Open Source 'Matter' Hopes To Make Sense Of The Fractured, Messy Smart Home Sector

from the simplify-all-the-things dept

If you've spent any meaningful time trying to build a "smart home" you've probably run face first into no shortage of problems. Gear is expensive, frequently complicated, and more often than not different devices don't play well together. It's a sector filled with various walled gardens by gatekeepers looking to lock you into one ecosystem, placing the onus on consumers to figure out which devices work with other devices and ecosystems, forcing the end user to spend countless calories trying to fix interoperability issues when they inevitably arrive.

The resulting mess has slowed adoption by those who (quite understandably) find dumb home tech (ordinary door locks, for example) to be the smarter option.

While various standards have tried to unify the space, they've not been particularly successful. In part because the central control of all these devices has been fractured across different standards and technologies (Zigbee, Z-Wave, Wi-Fi, and Bluetooth) all jostling for primary control despite none of them working particularly well. Enter Matter, a new open-sourced connectivity standard created by over 200 companies that's attempting to bring some sanity to the space.

Matter is an emerging communication protocol leaning on numerous existing technologies -- Thread, Wi-Fi, Bluetooth, and ethernet -- with the goal of letting all of your smart home devices communicate with each other locally, without the need for a controlling gateway and hub. The Verge has a great breakdown on how the standard hopes to accomplish this (namely by being IP-based and integrating with existing technologies):

"Its unique feature is it’s an IP-based technology, meaning it uses the same mechanisms to communicate as the internet. So, there is no dependency on bridges or hubs, and yes, you will (eventually) be able to get rid of all those white boxes hooked up to your modem.

To simplify adoption, Matter will start as an application layer on top of existing IP technologies, including ethernet, Wi-Fi, Thread, and Bluetooth (for device provisioning). This means Matter is not reinventing the wheel; it’s adding better technology to the highways our smart homes are driving on.

Granted this isn't our first rodeo with these kinds of efforts, as this old XKCD comic attests:

This time though there seems to be an underlying understanding that simplifying this mess is in everybody's interests, from the biggest companies looking to sell more smart home gear, to the smaller players developing innovative new solutions. As such Matter is being directly supported not just by Amazon, Apple, Google/Nest, and Samsung, but a long line of other smart home and IOT companies like Wyze, Ecobee, iRobot, and others. Matter should find its way into products starting sometime near the end of next year, at which point you'll be able to see if the underlying promise materializes.

Filed Under: home automation, matter, open source, smart home, standards

Trump Given 30 Days To Have His Social Media Site Comply With Open Source License

from the tick-tock dept

Plenty of people have raised concerns that Donald Trump's sketchy new social media site, Truth Social, is just a lightly reskinned Mastodon, which is violating Mastodon's fairly strict AGPLv3 license. As we had previously discussed, the aggressive (and sloppy) terms of service for the site claim that the code is proprietary, and even claims that "all source code, databases, functionality, software, website designs, audio, video, text, photographs, and graphics on the Site (collectively, the “Content”) and the trademarks, service marks, and logos contained therein (the “Marks”) are owned or controlled by us or licensed to us..."

Of course, part of the reason that Mastodon uses such a license is to encourage others to take the code and build on it if they abide by the terms of the license. And the nature of Mastodon's license is that if you use it, you must make the complete source code available of what you build with it. The key bit of the license:

You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:

a) The work must carry prominent notices stating that you modified it, and giving a relevant date.

b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices".

c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.

d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.

It's not clear that any of these conditions have been met. So, now the Software Freedom Conservancy has given Trump 30 days to bring the code into compliance -- specifically by providing the source code to Truth Social to the early users who were able to sign up -- or, under the license terms, Trump's "rights in the software are permanently terminated."

Early evidence strongly supports that Trump's Group publicly launched a so-called “test site” of their “Truth Social” product, based on the AGPLv3'd Mastodon software platform. Many users were able to create accounts and use it — briefly. However, when you put any site on the Internet licensed under AGPLv3, the AGPLv3 requires that you provide (to every user) an opportunity to receive the entire Corresponding Source for the website based on that code. These early users did not receive that source code, and Trump's Group is currently ignoring their very public requests for it. To comply with this important FOSS license, Trump's Group needs to immediately make that Corresponding Source available to all who used the site today while it was live. If they fail to do this within 30 days, their rights and permissions in the software are automatically and permanently terminated. That's how AGPLv3's cure provision works — no exceptions — even if you're a real estate mogul, reality television star, or even a former POTUS.

I and my colleagues at Software Freedom Conservancy are experts at investigating non-compliance with copyleft license and enforcing those licenses once we confirm the violations. We will be following this issue very closely and insisting that Trump's Group give the Corresponding Source to all who use the site.

I think that's called being put on notice. It will be interesting to see how Trump responds -- and what happens next.

Filed Under: agpl, copyright, donald trump, licenses, open source, source code
Companies: mastodon, software freedom conservancy, truth social

Support Public Code, While Helping Support Techdirt

from the synergy dept

Recently, following our announcement that we have removed all Google ads and tracking code from Techdirt, a reader reached out to us with a novel (and greatly appreciated!) proposal for supporting the change and our ongoing reporting while also helping out a good cause: buying an ad — not for their own benefit, but for that of a public interest campaign that aligns perfectly with our own values. That's why you see a new banner in the sidebar on the site, encouraging our readers to sign an open letter put together by FSFE calling on the EU to pass a law requiring all publicly financed software to be made available under a free and open source license.

This reader purchased the ad with their own money, as a way of helping out both Techdirt and the FSFE campaign — and we think this is such an amazing and generous idea that we wanted to call extra attention to it with a post. We've written about this same issue of open sourcing publicly funded software in the past, when the White House began embracing the idea and then unveiled an official open source software policy — but the fact is it should be the norm for all governments that use taxpayer money to develop software. If the public funds something, it should be available to the public by default.

And, of course, we also want to call attention to this campaign as a way that you can support Techdirt. As we said in our post about removing Google trackers from the site, these kinds of reader-friendly changes also take away some of our revenue streams, and increase our reliance on you, our readers, to support us directly when and if you can. We're extremely grateful to all the readers who stepped up and gave us a tip through our Friend of Techdirt option in the Insider Shop, or engaged with one of the many other ways to support us — and now this one generous reader has showed yet another option, and one that allows you to support Techdirt and the public interest at the same time.

So we encourage everyone to sign the open letter to help demonstrate that this kind of campaign works. Moreover, if there's a campaign or an organization out there that you think aligns well with Techdirt's values and readership and that you'd like to support while helping us out in this way, please get in touch and let us know. We don't currently have fixed rates for direct ad purchases like this, and instead prefer to come up with custom solutions that fit your budget and needs — so don't hesitate to reach out and let us know what you have in mind.

Thanks again to all our readers, and today especially to this one reader who came to us with this excellent idea!

Filed Under: ads, open code, open licensing, open source, publicly financed software
Companies: techdirt

A Second Cambrian Explosion of Open Source Licenses Or Is it Time For Open Source Lawyers to Have Fun Again?

from the fun-with-open-source-licensing dept

As the open source world has grown, so have concerns about the context in which openly licensed items are used. While these concerns have existed since the beginning of the open source movement, today’s larger and more diverse movement has brought new urgency to them. In light of this revived interest within the community, the time may be ripe to begin encouraging experimentation with open source licensing again.

How We Got Here

While the history of open source software is long and varied (and predates the term open source software), for the purposes of this blog post its early evolution was driven by a fairly small group of individuals motivated by a fairly homogeneous set of goals. As the approach became more popular, the community developed a wide range of licenses designed to address a wide range of concerns. This ‘First Cambrian Explosion’ of open source models and software licenses was a time of experimentation within the community. Licenses varied widely in structure, uptake, and legal enforceability.

Eventually, the sprawling nature of this experimentation began to cause problems. The Free Software Foundation’s Free Software Definition and the Open Source Initiative’s Open Source Definition were both attempts to bring some order to the open source software world.

In the specific context of licensing, the Open Source Initiative began approving licenses that met its criteria. Soon thereafter, it released a License Proliferation Report detailing the challenges created by this proliferation of licenses and proposing ways to combat them.

These activities helped to bring order and standardization to the world of open source licensing. While OSI continues to approve licenses, for well over a decade the conventional wisdom in the world of open source has been to avoid creating a new license if at all possible. As a result, for most of this century open source software license experimentation has been decidedly out of style.

Largely for the reasons described in the License Proliferation Report, this conventional wisdom has been beneficial to the community. License proliferation does create a number of problems. Standardization does help address them. However, in doing so standardization also greatly reduced the amount of license experimentation within the community.

Reduced experimentation means that concerns incorporated into approved licenses (access to modifications of openly licensed code) have been canonized, while concerns that had not been integrated into an approved license (restrictions on unethical uses of software) at the moment of formalization were largely excluded from consideration within the open source community.

What Changed

What has changed since the move towards codification of licenses? The open source software world has gotten a lot bigger. In fact, it has gotten so much bigger that it isn’t just the open source software world anymore. Creative Commons - today a towering figure in the world of openness - did not even exist when the Open Source Initiative started approving licenses. Now the open world is open source hardware, and Creative Commons-licensed photos, and open GLAM collections, and open data, and all sorts of other things (this is a whole other blog post). The open source world has moved beyond early debates that questioned the fundamental legitimacy of open source as a concept. Open source has won the argument.

An expansion of applications of open source has lead to an expansion of people within open source. Those people are more diverse than the early open source software proponents and are motivated by a wider range of interests. They also bring with them a wider range of concerns, and a wider range of relationships to those concerns, than early open source adopters.

What is Happening Now

This broader community does not necessarily share the consensus about how to approach licensing that was developed in an earlier period of open source. They bring a range of viewpoints that did not exist in the earlier days of open source software into the open source community itself. They are also applying open source concepts and licenses to a range of applications that were not front of mind - or in mind at all - during the drafting of today’s canonical licenses.

Unsatisfied with the consensus rules that have delivered us the existing suite of (incredibly successful) licenses, parts of the community have begun experimenting again. Veteran open source lawyers are rewriting licenses with public understandability in mind. Community members are transforming their interpretation of open source development into licences that invite collaboration without intending to adhere to the open source definition. Some of these licenses are designed to address concerns traditionally excluded from the scope of open source licenses. I am directly involved in the ml5.js attempt to do just that.

The creators of these experiments are responding to a standardized approach to licensing that does not fully accommodate their needs and concerns. In some cases the standardized approach does not accommodate these concerns because the community litigated including them in the past and decided it could or should not be done. However, even in those cases, that debate happened within a very different community in at least somewhat different contexts. The conclusions arrived at then are not necessarily valid for the broader world that open source finds itself inhabiting.

In light of that, it may be time to begin encouraging experimentation in open source licensing again. Encourage people to test out new approaches by applying them to real world problems. In some cases, the decisions made in the past will prove to be robust and sustainable. In others, a new debate will reveal the decisions’ shortcomings. In both cases, the open source community will be stronger by being tested from within.

Coda: Is This Post Just a Lawyer Advocating for Lawyers to Have More Fun?

Throw out the old ways of doing things! Try something new! Experiment! Is this just a call for lawyers to have fun by screwing around with exotic licensing concepts at the expense of everyone else’s stability (and sanity)?

It could be. But I don’t really think so. The thing about lawyers (as a group - there are always exceptions) is that novelty and instability makes us nervous. Things that are tried and true will probably work. That means we do not have to worry about them. New things - who knows what will happen to them? That uncertainty makes lawyers nervous.

That is part of the reason why lawyers like today’s conventional wisdom. The canonical set of open source licenses have more or less worked for decades. It is unlikely that they will explode, and it is even less likely that they will explode in the face of the lawyer who uses them on any given project. In contrast, any lawyer who writes their own license is setting themselves up for a period of anxiety, waiting to discover what they missed or how things will go wrong.

Of course, some lawyers do think it is fun to cook up new open licenses. And maybe this post is a call for them to do more of it. But, on balance and as a whole, introducing new licenses into the world of open source will probably cause open source lawyers more anxiety than joy.

I think that anxiety is probably worth it. But that will be far from a universally held position.

Originally published on Michael Weinberg's blog and repbulished under a CC-BY-SA 4.0 license.

Filed Under: licenses, open source, open source licenses, sharing

What3Words Sends Ridiculous Legal Threat To Security Researcher Over Open Source Alternative

from the never-use-what3words dept

A couple years we wrote about What3Words, and noted that it was a clever system that created an easy way to allow people to better share exact locations in an easily communicated manner (every bit of the globe can be described with just 3 words -- so something like best.tech.blog is a tiny plot near Hanover, Ontario). While part of this just feels like fun, a key part of the company's marketing message is that the system is useful in emergency situations where someone needs to communicate a very exact location quickly and easily.

However, as we noted in our article, as neat and clever as the idea is, it's very, very proprietary, and that could lead to serious concerns for anyone using it. In our article, we wrote about a bunch of reasons why What3Words and its closed nature could lead to problems -- including the fact that the earth is not static and things move around all the time, such that these 3 word identifiers may not actually remain accurate. But there were other problems as well.

And, apparently one of those problems is that they're censorial legal bullies. Zach Whittaker has the unfortunate story of how What3Words unleashed its legal threat monkeys on a security researcher named Aaron Toponce. Toponce had been working with some other security researchers who had been highlighting some potentially dangerous flaws in the What3Words system beyond those we had mentioned a few years back. The key problem was that some very similar 3 word combos were very close to one another, such that someone relying on them in an emergency could risk sending people to the wrong location.

The company insists that this is rare, but the research (mainly done by researcher Andrew Tierney) indicates otherwise. He seemed to find a fairly large number of similar 3 word combos near each other. You can really see this when Tierney maps out some closely related word combos:

In a follow up article, Tierney detailed a bunch of examples where this confusion could be dangerous. Some of them are really striking. Here's just one:

“I think I’m having a heart attack. I’m walking at North Mountain Park. Deep Pinks Start.” – 1053m.

(Try reading both out)

https://what3words.com/deep.pink.start

https://what3words.com/deep.pinks.start

Anyway, Toponce had been tweeting about Tierney's findings, and talked about WhatFreeWords, which had been "an open-source, compatible implementation of the What3Words geocoding algorithm." It was a reverse engineered version of the proprietary What3Words system. That tool was created back in 2019, but a week after it went online, What3Words lawyers sent incredibly overbroad takedown letters about it to everyone who had anything even remotely connected to WhatFreeWords, and had it pulled offline basically everywhere.

First up: this is ridiculous. While reverse engineering is unfortunately fraught with legal risk, there are many areas in which it is perfectly legal. And it seems like WhatFreeWords implementation should be legal. But it appeared to have been a fun side project, and not worth the legal headache.

Even though WhatFreeWords was disappeared from the world in late 2019, it appears that Toponce still had some of the code. So in tweeting about Tierney's research, he offered up the tool to researchers to help investigate more problems with What3Words, similar to what Tierney had found.

And that's when What3Words' lawyers pounced. And, in pouncing, the mere chilling effects of the legal threat worked:

Toponce also admits he couldn't even sleep after receiving the threat letter. This is an underappreciated aspect of the insanely litigious nature of many censorial bullies these days. Even if you're in the right, getting sued can be completely destructive. Toponce was trying to help security researchers better research an application that is promoted for being safe and security researchers should be allowed to make use of reverse engineering to do exactly that. But, What3Words and their bullying lawyers made sure that's impossible.

To be fair to their bullying lawyers, the threat letter is not as aggressive as some others, and they even make it explicit that they are not seeking that Toponce stop criticizing the company:

In this connection, and to be clear, our client does not require the deletion of your criticism of and feedback in respect of its service.

But... it still makes pretty stringent demands.

i) delete all copies of "What Free Words" and any other works derivative of W3W's software and wordlist presently in your possession or under your control;
ii) confirm, to the best of your knowledge, the identities of all parties / individuals to whom you have provided copies or derivations of the software and/or wordlist;
iii) agree that you will not in the future make further copies or derivations of and/or distribute copies or derivations of the software and/or wordlist;
iv) delete any Tweets or other online references made to the copies / derivations of our client's software and wordlist and that are connected with or emanate from the "What Free Words", and agree not to make similar representations in the future.

Of course, there are some questions about what intellectual property is actually being infringed upon here as well. When the company's lawyers got the original WhatFreeWords site taken down, they claimed copyright and trademark rights, though extraordinarily broadly. They claim their own software is covered by copyright, but WhatFreeWords isn't using their software. They also claim that all the 3 word combos are covered by copyright and... eh... it might be in the UK where W3W is based, but in the US, it would be harder to claim that three random word combos are creative enough to get a copyright. Also, in the US there would be a strong fair use defense. Unfortunately, in the UK, there is a ridiculous concept known as "database rights" that let you claim a right over a mere collection of things, even if you have no claim to the underlying rights. But, even so, it seems that there should be a fair use defense here. The UK has a fair dealing exception for research and private study, which seems like it should apply as well.

As for the trademark claims, well, no one's going to get confused about it, since it's pretty clear that WhatFreeWords was designed explicitly not to be from What3Words, and in this particular case, it's not being offered widely, just to knowledgeable security researchers. Even more insane: the original threat letter over WhatFreeWords claimed that there could be criminal penalties for violating consumer protection laws, and that's just insane.

Still, as Mike Dunford notes in his thread about this situation, W3W's decision to focus on locking up and threatening everyone perhaps explains why so few people know about or use What3Words. Imagine if they had built this as an open tool that others could build on and incorporate into other offerings. Then they could have others experiment and innovate and get more people to adopt it. By making it proprietary, and locking it down with threats and asshole lawyers, there's simply no reason to bother.

The only proper response to this is never, ever use What3Words for anything that matters. Beyond not giving in to censorial, abusive bullies, their legal reaction to a security researcher doing reverse engineering work to help find potentially dangerous problems with What3Words screams loudly to the world that What3Words has no confidence that it's products are safe. They're scared to death of security researchers being able to really test their work.

Both of these reasons means that What3Words should be remembered as little more than a failed.dumpster.fire rather than the cool.mapping.idea it could have been.

Filed Under: 3 words, aaron toponce, andrew tierney, bullies, copyright, location, open source, security, threats, trademark, whatfreewords
Companies: what3words

Germany Drops Idea Of 'Pre-Flagging' Legal Uploads, Which Could Have Stopped EU Copyright Filters Blocking Memes, Parodies, Quotes And Creative Commons Material

from the that's-not-a-bad-approach,-better-get-rid-of-it dept

Techdirt recently wrote about how copyright companies are not satisfied with the already one-sided EU Copyright Directive, but want to tilt the playing-field even further in their favor. In particular, they want to ignore one of the few safeguards that the new law includes: the requirement that legal content must not be blocked by the upload filters that will inevitably be introduced by Article 17 (formerly Article 13). The bad news is that the German government is planning to give the copyright maximalists what they want in its national implementation of the new EU legislation.

Julia Reda reported in an article on Heise Online back in July that the initial proposal from the German government had some attempts to limit the damage from upload filters (original in German). For example, it introduced the sensible idea of letting users "pre-flag" as legal the material that they upload. In this way, things like memes, parodies or material released under a Creative Commons license would not be blocked by the upload filters. As Reda explained, the idea was not without difficulties, but at least it provided a way for uses of copyright material that people believed to be legal to be signposted before they were blocked automatically. In a depressing turn of events, the latest proposal from the German government ditches this innovative approach almost completely. Reda writes on Netzpolitik.org (original in German):

According to the Ministry of Justice's new plans, [online] platforms should be obliged to check content for copyright infringements in real time, while it is being uploaded. Only if this real-time check detects copyright-protected content for which the platform has not acquired a license, will users then be given the option of either marking the content as permitted or canceling the upload process. In the first instance, potential copyright violations should not be published.

...

In such situations, the new draft law does not offer any protection against erroneous bans. The elimination of the option to mark uploads as legal as a precaution means anyone who uploads a legal quote or a parody, for example, can no longer protect themselves against future blocking requests from rights holders. Users can only complain afterwards if content has already been blocked. However, this approach does not even meet the requirements of Article 17 itself, which requires that legal content is not blocked in the first place.

Reda goes on to note that there are many cases of perfectly legal uploads being blocked by unintelligent filters like Google's Content ID, because companies have falsely claimed rights to material that has been released freely, or under a Creative Commons license. It is also easy to imagine average users being intimidated when their uploads are immediately blocked by the system, and naturally concerned that they what they have done is seriously illegal in some way. Unless they are well versed in copyright law, many people will simply cancel the upload of their witty meme or parody, and the world will be a poorer, more boring place.

It's pretty outrageous that the German government is ignoring the explicit requirement of the new law that legal content should not be blocked in an automatic fashion. On the plus side, this flagrant omission could make it more likely that a legal challenge to the EU Copyright Directive at the EU's top court -- something that is bound to come -- would be successful, and lead to Article 17 being struck down completely.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: article 13, article 17, copyright, copyright directive, creative commons, eu, fair use, filters, germany, open source, parody

Academic Study Says Open Source Has Peaked: But Why?

from the share,-and-share-alike dept

Open source runs the world. That's for supercomputers, where Linux powers all of the top 500 machines in the world, for smartphones, where Android has a global market share of around 75%, and for everything in between, as Wired points out:

When you stream the latest Netflix show, you fire up servers on Amazon Web Services, most of which run on Linux. When an F-16 fighter takes off, three Kubernetes clusters run to keep the jet's software running. When you visit a website, any website, chances are it's run on Node.js. These foundational technologies -- Linux, Kubernetes, Node.js -- and many others that silently permeate our lives have one thing in common: open source.

Ubiquity can engender complacency: because open source is indispensable for modern digital life, the assumption is that it will always be there, always supported, always developed. That makes new research looking at what the longer-term trends are in open source development welcome. It builds on work carried out by three earlier studies, in 2003, 2007 and 2007, but using a much larger data set:

This study replicates the measurements of project-specific quantities suggested by the three prior studies (lines of code, lifecycle state), but also reproduce the measurements by new measurands (contributors, commits) on an enlarged and updated data set of 180 million commits contributed to more than 224,000 open source projects in the last 25 years. In this way, we evaluate existing growth models and help to mature the knowledge of open source by addressing both internal and external validity.

The new work uses data from Open Hub, which enables the researchers to collect commit information across different source code hosts like GitHub, Gitlab, BitBucket, and SourceForge. Some impressive figures emerge. For example, at the end of 2018, open source projects contained 17,586,490,655 lines of code, made up of 14,588,351,457 lines of source code and 2,998,139,198 lines of comments. In the last 25 years, 224,342 open source projects received 180,937,525 commits in total. Not bad for what began as a ragtag bunch of coders sharing stuff for fun. But there are also some more troubling results. The researchers found that most open source projects are inactive, and that most inactive projects never receive a contribution again.

Looking at the longer-term trends, an initial, transient exponential growth was found until 2009 for commits and contributors, until 2011 for the number of available projects, and until 2013 for available lines of code. Thereafter, all those metrics reached a plateau, or declined. In one sense, that's hardly a surprise. In the real world, exponential growth has to stop at some point. The real question is whether open source has peaked purely because it has reached its natural limits, or whether they are other problems that could have been avoided.

For example, a widespread concern in the open source community is that companies may have deployed free code in their products with great enthusiasm, but they have worried less about giving back and supporting all the people who write it. Such an approach may work in the short term, but ultimately destroys the software commons they depend on. That's just as foolish as over-exploiting the environmental commons with no thought for long-term sustainability. As the Wired article mentioned above points out, it's not just bad for companies and the digital ecosystem, it's bad for the US too. In the context of the current trade war with China, "the core values of open source -- transparency, openness, and collaboration -- play to America's strengths". The new research might be an indication that the open source community, which has selflessly given so much for decades, is showing signs of altruism fatigue. Now would be a good time for companies to start giving back by supporting open source projects to a much greater degree than they have so far.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: open source, software development

Lawsuit & Bi-Partisan Group Of Senators Seek To Push Back On Trump Administration's Attempt To Corrupt The Open Technology Fund

from the do-something-good-marco dept

Last month we wrote about how the newly appointed head of the US Agency for Global Media (USAGM) had cleaned house, getting rid of the heads of the various organizations under the USAGM umbrella. That included Voice of America, Radio Free Europe/Radio Liberty, Radio Free Asia, Middle East Broadcasting... and the Open Technology Fund. The general story making the rounds is that Pack, a Steve Bannon acolyte, planned to turn the famously independent media operations into a propaganda arm for the Trump administration. Leaving side the concerns about why this is so dangerous and problematic on the media side, we focused mostly on the one "different" organization under the USAGM banner: the Open Technology Fund.

OTF is incredibly important to a functioning and open internet -- especially one where freedom and privacy to communicate can work around the globe, with a focus on funding audited, open source technologies. Last week, Vice had a detailed story about what it describes as "the plot to kill the Open Technology Fund." In it, it notes that Pack wants OTF to fund two apps that are not open source, Freegate and Ultrasurf. While both claim to be about helping circumvent internet censorship, most activists don't trust those apps. Indeed, it notes that the developer behind Ultrasurf agreed to a security audit by the US government, but then threatened the company who did the audit with legal action if it made the report public:

VICE News has learned that Ultrasurf recently underwent a security audit to assess if the app contained any critical security flaws. The audit was conducted at the request of the State Department as a condition of funding, but the report has not been published.

This was because the developer of Ultrasurf wanted a reference to “a high-severity bug” removed from the report, according to a source at the company that conducted the audit, Cure53.

The developer, who uses the pseudonym Clint to protect his family in China, subsequently threatened Cure53 with legal action if they ever published the report. Clint told VICE News the audit was “sort of like a trap” and that the report was not made public because it would reveal too much about his source code.

Let's be clear: if publishing a security audit about your software will reveal too much about your source code your app is not secure.

So why would OTF under Pack's command suddenly be interested in funding these closed source, highly questionable apps? You guessed it:

Mainly because prominent individuals with strong links to Pack have spent the better part of the last decade repeatedly pushing these apps to receive tens of millions of dollars in funding from the U.S. government, without providing any evidence that the technology will succeed.

The two loudest proponents of these technologies are Michael Horowitz, a former director of the Project for International Religious Liberty at the Hudson Institute, and Katrina Lantos Swett, the president of the Lantos Foundation Human Rights and Justice.

The former heads of OTF told Vice that they received a threatening call from Swett basically saying that if OTF didn't fund these questionable apps, she would lean on Pack to retaliate against OTF:

In March, around the time Trump decided to pressure Republicans in the Senate to confirm Pack’s appointment, Libby Liu, OTF’s CEO, and Laura Cunningham, OTF’s president, got a phone call from Swett and her colleagues to discuss funding for large-scale circumvention tools to help people in China bypass the Great Firewall.

Swett described it as “a very professional and a very cordial call,” but that’s not how Liu and Cunningham remember it.

“It was quite threatening,” Cunningham told VICE News. “They said that they were very close with Michael Pack [and] told us that there was a lot of disappointment that we were not funding the most effective circumvention tools out there. Their advice was that if we wanted to make sure we stayed in CEO Pack’s good graces, that we needed to reorient our funds immediately to support those technologies.”

Liu says Swett and her colleagues “lectured us, you know, round robin-style, and threatened us.”

Vice also shows Horowitz showing up on Steve Bannon's radio show last month directly saying that Libby Liu should be fired (though he mistakenly claims she's part of Radio Free Asia, which used to house OTF, but OTF has been spun out separately from RFA for a while now):

In that video, you see Bannon ask Horowitz to repeat the name of who he wanted fired, and apparently write down Liu's name while saying "okay." Days later, Liu and Cunningham were both fired by Pack (incredibly, Liu had already resigned, but Pack doubled down and fired her anyway).

In response, OTF itself and the board members of many of the USAGM organizations have now sued Michael Pack, arguing that he has no right to fire people:

Although funded by Congress through grants administered by the Agency, the four organizations targeted by Mr. Pack are not part of the government. Their employees are not government employees. They are private, nonprofit organizations with their own leadership and independent boards of directors. That is by design. Their mission, collectively, is to promote the free flow of information worldwide, especially in countries where authorities restrict freedom of expression. They do this through global efforts to combat online censorship and news broadcasts in 61 different languages, reaching 400 million people each day. But they can only be effective in countering disinformation and censorship if they are rightly perceived as independent, professional, and fact-driven—not as official mouthpieces for some partisan agenda. To ensure the integrity and credibility of this vital work, their independence from political interference is protected by a strict “firewall” embodied in statutes, regulations, and binding contract provisions. Mr. Pack’s actions this past week constitute the most egregious breach of that firewall in history.

[....]

Mr. Pack’s actions are unlawful in at least two critical respects. First, with respect to Open Technology Fund—an independent nonprofit dedicated to advancing global Internet freedom— Packlacks any legal authority whatsoever to remove its officers or directors. The statutory authority and bylaws on which Mr. Pack purported to rely do not remotely confer any such authority.Second, although Pack does have limited statutory authority with respect to personnel decisions at the other three organizations, that authority is strictly constrained by statute, regulation, and contract. With respect to all four organizations—Radio Free Europe, Radio Free Asia, the Middle East Broadcasting Networks, and Open Technology Fund—Mr. Pack’s attempt to remove the organizations’ officers and directors across the board constitutes an impermissible breach of the “firewall.” So does his attempt to freeze funds. Indeed, in each of its grant agreements with these organizations, the Agency has pledged to honor these statutory and regulatory obligations and is prohibited from “tak[ing] any . . . action that may tend to undermine” the organizations’ “journalistic credibility or independence.”Mr. Pack’s actions impermissibly breach the “firewall.” It is hard to conceive of a more serious breach of the organizations’ legally protected independence than the wholesale decapitation of their leadership by an ideologically-oriented maker of political films, installed by the President for the stated purpose of altering the organizations’ content.

On top of that, it seems that these moves by Pack to clean house have at least raised surprisingly bi-partisan concerns in Congress. A group of Senators led by Marco Rubio have sent a letter to Pack demanding an explanation and making it clear that USAGM is supposed to be independent of politics.

As the United States faces global challenges in the information space, it cannot afford to invest in an enterprise that denigrates its own journalists and staff to the satisfaction of dictators and despots, nor can it be one that fails to live up to its promise of providing access to a free and independent press. Congress set up these networks, and its governance structure at USAGM, to preserve the grantees’ independence so they can act as a bulwark against disinformation through credible journalism.

We urge you to respect the unique independence that enables USAGM’s agencies and grantees to help cultivate a free and open world. Given the bipartisan and bicameral concern with recent events, we intend to do a thorough review of USAGM’s funding to ensure that United States international broadcasting is not politicized and the agency is able to fully and effectively carry out its core mission.

Beyond Rubio, the letter is signed by some fairly powerful Senators on both sides of the aisle: Dick Durbin, Lindsey Graham, Pat Leahy, Jerry Moran, Susan Collins and Chris Van Hollen. Will it convince Pack to back off? Who knows, but at least it's nice to see that in this one very important area, some Senators have the backbone to push back against what appears to be a very swampy, corrupt move by this administration.

Filed Under: censorship, libby liu, marco rubio, michael pack, open source, open technology fund, usagm
Companies: open technology fund, radio free asia, radio free europe, voice of america

Germany's CDU, Angela Merkel's Party Of Fuddy-Duddies, Decides To Join The Cool Kids: Backs Open Standards, Open Source, Open Data, Open APIs -- Open Everything

from the it's-groovy,-man dept

The Christian Democratic Union (CDU) of Germany is Angela Merkel's party. She led it for 18 years before resigning last year as leader, but remaining as Chancellor of Germany until 2021. It is a party that has often held the reins of power in Germany, but has seen a steady decline in membership over the last 30 years. From a peak of nearly 800,000 in 1990, it is now down to around half that. According to figures on Wikipedia, in 2012, the members' average age was 59 years, and 6% of the Christian Democrats were under 30 years old. In other words, it is German's party of old fuddy-duddies. Against that historical background, the following passage from its "Digital Charter", agreed during its recent party conference, is noteworthy (original in German pdf):

The open and jointly developed standards of the Internet and open interfaces are the principles from which we advance the digitisation of Germany. It is only through openness that competition can be created; only through openness can new players in competition challenge the top dogs. This is why the following will apply to all (public) digitisation projects in Germany in the future: the awarding of contracts and funding will be subject to compliance with the principles of open source and open standards. Software financed by public funds should serve all citizens. In addition, free and open APIs should facilitate access for independent developments.

That's an impressive hit-rate for the "opens": openness, open interfaces, open source, open standards. Also thrown in for good measure is the idea that publicly-funded code should be available to everyone -- presumably as open source. Elsewhere in the document, the Digital Charter speaks approvingly of open data and open educational resources (OER), and promises to create an "open public repository" of re-usable digital components. On the downside, the document also includes the usual platitudes about blockchains, AI, 5G and "smart cities", as well as rolling out tired buzzwords such as "agility", "sandboxing" and "decentralization".

Nonetheless, the emphasis on openness in all its forms is striking and thoroughgoing. The Digital Charter may not commit the party to doing anything concrete very soon. But it's a clear and welcome sign that openness has entered the mainstream to such an extent that even the fuddy-duddies get it.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: angela merkel, cdu, germany, open, open interfaces, open source, open standards