. They'll also argue that DNS over HTTPS really complicates life for enterprise IT managers, and in some instances encrypted DNS could derail existing cybersecurity solutions or parental control solutions.

Mozilla says it's listening to these complaints, so it's starting slowly with a gradual roll out across the US only. The organization says Firefox will disable encrypted DNS if it conflicts with parental controls. The feature will also be disabled by default in enterprise configurations. Firefox's encrypted DNS will use Cloudflare by default, though users can switch to other encrypted DNS providers manually in their browser settings. Those curious about the particulars can dig through Mozilla's FAQ here.

Filed Under: browsers, dns, dns-over-https, encryption, firefox, privacy, snooping
Companies: mozilla

UK ISPs Vilify Mozilla For Trying To Secure The Internet

from the ill-communication dept

Over the years, UK ISPs have been forced by the government to censor an increasing array of "controversial" content, including copyrighted material and "terrorist content." In fits and spurts, the UK has also increasingly tried to censor pornography, despite that being a decidedly impossible affair. Like most global censorship efforts, these information blockades often rely on Domain Name Server (DNS) level blacklists by UK ISPs.

Historically, like much of the internet, DNS hasn't been all that secure. That's why Mozilla recently announced it would begin testing something called "DNS over HTTPS," a significant security upgrade to DNS that encrypts and obscures your domain requests, making it difficult to see which websites a user is visiting. Obviously, this puts a bit of a wrinkle in the government, ISP, or other organizational efforts to use DNS records to block and filter content or track user activity.

Apparently thinking they were helping(?), the UK Internet Services Providers’ Association (ISPA), the policy and trade group for UK ISPs, last week thought they'd try and shame Mozilla for... trying to secure the internet. The organization "nominated" Mozilla for the organization's meaningless "internet villain" awards for, at least according to ISPA, "undermining internet safety standards in the UK":

Of course Mozilla is doing nothing of the sort. DNS over HTTPS (which again Mozilla hasn't even enabled yet) not only creates a more secure internet that's harder to filter and spy on, it actually improves overall DNS performance, making everything a bit faster. Just because this doesn't coalesce with the UK's routinely idiotic and clumsy efforts to censor the internet, that doesn't somehow magically make it a bad idea.

Of course, many were quick to note that ISPA's silly little PR stunt had the opposite effect than intended. It not only advertised that Mozilla was doing a good thing, it advertised DNS over HTTPS to folks who hadn't heard of it previously:

The silly PR stunt also reminded everybody how the bigger players in telecom sector (be it in the US, UK, or elsewhere) are usually all too happy to buckle to requests to censor the internet or spy on internet users. That said, one smaller UK ISP, Andrews and Arnold, decided to donate some money to Mozilla:

UK spy agency GCHQ and the Internet Watch Foundation (which manages the UK's internet watchlist) have also complained that the DNS security upgrade makes it harder to censor content and spy on users. But again, Mozilla says the effort is simply under discussion, won't be enabled by default, wouldn't break things like parental controls, and there's not even a hard date for deployment yet. For those interested, Cloudflare operates a DNS-over-HTTPS-compatible public DNS server at 1.1.1.1.

Update: It looks like ISPA is now in full retreat and have pulled the Mozilla nomination entirely, but not before issuing a "sorry not sorry" press release:

Filed Under: censorship, dns, dns over https, privacy, security, streisand effect, uk
Companies: andrews and arnold, cloudflare, ispa, mozilla, uk ispa

British Military Chief Warns Russia Could Cut NATO's Internet Connections, As Traffic For World's Top Sites Is Mysteriously Routed Via...Russia

from the probably-just-a-coincidence dept

We recently wrote about an interesting comment from Vladimir Putin's Press Secretary that Russia had no intention of cutting itself off from the rest of the Internet. But there's another side to the disconnection story, as this Guardian news item reveals:

Russia could pose a major threat to the UK and other Nato nations by cutting underwater cables essential for international commerce and the internet, the chief of the British defence staff, Sir Stuart Peach, has warned.

Russian ships have been regularly spotted close to the Atlantic cables that carry communications between the US and Europe and elsewhere around the world.

In other words, although Russia says it won't cut itself off from the Internet, it could probably cut off many NATO countries. A new report, entitled "Undersea Cables: Indispensable, insecure", emphasizes the importance and vulnerability of the underwater cables that provide much of the Internet's global wiring:

97% of global communications and $10 trillion in daily financial transactions are transmitted not by satellites in the skies, but by cables lying deep beneath the ocean. Undersea cables are the indispensable infrastructure of our time, essential to our modern life and digital economy, yet they are inadequately protected and highly vulnerable to attack at sea and on land, from both hostile states and terrorists.

US intelligence officials have spoken of Russian submarines "aggressively operating" near Atlantic cables as part of its broader interest in unconventional methods of warfare. When Russia annexed Crimea, one of its first moves was to sever the main cable connection to the outside world.

And if there were any doubts that Russia is very interested in the world's Internet connectivity, this recent event may help to clarify things:

Traffic sent to and from Google, Facebook, Apple, and Microsoft was briefly routed through a previously unknown Russian Internet provider Wednesday under circumstances researchers said was suspicious and intentional.

As another story in Ars Technica reported, this is not the first time important traffic has been mysteriously routed through Russia:

large chunks of network traffic belonging to MasterCard, Visa, and more than two dozen other financial services companies were briefly routed through a Russian government-controlled telecom under unexplained circumstances that renew lingering questions about the trust and reliability of some of the most sensitive Internet communications.

These events are a reminder that the online world depends on technologies where trust is an important element. That approach is now looking increasingly shaky as nation states wage attacks not just by means of the Internet, but even against it. This may explain why Russia says it wants alternative DNS servers for the BRICS nations: they could come in quite handy if -- by any chance -- the rest of the Internet goes down.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: connectivity, dns, infrastructure, internet, russia, uk, undersea cables

Russia Says Disconnecting From The Rest Of The Net 'Out Of The Question', But Wants Alternative DNS Servers For BRICS Nations

from the think-global,-act-local dept

At the start of the year, we wrote about a call for Russia to make its Internet infrastructure resistant to external attempts to shut it down, and able to work in isolation if need be. It looks like the authorities are moving ahead with the idea:

The Russian Security Council has asked the country's government to develop an independent internet infrastructure for BRICS nations, which would continue to work in the event of global internet malfunctions.

The RT news story has some details on how the BRICS subnet will work:

They decided that the problem should be addressed by creating a separate backup system of Domain Name Servers (DNS), which would not be subject to control by international organizations. This system would be used by countries of the BRICS bloc -- Brazil, Russia, India, China and South Africa.

The plan has evidently developed from a purely Russian intranet system to one that includes the other BRICS nations. Creating additional DNS servers will be easy, so there's no reason why it shouldn't happen -- not least because Putin has "personally set a deadline of August 1, 2018 for the completion of the task". Perhaps the most interesting aspect of the story is the following comment by Putin's Press Secretary, Dmitry Peskov:

"Russia’s disconnection from the global internet is of course out of the question," Peskov told the Interfax news agency. However, the official also emphasized that "recently, a fair share of unpredictability is present in the actions of our partners both in the US and the EU, and we [Russia] must be prepared for any turn of events."

That offers a pragmatic recognition that disconnection from the global Internet is no longer an option for a modern state, even if Iran begs to differ. It's true that local DNS servers provide resilience, but they also make it much easier for a government to limit access to foreign sites by ordering their IP addresses to be blocked -- surely another reason for the move.

This latest proposal is part of a long-running campaign by Russia to wrest control of key aspects of the Internet -- such as the DNS system -- from international bodies, for example during the ITU's World Conference on International Communications (WCIT) in 2012. Russia already had the support of other BRICS governments back then, which suggests they will back the new approach.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: brics, dns, internet, russia