Japanese Government Seeks To Circumvent Its Own Constitution To Censor 'Pirate' Sites

from the that's-not-how-constitutions-work dept

With site-blocking regimes now fully in vogue, far too many governments are getting in on this censorious party. In the cases of most governments, there is leeway in the overall legal structure to do this sort of thing, even if it is wholly unadvised and typically comes with disastrous results. But when Japan announced recently that it is considering site-blocking of so-called "pirate sites" in order to help its anime and manga industries, many familiar with Japanese federal law raised an eyebrow.

The country has no specific legislation that allows for site-blocking of any kind, let alone on copyright infringement grounds. In fact, the constitution expressly supports freedom of speech and expressly forbids censorship.

“Freedom of assembly and association as well as speech, press and all other forms of expression are guaranteed,” Article 21 reads. “No censorship shall be maintained, nor shall the secrecy of any means of communication be violated,” the constitution adds.

If you wanted a federal constitutional provision that almost perfectly inoculated against censorious site-blocking over something as relatively mundane as copyright infringement, this would appear to be it. The writers of the Japanese constitution clearly were concerned about government censorship and specifically prohibited it.

This has not stopped the government from trying to dip its toes in these waters, chiefly by pretending that copyright infringement is something that it isn't.

Mainichi reports that the government will argue there are grounds for “averting present danger”, a phrase that’s detailed in Article 37 of Japan’s Penal Code.

“An act unavoidably performed to avert a present danger to the life, body, liberty or property of oneself or any other person is not punishable only when the harmc produced by such act does not exceed the harm to be averted,” the Article (pdf)begins.

It’s fairly clear that this branch of Japanese law was never designed for use against pirate sites. Furthermore, there is also a clause noting that where an act (in this case blocking) causes excessive harm it may lead “to the punishment being reduced or may exculpate the offender in light of the circumstances.”

If Japan indeed goes down this route, it will be a complete mess at best and result in the eroding of its own constitution at worst. To combat copyright infringement. The very notion of this is insane. Creaking open the door for this kind of full site-blocking censorship, a door that will surely be burst through by every major and minor content producer in Japan and abroad, and subverting the nation's constitution in order to support one specific industry within the country that isn't hurting for money, make zero sense. The manga industry in Japan alone is a multi-billion dollar industry and it's growing. Whatever challenges it faces from copyright infringement, it's not existential in nature.

As of now, the government looks to be softening its approach to make this kinda-sorta voluntary by ISPs.

It appears that rather than forcing Internet providers into compliance, the government will ask for their “understanding” on the basis that damage is being done to the anime and manga industries. ISPs reportedly already cooperate to censor child abuse sites so it’s hoped a similar agreement can be reached on piracy.

Initially, the blocking requests will relate to just three as-yet-unnamed platforms, one local and two based outside the country. Of course, this is just the tip of the iceberg and if ISPs agree to block this trio, more demands are sure to follow.

This has been true in virtually every case where site-blocking has been introduced. It starts off as the mere exception before being strong-armed into the rule.

Don't do this, Japan. Don't torch your own constitution over a non-problem.

Filed Under: censorship, constitution, file sharing, free speech, infringement, japan, manga

The NSA's Weird Interest In File Sharing Programs

from the National-Sharing-Agency dept

Another large Snowden document dump from The Intercept uncovers many more off-brand uses of NSA surveillance tools. The pile of documents come from the NSA's "SID (Signals Intelligence Directorate) Today" files, of which there are apparently thousands of available pages. The documents released late last week show that if it happened online, the NSA was looking at it.

According to documents provided by NSA whistleblower Edward Snowden, the spy agency formed a research group dedicated to studying peer-to-peer, or P2P, internet traffic. NSA didn’t care about violations of copyright law, according to a 2005 article on one of the agency’s internal news sites, SIDtoday. It was trying to determine if it could find valuable intelligence by monitoring such activity.

But it appears the NSA found very little worth observing.

“By searching our collection databases, it is clear that many targets are using popular file sharing applications,” a researcher from NSA’s File-Sharing Analysis and Vulnerability Assessment Pod wrote in a SIDtoday article. “But if they are merely sharing the latest release of their favorite pop star, this traffic is of dubious value (no offense to Britney Spears intended).”

The info in the SID Today publication [PDF] is a bit dated, as it shows BitTorrent trailing applications like eDonkey and KaZaa. Even though it was mostly popular albums traversing the internet pipes, the NSA still formed a File-sharing Analysis and Vulnerability Assessment (FAVA) "pod" to poke away at the infrastructure and search the shared files for data of national security interest. To do this, it had to strip away the layers of protection lying between the NSA and the contents of the files.

As many of these applications, such as KaZaA for example, encrypt their traffic, we first had to decrypt the traffic before we could begin to parse the messages. We have developed the capability to decrypt and decode both KaZaA and eDonkey traffic to determine which files are being shared, and what queries are being performed.

Breaking the encryption allowed the NSA to peer into users' computers via their shared folders, as well as harvest email addresses, country codes, user names, and lists of recent searches.

Even so, there was little actual intelligence to be gathered from the most popular file sharing applications of a decade ago. But that laid the groundwork for further examination of file sharing for national security reasons. A program called GRIMPLATE tracked BitTorrent use by Defense Dept. employees, checking to see if any of the swarms travelling in and out of the DoD's safe spaces was "malicious" -- a definition that presumably covers DoD employee exfiltration of sensitive files as well as possibly-harmful programs being downloaded to DoD computers.

Over in the UK, GCHQ was taking much more proactive steps toward turning torrent traffic into both a weapon and a source of intel.

The page describes DIRTY RAT, a GCHQ web application used by analysts that at the time had “the capability to identify users sharing/downloading files of interest on the eMule (Kademlia) and BitTorrent networks. … For example, we can report on who (IP address and user ID) is sharing files with ‘jihad’ in the filename on eMule. If there is a new publication of an extremist magazine then we can report who is sharing that unique file on the eMule and BitTorrent networks.”

The RAT was also tasked with gathering info to be shared with law enforcement. Child porn is name-checked in the document, as are the London Metro Police and FBI. But GCHQ wasn't interested in merely collecting info on users sharing illicit content. It also wanted to use the sharing platforms for malware delivery.

A tool called PLAGUE RAT “has the capability to alter the search results of eMule and deliver tailored content to a target,” the wiki article states. “This capability has been tested successfully on the Internet against ourselves and testing against a real target is being pursued.”

File sharing hasn't gone away, so it's indisputable both agencies are still eyeballing BitTorrent traffic. Considering a number of exfiltrated docs/software have been shared via the service, there are probably files of national security interest circulating along with movies, music, and games.

Filed Under: copyright, encryption, file sharing, nsa, surveillance

First Look At UK Piracy Alert System: Mostly Benign, Except ISPs Are Requesting Filesharing Software Be Removed By Clients

from the why? dept

Earlier in the year, the public learned ISPs in the UK were partnering with the entertainment industries to send out "educational notices" to internet users suspected of copyright infringement. Having seen this type of "education" take many forms in the past, from silly to threatening, we have since waited to see what form this iteration would take. Well, TorrentFreak got in touch with someone who was notified through the system, and it appears this version is relatively benign.

The redacted sections are those that would identify the individual to whom it was sent, but you get an idea of the actual content in the notice. The links included in the notice are to the subscriber's ISP account, as well as one that takes you to the 'Get it Right Information Portal." It's at that portal that a subscriber will get more information on the suspected act of copyright infringement. While that information is fairly detailed, including such things as file sizes and types, the times and dates of the infringement, and the application used in the alleged infringement... the whole thing still relies on the faulty evidence of an IP address. That's problematic for reasons we've discussed to death here at Techdirt, but given the lack of any threatening language in any of this, it's still all fairly benign.

Which is why the individual TorrentFreak spoke with, who admits to committing the act in question, doesn't think the public will be all that impressed with this unsolicited "education."

“I don’t think [the warnings] will work, at least not on a big scale. Maybe they will educate some people who did it by mistake or did it just once but for someone like me there is no hope. But at least the campaign is not aggressive.”

The only thing in all of this that raised some eyebrows was that this notice came from Sky, the same ISP that has suggested that receivers of these notices will be forced to remove filesharing software to keep service from being interrupted.

“Your broadband service won’t be affected as a result of receiving this email alert,” Sky assures its subscribers, but it doesn’t stop there. “However, if you continue to share content illegally using your broadband connection, Sky will request that you take immediate steps to remove or disable any file sharing software that is being used to share copyrighted content illegally,” Sky writes.

So, putting all of this together makes this a little more troubling. ISPs will monitor your connection at the behest of private industry, will notify you that they're doing so, and only promise to serve you as their customer if you agree to remove software with all kinds of legitimate uses... and all of this is still based on the concept that an IP address is useful as an identifier for an infringer. When taken in total context, it's easy to see how this foot-in-the door, benign "education" could transition to ISPs mandating control of the public's software rollouts to get service. And that's not benign at all.

Filed Under: alerts, copyright, file sharing, file sharing software, infringement, uk

Court Stays FTC's LabMD Injunction; No Deterrent In Punishing A Company It Helped Kill

from the killing-a-horse-just-to-beat-it dept

Despite turning LabMD into a stone -- based on some suspect data breach allegations by a data protection company engaged in shady sales tactics -- the FTC is still seeking to extract as much blood as possible. Thanks to the FTC's ongoing efforts against LabMD, the company has been closed, has less than $5000 to its name, and is fighting back against the commission with pro bono help.

The FTC wants to punish LabMD for a patient file that ended up file sharing services thanks to an employee's use of Limewire at work. (The file was in folder that end up being "shared" by default Limewire settings [My Documents].) Tiversa, a company that prowled file sharing services for sensitive documents in hopes of leveraging these into data security contracts, took this info to the FTC when LabMD refused to purchase its offerings.

Since that point, the FTC has bankrupted LabMD by forcing it to defend itself against a supposed breach that never resulted in the misuse of patient data. Tiversa has seen its own fortunes diminish, culminating in an FBI raid of its offices in March of this year.

The FTC overturned an Administrative Law Judge's (ALJ) decision in July, giving itself permission to restore its charges against LabMD for the breach -- ones the ALJ had dismissed. The FTC claims LabMD "left" the mistakenly-shared file out somewhere in the internet, as if the company actually had any way to "retrieve" it once it had been uploaded.

Seemingly unconcerned that LabMD is now a defunct company, the FTC still wants it to implement a series of expensive steps to ensure the data it won't be collecting in the future is better protected.

Having found that LabMD violated the FTC Act, the Commission’s Final Order will ensure that LabMD reasonably protects the security and confidentiality of the personal consumer information in its possession by requiring LabMD to establish a comprehensive information security program. It also requires LabMD to obtain periodic independent, third-party assessments regarding the implementation of the information security program, and to notify those consumers whose personal information was exposed on the P2P network about the unauthorized disclosure of their personal information and about how they can protect themselves from identity theft or related harms.

LabMD has asked for a stay of this injunction pending its appeal. That stay has been granted by the Eleventh Circuit Appeals Court. (via the Office of Inadequate Security)

The appeals court points out [PDF] several things about the stay the FTC is contesting, not the least of which is the company's inability to actually follow the injunction if granted, much less have any reason to do so, given its current situation.

The costs of complying with the FTC’s Order would cause LabMD irreparable harm in light of its current financial situation. [...] The costs associated with these measures are hotly debated by the parties. LabMD says the costs will exceed $250,000. The FTC does not offer its own estimate, but disputes the $250,000 figure. Regardless, it is clear that the postage for the notice requirements alone would be more than $4,000. Certainly the costs of all the other measures would add to that amount.

LabMD is no longer an operational business. It has no personnel and no revenue. It now has less than $5,000 cash on hand. It reported a loss of $310,243 last fiscal year, and has a pending $1 million judgment against it on account of its early termination of its lease. LabMD cannot even afford legal representation, and is relying on pro bono services for this appeal.

Given the company's financial ruin, the injunction would serve no possible deterrent purpose. There's nothing left to destroy and, unfortunately, nothing to be gained by LabMD, even if it ultimately prevails.

Ordinary compliance costs are typically insufficient to render harm irreparable. But given LabMD’s bleak outlook, the costs of compliance pending appeal would constitute an irreparable harm. This is especially so because if LabMD is ultimately successful on appeal, the costs would not be recoverable in light of the FTC’s sovereign immunity.

Furthermore, the court feels there's absolutely no risk to the further exposure of patients' data, even with the file still supposedly in the wild. The company has its own copy, residing on a computer that is never connected to the internet. If a customer requests data, LabMD hooks it up to printer and mails or faxes them a hard copy.

As for the FTC's claim that a file that has been in the wild since 2005 would result in future breaches of patient confidentiality, the court is rather skeptical.

For those patients whose personal information was in the 1718 file, there is no evidence of a current risk to them. Specifically, there is no evidence that any consumer ever for nefarious purposes before this appeal terminates. suffered any tangible harm, or that anyone other than Tiversa, LabMD, or the FTC has seen the 1718 file. Although the FTC’s Order denying LabMD’s stay application says there remains a potential risk of harm to consumers whose information was in this file, we think it improbable that a party downloaded this information now years ago, has not used it for several years, but may yet use it for nefarious reasons before this appeal terminates.

Finally, the court has a few choice words for the FTC's dictionary attack -- used to shore up its weak claims of future harm from the escaped file.

[I]t is not clear that the FTC reasonably interpreted “likely to cause” as that term is used in § 45(n). The FTC held that “likely to cause” does not mean “probable.” Instead, it interpreted “likely to cause” to mean “significant risk,” explaining that “a practice may be unfair if the magnitude of the potential injury is large, even if likelihood of the injury occurring is low.” The FTC looked to different dictionaries and found different definitions of “likely.” It is through this approach that it argues its construction is correct, considering the statute’s context as a whole.

Even respecting this process, our reading of the same dictionaries leads us to a different result. The FTC looked to dictionary definitions that say “likely” means “probable” or “reasonably expected.”Reliance on these dictionaries can reasonably allow the FTC to reject the meaning of “likely” advocated by LabMD, that is, a “high probability of occurring.” However, we read both “probable” and “reasonably expected,” to require a higher threshold than that set by the FTC. In other words, we do not read the word “likely” to include something that has a low likelihood. We do not believe an interpretation that does this is reasonable.

The sick thing is that even if LabMD ultimately prevails, it won't matter. It cannot recover any of its expenses and the company has been gutted by its fight against the FTC. That the whole situation appears to have stemmed from a data protection company's shady sales pitch is even worse. Tiversa not only was uncooperative during the FTC's investigation of LabMD, but it has also drawn the attention of the House Oversight Committee, which was unimpressed by the Tiversa's tactics both before and after the FTC's investigation of LabMD.

Filed Under: court, data breach, file sharing, ftc, injunction
Companies: labmd, tiversa

Angolans Turning Zero-Rated Wikipedia, Facebook Into Ad Hoc File Sharing Services

from the internet-users-continue-to-be-amazing dept

Zero-rating -- the nifty trick companies use to edge around net neutrality rules -- is being offered to developing countries as a way to provide cheap internet access to their citizens. There's a bit of altruism in the offerings, but there's also a lot of walls surrounding gardens. Facebook's "Free Basics" is a zero-rated platform that functions like a twenty-first century AOL, funneling users into Facebook's version of the internet.

Wikipedia is similarly offering zero-rated access to countries with limited internet options. It -- along with Facebook -- has partnered with a local telecom to give Angolans access to data without having to pay provider rates for it. This includes its associated properties, like its Wikimedia Commons.

Angolans have taken to this pair of walled gardens and, ingeniously, turned them into an ad hoc zero-rated Pirate Bay, as Motherboard's Jason Koebler reports.

Enterprising Angolans have used two free services—Facebook Free Basics and Wikipedia Zero—to share pirated movies, music, television shows, anime, and games on Wikipedia. And no one knows what to do about it.

Because the data is completely free, Angolans are hiding large files in Wikipedia articles on the Portuguese Wikipedia site (Angola is a former Portuguese colony)—sometimes concealing movies in JPEG or PDF files. They’re then using a Facebook group to direct people to those files, creating a robust, completely free file sharing network. A description for a Facebook group with 2,700 members reads: “created with the objective of sharing music, movies, pictures, and ANIMES via Wikimedia.”

One possible solution is no solution at all: pulling the services from Angola. No one wants to look like they're depriving impoverished citizens of what's likely their only access to the internet. On the other hand, neither entity is too thrilled to be hosting possibly infringing material. Another solution is also no solution at all: playing whack-a-mole with content and new Wikipedia/Facebook accounts.

The third solution, though, is even worse. As Koebler explains, this proposed solution is predicated on some terrible assumptions about how people must behave to "earn" internet access privileges.

Many on the listserv are framing Angola’s Wikipedia pirates as bad actors who need to be dealt with in some way so that more responsible editors aren’t punished for their actions. This line of thinking inherently assumes that what Angola’s pirates are doing is bad for Wikipedia and that they must be assimilated to the already regulated norms of Wikipedia’s community. If the developing world wants to use our internet, they must play by our rules, the thinking goes.

Playing by the rules -- which basically means curbing infringement to appease rights holders -- may be a bad thing for Angolans in the long run, even if it seems like a plausible short-term solution. The "loopholes" in these zero-rated services aren't limited to spreading pirated content. They could also serve as handy tools for activism and dissent.

Angolan's pirates are learning how to organize online, they're learning how to cover their tracks, they are learning how to direct people toward information and how to hide and share files. Many of these skills are the same ones that would come in handy for a dissident or a protester or an activist. Considering that Angola has had an autocratic leader in power for more than 35 years, well, those are skills that might come in handy one day.

Shutting down dubious uses of the services will only result in greater local control of internet access, which is the last thing the country needs. The fact that people are using a service in ways it was never intended to be used is a feature, not a bug. Erecting walls only encourages people to find ways to route around them. These are important communication tools that democratizes Angolan internet access. (To a certain extent -- citizens with funds to pay for data charges will get the "real" internet, rather than the Facebook/Wikipedia version.). And this little bit of access -- no matter how controlled and contained -- is indisputably better than nothing at all. Further limiting this use will do more damage to those using this limited access to escape government control than it will to the file sharers so aptly illustrating how futile the "walled garden" concept actually is.

Filed Under: angola, copyright, file sharing, net neutrality, zero rating
Companies: facebook, wikipedia

MPAA Whacs A Few More Moles, Declares Premature Victory While Making Movie Fans Worse Off

from the good-luck-with-that-strategy dept

The MPAA gleefully announced on Tuesday that it had shut down the main fork of Popcorn Time along with torrent site YTS (and its associated release group YIFY). Of course, if we go back through the history of file sharing, we can find plenty of times when the MPAA similarly declared victory over the shutdown of other file sharing sites -- and not a single one did a damn thing to slow down piracy rates. People just move on to something else. And yet, the MPAA thinks that it did something important here:

“This coordinated legal action is part of a larger comprehensive approach being taken by the MPAA and its international affiliates to combat content theft,” said Chris Dodd, chairman and chief executive of the MPAA, in a statement.

Dodd also says, "By shutting down these illegal commercial enterprises, which operate on a massive global scale, we are protecting not only our members’ creative work and the hundreds of innovative, legal digital distribution platforms, but also the millions of people whose jobs depend on a vibrant motion picture and television industry.”

Dodd is wrong. He's not protecting anything, other than perhaps his own job. Shutting down these sites doesn't decrease infringement -- the infringement just moves elsewhere. It's a giant game of whac-a-mole that the MPAA (and RIAA) have been playing for over a decade, and never seeing any kind of different result.

We highlighted this just last month with our Carrot or Stick research report, which made it clear that these enforcement efforts don't do a damn thing to slow down piracy, and don't do anything to help content creators or the wider creative ecosystem to get paid. You know what does do that? Allowing more innovation to flow. Popcorn Time was popular not just because it was "free" but because the interface and usability were incredible. The MPAA should be learning from that, in understanding how to help offer better products rather than celebrating shutting it down.

Again and again we've seen that when people are presented with good, convenient and reasonably priced options, they massively decrease their infringing activities. But the MPAA has actually made that difficult by burdening most services with ridiculous requirements (like forcing people to watch a movie within 24 hours, or limiting things so that the market becomes fragmented and people can't find the content they actually want to see). If the MPAA were truly concerned with making sure that revenue was supporting the creative ecosystem it would be looking at what Popcorn Time did right, and creating a legal service based on it. Cheering on the fact that you whac'd another mole, while everyone's already moved on to something else is hardly something worth celebrating.

Filed Under: copyright, enforcement, file sharing, innovation, popcorn time, takedowns, yify, yts
Companies: mpaa

Torrent Madness: UK Cybercrime Official Argues That File Sharing Is A Gateway Drug To Crime

from the moral-panic-du-jour dept

Perhaps it's time to make an update to Reefer Madness, entitled Torrent Madness. A totally out of touch and clueless -- but powerful -- UK official, Andy Archibald, who somehow is the deputy director of the National Cyber Crime Unit at the National Crime Agency, is going around spouting nonsense about how file sharing is some sort of "gateway" into more crimes for young people today (found via Ars Technica):

"If you think about the illegal downloading of music, of videos and DVDs, I think that practice is more common than we might imagine within the youth of today.

"That's criminality.

"It's almost become acceptable.

"That's the first stages, I believe, of a gateway into the dark side."

Considering how many people engage in file sharing, if it actually were a "gateway" into further criminal activity, you'd think we'd be in the midst of an incredible crime wave. And yet, here are the stats straight from the UK government: Obviously, correlation is not causation and yada yada, but doesn't that look like crime rates peaked just as file sharing really started taking off? If it were truly acting as a gateway to more crime, wouldn't that be showing up in the data somewhere?

But, no, good old Andy Archibald isn't troubled by the data. He knows that these evil hacker types are all showing up because of that no good file sharing:

"There are many of our young people, and not only young people, who are becoming highly skilled and capable in a digital environment," he said.

"It's important that they put those skills to good use and are not tempted to become involved, unwittingly in cyber criminality.

"They are members of forums and are exchanging ideas in a marketplace that criminals are looking (at).

"They are looking for people with technical skills who can compliment their criminal business.

"They are looking to recruit those people.

"They try to induce and manipulate them."

Yup. We've moved past the "child predators are grooming your kids" moral panic, into the "evil cybercriminals are grooming those file sharers" moral panic.

And, of course, it's all happening in that scary, scary place known as the "dark web" (boo!)

"When I joined policing ... you had drug trafficking, organised immigration crime, firearms trafficking, you knew where to go to sell stolen property, you knew where to go to hire a hit man, frankly.

"Actually, we could control that and we managed that by covert policing, overt policing and an infrastructure around it.

"All of those things I've just described are now happening in a digital environment in what is loosely termed the dark web.

"On the dark web we have criminals operating there, trading guns, trading drugs.

"That is where the illegal commodities are being traded."

But, he insists, the police don't want mass surveillance. They want "A narrative... that reassures the public." Funny, then, that it appears most of his speech was a bunch of nonsense designed to scare the public, huh?

Filed Under: andy archibald, crime, cybercrime, file sharing, gateway, uk

Spying On Sharing: Canada's Intelligence Agency Collecting Data And IP Addresses From Free File-Sharing Sites

from the more-sharing-going-on-than-previously-imagined dept

If it can be accessed with minimal effort, it's safe to say one government or another is looking at it. Here in the US, phone records, license plate data, cell site location information and any number of communications traveling across international internet backbones are all fair game for the world's law enforcement and intelligence agencies.

In the first document from Snowden's stash to detail the spying efforts of our ever-polite and apologetic neighbor to the north, it's file sharers who are under the microscope mass surveillance macroscope.

The covert operation, revealed Wednesday by CBC News in collaboration with The Intercept, taps into Internet cables and analyzes records of up to 15 million downloads daily from popular websites commonly used to share videos, photographs, music, and other files…

According to the documents, the LEVITATION program can monitor downloads in several countries across Europe, the Middle East, North Africa, and North America. It is led by the Communications Security Establishment, or CSE, Canada’s equivalent of the NSA.

The CSE is keeping tabs on (at least) 102 file-sharing sites (and likely eyeing traffic on BitTorrent networks), but only three are listed in the leaked document: SendSpace, RapidShare and the now-dead MegaUpload. In a statement given to The Intercept, SendSpace said that “no organization has the ability/permission to trawl/search Sendspace for data.” Not that SendSpace's permission (or promises to its users about data security) ultimately matters.

LEVITATION does not rely on cooperation from any of the file-sharing companies. A separate secret CSE operation codenamed ATOMIC BANJO obtains the data directly from internet cables that it has tapped into, and the agency then sifts out the unique IP address of each computer that downloaded files from the targeted websites.

The documents (dated 2012) say the agency is only looking for about "2,200 documents" related to terrorists and terrorist activity. From the piles of data amassed, the agency begins its straightforward-as-a-patent-thicket sorting process…


…which at least attempts to sort out the TV episodes from the hostage videos.


The agency then uses the captured IP addresses as selectors to trace activity across the web. The slides show that it has had success linking downloads of targeted files to Facebook accounts and Google profile pages by using two intelligence tools created by outside agencies: MARINA Profile and MUTANT BROTH. NSA-developed MARINA harvests a vast amount of internet activity and GCHQ's MUTANT BROTH intercepts "billions" of ad cookies to help correlate IP addresses.

But, while the agency says it's only tracking ~2,200 files (leading to 350 "interesting" downloads per month), there's nothing in the document (other than the filtering out of unwanted files) that suggests the harvested file-sharing activity isn't stored in bulk. And, like many other spy programs, it bypasses safeguards these sites have implemented and grabs data straight from the backbone.

It's safe to say that no major file-sharing service is able to protect its users' data. Even the promise that this information will only be turned over to law enforcement/intelligence services who present the proper legal paperwork is hollow -- if unintentionally so. The document notes that the agency "sees" about 10-15 million FFUs (Free File Uploads) per day, but fails to provide any clarification as to what that word entails. If "sees" means "collects," then the agency has access to millions of non-relevant IP addresses and uploads. If "sees" means "disregards non-'interesting' uploads/downloads," then the effort is more focused than most of its counterparts' surveillance programs.

On top of that, there's nothing included here that indicates the program has usefulness beyond harvesting data for data-harvesting's sake.

It is unclear from the document whether LEVITATION has ever prevented any terrorist attacks. The agency cites only two successes of the program in the 2012 presentation: the discovery of a hostage video through a previously unknown target, and an uploaded document that contained the hostage strategy of a terrorist organization. The hostage in the discovered video was ultimately killed, according to public reports.

When defended, the CSE will probably note that this is part of a suite of tools designed to gather as much information as possible on suspected terrorists. But it has been shown that massive amounts of data makes terrorist hunting harder, rather than easier. And while there is at least some form of targeting built into the system, there's always the potential for abuse. CSE says it won't spy on its own citizens but this statement is undercut by its vast collection effort. It can't have it both ways, especially if it's gathering data directly from backbones. It could be anybody's data, but the agency won't know whose it is until it's looked at it.

Filed Under: canada, copyright, cse, file sharing, five eyes, nsa, surveillance, terrorism
Companies: megaupload, rapidshare, sendspace

Sony Hack Reveals That MPAA's Big '$80 Million' Settlement With Hotfile Was A Lie

from the of-course-it-was dept

For years, we've pointed out that the giant "settlements" that the MPAA likes to announce with companies it declares illegal are little more than Hollywood-style fabrications. Cases are closed with big press releases throwing around huge settlement numbers, knowing full well that the sites in question don't have anywhere near that kind of money available. At the end of 2013, it got two of these, with IsoHunt agreeing to 'pay' $110 million and Hotfile agreeing to 'pay' $80 million. In both cases, we noted that there was no chance that those sums would ever get paid. And now, thanks to the Sony hack, we at least know the details of the Hotfile settlement. TorrentFreak has been combing through the emails and found that the Hotfile settlement was really just for $4 million, and the $80 million was just a bogus number agreed to for the sake of a press release that the MPAA could use to intimidate others.

“The studios and Hotfile have reached agreement on settlement, a week before trial was to start. Hotfile has agreed to pay us $4 million, and has entered into a stipulation to have an $80 million judgment entered and the website shut down,” the email from Sony’s SVP Legal reads.

Considering the time and effort that went into the case, it would be no surprise if the movie studios actually lost money on the lawsuit.

The good news for the MPAA is that the money was paid in full. There were some doubts if Hotfile would indeed pay up, but during the first weeks of December last year the $4 million was sent in three separate payments.

Of course, all of this is just for show. You can safely assume that none of the much lower $4 million went back to any content creators. Instead, it's likely it got plowed back into the MPAA's vast "anti-piracy" machine, allowing it to be used for other lawsuits and funding investigations by state Attorneys General.

Still, is it any surprise that the industry famous both for its fictional "Hollywood Endings" and "Hollywood Accounting" where a hit movie like one of the Harry Potter films can bring in nearly a billion dollars, but still have a "loss" for accounting purposes, would create a made-up scenario in which everyone pretends many tens of millions of dollars are paid due to "infringement"?

Filed Under: copyright, file sharing, settlements, sony hack
Companies: hotfile, mpaa

Hollywood Studios Tried To Add File Sharing Sites To New Zealand's Child Porn Blacklist

from the the-audacity-of-egotistical-self-interest dept

We just wrote about the UK's filtering systems blocking access to 20% of the world's top 100,000 sites, even though only about 4% of those host the porn Prime Minister David Cameron seems so obsessed with blocking. Also noted in that story was the fact that many "pirate sites" are being blocked at ISP level via secret court orders.

MPAA head Chris Dodd absolutely loves web filters, proclaiming them to be the best tool the industry can (ab)use to thwart piracy.

Speaking recently at the IP Summit in London, Former Senator turned MPAA boss Chris Dodd pronounced his love for forcing ISPs to block and filter websites accused of aiding copyright infringement. Despite the fact filters can be easily bypassed by anyone with a modicum of technical knowledge and often filter legitimate content (a report this week suggests a massive swath of legitimate websites are blocked by UK filters), Dodd believes filters are the "most effective tools anywhere in the world" at fighting piracy.

It appears the studios agree as well, going so far as to attempt to equate the act of piracy with the act of distributing child porn.

The UK’s Internet Watch Foundation (IWF) maintains a blocklist of URLs that point to sexual child abuse and criminally obscene adult content. Over in New Zealand the Department of Internal Affairs maintains DCEFS, the Digital Child Exploitation Filtering System. Both are run in cooperation with the countries’ ISPs with the sole aim of keeping the most objectionable material away from public eyes…

According to a RadioLIVE report, in order to prevent copyright infringement the studios requested access to the DCEFS child abuse filtering system.

After obtaining government permission, Hollywood hoped to add their own list of sites to DCEFS so that by default subscribers to New Zealand’s main ISPs would be prohibited from accessing torrent and other file-sharing type sites.

So, in hopes of protecting their business model, studios tried to add file sharing sites to a list of child pornography sites. Not one of them seemed to realize how wrong it was to equate their companies' profitability with the sexual abuse of children. Whatever level of entitlement these companies have risen to in the past, they've vastly exceeded it with this maneuver. Studios may secretly believe copyright infringement is (very subjectively) as damaging as child pornography, but they've never made it this explicitly clear.

Fortunately, ISPs and the Kiwi government pushed back, unwilling to be complicit in the studios' most insensitive act of self-preservation yet. Unfortunately for Dodd and his charges, the studios will have to make do with secret court orders and default web filters that still allow end users to flip the "hide file sharing sites" switch to "off."

The studios believe they should have root access to government-ordained web blocking. In the interest of not making the situation worse than it already is, this should never be granted. Various governments have already included protection for the copyright industries in some of their web-targeted "for the children" legislation. Giving studios the go-ahead to tamper with child porn blacklists would just stretch the definition of "children" to include major Hollywood studios -- entities full of full-grown adults with enough power and money to protect them from anything.

Filed Under: censorship, child porn, chris dodd, copyright, file sharing, filters, new zealand