The Curious Case Of Billionaire Brian Sheth, An Anonymous Tweeter, Copyright Law, Twitter, And Some Company That Barely Seems To Exist

from the wtf-is-going-on-here? dept

Techdirt regular John Roddy highlighted a truly bizarre fight happening in a California court that may or may not involve billionaire Brian Sheth. Sheth was a cofounder of the high-flying Vista Equity Partners, and left it a year ago in a high profile exit, after the firm's other cofounder, Robert Smith, entered into a non-prosecution agreement with the DOJ and agreed to pay $139 million and "abandon" $182 million in deductions, related to charges of tax fraud. In the Forbes link above, Sheth claims he sought to have Smith leave Vista following this revelation, but "Smith prevailed" and so Sheth left. Nothing in that article makes Sheth look particularly bad.

However... an anonymous Twitter user @CallMeMoneyBags has been tweeting criticism of lots of folks involved in the private equity space, including Brian Sheth. A year ago, just about the same time that Sheth left Vista, MoneyBags tweeted a bunch of tweets referring to Sheth, and including snapshots of women who were sometimes scantily clad. The text of the tweets wasn't particularly bad. One of them just says "Brian Sheth is the King of Private Equity" with some hashtags:

Some of the tweets could be read obliquely to suggest infidelity:

You'll notice that the screenshots of those tweets show the media disabled over a copyright claim, and that's the next stage of this mystery. An entity called "Bayside Advisory LLC," which barely seems to exist, sent Twitter a copyright infringement notice for the images in those tweets, and then immediately filed a DMCA 512(h) subpoena to Twitter demanding that it identify the person behind @CallMeMoneyBags.

Twitter, properly moved to quash the subpoena, noting that this was all highly sketchy, and that the standard to force the disclosure of an anonymous poster is quite high, and it was not met here. Twitter rightfully noted that it was also somewhat perplexed by who the hell Bayside Advisory LLC was, and whether it had any connection to Sheth:

None of the Tweets mention Bayside.... Twitter’s counsel has attempted to learn the connection between Bayside and Sheth or the images at issue but has been unsuccessful.... Bayside does not appear to be registered to conduct business in California, and public searches of Bayside reveal only an Ohio real estate holdings company with no apparent connection to Sheth and no specialization in creating or acquiring copyrights of candid photographs.

There's been a fair bit of back and forth, but to summarize, Twitter argues (correctly) that the 1st Amendment protects anonymity. "Bayside" (whoever that is) argues back (misleadingly) that copyright infringement is not protected by the 1st Amendment. Twitter argues (correctly) that fair use is not infringement, and Bayside argues that it's not fair use. Twitter then argues again that (1) it is fair use, and (2) even if it's not fair use, Bayside doesn't meet the very high bar to expose an anonymous social media user.

Throughout all of this Bayside keeps insisting that it has no connection to Sheth at all and is merely a concerned copyright holder trying to police infringement. This seems exceedingly difficult to believe. However, the company filed a disclosure insisting that there were no other parties of interest in this case, and says that Twitter is wrong in implying that Sheth or someone connected to him are trying to expose MoneyBags:

Twitter falsely claims that Bayside is attempting to unmask a Twitter user (“MoneyBags”) for commenting on a newsworthy billionaire, thereby chilling MoneyBags’ First Amendment speech. (Dkt. 13 at 5). Bayside is not. As was clear in its opposition to the motion to quash (Dkt. 9), Bayside seeks the identity of a copyright infringer pursuant to the DMCA. The First Amendment does not afford protection for copyright infringement, nor are copyright infringer identities protected from disclosure by the First Amendment. Harper & Row Publishers, Inc. v. Nation Enters., 471 U.S. 539, 556 (1985); Arista Records, LLC v. Doe 3, 604 F.3d 110, 118 (2d Cir. 2010). Bayside has never requested MoneyBags’ tweets be removed. The commentary in those tweets remained after Bayside’s DMCA notice, and their textual comment is of no concern to Bayside. What is of great concern to Bayside is the unauthorized use of several of its copyrighted Photographs simply as an illustrative aid to those tweets, which does not constitute fair use.

Elsewhere, Bayside is even more emphatic that it has nothing to do with Sheth:

“the photos are exclusively and solely owned and controlled by our client Bayside Advisory LLC, the photos are registered with the United States Copyright Office reflecting that Bayside is the sole owner, Mr. Sheth never had any ownership or control interest in the photos and that Mr. Sheth does not own or control any interest in Bayside.”

For what it's worth, it does appear that Bayside Advisory LLC, using a US Postal Service postal box based in Menlo Park, California, did in fact file a copyright registration for six photos after MoneyBags posted the tweets. The registration claims that two of the photos (registered as a "group") were "published" in 2017 and the four others (also registered together as a group) were "published" in July of 2020. In those registrations, Bayside names Brenda Diaz as the photographer of all six photos. Notably, Bayside insists that protecting copyright is part of what it does:

Contrary to Twitter’s baseless conjecture, Bayside is a communications and strategic advisory firm that, among other things, advises and partners with creators, artists, and entrepreneurs to protect, promote, and champion creative expression. Bayside owns a catalog of photographs (the Photographs are only a small part of the catalog) to exploit for those purposes. What Twitter is attempting to do with its motion to quash is diminish the rights of copyright holders by forcing them to navigate the court system and fight diligently, and at great cost and expense, to get basic information about those who infringe their copyrights.

That would be a hell of a lot more compelling if... the two registrations at issue here weren't the only two registrations for published works that Bayside Advisory has. Earlier this summer (many, many months later) Bayside Advisory did register two more groups of unpublished photographs, but the idea that these photos are "only a small part of its catalog" is, at the very least, not clearly seen in its copyright registration practices.

Now, many months later, the judge has finally issued an order... which only punts the matter for the time being. Basically, the judge says it doesn't have enough info about @CallMeMoneyBags' use of the photos to determine whether or not they are protected by fair use, because MoneyBags is not a party here and hasn't filed anything on his (or her) behalf. So the court says that it has to hear from MoneyBags in order to get the full record and make a fair use determination, and whether or not MoneyBags' anonymity should also be protected:

To the extent the court must reach the issue of whether @CallMeMoneyBags’s use of the photos constitutes fair use, it lacks a well-developed record on which to base any ruling. ... In this case, Twitter states that “[i]t appears the anonymous Twitter user here posted those candid photographs for the purpose of criticizing or satirizing Sheth.” Mot. to Quash 12. Twitter speculates. The purpose and meaning of the tweets is not clear. They include hashtag references which are not obvious. Evidence regarding the user’s purpose and intended meaning is likely available only from the individual(s) who posted the tweets. ... The facts relevant to the first factor may also impact the third, which examines “the amount and substantiality of the portion used in relation to the copyrighted work as a whole.”... As the Supreme Court has explained, when examining the third factor, “the enquiry will harken back to the first of the statutory factors” because “the extent of permissible copying varies with the purpose and character of the use.”

Additionally, to the extent the court determines it is necessary and appropriate to “balance ‘the magnitude of the harms that would be caused to the competing interest by a ruling in favor of [Bayside] and by a ruling in favor of [Twitter and the user of the @CallMeMoneyBags account],’” the court lacks sufficient information to do so.... As noted, Twitter contends that unmasking @CallMeMoneyBags “may invite social ostracism, expose them to harassment, or prevent future employment opportunities,” but this too is speculative.

Accordingly, the court shall give the user(s) of the @CallMeMoneyBags account an opportunity to provide information supporting the foregoing inquiries, including evidence regarding any claim of fair use of the photos and the harms that could result if the court rules in favor of Bayside on the motions to quash and to compel. Twitter shall immediately serve a copy of this order along with the complete briefing on Twitter’s motion to quash and Bayside’s motion to compel on the email address associated with the @CallMeMoneyBags account, and file a declaration attesting to the same by November 10, 2021. By no later than December 10, 2021, the user(s) of the @CallMeMoneyBags account may specially appear and file evidence regarding fair use and/or the harms that may result if the court denies the motion to quash and grants the motion to compel. The user(s) may appear anonymously for the purpose of submitting such evidence. The court will take the matter under submission after December 10, 2021.

Twitter has since told the court that it has sent this ruling to @CallMeMoneyBags, and one hopes that MoneyBags can find himself (or herself) a decent lawyer who understands both fair use and anonymity...

And, of course, there's a lot that's perplexing here. The most obvious candidate for wanting to identify MoneyBags would be Sheth, but Bayside is emphatic (in its court filings) that it's not Sheth, but it's not at all clear who is actually behind Bayside or what Bayside actually does. But if it's not Sheth, then who would be so insistent on finding out who is behind the account, and spending what appears to be significant amount on a lawyer who used to run legal affairs for Universal Music Publishing Group? That's not how most people react to random snapshots being placed on Twitter. It's possible that it's somehow connected to the photographer, Diaz, but, if so, why did she hand over just those six images to Bayside to register and fight this fight? It's all... very perplexing.

Either way, kudos to Twitter for (1) fighting for the right to post anonymously, to criticize people while doing so, and (2) fighting for fair use.

Filed Under: 512(h), anonymity, brenda diaz, brian sheth, callmemoneybags, copyright, criticism, dmca 512, first amendment, identity, social media, subpoenas
Companies: bayside advisory, twitter

Court Says Twitter Must Unmask User Whose Bogus Document Jumpstarted Seth Rich Conspiracy Theory

from the anonymous-speech-is-still-worth-protecting,-judge dept

Lawsuits related to false reports about the murder of Seth Rich -- a DNC staffer conspiracy theorists have continually tried to link to the leak of DNC emails to DCLeaks and WikiLeaks back in 2016 -- continue to make their way through the court system. Seth Rich's brother, Aaron, has been pursuing a defamation suit against several parties (including conspiracy theorist/Fox New commentator [but I repeat myself…] Ed Butowsky, who has engaged in some litigation of his own).

Currently, the lawsuit is at somewhat of a standstill. Aaron Rich has been seeking information about a Twitter account that allegedly "leaked" a forged FBI document to the sued parties, resulting in some actual fake news that "linked" Seth Rich to the DNC hack.

After several subpoenas and rounds of discovery, Aaron Rich has gotten no closer to unmasking the person behind the @whyspertech account that supplied the document that appeared to give credence to the fevered rantings of conspiracy theorists around the nation.

As NPR reports (cautiously, I assume, since it's being sued for defamation itself by Butowsky), a federal judge has decided there's enough in Rich's lawsuit to justify the unmasking of the user behind @whyspertech.

A federal judge in California has ordered that Twitter reveal the identity of an anonymous user who allegedly fabricated an FBI document to spread a conspiracy theory about the killing of Seth Rich, the Democratic National Committee staffer who died in 2016.

[...]

While Twitter fought to keep the user's identity secret, U.S. Magistrate Judge Donna Ryu in Oakland, Calif., ordered on Tuesday that the tech company must turn over the information to attorneys representing Rich's family in a defamation suit by Oct. 20.

The ruling [PDF] cautiously sides with Rich, rejecting Twitter's challenge of the subpoena demanding identifying info. The court says this subpoena is narrowly-crafted, seeking only what's needed to determine whether the person behind the account could have credibly had access to actual FBI documents.

Here, unlike in 2TheMart.com where the subpoena was “extremely broad,” the Subpoena is narrowly tailored to exclude any personal communications made by the Account user. Additionally, Rich has shown that Defendants will likely rely on the affirmative defense of truth with regard to the FBI Report, which weighs in favor of a finding of good faith.

That's the defense the alleged defamers will use: that they had no reason to believe the document handed to them by this account was bogus. Unfortunately for the defendants, that's not going to be an easy sale. Previous discovery uncovered messages between a Butowsky associate and a [cough] "reporter" for InfoWars indicating they felt the document was highly questionable, as was its source.

The court moves past Twitter's assertions that releasing this information about an anonymous user (and their anonymous speech) will result in damage to the First Amendment by stating that a protective order forbidding the public release of the account user's info will mitigate potential Constitutional injuries.

[T]he Protective Order is sufficient to prevent the harm contemplated by Twitter. The Protective Order allows any producing party to designate discovery materials as “Highly Confidential.” Under this designation, disclosure is limited to individuals involved in the case and the information cannot be used for any other purpose other than the action. Thus, the Protective Order provides adequate safeguards against Rich’s ability to publicize the user information for inappropriate reasons.

The court follows a four-point checklist erected by the Ninth Circuit ruling cited by Twitter to come to this conclusion: because the core claim of Rich's lawsuit is defamation and Rich expects the defendants to claim they acted in good faith by relying on an FBI document handed to them by a Twitter account they honestly believed was a credible source, Twitter should be forced to turn over information on this anonymous account.

There's some chill to be felt here. The Twitter account is not a party to this lawsuit. While its input may prove to be of value to the plaintiff (or the defendants), at this point it's only the origin point of a questionable document others referenced while publicly entertaining their conspiracy theories. Forcing Twitter to unmask a non-party to allow a lawsuit to proceed against other defendants doesn't do much for the First Amendment as Twitter pointed out in its objection. The damage here may end up being minimal but a ruling like this will encourage litigants operating in far worse faith to pursue the unmasking of anonymous internet users only tangentially related to the case at hand.

Filed Under: aaron rich, anonymity, conspiracy, defamation, ed butowsky, identity, seth rich, unmasking
Companies: twitter

Tunisia's Plans To Bring In Its Own National 'Aadhaar' Biometric ID System Halted -- For Now

from the peace-be-with-you dept

The last time that Techdirt wrote about Tunisia was back in 2011, when the Internet helped bring about a major regime change there. Although violent protests against the government have flared up recently, in general, the processes that are being applied to shift national policies in Tunisia are both peaceful and successful. Here, for example, is some good news from Access Now on the privacy front:

This week the people of Tunisia won a major victory for privacy: the dangerous biometric ID card proposal has officially been withdrawn from consideration in the Assembly of the Representatives of the People (ARP).

We worked hard with our partners at Al Bawsala to oppose passage of the bill, including encouraging members of the assembly to adopt a set of key amendments to ensure that if it did pass, the bill would protect citizens' data and their right to consult and rectify their own information. Over the past week, we spent hours talking to assembly members, highlighting the dangers of pushing the bill through without adding necessary and vital protections for Tunisians' privacy and data security.

It worked! The assembly members advanced the amendments that we proposed, and nearly all were adopted within the Consensus Commission. The Ministry of the Interior, which had pushed hard to pass the bill without these important safeguards, dropped the proposal entirely.

That's particularly welcome at a time when the problems of India's biometric ID card system "Aadhaar" are becoming all-too clear. However, as Access Now rightly notes:

Even though we're overjoyed, we must remain vigilant. We could see this proposal revived. If that happens, we will continue working to ensure that any new legislation protects human rights.

Let's hope Tunisia's democratic legislative processes continue to function as effectively as they have in this particular case, and that the country does not end up with another Aadhaar.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: biometrics, id, identity, privacy, tunisia

Want Anybody's Personal Details From Aadhaar, India's Billion-Person Identity Database? Yours For $8

from the Aadhaar-admin-accounts-also-available-on-request dept

We've been writing about the world's largest biometric database, India's Aadhaar, since July 2015. Over 1.1 billion people have now been enrolled, and assigned an Aadhaar number and card, which represents 99.9% of India's adult population. There are currently around 40 million authentications every day, a number that will rise as Aadhaar becomes inescapable for every aspect of daily life in India, assuming it survives legal challenges. That scale necessarily entails a huge infrastructure to handle enrollment and authentication. So it will comes as no surprise to Techdirt readers that it turns out you can obtain unauthorized access to the Aadhaar system very easily, and for very little cost. As the Indian newspaper The Tribune revealed:

It took just Rs 500 [about $8], paid through Paytm [an Indian online payment system], and 10 minutes in which an "agent" of the group running the racket created a "gateway" for this correspondent and gave a login ID and password. Lo and behold, you could enter any Aadhaar number in the portal, and instantly get all particulars that an individual may have submitted to the UIDAI (Unique Identification Authority of India), including name, address, postal code (PIN), photo, phone number and email.

What is more, The Tribune team paid another Rs 300 [$4.75], for which the agent provided "software" that could facilitate the printing of the Aadhaar card after entering the Aadhaar number of any individual.

Given the repeated assurances by the UIDAI that the Aadhaar database was completely secure, this is big news, and led to some breathless damage limitation by the Indian authorities on Twitter. The UIDAI explained that: "Some persons have misused demographic search facility, given to designated officials to help residents who have lost Aadhaar/Enrollment slip to retrieve their details"; and: "There has not been any data breach of biometric database which remains fully safe & secure with highest encryption at UIDAI and mere display of demographic info cannot be misused without biometric". Although it may be true that this is not a biometric data breach, it nonetheless reveals a serious vulnerability in the system's design, and on a vast scale. According to the original article in The Tribune, more than 100,000 "village-level enterprise operators", hired to help with Aadhaar enrollment, have been offering this kind of unauthorized access to the database. In fact, the problem seems to be even more serious than simply providing login credentials to thousands of people. Here's what another Indian site discovered:

Following up on an investigation by The Tribune, The Quint found that completely random people like you and me, with no official credentials, can access and become admins of the official Aadhaar database (with names, mobile numbers, addresses of every Indian linked to the UIDAI scheme). But that's not even the worst part. Once you are an admin, you can make ANYONE YOU CHOOSE an admin of the portal. You could be an Indian, you could be a foreign national, none of it matters -- the Aadhaar database won't ask.

Even if biometric data is not involved, it's hard to see how UIDAI could claim that these aren't breaches of the database, or deny that the entire Aadhaar system is seriously compromised. It's almost inevitable that the security of an important database system will be defeated eventually in some way, since the rewards are by definition so high. The fundamental problem with Aadhaar is its underlying intent -- to create a single, giant database with key personal information about a billion people that can be accessed very frequently and very widely. That's never going to be safe, as the inevitable future breaches will confirm.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, database, hacked, id, identity, india, privacy

China Plans To Turn Country's Most Popular App, WeChat, Into An Official ID System

from the won't-that-be-convenient? dept

In one respect at least, China's embrace of digital technology is far deeper and arguably more advanced than that of the West. Mobile phones are not only ubiquitous, but they are routinely used for just about every kind of daily transaction, especially for those involving digital payments. At the heart of that ecosystem sits Tencent's WeChat program, which has around a billion users in China. It has evolved from a simple chat application to a complete platform running hugely popular apps that are now an essential part of everyday life for most Chinese citizens. The centrality of WeChat makes the following move, reported here by the South China Morning Post, entirely logical:

The government of Guangzhou, capital of the southern coastal province of Guangdong, started on Monday a pilot programme that creates a virtual ID card, which serves the same purpose as the traditional state-issued ID cards, through the WeChat accounts of registered users in the city's Nansha district, according to a report by state news agency Xinhua.

It said that trial will soon cover the entire province and further expand across the country from January next year.

The Wall Street Journal has some details of how people register:

Under the pilot program, funded by the National Development and Reform Commission, people create a basic identity card by scanning an image of their face into a WeChat mini program, reading aloud four numbers that pop up on the screen and entering their identification number as well as other information.

It obviously makes a lot of sense to use the WeChat platform to provide a virtual identity card. It's convenient for users who already turn to WeChat apps to handle most aspects of their lives. It means they don't need to carry around a physical ID card, but can let the software handle the necessary authentication when needed. That's also good news for businesses that want to confirm a person's identity.

But it's also an extremely powerful way for the Chinese government to implement its real-name policy for online activities, something that it has so far failed to push through. It will mean that the daily posts and transactions carried out using a mobile will not only be available to the Chinese authorities, but will be unambiguously linked to an individual once such digital IDs become obligatory for WeChat users, as they surely will. That, in its turn, will be very handy for implementing the proposed "citizen score" framework. Once this has been rolled out nationwide, it will form one of the most effective means of control available to the Chinese government, especially if combined with a similarly comprehensive plan to collect everyone's DNA.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, id card, identity, privacy, virtual id
Companies: wechat

DOJ Still Demanding Identity Of Twitter Users Because Someone They Shouldn't Have Arrested Tweeted A Smiley Emoji

from the this-case-remains-fucked-up dept

Last month, I had two blog posts about a particularly insane lawsuit being pushed by the Justice Department against a computer security researcher, Justin Shafer. As we explained, the arrest and prosecution of Shafer appeared to be the result of a truly ridiculous vendetta against Shafer by the FBI because Shafer got angry over a previous (and totally misguided) decision to raid his home, after he properly disclosed security problems involving some dental practice software. It seems clear that Shafer never should have been arrested (and never should have had the FBI raid his house three times over just a few months). Of course, what first brought the case to my attention was an even more ridiculous part of the story, in which the DOJ had sent a subpoena to Twitter demanding basically all info on five Twitter users -- even though two of them don't hide their identity -- because Shafer tweeted a smiley emoji at them.

That story is even more insane than it sounds, but I'm not going to repeat the details here -- I'll just repeat: the case involved the DOJ demanding the identity (and more) of five Twitter users because someone else (who they're railroading over bogus charges) sent a smiley emoji to them on Twitter where they were discussing a different lawsuit altogether.

We now have two updates on that story: (1) Shafer is appealing the fact that he's still in jail, months later and (2) the DOJ has refused to withdraw the emoji subpoena. Yes. You read that right. The DOJ is doubling down, demanding the identity (and more) of Twitter users because someone they never should have arrested, sent a smiley emoji to them. We can cover that second point first because there's not much more to say beyond "What the fuck is wrong with the DOJ?" As you may recall, the five Twitter users whose info was sought by the subpoena included @dawg8u ("Mike Honcho"), @abtnatural ("Virgil"), @Popehat (Ken White), @associatesmind (Keith Lee) and @PogoWasRight (Dissent Doe). Ken White and Keith Lee are both known (and each has blogged about the situation). The rest are at least partially pseudonymous. Dissent Doe, for one, has strong reasons for retaining anonymity, given her focus on data breaches and privacy issues. She revealed the DOJ's stunning decision to keep going over the weekend, noting that she now needs to fight the subpoena in court.

Dissent Doe explained to me later that her lawyers have tried, repeatedly, to contact the DOJ about this ridiculous subpoena, and the DOJ has ignored all attempts to communicate. Twitter has told her that any motion to quash the subpoena needs to be filed this week. She also notes, appropriately, that she's "really really ticked off" about all of this. We all should be.

And, just to be clear, there is no way the subpoena is even remotely Constitutional. Not even armchair lawyers could possibly think so. Over and over again, courts have said that anonymity is protected under the First Amendment, and you need to have very strong reasons to pierce the anonymity. The key case here is McIntyre v. Ohio Elections Commission, but plenty of others have weighed in since then. As we pointed out, the recent Awtry v. Glassdoor case nicely summarizes the history of cases protecting anonymity under the First Amendment:

The Supreme Court has recognized that “an author’s decision to remain anonymous, like other decisions concerning omissions or additions to the content of a publication, is an aspect of the freedom of speech protected by the First Amendment.” McIntyre v. Ohio Elections Comm’n, 514 U.S. 334, 342 (1995). Indeed, “[t]he right to speak anonymously was of fundamental importance to the establishment of our Constitution.” Doe v. 2TheMart.com Inc., 140 F. Supp. 2d 1088, 1092 (W.D. Wash. 2001) (citing McIntyre, 514 U.S. at 341-42). In particular, “Justice Black . . . reminded us that even the arguments favoring the ratification of the Constitution advanced in the Federalist Papers were published under fictitious names.” McIntyre, 514 U.S. at 342 (citing Talley v. California, 362 U.S. 60, 64 (1960)). So too were the responses of the anti-federalists, which were published by authors who used such fictitious names as “Centinel,” “Brutus” and “The Federal Farmer.” In re Anonymous Online Speakers, 661 F.3d 1168, 1172-73 (9th Cir. 2011).

Further, it is well-established that anonymous speech on the Internet, like other types of anonymous speech, enjoys First Amendment protection. In re Anonymous Online Speakers, 661 F.3d 1168, 1173 (9th Cir. 2011)(“online speech stands on the same footing as other speech—there is `no basis for qualifying the level of First Amendment scrutiny that should be applied’ to online speech”) (quoting Reno v. Am. Civil Liberties Union, 521 U.S. 844, 870 (1997)). As the Ninth Circuit has explained, “the ability to speak anonymously on the Internet promotes the robust exchange of ideas and allows individuals to express themselves freely without `fear of economic or official retaliation . . . [or] concern about social ostracism.'” Id.(quoting McIntyre, 514 U.S. at 341-42).

First Amendment protection of anonymous speech “is not unlimited, however, and the degree of scrutiny varies depending on the circumstances and the type of speech at issue.” Id. Political speech is considered to be “core” speech and is afforded the highest level of First Amendment protection. McIntyre, 514 U.S. at 346. Online messages such as the ones at issue here are also entitled to some level of First Amendment protection, even if the hurdle for overcoming that protection is less stringent than it is for political speech. See In re Anonymous Online Speakers, 661 F.3d 1168 at 1177; see also Highfields Capital Mgmt., L.P. v. Doe, 385 F. Supp. 2d 969 (N.D. Cal. 2005) (finding that identity of individual who anonymously posted derogatory comments about a company on an online message board was protected from disclosure under the First Amendment); Art of Living Foundation v. Does 1-10, No. 10-cv-5022 LHK, 2011 WL 5444622, at *5 (N.D. Cal. Nov. 9, 2011) (finding the standard articulated in Highfields applied to anonymously posted online commentary criticizing the plaintiff’s organization).

Given that tons of people are pointing this out publicly, what possible reason could the DOJ have for continuing to push Twitter to cough up this info other than to just be assholes?

As for the second update: Shafer has appealed the decision of a magistrate just revoking his pretrial release. The filing, by lawyers Tor Ekeland and Frederic Jennings, is... quite a read (and even cites my articles). It certainly doesn't hold back:

The government accuses Justin Mark Shafer of putting an FBI agent and his wife in substantial emotional distress and publishing restricted information about that FBI agent with the intent to incite violence against him. But nowhere in the record, or in the discovery in this case, is there any true threat of violence against anyone. There is no explicit language articulating any kind of threat. The “restricted” information in question was a prior home address for the FBI agent, publicly available on the internet. This entire case is built on innuendo and speculation that withstands neither constitutional nor statutory scrutiny. It is a chilling example of federal law enforcement overreach, and has serious ramifications for constitutional free speech and due process in relation to the internet and computer law. If the government’s accusations in this case are a crime, then millions of social media using Americans are subject to the prosecutorial whim of the Department of Justice.

The factual bases of the government’s bare bones indictment are a handful of public tweets; a Facebook friend request and message sent to a public Facebook account; the following of a public Twitter account;1 and two emails to an FBI Agent – one with a 😊 emoji and another inquiring about the status of a report of a patient privacy violation. The Defendant made no attempt to mask his identity, and the FBI never contacted the Defendant to express any concern or to ask him to stop his communications. Instead they arrested him. And any claim that he engaged in a sustained course of conduct with a continuity of purpose to cyberstalk or threaten are ludicrous when compared to facts embodied in the case law regarding these statutes.

These accusations led to a pretrial release order so broad it functioned as a prior restraint on Mr. Shafer’s constitutional right to speak about the accusations made against him. When he sought to do so – through a post on his work-related blog – the magistrate judge revoked release, broadly interpreting the release condition terms and finding a violation of those conditions.

An innocent man—who the government has not charged, and cannot charge, with any violent crime, nor with any history of violent crime— is now in jail on the basis of protected speech.

I recommend people read the entire document, as it goes into great detail (even beyond my original posts) about the vindictive nature of the FBI's vendetta against Shafer -- not for doing anything wrong, mind you -- but for being upset that the FBI raided his house and took all his electronics twice for completely bogus reasons. And it's not just Shafer, but Shafers three kids who are now traumatized over the mutliple FBI raids, in which agents pointed weapons at the children, or denied their parents the ability to get the children out of their rooms for extended periods of time.

The children now suffer currently from trauma and substantial emotional distress as a result of the repeated armed FBI raids. The Shafers’ three-year old is now unable to sleep alone in her room. Their (now) six-year old is struggling and withdrawn in school, where he previously excelled. Their ten-year old is now afraid to be near open shades, for fear of being surveilled.... Their father has not come home since April 18, 2017, because he is in jail awaiting trial.

As for why Shafer has been in jail all this time? Apparently it's because he wrote a blog post about the case. You can read that blog post here. I wouldn't necessarily say that the blog post was a good idea, because he's clearly venting his anger about the arrest and the treatment by the FBI and Special Agent Nathan Hopp in particular. But it hardly meets the criteria of threatening Hopp or "contacting" him via social media. And yet, since Shafer was barred from either of those things as condition for pretrial release, he was brought back in and has been in jail ever since. That raises a whole new set of First Amendment questions. Shafer is in jail for blogging.

During the period of Mr. Shafer’s pretrial release, he committed no crimes. He used no illegal or prohibited substances. He neither fled nor attempted to flee. He did nothing that posed a threat to the safety of any person or the community. He simply wrote a blog post comprised of constitutionally protected speech criticizing his prosecution. (See Ex. C, April 14, 2017 Blog Post) For this he has been taken away from his wife and children.

Shortly after the blog post was published, Mr. Shafer received a notice of potential violation of his pretrial conditions of release.

On April 18, 2017, a revocation hearing was held before Magistrate Judge Toliver. The government referenced vague concerns regarding flight risk, and claimed that the blog post Mr. Shafer had written was evidence of danger to the community or violation of the no-contact order between Mr. Shafer and SA Hopp. The government argued at the revocation hearing that merely “criticizing” SA Hopp in the “blog site” [sic] was indirect contact. (Tr. 5:8-6:10 (Apr. 18, 2017).) At the close of the revocation hearing, Magistrate Judge Toliver revoked Mr. Shafer’s pretrial release order. He has been detained since.

More specifically, Shafer's lawyers point out:

The original terms of his supervised release violated his free speech rights under the First Amendment. Imprisoning him pre-trial based on his speech is unconstitutional. This current, unconstitutional incarceration before an adjudication by a jury of his peers hampers Mr. Shafer’s ability to put on an effective defense, as he is not free to diligently prepare for his defense with his attorneys due to constant monitoring and harassment in jail. This violates his Fifth Amendment Due Process rights and his Sixth Amendment right to mount an effective defense. Moreover, none of Congress’s narrowly prescribed exceptions to an innocent defendant's presumption of liberty apply here. Mr. Shafer should be released pre-trial under appropriate conditions because his current incarceration violates the Constitution and federal law.

Everything about this case is crazy. We've certainly seen overreach by the DOJ in the past, but this case seems like a pretty blatant example not just of overreach, and not just of the DOJ doing whatever the fuck it wants, but of it doubling down to violate the rights of people just because it doesn't like being called out about it.

Filed Under: anonymity, cfaa, disclosure, dissent doe, doj, fbi, first amendment, identity, justin shafer, keith lee, ken white, nathan hopp, popehat, subpoena, vendetta
Companies: twitter

India's High-Tech Billion-Person Aadhaar Identity System Can't Cope With Real-Life Biometrics

from the well,-that's-awkward dept

We first wrote about India's Aadhaar system, which assigns a unique 12-digit number to all Indian citizens, a year ago. Mainstream media are finally waking up to the scale of the project, as this article in the Guardian indicates:

The Aadhaar scheme was launched in 2009, under former prime minister Manmohan Singh, but the current government, led by Narendra Modi, is credited with rolling it out across India. According to the latest figures in May 2016 from the Unique Identification Authority, more than a billion people have been given Aadhaar numbers. Within the next few months, the details of every person in India will be in the government database.

To allay privacy and surveillance concerns, the Indian government insisted initially that Aadhaar was to be purely voluntary. But as Techdirt reported earlier this year, it's quite clear that the government's intention is to get everyone on to the Aadhaar system, and to embed it ever-more deeply in daily life. The principal argument for doing so is that it will make India's bureacracy more efficient, help fight corruption, and make it easier for citizens to receive government support:

The data collected by the Aadhaar centres will be stored in a network of servers in the southern city of Bangalore. Information from the database can then be circulated to different authorities. The ID system, according to the government, will prevent welfare fraud and ensure subsidies and social security schemes are reaching the right people.

All laudable goals, but an article in The Times of India reveals the reality. In the Indian State of Rajasthan, 14 million people have dropped off the Aadhaar system. A major problem is that one of the key biometric identifiers -- fingerprints -- is proving unusable for precisely the groups of people that Aadhaar was supposed to help:

Hard manual labour flattens fingerprint patterns on the palm. Chances of the machines detecting them are really dim.

These patterns also fade with age. "I've never been a manual labourer, but at 70 the lines on my fingers are faint and the device never works with me too," says Aruna Roy of [the Indian social movement] MKSS.

Vaishali Devi of Kishangarh tehsil, Ajmer, complains she's been deprived of ration and pension for over three months. She was at the Jawab Do dharna in Jaipur for 20 days. With her was fellow villager Vanni Bai. For three months, she hasn't been able to collect her quota of supplies.

Another issue is that poor Internet connectivity makes it hard to check readings with the central Aadhaar databases in Bangalore, so many attempts are necessary before fingerprints are recognized, and the food rations can be given out. The good news is that there's an alternative approach:

In principle, the Unique Identity Authority of India, implementing agency for Aadhaar can issue a one-time password to the ration seeker's mobile phone if the system fails.

The bad news:

Many using the system can't afford mobile phones; some don't remember the number registered on their Aadhaar.

It sounds like getting India’s 1.29 billion population to use the Aadhaar system for routine daily transactions is going to be something of a challenge, to put it mildly.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, biometrics, identification, identity, india, national id, privacy

India Still Trying To Turn Optional Aadhaar Identification Number Into A Mandatory National Identity System

from the sliding-down-the-slippery-slope-to-disaster dept

Last year, we wrote about India's attempt to turn the use of its Aadhaar system, which assigns a unique 12-digit number to all Indian citizens, into a requirement for accessing government schemes. An article in the Hindustan Times shows that the Indian government is still pushing to turn Aadhaar into a mandatory national identity system. A Bill has just been passed by both houses of the country's parliament, which seeks to give statutory backing to the scheme -- in the teeth of opposition from India's Supreme Court:

There have been orders passed by the Supreme Court that prohibit the government from making Aadhaar mandatory for availing government services whereas this Bill seeks to do precisely that, contrary to the government's argument that Aadhaar is voluntary.

The article notes that in some respects, the new Bill brings improvements over a previous version:

It places stringent restrictions on when and how the UID [Unique Identification] Authority (UIDAI) can share the data, noting that biometric information -- fingerprint and iris scans -- will not be shared with anyone. It seeks prior consent for sharing data with third party. These are very welcome provisions.

But it also contains some huge loopholes:

The government will get sweeping power to access the data collected, ostensibly for "efficient, transparent, and targeted delivery of subsidies, benefits and services" as it pleases "in the interests of national security", thus confirming the suspicions that the UID database is a surveillance programme masquerading as a project to aid service delivery.

The fact that an optional national numbering system now seems to be morphing into a way to monitor what people are doing will hardly come as a surprise to Techdirt readers, but this continued slide down the slippery slope is still troubling, as are other aspects of the new legislation. For example, it was introduced as a "Money Bill," which is normally reserved for matters related to taxation, not privacy. That suggests a desire to push it through without real scrutiny. What makes this attempt to give the Aadhaar number a much larger role in Indian society even more dangerous is the possibility that it won't work:

A recent paper in the Economic and Political Weekly by Hans Mathews, a mathematician with the [Centre for Internet and Society], shows the programme would fail to uniquely identify individuals in a country of 1.2 billion.

A mandatory national identity system that can't even uniquely identify people: sounds like a recipe for disaster.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar identification number, id system, identity, india, papers please

Why Online Abuse Is Not Our Destiny

from the we'll-learn-to-behave dept

If you've spent any time on social networking sites like Facebook or Twitter, you can appreciate the hazards of the digital jungle. And even if you can fend for yourself out there, what about your kids? As well as I know the jungle's safe paths, I constantly worry about my three sons as they begin to navigate social platforms.

The alternate world of our social media identities – profiles, handles, accounts, "friends" – has ruined reputations and ended careers, even lives. Adolescents and teenagers see this daily in the form of online bullying. For adults, the harassment usually comes from the anonymous vitriol spewed across the web. The question becomes then: Will it get better? Or is this simply the new normal of our increasingly all-digital world?

The Supreme Court recently heard arguments in the case of a man convicted of threatening on Facebook to kill his wife. The defendant argues that he never meant what he wrote online. The prosecution argues, in effect, that intent is not the issue. Rather, a reasonable person would have felt threatened and that should be standard for a crime committed. What would you – or did you – think if someone dropped a death threat on your profile page?

How the Court decides Elonis v. United States could lead the way toward stemming online abuse. The Justices may uphold the conviction, but as Justice Sonia Sotomayor said during oral arguments, "We've been loathe to create more exceptions to the First Amendment." It's a comment that might leave the floodgates wide open for online abuse, granting online bullies and trolls even greater latitude under the cover of the First Amendment.

No matter what the Court decides, it still would be exceedingly hard to prosecute online offenders whose abuse doesn't include physical threats. Ask any teenager or adolescent if online attacks like, "You're so ugly; you should kill yourself," hurt any less than verbal assaults. The Court's decision won't stem the online harassment of adult victims either, whose tweets, posts or pictures done in poor taste can cause serious digital backlash.

The fact is social networks have changed the way we see ourselves, just as email once changed the way we communicated. Whether it's bullying or harassment, there still exists a sense of comfortable anonymity in the digital-social world. We have our "offline" selves, who would never say such things to someone's face, and our "online" selves, who can't stop from piling on our targets. In many ways, it's no different than the violent mobs of yesteryear – people in a mob find themselves doing things they would never contemplate on their own.

But Court cases like Elonis are helping to erode this digital wall between our online and offline identities. Since its foundation, the Internet has revealed its unique place in society – a place where people are free to be whoever they want. As the classic New Yorker cartoon featuring two canines puts it, "On the Internet, nobody knows you're a dog." This freedom has found its purest expression in social network sites. Yet the nature of the Internet is changing. We hardly even talk about "being online" anymore, because we're always online through our smartphones and mobile devices.

And today, more and more of our cars are online. Our televisions are online. Even our clock radios are online. There will be a time in the not-so-distance future when most of our household appliances will be connected to the web – and not in the way we now know them: using the Internet for one application, such as navigation for cars. They will be "communicating" with other connected devices, constantly gathering data through sensors on us, the users, and on our surroundings.

As the Internet evolves, so too will the way in which we see ourselves. Social networks will no longer be confined to our screens – laptops, tablets or smartphones. They will be as seamlessly integrated into our daily lives as the Internet itself. In this digital future, it will be much harder to cyberbully and torment people online, because the anonymity of the Internet will give way as we circle back to a world of singular identity – online and off.

The chasm that once existed between our online selves and our offline selves is shrinking. Given the trends of digital devices and the ubiquity of the Internet we see today, Facebook, Twitter and other social networks will no longer be separate places where our actions live without consequence. They will be as real as our brick-and-mortar reality, where civility and restraint still govern. "Welcome to the jungle" will no longer be a dire warning, but a digital whisper.

Shawn DuBravac, Ph.D., is the chief economist at the Consumer Electronics Association and the author of the forthcoming book, "Digital Destiny: How the New Age of Data Will Transform the Way We Work, Live, and Communicate" (Regnery, 2015). Follow Shawn on Twitter @ShawnDuBravac

Filed Under: abuse, culture, harassment, identity, online