New French Mandate Will Use Facial Recognition App To Create 'Secure Digital IDs'

from the downloadable-panopticon-portal dept

Facial recognition tech is considered at least mildly controversial in the United States. Certain federal agencies (like the DHS) are pushing for widespread deployment even as Congress members are raising questions about the tech's accuracy and reliability. Meanwhile, facial recognition bans are being introduced and enacted at the city and state level, showing there's no nationwide consensus that the tech is trustworthy, useful, or non-invasive.

Citizens and privacy groups have similar concerns in France, but the French government apparently doesn't care. In the name of "security," the government is adding facial recognition tech to its national ID program, as Helene Fouquet reports for Bloomberg.

France is poised to become the first European country to use facial recognition technology to give citizens a secure digital identity -- whether they want it or not.

Saying it wants to make the state more efficient, President Emmanuel Macron’s government is pushing through plans to roll out an ID program, dubbed Alicem, in November, earlier than an initial Christmas target.

This move by the Interior Ministry is already being challenged in court by privacy group La Quadrature du Net. Unfortunately, this challenge isn't preventing the rollout of the French government's Android app, which will be the only way for residents to create a digital ID that can be used to access government services.

An ID will be created through a one-time enrollment that works by comparing a user’s photo in their biometric passport to a selfie video taken on the app that will capture expressions, movements and angles. The phone and the passport will communicate through their embedded chips.

Because this digital ID is a mandatory possession, opponents have pointed out it violates consensual data collection provisions put in force by the GDPR. But that's far from the only problem. Facial recognition tech still doesn't work as well as its proponents claim, which is going to result in residents either being unable to create an ID the government will accept or possibly find themselves accused of ID fraud if the government side of the tech thinks they're someone else.

And then there's the security of the program itself. It's supposed to make French citizens more "secure," but the government hasn't impressed anyone with its claims of "highest, state level" security. Its own encrypted messaging platform was compromised in less than two hours by a security researcher, allowing the researcher to create accounts at will and harvest sensitive data from existing accounts. A bug bounty was rolled out shortly after that. There has been no offer of a bug bounty or any invitation to stress test the "state level" security of the government's latest app -- one that will be used by roughly 100% of the country's residents.

Potential damage will be mitigated by the catch-and-release nature of the data collection. Once an ID is created, the government will apparently delete the data it has collected and everything stored locally by the app on the user's device will vanish after the enrollment is complete and the app has been deleted. But some data is still being stored somewhere so citizens can use their new digital IDs to access government services, although the government insists biometric info from Alicem won't make its way to other government databases.

Even if everything the government claims is true, this rollout -- one that occurred without public comment and does not give residents any way to opt out -- will make it easier for the government to introduce more intrusive facial recognition programs. If this digital ID program runs smoothly and does what's advertised, it will lower resistance to government use of biometric scanning and tracking in the future. After all, if something worked well once during a minimal, controlled rollout, it might work again when there's more at stake and fewer controls on collection and retention of biometric info. Surveillance creep is still a thing. And it always has a starting point few people find objectionable.

Filed Under: facial recognition, france, id, privacy, secure digital ids

Indian Supreme Court Rules Aadhaar Does Not Violate Privacy Rights, But Places Limits On Its Use

from the mixed-result dept

Techdirt wrote recently about what seems to be yet another problem with India's massive Aadhaar biometric identity system. Alongside these specific security issues, there is the larger question of whether Aadhaar as a whole is a violation of Indian citizens' fundamental privacy rights. That question was made all the more pertinent in the light of the country's Supreme Court ruling last year that "Privacy is the constitutional core of human dignity." It led many to hope that the same court would strike down Aadhaar completely following constitutional challenges to the project. However, in a mixed result for both privacy organizations and Aadhaar proponents, India's Supreme Court has handed down a judgment that the identity system does not fundamentally violate privacy rights, but that its use must be strictly circumscribed. As The New York Times explains:

The five-judge panel limited the use of the program, called Aadhaar, to the distribution of certain benefits. It struck down the government's use of the system for unrelated issues like identifying students taking school exams. The court also said that private companies like banks and cellphone providers could not require users to prove their identities with Aadhaar.

The majority opinion of the court said that an Indian's Aadhaar identity was unique and "unparalleled" and empowered marginalized people, such as those who are illiterate.

The decision affects everything from government welfare programs, such as food aid and pensions, to private businesses, which have used the digital ID as a fast, efficient way to verify customers' identities. Some states, such as Andhra Pradesh, had also planned to integrate the ID system into far-reaching surveillance programs, raising the specter of widespread government spying.

In essence, the Supreme Court seems to have felt that although Aadhaar's problems were undeniable, its advantages, particularly for India's poorest citizens, outweighed those concerns. However, its ruling also sought to limit function creep by stipulating that Aadhaar's compulsory use had to be restricted to the original aim of distributing government benefits. Although that seems a reasonable compromise, it may not be quite as clear-cut as it seems. The Guardian writes that it still may be possible to use Aadhaar for commercial purposes:

Sharad Sharma, the co-founder of a Bangalore-based technology think tank which has worked closely with Aadhaar's administrators, said Wednesday's judgment did not totally eliminate that vision for the future of the scheme, but that private use of Aadhaar details would now need to be voluntary.

"Nothing has been said [by the court] about voluntary usage and nothing has been said about regulating bodies mandating it for services," Sharma said. "So access to private parties for voluntary use is permitted."

That looks to be a potentially large loophole in the Supreme Court's attempt to keep the benefits of Aadhaar while stopping it turning into a compulsory identity system for accessing all government and business services. No doubt in the coming years we will see companies exploring just how far they can go in demanding a "voluntary" use of Aadhaar, as well as legal action by privacy advocates trying to stop them from doing so.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, biometric, id, identification, india, privacy

Tunisia's Plans To Bring In Its Own National 'Aadhaar' Biometric ID System Halted -- For Now

from the peace-be-with-you dept

The last time that Techdirt wrote about Tunisia was back in 2011, when the Internet helped bring about a major regime change there. Although violent protests against the government have flared up recently, in general, the processes that are being applied to shift national policies in Tunisia are both peaceful and successful. Here, for example, is some good news from Access Now on the privacy front:

This week the people of Tunisia won a major victory for privacy: the dangerous biometric ID card proposal has officially been withdrawn from consideration in the Assembly of the Representatives of the People (ARP).

We worked hard with our partners at Al Bawsala to oppose passage of the bill, including encouraging members of the assembly to adopt a set of key amendments to ensure that if it did pass, the bill would protect citizens' data and their right to consult and rectify their own information. Over the past week, we spent hours talking to assembly members, highlighting the dangers of pushing the bill through without adding necessary and vital protections for Tunisians' privacy and data security.

It worked! The assembly members advanced the amendments that we proposed, and nearly all were adopted within the Consensus Commission. The Ministry of the Interior, which had pushed hard to pass the bill without these important safeguards, dropped the proposal entirely.

That's particularly welcome at a time when the problems of India's biometric ID card system "Aadhaar" are becoming all-too clear. However, as Access Now rightly notes:

Even though we're overjoyed, we must remain vigilant. We could see this proposal revived. If that happens, we will continue working to ensure that any new legislation protects human rights.

Let's hope Tunisia's democratic legislative processes continue to function as effectively as they have in this particular case, and that the country does not end up with another Aadhaar.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: biometrics, id, identity, privacy, tunisia

Want Anybody's Personal Details From Aadhaar, India's Billion-Person Identity Database? Yours For $8

from the Aadhaar-admin-accounts-also-available-on-request dept

We've been writing about the world's largest biometric database, India's Aadhaar, since July 2015. Over 1.1 billion people have now been enrolled, and assigned an Aadhaar number and card, which represents 99.9% of India's adult population. There are currently around 40 million authentications every day, a number that will rise as Aadhaar becomes inescapable for every aspect of daily life in India, assuming it survives legal challenges. That scale necessarily entails a huge infrastructure to handle enrollment and authentication. So it will comes as no surprise to Techdirt readers that it turns out you can obtain unauthorized access to the Aadhaar system very easily, and for very little cost. As the Indian newspaper The Tribune revealed:

It took just Rs 500 [about $8], paid through Paytm [an Indian online payment system], and 10 minutes in which an "agent" of the group running the racket created a "gateway" for this correspondent and gave a login ID and password. Lo and behold, you could enter any Aadhaar number in the portal, and instantly get all particulars that an individual may have submitted to the UIDAI (Unique Identification Authority of India), including name, address, postal code (PIN), photo, phone number and email.

What is more, The Tribune team paid another Rs 300 [$4.75], for which the agent provided "software" that could facilitate the printing of the Aadhaar card after entering the Aadhaar number of any individual.

Given the repeated assurances by the UIDAI that the Aadhaar database was completely secure, this is big news, and led to some breathless damage limitation by the Indian authorities on Twitter. The UIDAI explained that: "Some persons have misused demographic search facility, given to designated officials to help residents who have lost Aadhaar/Enrollment slip to retrieve their details"; and: "There has not been any data breach of biometric database which remains fully safe & secure with highest encryption at UIDAI and mere display of demographic info cannot be misused without biometric". Although it may be true that this is not a biometric data breach, it nonetheless reveals a serious vulnerability in the system's design, and on a vast scale. According to the original article in The Tribune, more than 100,000 "village-level enterprise operators", hired to help with Aadhaar enrollment, have been offering this kind of unauthorized access to the database. In fact, the problem seems to be even more serious than simply providing login credentials to thousands of people. Here's what another Indian site discovered:

Following up on an investigation by The Tribune, The Quint found that completely random people like you and me, with no official credentials, can access and become admins of the official Aadhaar database (with names, mobile numbers, addresses of every Indian linked to the UIDAI scheme). But that's not even the worst part. Once you are an admin, you can make ANYONE YOU CHOOSE an admin of the portal. You could be an Indian, you could be a foreign national, none of it matters -- the Aadhaar database won't ask.

Even if biometric data is not involved, it's hard to see how UIDAI could claim that these aren't breaches of the database, or deny that the entire Aadhaar system is seriously compromised. It's almost inevitable that the security of an important database system will be defeated eventually in some way, since the rewards are by definition so high. The fundamental problem with Aadhaar is its underlying intent -- to create a single, giant database with key personal information about a billion people that can be accessed very frequently and very widely. That's never going to be safe, as the inevitable future breaches will confirm.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, database, hacked, id, identity, india, privacy

When A Fingerprint IS The Password, Where Does The Fifth Amendment Come Into Play?

from the a-non-testimonial-appendage? dept

FBI Director James Comey is still complaining about encryption but it doesn't seem to be preventing law enforcement from accessing devices. To date, law enforcement has paid hackers to break into a phone, had an iPhone owner suddenly "remember" his password, seen a person jailed for 7 months (so far) for refusing to provide a password and, now, a law enforcement agency has used a warrant to force a suspect to unlock an iPhone using a fingerprint.

[A]uthorities obtained a search warrant compelling the girlfriend of an alleged Armenian gang member to press her finger against an iPhone that had been seized from a Glendale home. The phone contained Apple's fingerprint identification system for unlocking, and prosecutors wanted access to the data inside it.

The mostly-unanswered question is whether this violates the Fifth Amendment by forcing a person to provide evidence against themselves. (Not that due process was at the forefront of law enforcement's mind in this case. Or the magistrate judge's either. Jonathan Zdziarski points out the warrant was obtained within 45 minutes of the suspect being arrested -- not even enough time to bring in a lawyer.) While the law allows police to collect data from detained individuals -- including fingerprints -- it doesn't say much about physically applying someone's finger to their phone to unlock its contents.

The concern that fingerprint "passwords" would be less insulated against court orders and warrants was brought up here more than two years ago, shortly after Apple announced the new security feature. Biometric data isn't something anyone "knows" that could be considered "testimonial." It simply is an indicator of who you are, which courts have held isn't covered under Fifth Amendment protections against self-incrimination.

The additional concern is that law enforcement may have also used this Fifth Amendment workaround to obtain information on a separate suspect. The LA Times article adds these details to the general murkiness:

Why authorities wanted [Paytsar] Bkhchadzhyan to unlock the phone is unclear. The phone was seized from a Glendale residence linked to Sevak Mesrobian, who according to a probation report was Bkhchadzhyan's boyfriend and a member of the Armenian Power gang with the moniker of "40." Asst. U.S. Atty. Vicki Chou said the search was part of an ongoing probe. She declined further comment.

Bkhchadzhyan was arrested and pled no contest to one count of identity theft. But the US Attorney's comment seems to imply law enforcement was looking for more than just evidence on Bkhchadzhyan when it searched the phone. If so, it raises even further questions about the constitutionality of this particular warrant, which may have forced this suspect to provide evidence against someone else.

The only prior case to raise this issue isn't very instructive and a dataset of one is hardly an indicator of prevailing judicial winds. But the reasoning in the 2014 case draws a line between what the court considers "testimonial" and what is merely providing access.

In 2014, a judge said Baust could be compelled to provide his fingerprint to open a locked phone but could not be ordered to disclose a passcode. The judge reasoned that providing a fingerprint was akin to giving a key, while giving a passcode — stored in one's mind — entailed revealing knowledge and therefore testifying. Baust was later acquitted.

But does that line even exist? It's difficult to say it does when both fingerprints and passwords are virtually interchangeable, thanks to Apple's Touch ID system. The fingerprint is the password. The difference is detained suspects can only retain one of these "keys" in their minds. The rationale used by the court presumes vocal utterances are the only way a person can provide incriminating evidence against themselves.

It's not like withholding passwords will work in all cases either. Those who aren't jailed for contempt of court may instead find judges deciding that providing a password to law enforcement isn't a "testimonial" act on its own. The refusal to provide a password may also work against defendants by giving prosecutors a bit more ammo for their "foregone conclusion" justifications. After all, if a locked device didn't contain evidence of criminal activity, any "reasonable" person would have provided a password without hesitation.

It's a stretch of an argument though -- considering the prosecution needs to provide evidence it knows the stuff it's looking for resides on the devices, which is something extremely difficult to prove when the device is fully encrypted.

The limits of the Fifth Amendment's protections against self-incrimination are far from clearly defined when it comes to encrypted devices.. This leaves the security question in the hands of each individual user. Your choice of security method depends on who you're more worried about having access to your phone. If it's phone thieves, then a fingerprint might do. But if it's the government, use a password.

Filed Under: 5th amendment, encryption, fingerprint, fingerprint swipe, id, paytsar bkhchadzhyan, self incrimination, sevak mesrobian, touch id

Aadhaar: Soon, In India, Everyone Will Be A Number

from the national-identity-card-club dept

National identification numbers are common enough -- many countries issue their citizens with a unique identifier. But in terms of scale, few can match Aadhaar, India's identity number system. As The Times of India explained a few years back, when the scheme was first announced:

Aadhaar is a 12-digit unique number which will be issued by the Unique Identification Authority of India (UIDAI) to all residents of the country. It's a step towards putting India in the club of more than 50 countries around the world that have some form of national identity cards. These include most of continental Europe (not the UK), China, Brazil, Japan, Iran, Israel and Indonesia. The number will be stored in a centralized database and linked to the basic demographics and biometric information photograph, ten fingerprints and iris of each individual. The number will be unique and would be available for online and offline verification and, hence, will rule out the possibility of duplicate and fake identities from government as well as various private databases.

The Aadhaar system is designed to make it easier for people on the sub-continent to prove their identity:

One of the key challenges faced by people in India is difficulty in establishing identity. People have multiple identity documents, each serving a different purpose. The most important characteristic of Aadhaar is its universality and it is assumed that the biometric card with the number will be gradually accepted across the country as the identification number by all service providers and government agencies.

The system is almost in place. According to an article in The Economic Times, as of this month, 870 million Aadhaar numbers have been issued. The hope is to achieve "universal coverage" -- 1.2 billion people -- by December.

Initially, the Indian government insisted that the scheme was voluntary, although even in 2013, there were concerns that it was effectively mandatory because various state benefits required its use. In 2014, India's Supreme Court reiterated that the system should not be compulsory, and also forbade the authorities from sharing biometric data held on the associated database with the police or similar agencies without the permission of the person concerned.

That raises one of the principal concerns with such centralized databases: the fact that, once created, there is a natural tendency to use them for purposes that have nothing to do with the original justification. For example, in 2013, there were suggestions that the Aadhaar card could be linked to driving licenses. In December last year, 100 million bank accounts were already associated with Aadhaar numbers. Last month, it was revealed that the Indian Railways may make the use of the Aadhaar number mandatory for booking online tickets. All of those will make tracking a person's activities much easier.

As the use of the Aadhaar system spreads to more domains, and becomes indispensable for more everyday services, that single number will assume an ever-greater importance in the lives of people in India -- and therefore become increasingly useful for identity fraud. It will doubtless make things much easier for the public there; but it will also provide the authorities with the perfect way of unifying all the information that they hold about citizens. Let's hope that by the time that happens, India has in place suitably robust laws regulating both government surveillance and data protection.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, id, id number, national id, number, privacy

Police Chief Deploys Officers With Assault Rifles To Stop & ID Everyone; Says Local Crime Stats Give Him Probable Cause

from the your-police-chief-needs-to-talk-less-and-listen-more dept

It's been frequently posited that the US is slowly becoming a police state, what with the near-constant surveillance of citizens, the "Constitution-free" zone surrounding our borders, the endless hassles of attempting to board a plane, NYC's controversial "stop-and-frisk" program, and the many security agencies that either were created or greatly expanded post-9/11.

Apparently, "slowly becoming" a police state isn't fast enough for the police department of Paragould, Arkansas. In response to an increase in crime, the Paragould PD will be deploying armed officers into high crime areas, clad in SWAT gear, to check IDs on any residents they happen to encounter.

[Police Chief] Stovall told the group of almost 40 residents that beginning in 2013, the department would deploy a new street crimes unit to high crime areas on foot to take back the streets.

"[Police are] going to be in SWAT gear and have AR-15s around their neck," Stovall said. "If you're out walking, we're going to stop you, ask why you're out walking, check for your ID."

Stovall said while some people may be offended by the actions of his department, they should not be.

"We're going to do it to everybody," he said. "Criminals don't like being talked to."

You know who else doesn't like to be talked to by police armed with AR-15 assault rifles and dressed in tactical gear? Damn near everybody. Since it is written exactly nowhere that US citizens are required to carry identification at all times, this sort of "papers, please" activity is going to please no one and do very little to make anyone feel any "safer." (And Stovall, your jurisdiction doesn't really cover things like determining what should or shouldn't offend constituents.)

Despite the obvious issues with this plan, the mayor is fully onboard and ready to start violating some rights!

Gaskill backed Stovall's proposed actions during Thursday's town hall.

"They may not be doing anything but walking their dog," he said. "But they're going to have to prove it."

Fantastic. Now pets will need some ID as well, not to mention be willing to sign a statement in your defense, should the need arise. Despite the dubious aspects of this plan (of which there are several), Chief Stovall has convinced himself that not only is this necessary, but fully justified.

Normally, police would not stop individuals for simply walking on the street, but Stovall said the level of crime in certain areas and concerns from residents gave his officers the right to institute the actions announced at the town hall event.

"This fear is what's given us the reason to do this. Once I have stats and people saying they're scared, we can do this," he said. "It allows us to do what we're fixing to do."

Stovall further elaborated on the stop-and-ID policy Friday morning, claiming the city's crime statistics alone met the threshold of reasonable suspicion required to lawfully accost a citizen.

"To ask you for your ID, I have to have a reason," he said. "Well, I've got statistical reasons that say I've got a lot of crime right now, which gives me probable cause to ask what you're doing out. Then when I add that people are scared...then that gives us even more [reason] to ask why are you here and what are you doing in this area."

I'm sorry, but crime statistics in aggregate do not automatically convert citizens into "suspects." I'm completely baffled that someone would actually say, out loud, that crime statistics equal "reasonable suspicion." That's some messed up police work right there. And it gets worse. Here's some more statements from Stovall, which range from "flabbergasting" to "you DO realize you're still on the record?"

Individuals who do not produce identification when asked could be charged with obstructing a governmental operation, according to Stovall... "I'm hoping we don't run across [any] of that," Stovall said. "Will there be people who buck us? There may be. But we have a right to be doing what we're doing. We have a zero-tolerance. We are prepared to throw your hind-end in jail, OK? We're not going to take a lot of flack..."

Stovall said he did not consult an attorney before announcing his plans to combat crime. He even remained undaunted when comparing his proposed tactics with martial law, explaining that "I don't know that there's ever been a difference" between his proposals and martial law.

Note that Stovall did not consult an attorney. If he had, he might not be as breezily confident about his "Police State of Paragould, Arkansas" plan. Here's what City Attorney Allen Warmath had to say, which attempts to walk back a some of Stovall's claims.

Warmath said while he had not directly spoken to Stovall, he understood that the street crimes unit would actually be less confrontational than Stovall let on...

As for having IDs, he said citizens wouldn't have to worry about that, either. He said the police would not arrest residents solely for failing to produce identification when asked.

Stovall himself has taken to the Paragould PD website to walk back a few of his claims as well, perhaps prompted by the heat he's received for his earlier statements.

Most often, this identification process will be nothing more than making contact with a subject, handing them a business card, and asking if they live in the area and if there's anything we can do for them. During hours in which crime seems to be more prevalent (i.e. between the hours of 11pm and 5 am), our process will become more stringent. We will be asking for picture identification. We will be ascertaining where the subject lives and what they are doing in the area.

Well, that is very different from the "zero tolerance" toss-your-non-ID-having ass in jail portrait he painted before the criticism began rolling in. Suddenly, it looks like an actual police operation that might fall within the limitations imposed on it by the Constitution. Stovall also clarifies the SWAT team look he was playing up earlier.

To give a little background information, several of our patrol officers already carry AR-15 rifles in their patrol vehicles. The AR-15 and police work is nothing new. Our Street Crimes Unit will not be wearing them constantly. That would be impractical. As we have stated in our meetings, our main purpose of mentioning this was to prepare our residents in the event that they saw an officer armed with one. When our officers deploy into areas where there is the potential for contacting several subjects in a high-crime area, that is when the potential deployment of AR-15's will occur.

Stovall states the new patrols are not out to "violate anyone's rights" but it's hard to square this intention with the thought process that turns aggregate crime statistics into a "reasonable suspicion" blank check. Finally, he bemoans the lack of attendance at town hall meetings held by the police department regarding its new anti-crime street patrol (fewer than 100 people attended the first two meetings)... and then cancels the remaining town hall meetings because they might be "unproductive" (and full of angry citizens).

In the interest of public safety, we have elected to cancel the remaining Town Hall Meetings.

We have corresponded with numerous residents and non-residents today alone who were both supportive and against our Street Crimes Unit and Town Hall Meetings. Some of the correspondance has caused us great pause in whether or not the meetings should remain as scheduled.

As the police department, it is our duty to protect ALL residents and non-residents from harm. We feel that with the strong feelings on both sides of the Street Crimes Unit issue, a safe and productive meeting would not be the probable outcome.

Wow. I can't imagine why people might be angry... or why Chief Stovall might want to dodge the backlash. This is the fundamental disconnect infects so many of those who create and enforce laws. Chief Stovall feels these tactics are completely justified and doesn't even flinch when they're compared to martial law. This is the person calling the shots, someone who institutes something that skirts the very edge of Constitutionality without even consulting an attorney. The message being sent is that the police will play by their own rules, with the citizens expected to be helpful, grateful, cooperative and, at all times, in possession of an ID, a clean criminal record and full justification for any suspicious "walking around" they might be doing.

And when the backlash hits, Stovall first tries walking his statements back before turning around completely and running away from the issue. So much for listening to "suggestions" and "feedback." Say hello to armed patrols and "papers, please."

Filed Under: arkansas, id, paragould, privacy, probable cause

Motion To Quash Against Copyright Troll Explains How IP Address Does Not ID User

from the will-it-work? dept

That Anonymous Coward alerts us to a recently filed "motion to quash" (pdf) one of the many subpoenas that copyright troll lawyer John Steele has been trying to get courts to issue. After running into trouble convincing judges in his home state of Illinois, it appears that Steele has branched out. This latest involves a lawsuit filed in the Northern District of California, where (unfortunately) Magistrate Judge Howard Lloyd went ahead and allowed early discovery and the issuance of subpoenas. While this is standard in many cases, more and more courts have begun realizing it is not appropriate in these copyright trolling cases where the sole purpose is to identify users to try to pressure them into settling.

While there have certainly been many motions to quash, this one made some particularly good points that seemed worth highlighting. First, it explains that IP addresses are not like fingerprints and do not identify a user (my emphasis):

The Third Degree Films complaint and ex parte request for expedited discovery form yet another in a wave of suits in which copyright infringement plaintiffs seek to “tag” a defendant based solely on an IP address. However, an IP address is not equivalent to a person or entity. It is not a fingerprint or DNA evidence – indeed, far from it. In a remarkably similar case in which an adult entertainment content producer also sought expedited discovery to learn the identity of persons associated with IP addresses, United States District Judge Harold Baker of the Central District of Illinois denied a motion for expedited discovery and reconsideration, holding that, “IP subscribers are not necessarily copyright infringers…The infringer might be the subscriber, someone in the subscriber’s household, a visitor with her laptop, a neighbor, or someone parked on the street at any given moment.” Order of Apr. 29, 2011, VPR Internationale v. DOES 1-1017, No. 2:11-cv-02068 (Central District of Illinois) (Judge Harold A. Baker) [hereinafter VPR Internationale Order], attached hereto as Exhibit C. The point so aptly made by Judge Baker is that there may or may not be a correlation between the individual subscriber, the IP address, and the infringing activity. Id. The risk of false identification by ISPs based on internet protocol addresses is vividly illustrated by Judge Baker when he describes a raid by federal agents on a home allegedly linked to downloaded child pornography. The identity and location of the subscriber were provided by the ISP (in the same fashion as Plaintiff seeks to extract such information from Wide Open West.) After the raid revealed no pornography on the family computers, federal agents eventually learned they raided the wrong home. The downloads of pornographic material were traced to a neighbor who had used multiple IP subscribers’ Wi-Fi connections. Id. This risk of false identification and false accusations through disclosure of identities of internet subscribers is also presented here. Given the nature of the allegations and the material in question, should this Court force Wide Open West to turn over the requested information, DOE No. 605 would suffer a reputational injury.

Separately, it notes that those using these tactics are using high pressure efforts to get people to pay up to settle:

If the mere act of having an internet address can link a subscriber to copyright infringement suits, internet subscribers such as DOE No. 605 will face untold reputational injury, harassment, and embarrassment. The reputational risk that Judge Baker found to be an undue burden is equally presented here: “[W]hether you’re guilty or not, you look like a suspect.” Id. at 3. Moreover, this case presents the same extortion risk that so concerned Judge Baker:

“Could expedited discovery be used to wrest quick settlements, even from people who have done nothing wrong? The embarrassment of public exposure might be too great, the legal system too daunting and expensive, for some to ask whether VPR has competent evidence to prove its case.”

Id. Discovery is not a game. Yet, plaintiffs in these types of cases use discovery to extort settlements from anonymous defendants who wish to avoid the embarrassment of being publicly associated with this type of allegation. Id. Such abuse of the discovery process cannot be allowed to continue.

From there, it argues that since an IP address does not identify the user, the subpoena itself is invalid:

Additionally, this subpoena should not have been issued in the first place because the information sought is not relevant to Plaintiff’s allegations. Implicit in the rule granting subpoena power is a requirement that the subpoena seeks relevant information. See Syposs v. United States, 181 F.R.D. 224, 226 (W.D.N.Y. 1998)(“the reach of a subpoena issued pursuant to [FED. R. CIV. P. 45] is subject to the general relevancy standard applicable to discovery under [FED. R. CIV. P. 26(b)(1)].”). The information linked to an IP address cannot give you the identity of the infringer. VPR Internationale Order, at 2. Because the infringer could have been anybody with a laptop passing within range of the router, the information sought by Plaintiff is not relevant to the allegations in any way. Id. Moreover, even if the information has some small amount of relevance to the claim—which it does not—discovery requests cannot be granted if the quantum of relevance is outweighed by the quantum of burden to the defendant. FED. R. CIV. P. 26(b)(2)(C)(iii). Plaintiff’s request fails that balancing test. Given that DOE No. 605 was only one of many persons who could have used the IP address in question, the quantum of relevance is miniscule at best. However, as discussed above, the burden to DOE No. 605 is severe. The lack of relevance on the one hand, measured against the severe burden of risking a significant reputational injury on the other, means that this subpoena fails the Rule 26 balancing test. Id. Plaintiff’s request for information is an unjustified fishing expedition that will cause reputational injury, prejudice, and undue burden to DOE No. 605 if allowed to proceed. Good cause exists to quash the subpoena served on Wide Open West to compel the disclosure of the name, address, telephone number and e-mail address of DOE No. 605."

Nice to see more people fighting back against obvious fishing expeditions. Hopefully more judges start realizing what these kinds of requests are really about.

Filed Under: copyright, id, ip address, trolls

Man Acquitted In Lawsuit Over Filming The TSA And Not Showing ID

from the good-for-him dept

A few folks have sent in variations on this story, involving how a guy named Phil Mocek has been acquitted of charges filed by the TSA after he refused to show TSA officials his ID back in 2009. Mocek had no ID on him and noted (correctly) that you do not, in fact, need ID to fly. He filmed the entire incident and then was charged with four misdemeanors: disorderly conduct, concealing his identity, refusing to obey a police officer, and criminal trespass. You can see the video here: It turns out that Mocek was completely correct in that he did not need to have ID and he was well within his rights to film the encounter. At no point did he raise his voice or act in a "disorderly" manner, and it appears that the jury recognized that -- and also recognized that the TSA and the police appeared to simply be annoyed at the guy for doing what was completely within the law.

Filed Under: airports, filming, id, phil mocek, rights, tsa