Lego's Mostly Obnoxious IP Bullying Of The 3D Printing Community Doesn't Make Any Sense

from the get-over-it dept

In the earlier days of Techdirt, Lego made multiple appearances as an IP bully. However, its IP bullying ran into some legal headaches as various courts pushed back again and again and again. The company failed, pretty spectacularly, in its quest to argue that no one could make similar, or even interconnecting, Lego bricks. Its patents long expired, and any copyright and trademark rights were much more limited.

For years, the company has relied on the fact that even with the ability of other companies to copy its designs, really only Lego could manufacture the toy bricks with the kind of exact precision that made them work properly. Knock-offs tended to not connect nearly as well. And Lego's manufacturing was such that beyond the precision in the blocks, it could also make the blocks so cheaply that it was difficult for anyone to undercut them anyway. Finally, Lego's brand is pretty powerful in its own right, and many people would buy official Lego products as the default anyway, because of the brand association.

All of that makes the recent news of Lego threatening the 3D printing community all the more bizarre. There's simply no way that 3D printed version of Lego-style bricks are a "threat" in any way. The takedown letter itself, as posted by recipient MyMiniFactory (who initially thought it was spam!), is bizarre. It's symptomatic of obnoxious IP bullying, in that it was sent to platforms like MyMiniFactory that host 3D printable designs for sale, but, while it lists out designs it says are infringing, it appears not to explain how or why they are infringing. It does list out copyright and trademark rights that the company holds, but does not indicate which ones its complaining about for which designs, leaving it up to MyMiniFactory to determine such things. That, by itself, is a bullying tactic, effectively making it harder for the recipient to judge the merit of the infringement claims, and (most likely) hoping that leads to broader compliance with the request to avoid the hassle and potential legal costs and liability.

Dear myminifactory.com: LEGO A/S, LEGO Juris A/S and LEGO System A/S (collectively but not exclusively “the LEGO Group”) hold exclusive worldwide rights to the LEGO® intellectual property, including but not limited to the famous LEGO word mark, the famous red-square LEGO logo and the Minifigure figurine. These trademarks and copyrights, registered and/or protected under US and international trademark and copyright law, are used to identify, advertise and promote products and activities developed and/or held by the LEGO Group of companies. In addition, LEGO holds exclusive Copyright and Trademark rights to the world-famous LEGO® Minifigure figurine design. The LEGO Minifigure design is protected by United States Copyright registrations VA655104, VA655230. The LEGO Minifigure design, since the first launch in 1978, is protected by copyright laws and enforceable internationally through application of the Berne Convention. I, the undersigned, state UNDER PENALTY OF PERJURY that: 1. I am an agent authorized to act on behalf of the LEGO Group, of certain intellectual property rights; 2. I have a good faith belief that the URLs identified below offer items or contain materials that are not authorized by the the LEGO Group, its agent, or the law, and therefore infringe the IP Owner’s rights; and 3. The information in this notice is accurate. Please act expeditiously to remove the listings identified below:

As NYU's Michael Weinberg (who used to be General Counsel at Shapeways) explains in great detail, another element of the bullying factor here is that while there may be narrow areas where the infringement claims are correct, the overall point of the bullying appears to be nonsense.

To be specific, it appears that Lego maintains a legitimate copyright on the "mini figure" Lego characters ("minifigs"), and if someone is making such things, in theory, Lego could ask them to stop. The trademark claims also could have some level of legitimacy, but it still sounds like Lego is over-claiming its rights. As Weinberg explains:

If you are using the Lego trademarks to make it appear that your models are coming from the Lego company you are likely infringing on Lego’s trademarks. In contrast, if you are merely using Lego’s trademarks to show that your model is compatible with Lego, you are unlikely to be infringing on that trademark....

It seems that many of the targeted users are not trying to pass their goods off as official Lego goods. Instead, they are using the term “Lego” to indicate that their model is compatible with Lego-style connectors. One could argue about ways to make that more clear - say by using a term like “Compatible with Lego” or “Lego-Compatible” - but it seems unlikely that a consumer looking at at least some of these models would be confused as to their source or origin.

This is, tragically, all too common with trademark claims however -- where big brands act as though a trademark gives them the right to stop all non-official uses, even in cases of pointing out compatibility. That's not how trademark is supposed to work.

Indeed, Lego's own comments, when questioned about these takedown notices by the press, do not inspire confidence that they have legitimate reasons for sending such notices:

Jonas Søndergård, Global Press Officer, The LEGO Group, Corporate Communications did provide a brief statement. Søndergård explained that while LEGO would not discuss specifics, the recent infringement notices were “to protect the long-term exclusive rights of the LEGO trademarks, copyrights and patents."

LEGO says that issuing takedown notices and challenges is necessary to ensure that the “LEGO wordmark or IP protected elements” does not erode over time. LEGO’s “Fair Play Policy” describes a number of guidelines on how the company would like to be referred to, and what it deems permissible by enthusiasts. For example, “If the LEGO trademark is used at all, it should always be used as an adjective, not as a noun. For example, say “MODELS BUILT OF LEGO BRICKS”. Never say “MODELS BUILT OF LEGOs”. 

Yeah, the thing is, that's pretty much all nonsense. First off, on copyrights, there is no requirement that you need to protect them in this manner. For trademarks, the only risk is if the company is allowing the marks to become generic, but from all of the evidence that is not the case, and people are using the word "Lego" to accurately portray that their designs are meant to be compatible with Lego-brand blocks. As for Lego's own guidelines? So what? They are guidelines. They are not legally binding, and as we've seen, Lego has a long history of over-claiming its own rights and demanding more of Lego fans than is legally allowed. This appears to be no different.

But, let's circle around to a much bigger point here as to why this entire enterprise by Lego in issuing takedowns is particularly stupid. As noted up top, Lego is already going to be making its own bricks much better and cheaper than anything that anyone can make with a 3D printer. As Weinberg notes, the only reasons to use 3D printing for Lego-compatible blocks is if you're trying to do something that Lego doesn't currently make -- and that's only likely to be happening with people who already buy a ton of legit Lego bricks:

... almost no one would buy a 3D printed lego-style block if an injection molded one existed. Lego is really good at making lego bricks. In a head-to-head matchup, a lego-produced brick is going to be cheaper and better than a 3D printed one by almost any metric.

The only reason to turn to 3D printing is to create a lego-compatible object that does not already exist. If you need something custom or specific that Lego does not make, 3D printing is probably your only option. And if you need a custom lego-compatible block, that is probably because you already have many, many official Lego blocks. You are probably already a Lego superfan.

That means that the 3D printed Lego-compatible market is almost purely complimentary to the official market.

And, as Weinberg notes, this is why MyMiniFactory's response to Lego is so dead on:

We believe that as a community we can build a positive way forward. We invite you to collaborate with us, to come up with, and share some creative solutions to help build better opportunities for indie designers and brands to work together as a form of co-creation. Much like the way Ravensburger did with the Labyrinth competition, a competition that incentivizes designers to create IP models for their beloved Labyrinth board game. We ask you to help us by commenting below with your best solutions! 

In addition, if you'd like to get involed - We know some of you are better with designs than words! -  we've launched an exciting new "OGEL: Beyond the Brick" competition! You can even win an eLEGOo resin 3D printer!! 

If there's one consistent theme that we've had over the years concerning over-enforcement of IP, it's that there are almost always more productive ways to deal with supposed or alleged "infringement" than by issuing takedowns and legal threats. Collaborating with people who, it seems clear, are likely already Lego superfans who are buying bricks by the barrel and only resorting to 3D printed options when necessary, seems like it would be a hell of a lot more productive than unleashing the lawyers. But, I guess Lego has to Lego.

Filed Under: 3d printing, bullying, competition, copyright, enforcement, legos, trademark
Companies: lego

Can't Have Copyright Enforcement Without Destroying Privacy Protections

from the let's-face-facts dept

Last week, Tim Geigner wrote about the Spanish soccer league, La Liga, getting hit with a GDPR fine because its mobile software just happened to sneakily include a surreptitious surveillance feature, turning on users' microphones to try to capture who was watching/listening to unauthorized broadcasts of matches. I wanted to write a little more on this, inspired by a comment from Professor Annemarie Bridy, who pointed out that anti-piracy enforcement goes hand-in-hand with surveillance:

This is an important point that often gets overlooked. Rick Falkvinge, the founder of the original Pirate Party, has repeatedly explained why Pirate Parties often view copyright policy, encryption, and privacy as all parts of the same issue. Indeed, he's argued that copyright enforcement efforts, by definition, are anti-privacy efforts.

Enforcement of copyright is fundamentally, conceptually incompatible with privacy of correspondence. You can't have the sealed and private letter in existence at the same time as you enforce copyright, once communications have gone digital. This is the reason you see VPN companies and other privacy advocates fight copyright enforcement and copyright law: because society has to choose between privacy and copyright, and basic civil liberties are considered more important than one particular entertainment business model.

Of course, that's why it's so ridiculous that Hollywood and its various front groups are out front-and-center (and also, very much behind the scenes with their lobbyists whispering in policymakers' ears) bashing internet companies for not respecting users' privacy. You know, without a doubt, that if internet companies were truly pushing for stronger privacy and real end-to-end encryption for internet services that Hollywood and its friends would be first in line arguing that this would only be used for piracy and must be stopped.

Copyright and privacy can co-exist -- but aggressive copyright enforcement all too frequently relies on surveillance and invasive privacy-eradicating demands. At some point, people are going to need to decide if they really want privacy, it's going to mean that copyright enforcement will have to take a backseat.

Filed Under: copyright, enforcement, privacy, surveillance

Wireless Carriers Busted Sharing User 911 Location Data

from the bottomless-well-of-dysfunction dept

Recent scandals involving companies like Securus and LocationSmart made it clear that cellular carriers are collecting and selling an ocean of user location data without any meaningful oversight. Several reports have highlighted how that data is then being routinely abused by everybody from ethically dubious local Sheriffs to bounty hunters. Subsequent investigations have shown how easy it is for bounty hunters and others to access this data, and how the FCC under several administrations has failed utterly to hold cellular carriers and data brokers accountable for any of it.

This week, Motherboard exposed another location data scandal with a report highlighting how cellular carriers are also selling private user A-GPS data with companies that aren't supposed to have access to it. A-GPS, or assisted GPS, involves using a device's onboard GPS chip as well as cellular network data to more quickly and precisely determine a user's location. Wireless industry filings with the government indicate this data can pinpoint a user's location indoors up to 50 meters; more precisely if a device's MAC and Bluetooth data are also utilized.

Motherboard's investigation focused specifically on a now-defunct location data broker by the name of CerCareOne, which had been selling cellular user location data -- including A-GPS data-- as recently as 2017. As with the other scandals, this scandal involves a universe of shady middlemen who buy and sell an ocean of such data, often without carriers understanding (or bothering to understand) how widespread the practice had become:

"Like with the companies involved in Motherboard’s previous investigation, CerCareOne’s real-time location data trickled down first from telecom companies, and then to a so-called location aggregator called Locaid. From there, Locaid sold that data access to a number of different companies, including CerCareOne, which in turn sold it to its own clients. Locaid was purchased by a company called LocationSmart in 2015 . The documents Motherboard obtained indicate that LocationSmart continued to sell data to CerCareOne after it obtained Locaid, and LocationSmart confirmed that to Motherboard."

The scale of the data collection was... not subtle:

"CerCareOne’s phone tracking service was not a one-off tool for bounty hunters and bail agents. A list of a particular customer’s phone pings obtained by Motherboard stretches on for around 450 pages, with more than 18,000 individual phone location requests in just over a year of activity. The bail bonds firm that initiated the pings did not respond to questions asking whether they obtained consent for locating the phones, or what the pings were for.

Another set of data is more than 250 pages long and covers around 10,000 phone pings. Another list of a different bounty hunter’s activity includes nearly 1,000 phone location requests in less than a year; a third details more than 4,500 pings."

The irony in this instance is that the FCC had crafted rules to specifically address this problem. Back in 2015 as the FCC was contemplating some new rules for enhanced 911 services, a coalition of privacy and consumer groups (including Public Knowledge, the EFF, and the ACLU) had written the agency warning that A-GPS and other granular data specifically used to aid in pinpointing 911 caller location (especially indoors) created the potential for some major privacy issues:

"The development of highly-precise location technologies designed to comply with the new regulations will raise a host of privacy concerns that have not been sufficiently addressed in the E911 proceeding. Public safety should not come at the expense of consumer privacy—nor should it have to."

The FCC obliged, and in 2017 finalized rules with carrier approval that specifically stated that this kind of A-GPS data should never be used for any purpose other than tracking user location for emergency services:

"CMRS providers must certify that they will not use the NEAD or associated data for any non-911 purpose, except as otherwise required by law."

Many carriers claim to have completely stopped sharing this and other forms of location data entirely with data brokers or anybody else. But it's going to take a comprehensive investigation to not only confirm that, but also to confirm that they're not currently engaging in even worse behavior. Especially since every time we think we've gotten to the bottom of this scandal, the floor drops out revealing countless additional layers beneath.

Even with Ajit Pai's efforts to neuter FCC authority over ISPs, I've spoken to at least four telecom and privacy experts who say the FCC very clearly has the authority and responsibility to stop this sharing of private data, they've just chosen not to -- despite the fact the agency had the foresight to craft rules specifically designed to stop this from happening.

Filed Under: 911, a-gps, bounty hunters, e-911, enforcement, fcc, location data, privacy
Companies: cercareone

And Now Comes The Pushback As One ROMs Site Is Challenging Nintendo's Takedown Of ROM Sites

from the rom-com dept

Over the past few weeks, we've discussed Nintendo's tortured relationship with fans of its retro offerings. As a starting point, after years of pretty much ignoring the demand for retro games offered for earlier versions of its consoles, Nintendo finally produced an offering for retro consoles loaded with some but not all of the games from the eight and sixteen bit eras. Before this official offering, Nintendo's ignoring the market had for years produced a wide range of websites that allowed gamers to engage in their nostalgia by playing old games no longer available via emulators and ROMs of those games. Nintendo's retro consoles successfully competed with these free games by producing a great product. Despite that success, Nintendo has since gone on a campaign against some of the highest profile ROM sites out there, suing some and allowing that lawsuit to serve as enough of a threat to simply get other sites to voluntarily take Nintendo ROMs down. These sites, which had essentially served to compile and record video game history that Nintendo refused to do itself, suddenly began disappearing.

There was always going to be some kind of a backlash to this. And, now, one site is signaling that its ready to fight Nintendo, going so far as to taunt the company with a forthcoming offering for retro game ROMs.

While these decisions are understandable, not everyone is equally impressed by the show of legal force. The niche pirate site ‘Good Old Downloads,’ for example, sees the ROMs controversy as a good opportunity to expand its catalog. With retro games.

The new section is “coming soon” according to the site’s homepage. While no further details are listed, it is now linked to a Tweet which makes it rather clear what motivated ‘Good Old Downloads’ to add retro-titles. The tweet embeds a video showing recent press coverage of the Nintendo lawsuit and the related shutdowns. Towards the end, it shows a clip from “Age of Ultron” where Thanos’ face is replaced by the site’s logo.

“Fine, I’ll do it myself,” he says.

Now, let's be clear about a couple of things. First, Good Old Downloads is absolutely a site for pirating video games. It's unambiguous in that. Nothing in this post is to suggest that what the site is doing is legal, or even morally okay. It isn't. What should be clear is that the site's move comes as the we're still waiting for a settlement between Nintendo and the ROMs site and in the immediate wake of other sites taking their own ROMs down. In other words, this is the first but almost certainly not the last site to dig its heels in and challenge Nintendo's takedown efforts.

Which is ultimately the point of this post: Nintendo's focus on putting a genie back in the bottle when that will never happen is both futile and pointless. Pointless because Nintendo is already successfully competing with these ROM sites. And futile because these files are still available roughly everywhere on the internet.

That said, ROMs haven’t been particularly hard to find through traditional pirate sources. For example, shortly after Nintendo announced its lawsuit, one Demonoid user uploaded torrents featuring thousands of ROMs to the site, including tiles belonging to the Japanese game giant.

This isn't even whac-a-mole. It's more like trying to fill up the ocean with all the grains of sand on the beach. There's a great deal of work to be done to keep you busy, but you'll never achieve your goal. So why bother?

Filed Under: copyright, emulators, enforcement, roms, video games
Companies: good old downloads, nintendo

Significant Concerns About The New NAFTA Agreement's Impact On Innovation And The Internet

from the it's-bad dept

Earlier this week, we wrote about how the USTR itself appeared to be totally confused about its own NAFTA-replacement agreement with Mexico in the "Intellectual Property" section, in that it was reporting that the agreement included copyright in some works for "75 years" in places and "life + 75 years" in other places, and acted as though they were the same thing. The USTR seemed legitimately confused over this issue, which did not give people much confidence that it knew what it was doing in these negotiations on the intellectual property questions. However, since that issue appeared to be one of pure confusion, which should be easily fixed in the final text, we should put our attention more towards the actual problems with what the USTR appears to be doing here.

We don't yet have the full text -- though that should be available soon -- but from the USTR's fact sheet there are many reasons to be concerned that this agreement is a massive handout to Hollywood and patent trolls, and against innovation. Let's dig in:

Enforcement authorities must be able to stop goods that are suspected of being pirated or counterfeited at all areas of entry and exit.

This seems to be an attempt to bring back some of the features of the long-derided and eventually discarded ACTA agreement, which had all sorts of problems. A big part of ACTA was ramping up enforcement by ICE in seizing "infringing" goods. Of course, this is the same ICE who wrongly seized blogs and search engines they eventually had to return years later because there was no actual evidence they were infringing. Incredibly, it announced these evidence free seizures from Disney's headquarters, making it quite clear whose interests they were representing. There are lots of other concerns with ICE these days, but the idea that it should have more power to "enforce" copyright and trademark law is problematic.

Enforcement against counterfeits and piracy occurring on a commercial scale.

This is another one that was in ACTA. The issue was that in ACTA, they greatly expanded the definition of what counted as "commercial scale" such that it would certainly catch a ton of individuals who may have been infringing at a much smaller scale than anyone would actually consider "commercial."

Meaningful criminal procedures and penalties for camcording of movies.

This is another bogeyman that the MPAA has been overreacting to for over a decade. Despite the fact that the majority of infringing films these days leak out of the Hollywood studios and their partners directly, there are still some that are cammed in a theater. It's not a huge deal, as the quality of those tend not to be that good anyway. But, the MPAA acts as if this is a total affront to America and apple pie. And, again this leads to ridiculous situations like ICE being called in by the MPAA to interrogate a guy who happened to wear his Google Glass device into a movie theater. Really. There is no need to increase penalties here and it won't noticeably impact piracy in any way. It may lead to more felony charges for kids filming their friends at a movie theater birthday party, though.

Establish a notice-and-takedown system for copyright safe harbors for Internet service providers (ISPs) that provides protection for IP and predictability for legitimate technology enterprises who do not directly benefit from the infringement, consistent with United States law.

The "consistent with US law" part seems good -- but there is a very notable absence here. The fact sheet says absolutely nothing about user rights, such as fair use. Indeed it was a big deal six years ago when the USTR for the very first time agreed to include "fair use" and other user rights in a trade agreement (even if we had some concerns about the implementation). But, prior to that, all other agreements that included US style copyright requirements on other countries only exported the enforcement side, with none of the user rights. That was a huge problem, and it appears it is back again.

During meetings with the USTR over the past few days, multiple people have asked whether or not the agreement includes fair use and other rights along with the enforcement language, and the USTR has literally ignored the question multiple times. That's extremely worrisome.

Require full national treatment for copyright and related rights so United States creators are not deprived of rights in foreign markets that domestic creators receive.

This is a backdoor favor to the recording industry, which has spent years aggressively pushing for a performance rights bill, that would make radio and internet streaming sites pay even more to the labels. Other countries do have this, but many of those other countries then withhold that money from US artists since the US doesn't have such a law. The fact that the US recording industry remains so successful and the envy of the world certainly suggests that such a law is not necessary to incentivize the creation of music, but nonetheless it is still a key plank that the industry has been asking for.

This sentence in the fact sheet certainly suggests that it will be used to pressure Congress into passing a law to "harmonize" US law with Mexico (and Canada if they join in).

Provide strong patent protection for innovators by enshrining patentability standards and patent office best practices to ensure that United States innovators, including small- and medium-sized businesses, are able to protect their inventions with patents.

Include strong protection for pharmaceutical and agricultural innovators.

It's unclear what this would mean in practice, as we already have this, so I worry that there's something nefarious snuck into the language that would prevent other fixes that Congress has opposed to limit the damage of patent trolls and bad patents.

All in all, from what the USTR has revealed, this appears to be a massive handout to a few industries: the legacy ones which have been failing to innovate lately, at the expense of the public and the industries that have continued to innovate. We'll have the full text soon, but it's not looking good. For all of the promises of Donald Trump as the ultimate dealmaker who would drain the swamp, this looks like an extra swampy handout to some giant industries.

Filed Under: canada, copyright, enforcement, mexico, nafta

Yet Another Study Shows You Beat Piracy Through Innovation, Rather Than Enforcement

from the water-is-wet,-except-to-hollywood dept

Three years ago we released our Carrot or the Stick? paper, in which we explored piracy rates in a bunch of different countries, and looked at what appeared to be most effective in reducing piracy: greater legal enforcement or innovative new services. Time and time again our research highlighted how it was innovation -- in the form of user friendly licensed services (the user friendly part is important...) would lead to a noticeable reduction in piracy (sometimes in dramatic ways). On the other hand, increased legal enforcement appeared to have (if anything) only a temporary effect.

It appears that others are now exploring the same area, and doing quite an incredible job with it. A group of Dutch researchers at the Institute for Information Law at the University of Amsterdam have just released a Global Online Piracy Study that does an incredible job looking at the same questions with even more thorough data and analysis. They surveyed 35,000 people and looked at situations in 13 different countries (larger than our sample). The conclusions of the report appear notably similar to our own research, which is great to see (as it certainly helps to confirm what we found):

Still, despite the abundance of enforcement measures, their perceived effectiveness is uncertain. Therefore, it is questionable whether the answer to successfully tackling online copyright infringement lies in additional rights or enforcement measures, especially if these will not lead to additional revenue for copyright holders and risk coming into conflict with fundamental rights of users and intermediaries. Instead, it might be sensible to search for the answer to piracy elsewhere – in the provision of affordable and convenient legal access to copyright-protected content.

The report also found the following, suggesting that the trend that we saw clearly demonstrated back in 2015 has continued:

Between 2014 and 2017, the number of pirates decreased in all European countries except Germany.

As with our report that found enforcement actions had little to do with decreasing piracy rates, this report found similar things:

It might be tempting to argue that an increase in the use of certain enforcement measures against obviously illegal platforms has contributed to the decreasing number of pirates in Europe. However, a lack of evidence concerning the effectiveness of most enforcement measures and the strong link between piracy and the availability and affordability of content suggests otherwise: at a country level, online piracy correlates remarkably strongly with a lack of purchasing power. Higher per capita income coincides with a lower number of pirates per legal users.

Moreover, pirates and legal users are largely the same people: demographically, pirates resemble legal users quite closely, although on average they tend to be somewhat younger and more often male. More importantly, for each content type and country, 95% or more of pirates also consume content legally and their median legal consumption is typically twice that of non-pirating legal users.

That latter point has been shown in over a dozen studies previously, and it's incredible that it still needs to be repeated: pirates are often the best customers.

One interesting question might be why did Germany not see piracy decrease in the same manner as other countries. One reason might be that of the various countries studied, it already had one of the lowest piracy rates (29% of respondents claimed to have accessed some unauthorized content in the previous year). Only Japan was lower at 23%. So there's some argument that there may be a natural floor on this sort of thing, below which you can't go much lower. There are some other potential reasons hinted at within the report, including that the population of Germany is older than in most of those other countries, and it's one of the very rare cases of a country where physical sales of music still is ahead of digital sales. In short: there may be a lot of people in Germany who aren't that internet savvy.

Either way this is a really useful addition to the economic literature on this issue, suggesting (yet again) as we've argued for years, that focusing on greater enforcement has always been a huge waste of time, resources and money -- and comes at tremendous costs to free speech and innovation. Incredibly, that's likely been massively counterproductive to the goal of reducing piracy, since we need that innovation in licensed services to help reduce piracy. Of course, those who live in the world of the legacy industries have spent so many decades living and breathing the idea that enforcement is the only answer that I doubt this particular study will move the needle in convincing them to maybe start approaching things differently.

Filed Under: copyright, enforcement, infringement, innovation, piracy

ICANN's Pre-emptive Attack On The GDPR Thrown Out By Court In Germany

from the who-is-whois-for? dept

The EU's General Data Protection Regulation (GDPR) has only just started to be enforced, but it is already creating some seriously big waves in the online world, as Techdirt has reported. Most of those are playing out in obvious ways, such as Max Schrems's formal GDPR complaints against Google and Facebook over "forced consent" (pdf). That hardly came as a shock -- he's been flagging up the move on Twitter for some time. But there's another saga underway that may have escaped people's notice. It involves ICANN (Internet Corporation for Assigned Names and Numbers), which runs the Internet's namespace. Back in 2015, Mike memorably described the organization as "a total freaking mess", in an article about ICANN's "war against basic privacy". Given that history, it's perhaps no surprise that ICANN is having trouble coming to terms with the GDPR. The bone of contention is the information that is collected by the world's registrars for the Whois system, run by ICANN. EPAG, a Tucows-owned registrar based in Bonn, Germany, is concerned that this personal data might fall foul of the GDPR, and thus expose it to massive fines. As it wrote in a recent blog post:

We realized that the domain name registration process, as outlined in ICANN's 2013 Registrar Accreditation Agreement, not only required us to collect and share information we didn't need, it also required us to collect and share people's information where we may not have a legal basis to do so. What's more, it required us to process personal information belonging to people with whom we may not even have a direct relationship, namely the Admin and Tech contacts [for each domain name].

All of those activities are potentially illegal under the GDPR. EPAG therefore built a new domain registration system with "consent management processes", and a data flow "aligned with the GDPR's principles". ICANN was not happy with this minimalist approach, and sought an injunction in Germany in order to "preserve Whois data" -- that is, to force EPAG to collect those administrative and technical contacts. A post on the Internet Governance Project site explains why those extra Whois contacts matter, and what the real issue here is:

The filing by ICANN's Jones Day lawyers, which can be found here, asserts a far more sweeping purpose for Whois data, which is part of an attempt to make ICANN the facilitator of intellectual property enforcement on the Internet. "The technical contact and the administrative contact have important functions," the brief asserts. "Access to this data is required for the stable and secure operation of the domain name system, as well as a way to identify those customers that may be causing technical problems and legal issues with the domain names and/or their content."

As the tell-tale word "content" there reveals, the real reason ICANN requires registrars to collect technical and administrative contacts is because the copyright industry wants easy access to this information. It uses the personal details provided by Whois to chase the people behind sites that it alleges are offering unauthorized copies of copyright material. This is precisely the same ICANN overreach that Techdirt reported on back in 2015: the organization is supposed to be running the Internet's domain name system, not acting as a private copyright police force. The difference is that now the GDPR provides good legal and financial reasons to ignore ICANN's demands, as EPAG has noted.

In a surprisingly swift decision, the German court hearing ICANN's request for an injunction against EPAG has already turned it down:

the Court said that the collection of the domain name registrant data should suffice in order to safeguard against misuse the security aspects in connection with the domain name (such as criminal activity, infringement or security problems).

The Court reasoned that because it is possible for a registrant to provide the same data elements for the registrant as for the administrative and technical contacts, ICANN did not demonstrate that it is necessary to collect additional data elements for those contacts. The Court also noted that a registrant could consent and provide administrative and technical contact data at its discretion.

However, as ICANN rightly notes, that still leaves unanswered the key question: would collecting the administrative and technical contact information contravene the GDPR? ICANN says it is "continuing to pursue the ongoing discussions" with the EU on this, and a clarification of the legal situation here would certainly be in everyone's interests. But there is another important angle to this. As the security researcher Brian Krebs wrote on his blog back in February:

For my part, I can say without hesitation that few resources are as critical to what I do here at KrebsOnSecurity than the data available in the public WHOIS records. WHOIS records are incredibly useful signposts for tracking cybercrime, and they frequently allow KrebsOnSecurity to break important stories about the connections between and identities behind various cybercriminal operations and the individuals/networks actively supporting or enabling those activities. I also very often rely on WHOIS records to locate contact information for potential sources or cybercrime victims who may not yet be aware of their victimization.

There's no reason to doubt the importance of Whois information to Krebs's work. But the central issue is which is more important for society: protecting millions of people from spammers, scammers and copyright trolls by limiting the publicly-available Whois data, or making it easier for security researchers to track down online criminals by using that same Whois information? It's an important discussion that is likely to rage for some time, along with many others now being brought into sharper focus thanks to the arrival of the GDPR.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: copyright, domain registrars, enforcement, gdpr, germany, privacy, whois
Companies: epag, icann, tucows