Another Bad EU Ruling: WiFi Providers Can Be Forced To Require Passwords If Copyright Holders Demand It

from the really-now? dept

For quite some time now, we've been following an odd case through the German and then EU court system, concerning whether or not the operator of an open WiFi system should be liable for copyright infringement that occurs over that access point. Back in 2010, a German court first said that if you don't secure your WiFi, you can get fined. This was very problematic -- especially for those of us who believe in open WiFi. The EU Court of Justice agreed to hear the case and the Advocate General recommended a good ruling: that WiFi operators are not liable and also that they shouldn't be forced to password protect their access points.

The ruling, unfortunately, says that WiFi operators can be compelled to password protect their networks. It's not all bad, in that the headline story is that WiFi operators, on their own, are not liable for actions done on the network, but that's completely undermined by the requirement to password protect it if a copyright holder asks them to.

In today’s judgment, the Court holds, first of all, that making a Wi-Fi network available to the general public free of charge in order to draw the attention of potential customers to the goods and services of a shop constitutes an ‘information society service’ under the directive.

Next, the Court confirms that, where the above three conditions are satisfied, a service provider such as Mr Mc Fadden, who providers access to a communication network, may not be held liable. Consequently, the copyright holder is not entitled to claim compensation on the ground that the network was used by third parties to infringe its rights. Since such a claim cannot be successful, the copyright holder is also precluded from claiming the reimbursement of the costs of giving formal notice or court costs incurred in relation to that claim.

However, the directive does not preclude the copyright holder from seeking before a national authority or court to have such a service provider ordered to end, or prevent, any infringement of copyright committed by its customers.

Lastly, the Court holds that an injunction ordering the internet connection to be secured by means of a password is capable of ensuring a balance between, on the one hand, the intellectual property rights of rightholders and, on the other hand, the freedom to conduct a business of access providers and the freedom of information of the network users. The Court notes, in particular, that such a measure is capable of deterring network users from infringing intellectual property rights.

The details here are especially troubling. As legal experts are noting, this ruling basically says that the times when an injunction can be ordered for password protection, the reason is for the sake of identifying users:

In McFadden the CJEU appears to have decided that password protection would be effective only if the user is required to provide identity details to the service provider so that the user cannot act anonymously.

Now that should raise some very serious concerns about anonymity and privacy -- things that we thought the EU supported. Instead, the CJEU basically seems to be saying you have a right to anonymity in connecting to the internet up until the point a major copyright holder doesn't like it any more, and they can now force WiFi operators to lock up their WiFi and/or demand identification to use it. Yikes.

This also punches a HUGE hole in the previous day's announcement by the EU Commission that there would be open WiFi across Europe. Under this new CJEU ruling, that may no longer be possible. It's fairly incredible how, between the European Court of Justice and the EU Commission, they seem so oddly confused about copyright and related issues that they seem to be messing absolutely everything up in just a few short weeks.

Filed Under: cjeu, copyright, eu court of justice, injunctions, liability, mcfadden, open wifi, passwords, wifi

French Law Enforcement 'Wishlist' Includes Banning Open WiFi, Tor Connections And Encrypted Communications

from the the-War-on-Citizens dept

More bad news for French citizens. Not only were they recently attacked by terrorists, but now their government is using these attacks against them to strip away civil liberties and shift more power to police and intelligence agencies.

A document viewed by Le Monde contains several very concerning suggestions from government agencies on how to better combat terrorism -- starting with blacklisting suspicious people and detaining them with administrative police orders. (via Galou Gentil and Numerama)

That's only the beginning of the wishlist. The document is not, by any means, a formal presentation of future legislative issues, but rather the equivalent of an open "suggestion" box, which has now been filled with terrible ideas by law enforcement agencies. How seriously French legislators take these suggestions won't be seen until early next year when the legislature reconvenes.

Other suggestions from "local police and gendarmes":

• Nonconsensual searches of vehicles and luggage (apparently without proper legal justification)
• "Papers please" identity checks, again with minimal legal justification
• Forcing those on the receiving end of administrative searches to give up DNA samples

From that point, law enforcement starts asking for more ways to control communications.

• Banning open WiFi connections during a state of emergency.

It's unclear whether they're looking for a preemptive ban or simply a kill switch. Either way, the state of emergency in France has been extended, and may never truly go away. If so, the ban/kill would be as permanent as the state of emergency itself. Open or shared connections would be subject to criminal sanctions.

• Blocking TOR connections in France
• Identifying communication sources (including VOIP) in France and forcing purveyors to hand over encryption keys

Back in the physical realm, police also want the power to shut down roads to search for vehicles -- again with little to no legal justification. They also want a centralized database containing information on anyone renting hotel rooms or vehicles.

As Le Monde notes, some of the requests fall outside of the realm of possibility and several fall outside the constraints of France's constitution. But the latter is definitely malleable. The government can't do anything about the impossible but it can use the current state of emergency to carve more holes in the rights of its citizens.

How seriously these requests will be taken remains to be seen. The post-terrorist attack spitballing by law enforcement agencies almost reaches the point of self-parody. Le Monde snarkily notes that it's not sure if this wishlist was meant for legislators or for "Santa." But it also notes that the expanded-government-power Santa may actually be presiding over this wishlist, unfortunately.

Santa has a new name: State of Emergency.

Whether or not any of this makes its way into actual law, it still clearly documents the law enforcement mindset -- one that never stops looking for ways to expand its own power at the expense of the citizens it's supposed to serve.

Filed Under: bans, encryption, france, going dark, law enforcement, open wifi, over reaction, paris attacks, state of emergency, tor

No Immunity For Cops Who Sent A SWAT Team To A 68-Year-Old Woman's House For Threats Delivered Over Open WiFi Connection

from the probable-cause-=-'internet-threats-plus-an-internet-connection...-somewhere& dept

Earlier this year, we covered the story of Louise Milan, a 68-year-old grandmother whose house was raided by a SWAT team (accompanied by a news crew) searching for someone who had made alleged threats against police officers over the internet. Part of the probable cause submitted for the warrant was Milan's IP address. But the police made no attempt to verify whether any resident of Milan's house made the threats and ignored the fact that the IP address was linked to an open WiFi connection.

While the presiding judge did take issue with the tactics deployed by the SWAT team (which included turning a regular warrant into a no-knock warrant by only giving Milan a few seconds to respond to their knock before battering down the door and hurling flashbang grenades into the house), he didn't have much to say about the department's bogus "an IP address is a person" justification for the raid. This was concerning because the police verified the IP address by wardriving. By doing so, they also could have confirmed the WiFi connection was open and that the threats could have been made by anyone accessing that connection.

The judge, however, refused to grant the defendants summary judgment on the excessive force claims or immunity. This decision was appealed by the police department, which still insists it should be granted qualified immunity. The Seventh Circuit Court of Appeals has a lot to say about the police officers' actions during this raid and the events leading up to it, none of it good.

First, it points out that the police officers could have performed their due diligence on the IP address before deciding to carry out a raid, but chose not to.

The defendants say they didn’t know that Mrs. Milan’s network was unsecured and therefore accessible by someone outside the house who could use the unsecured network to send the threatening messages. Although the police had discovered that there was an unsecured network near the house, they hadn’t bothered to find out whose network it was, as they could easily have done, precisely because it was unsecured and therefore accessible. Had they done that they would have known that it was Mrs. Milan’s network and, since it was unsecured, that it might have been used (without her knowledge) by someone outside her home to send the threatening messages. The failure to discover that the network was Mrs. Milan’s was a failure of responsible police practice.

The court notes that the officers' irresponsibility didn't end there. They also ignored the fact that a man who had made threats against officers in the past (Derrick Murray) was spotted sitting on a porch two houses away from Milan's by officers prior to the raid. (And, indeed, Murray watched the raid unfold from this same porch.) They also ignored the fact that none of the three other people they suspected of making the threats (former residents of the house/distant relations of Milan) had been observed entering or exiting the house. Instead, they took the IP address and the info obtained from the service provider and went after Milan. And, despite having no evidence someone dangerous might be in Milan's house, deployed a SWAT team.

So: a house occupied by an elderly woman and her two daughters; no evidence that any criminals would be present during the search although the possibility could not be excluded entirely; no effort to neutralize suspect Murray during the search, as by posting police to watch his house and make sure he didn’t rush over to Mrs. Milan’s house when the search began. But despite their insouciance about Murray and the perfunctory character of their investigation before the search, the police decided to search the Milan house—and in a violent manner.

The "violent manner" is described in greater detail in the opinion. The court grants itself a short tangent during its recounting of the incident to criticize the lingo cops deploy to downplay the violence of their methods and weaponry.

A search warrant was applied for and obtained, and the search was conducted by an eleven-man SWAT team accompanied by a news team. The members of the SWAT team rushed to the front door of the house, knocked, and without allowing a reasonable time—more than a few seconds—for a response (though they hadn’t gotten a “no knock” warrant) broke open the front door and a nearby window, and through these openings hurled two “flash bang” grenades. These are explosive devices, similar to but a good deal less lethal than military hand grenades, that are intended to stun and disorient persons, thus rendering them harmless, by emitting blinding flashes of light and deafening sounds. They can kill if they land on a person, especially a child. The police call them “distraction devices,” an absurd euphemism; we called them “bombs” in Estate of Escobedo v. Bender, 600 F.3d 770, 784–85 (7th Cir. 2010), and United States v. Jones, 214 F.3d 836, 837–38 (7th Cir. 2000).

Then the court gets to the most absurd part of the raid -- considering the danger the police were attempting to neutralize by assaulting both Milan and her house.

That no men were found in the house during the raid confirmed the police in their belief that Murray was responsible for the threats. It took them only a day to discover that it was indeed he who was responsible—he had used Mrs. Milan’s open network to threaten the police. But rather than give him the SWAT-team treatment, the police politely requested that he come to police headquarters, which he did, where he was arrested without incident. The police department’s kid-gloves treatment of Murray is in startling contrast to their flashbang assault on Mrs. Milan’s home.

On top of that, even when it was evident there was no danger and none of the suspects were present, the SWAT team refused to dial back its aggressive tactics.

The handcuffing of the daughter, looking indeed much younger than her 18 years, is shown on the helmet video along with the rest of the search, and she is so small, frail, utterly harmless looking, and completely unresisting that the sight of her being led away in handcuffs is disturbing. All that the SWAT officer had to do was take her by the hand and lead her out of the house, which was rapidly filling with smoke from the flash bangs; there was no conceivable reason to handcuff her.

Everything about the raid bothers the Seventh Circuit Court. The lack of actual investigative work. The over-the-top tactics. The fact that a unit deploying flashbang grenades couldn't even be bothered to ensure any more damage than "necessary" wasn't done.

Precipitate use of flash bangs to launch a search has troubled us before, leading us to declare that “the use of a flash bang grenade is reasonable only when there is a dangerous suspect and a dangerous entry point for the police, when the police have checked to see if innocent individuals are around before deploying the device, when the police have visually inspected the area where the device will be used and when the police carry a fire extinguisher.” Estate of Escobedo v. Bender, supra, 600 F.3d at 784–85. The police in this case flunked the test just quoted. True, they’d brought a fire extinguisher with them—but, as if in tribute to Mack Sennett’s Keystone Kops, they left it in their armored SWAT vehicle.

The court notes that reasonable mistakes made by officers do not nullify qualified immunity, even when the mistakes seem less reasonable by the application of hindsight. But there was nothing reasonable about this entire debacle.

We cannot understand the failure of the police, before flash banging the house, to conduct a more extensive investigation of the actual suspects: Murray, living two doors away from the Milan home and thus with ready access to Mrs. Milan’s open network, and the male Milans. The police neglect of Murray is almost incomprehensible. His past made him a prime suspect. A day of investigating him would have nailed him, as we know because a day of investigating—the day after the violent search of the home—did nail him.

More to the point, the lack of even minimal investigative efforts precludes the department from claiming these "mistakes" were "reasonable."

[T]o repeat for emphasis, the police acted unreasonably and precipitately in flash banging the house without a minimally responsible investigation of the threats. The open network expanded the number of possible threateners and just one extra day of surveillance, coupled with a brief investigation of Murray and the three male Milans, should have been sufficient to reassure the police that there were no dangerous men lurking in the house.

In other words, had the police officers actually performed any sort of police work, Milan's house would have been left unmolested/un-flashbanged and she wouldn't be suing the department for civil rights violations. This lawsuit could have been avoided entirely and the police were obviously capable of taking down a much more dangerous target without extra drama and explosives. But it had a news crew in tow -- one it was apparently "repaying" for the tips about the social media threats. And once it had eyes on it, it couldn't help but deploy its ridiculous "shock and awe" tactics... to take down a 68-year-old grandmother and her "small, frail" daughter.

Filed Under: derrick murray, louise milan, open wifi, police, raid, swat, wifi

Judge Not Too Concerned That 68-Year-Old Woman's House Was Raided Because Someone Used Her Open WiFi To Post A Threat

from the an-IP-address-isn't-a-person dept

We've written before about faulty legal activities based on nothing stronger than an IP address. An IP address is not a person, but many entities have decided it's "close enough." Fortunately, the judicial system has (occasionally) stepped in to correct this assumption, usually in the context of copyright infringement lawsuits.

There are those in the law enforcement arena that know an IP address can't be used as an identifier. Careless statements get made about the "danger" of open WiFi connections, or it's suggested that accessing open networks should be illegal. This doesn't have much to do with keeping citizens safe, but it does have everything to do with easing law enforcement's investigative workload.

A lawsuit filed against the Evansville, Indiana police department is being allowed to move forward. [pdf link] The suit centers on the raid of a 68-year-old woman's house -- a raid predicated on an IP address related to an unprotected WiFi connection.

In June of 2012, threats against the police department were posted to Topix.com.

The following posts were discovered under the heading “EPD leak!!! All officers addresses are being passed around Evansville”:

“Me n my boys need them copys asap.need to pay a few a visit.”

“[Chief] Bolin lives behind parkside”

“Lol at all da cops commenting,f#+k the police.you mfs need to b taught a lesson,always harassing n violating mfs rights. 4th of July a cops house gonna got hit.dont care about your kids or btchs lives.I dnt even care about my own life.I got my reasons…times ticking.?”

“Cops be aware.Note:I am proud of my county,but I hate police of any kind..I have explosives.:) made in America.Evansville will feel my pain.guess who’s in the river.”

The police -- possibly tipped off by a news reporter (there were also unverified claims about the FBI contacting the EPD) -- began an investigation. The EPD subpoenaed Topix and the local cable provider to discover the user's information. The information traced back to 68-year-old Louise Milan's house. Information was verified by police wardriving, confirming that there was an open WiFi connection in the vicinity of Milan's residence.

Also discovered during the initial surveillance was known gang member Derrick Murray, who was two houses down sitting on his mother's porch.

A search warrant for the Milan residence was obtained, but notably did not include mention of either Derrick Murray or the unsecured wireless network. Instead, the warrant request asserted that the device from which the threats had been posted was actually in Milan's home.

The request also stated that “in order for a particular electronic device to utilize a particular IP address, . . . [it] requires the electronic device to be IN the residence of 616 E. Powell Avenue to access the internet provided . . . to the residence.”

Further investigation uncovered the criminal activities of Milan's stepson, Anthony Milan and HIS son, Anthony Milan, Jr. This was used by the EPD -- despite neither of these Milans having resided at Louise Milan's residence for over four years -- to tie Milan's home in with the online threats.

Using this information -- much of it faulty or circumstantial -- the EPD determined that the only "safe" way to approach the Milan residence was a SWAT raid. This plan moved ahead despite statements made indicating the EPD knew it was raiding the wrong person's house.

This decision was made, and ultimately carried out, despite the fact that Murray—and not Milan or her relatives—was identified during the “pre-raid briefing” as likely being “ultimately responsible” for the threats.

Helmet cam video of the raid shows how it went down. It was not a "no-knock" warrant, but the "knock" delivered by the SWAT team had very little to do with announcing its presence and everything to do with giving itself permission to smash through the front door and hurl flashbangs into the house.


Louise Milan and her 18-year-old granddaughter were cuffed and led from the house at gunpoint. Their computer was seized. Two days later, the police raided Derrick Murray's residence and recovered the device used to post the threats to Topix. Notably, Murray watched the raid of Milan's house go down from the comfort of his mother's porch.

Shortly thereafter, Milan filed suit against the police department and the city of Evansville, claiming her rights were violated by the SWAT team raid. [pdf link]

Judge William T. Lawrence addresses each of Milan's complaints and, unfortunately, dismisses most of them. For Milan's claim of unreasonable search and seizure, Lawrence states:

When Detective Brown made this statement, however, he knew that an unsecured Wi-Fi network in a residence may be accessed from outside the home. The Court is troubled by Detective Brown’s statement. Even so, the Court finds that his statement did not render the search warrant invalid. Even if Detective Brown had stated that Milan’s router could be accessed from outside the home, the warrant would still be supported by probable cause. The threats were made using Milan’s IP address; “though it was possible that the transmissions originated outside of the residence to which the IP address was assigned, it remained likely that the source of the transmissions was inside that residence.”

The dismissal of the false arrest claims follows in line with Judge Lawrence's determination that the search warrant was valid, despite Detective Brown's false assertions. If the search warrant was valid, the detainment was valid. That Milan was only detained for 20 minutes also factored into this decision.

But when it comes to Milan's accusation of unreasonable force, Judge Lawrence finds enough evidence to allow the lawsuit to proceed.

Officers are allowed to use tactics and force they deem necessary to control a potentially dangerous situation. Law enforcement agencies are granted a lot of leeway by the courts when it comes to raids like these. But Judge Lawrence finds the EPD's assertion that the methods used were necessary because of the potential danger short on evidence of actual danger.

He points again to the the fact that the pre-raid briefing made it clear that Derrick Murray -- not anyone in the Milan residence -- was the most likely suspect. The fact that the posted threats declared July 4th (still two weeks away at the time of raid) to be the day the acts would be carried out also indicated that there was minimal danger in approaching the Milan residence.

Furthermore, the police chief invited a news crew to be on hand for the raid (as "repayment" for the threat tip) -- again suggesting the danger level was rather low. Coupled with the fact that the SWAT team broke through the glass door and threw (rather than carefully placed) distraction devices into the home within seconds of arrival brings Judge Lawrence to the following conclusion.

It is questionable whether the officers had sufficient time to look inside to ensure that no one would be injured by the devices. It is also undisputed that the officers were not carrying a fire extinguisher during the search. These facts lead the Court to conclude that there are questions of fact regarding whether the Defendants’ actions were unreasonable and excessive. Thus, summary judgment on this issue is not appropriate. The Court therefore DENIES summary judgment as to this claim.

Then Judge Lawrence goes further, declaring that the excesses of the EDP's use of force are enough to strip it of qualified immunity.

As detailed above, the decision to use the SWAT team and the distraction devices was made based solely on the nature of the threats and the small possibility that Milan, Sr., Milan, Jr., or Marc were responsible for the threats and would be found inside Milan’s home—that is it. The officers, however, did not see any of those men enter or leave Milan’s residence during their period of surveillance. Additionally, the officers suspected that Milan’s WAP was unsecured and that Murray was “ultimately responsible” for the threats long before they executed the search warrant at Milan’s home. Thus, there was little—if any—evidence that they would encounter a violent person. As discussed above, there was also no emergency situation (as the threat was for July 4), the officers did not carry a fire extinguisher, and the videos arguably indicate that the officers did not have sufficient time to look inside the residence for individuals who might be harmed before tossing (rather than placing) the distraction devices into Milan’s home. Lastly, there did not appear to be a dangerous point of entry. It was a clear day, and the front door (but not the storm door) was open when the SWAT team arrived.

For these same reasons, the Court also concludes that the EPD’s use of force “so clearly exceeded the bounds of reasonableness in the circumstances that it cannot be said to lie near the ‘hazy border between excessive and acceptable force’ along which qualified immunity shields officers from liability for their snap judgments, if those judgments prove to be wrong upon further reflection.” Id. at 786. These were not snap judgments; they were methodical and deliberate decisions, which were based on limited facts and an incomplete investigation. A reasonable officer would know that the EPD’s actions were constitutionally excessive.

While Judge Lawrence's decision to overlook Detective Brown's portrayal of an open WiFi network as a positive indicator of a device's location is unfortunate, his refusal to grant summary judgement against claims of excessive force and his stripping of the principals' qualified immunity somewhat mitigates this. This entire debacle was based on a purposefully wrong assertion, but the Evansville PD has been spared having to answer directly for this misrepresentation.

Filed Under: evansville, indiana, open wifi, police, swat team, wifi

European Court Of Justice To Consider Legal Ramifications Of Offering Open WiFi

from the this-could-be-important dept

Lawyer Martin Husovec has a post detailing an important case that has been referred to the EU Court of Justice, which could have a tremendous impact on legal liability for those who offer open WiFi in the European Union. It's tough to improve on Martin's summary of the post, so here it is:

The case arose between an entrepreneur selling light and audio systems who is also a member of the German Pirate Party and record label. The entrepreneur operates an open and free of charge WiFi in his store. He uses the WiFi sometimes as a tool for advertising of his store (preloaded home page points to his shop and name of the network bears its name) and sometimes to agitate for his political views (pointing to particular websites such as data protection campaigns, etc.). After receiving a letter informing him about a copyright infringement allegedly committed via his hot-spot, the entrepreneur unusually sued the right holder pursuing the negative declaratory action. The right holder as a defendant later counter-claimed asking for damages, injunctive relief and pre-trail costs as well as court fees under the above mentioned doctrine of BGH.

The referring court is hesitant whether mere conduit safe harbour of Article 12 allows especially for injunctive relief on which the German concept of Stoererhaftung is based. It points to similar cases before the Hamburg court (Case No. 25b C 431/13 and Case No. 25b C 924/13) that recently denied such claims arguing that mere conduit safe harbour prevents them. The court comes to conclusion that the plaintiff did not infringe the rights himself, and thus is considering what kind of measures can be imposed on a WiFi operator such as defendant. It is very symptomatic to German case-law on injunctive relief that the Munich court does not even mention applicability of Article 8(3) InfoSoc in this case. Despite the fact that its case is clearly about its local transposition and European limits.

He then digs deep into the specific questions raised by the court, and I recommend reading his detailed thoughts and explanations of what the different questions likely mean and the possible risks from different outcomes. The end result, though is that either some basic safe harbors could be established for those offering WiFi (as is mostly the case here in the US), or the court can continue to drag the EU in the other direction, putting often draconian liability and regulations on those who merely offer open WiFi. Martin "hopes" the court won't add to the burdens of open WiFi operators by increasing liability and rules. However, he also notes that it's a chance for the court to actually protect and encourage free WiFi by clearing up that merely offering it shouldn't make one liable for the actions on that network. But, he points out:

In order this to happen, somebody should explain the court the innovative potential and social use of open WiFis beyond mere household use, which most of the judges are [only] familiar with.

In other words, this is an important case to watch for those of us who believe in the value and importance of open WiFi.

Filed Under: eu, eucj, intermediary liability, open wifi, passwords, wifi

Appeals Court Says Using Open WiFi May Be A Crime

from the uh-oh dept

For many years, we've had ongoing debates about whether or not it's ethical or legal to use open WiFi connections. It's one of those debates that never seem to stop. Unfortunately, in a ruling yesterday, the Third Circuit appeals court suggested that merely using an open WiFi network may be a criminal act. This is hugely problematic for a variety of reasons.

The case is mainly about the question of whether or not police need a warrant to track down someone connecting to a neighbor's open WiFi. In fact, on first reading it, I had thought that I'd lump it in with yesterday's big victory for the 4th Amendment in the 11th Circuit, saying that police need to get a warrant for mobile phone location. The main thrust of this new ruling is that police do not need a warrant to use a tool called "MoocherHunter" to track down who is likely using someone else's WiFi. While I'm a big 4th Amendment fan, this ruling actually makes a fair bit of sense on that front, as I'll explain below. But eventually, it runs into serious trouble with some offhand comments towards the end.

In this case, police were trying to track down someone downloading and sharing child pornography via a P2P setup, and were able to track down the IP address. After visiting the residence associated with the IP address, the police quickly realized that no one in the house was the likely person involved with child porn (there was no child porn on the computers, nor the file sharing software with a matching user ID). From there, the police asked the residents to cooperate by installing "MoocherHunter" to try to track down who was actually connecting to their open router. It's worth noting that the police actually had a "lengthy discussion" with federal prosecutors over whether or not a warrant was needed for MoocherHunter first, and they concluded it wasn't needed.

Eventually, the results were narrowed down to the likely culprit, Richard Stanley, and the police then got a warrant to search that guy's apartment, leading him to confess (after first trying to run away). Stanley's computer also contained the child porn. Stanley tried to suppress the evidence, arguing that the use of MoocherHunter required a warrant, not unlike the Kyllo ruling that found that police needed a warrant to use a thermal imaging device from outside someone's house to detect if there was enough heat inside to support probable cause for growing marijuana. The court here notes that while, superficially, these may look similar (a device pointed at someone's residence), the reality is that they were quite different, because Kyllo was about looking inside someone's house to see what they were doing in the privacy of their own home, whereas MoocherHunter was about identifying someone who had reached out of their own home into someone else's space to make use of their WiFi connection.

Critical to Kyllo’s holding, however, was the fact that the defendant sought to confine his activities to the interior of his home. He justifiably relied on the privacy protections of the home to shield these activities from public observation. See Kyllo, 533 U.S. at 34 (characterizing the thermal imaging scan as a “search of the interior of [Kyllo’s] home[],” which it considered to be “the prototypical . . . area of protected privacy”). See 13 also id. at 37 (“In the home, our cases show, all details are intimate details, because the entire area is held safe from prying government eyes.”) (emphasis in original).

Stanley can make no such claim. Stanley made no effort to confine his conduct to the interior of his home. In fact, his conduct—sharing child pornography with other Internet users via a stranger’s Internet connection—was deliberately projected outside of his home, as it required interactions with persons and objects beyond the threshold of his residence. In effect, Stanley opened his window and extended an invisible, virtual arm across the street to the Neighbor’s router so that he could exploit his Internet connection. In so doing, Stanley deliberately ventured beyond the privacy protections of the home, and thus, beyond the safe harbor provided by Kyllo....

The court further emphasizes that since MoocherHunter only revealed the path, but not the content, Stanley has even less privacy interest. That all makes some amount of sense. The court then has an interesting discussion about the third party doctrine, and whether or not Smith v. Maryland applies to Stanley's signals. In this case, it concludes it does not. And while the reasoning is a bit convoluted, this seems important:

Were we to hold that Stanley exposed his “signal” under Smith by transmitting it to a third-party router, we might open a veritable Pandora’s Box of Internet-related privacy concerns. The Internet, by its very nature, requires all users to transmit their signals to third parties. Even a person who subscribes to a lawful, legitimate Internet connection necessarily transmits her signal to a modem and/or servers owned by third parties. This signal carries with it an abundance of detailed, private information about that user’s Internet activity. A holding that an Internet user discloses her “signal” every time it is routed through third-party equipment could, without adequate qualification, unintentionally provide the government unfettered access to this mass of private information without requiring its agents to obtain a warrant. We doubt the wisdom of such a sweeping ruling, and in any event, find it unnecessary to embrace its reasoning.

That's a very good ruling. But, then, suddenly, the ruling goes off the rails, saying that merely connecting to the open WiFi itself may have been a criminal act:

The presence of Stanley’s signal was likely illegal. A large number of states, including Pennsylvania, have criminalized unauthorized access to a computer network. A number of states have also passed statutes penalizing theft of services, which often explicitly include telephone, cable, or computer services. We need not decide here whether these statutes apply to wireless mooching, but the dubious legality of Stanley’s conduct bolsters our conclusion that society would be unwilling to recognize his privacy interests as “reasonable.”

Yikes. While the court acknowledges in a footnote that this issue is somewhat contested, it's incredibly problematic in general. Just the idea that this is unauthorized access is a big problem, because it's not unauthorized. The neighbors left their WiFi open, and thus, by default, it is sending out signals that effectively say "welcome, feel free to connect to this network." It is authorized by the very nature of the setup of the network. Thus, it's quite questionable to argue that this is either unauthorized access or "theft of services." The court doesn't even seem to consider this. And while this part is not central to the overall ruling, it is still quite troubling to have that on the record in an appeals court ruling.

Filed Under: 3rd circuit, 3rd party doctrine, 4th amendment, kyllo, moocherhunter, mooching, open wifi, richard stanley, warrants, wifi

Canadian Cyberbullying Bill Expands Scope, Targets Open WiFi Over Terrorism, Child Porn Fears

from the every-cyber-bill-a-Frankenstein's-monster dept

The drawn-out process in which a bill becomes a law lends itself to harmful things, like mission creep and bloating. Canada's new cyberbullying legislation, problematic in its "purest" form, is now becoming even worse as legislators have begun hanging language aimed at other issues (child porn, terrorism, cable theft [?]) on the bill's framework.

As was noted earlier, language aimed at punishing revenge porn had already been attached to the bill. But the urge to target as much as possible with a broadly written bill is too much for Canada's politicians to resist. Michael Geist notes that Bob Dechert (Secretary to the Minister of Justice) took a moment during the debate to speculate about the "dangers" of "stolen" cable.

With respect to the cable, I would like the member to consider if his cable were being tapped into by someone who was transmitting child pornography over the Internet, or if his home Wi-Fi was being tapped into by someone who was using it to cyberbully another child, he would want to know about that and he would want that to stop. The modernization of those provisions is simply to bring them up to date.

The amendments proposed on those long-standing offences of stealing cable are already in the Criminal Code in section 327. They simply update the telecommunication language to expand the conduct, to make it consistent with other offences…

However, I would like him to think about the potential for someone who is doing cyberbullying, transmitting child sexual images, or perhaps planning a terrorist act, doing it by tapping into some law-abiding citizen's cable or Wi-Fi Internet access.

The code Dechert refers to deals with theft of services. What Dechert is hoping to do is turn a targeted law into something that can be used to pursue vagaries. By throwing cyberbullying, child porn and terrorism into the mix, Dechert is hoping to limit opposition to this "update" of the language.

Geist doesn't think much of Dechert's statement.

In other words, Dechert is suggesting that accessing a neighbour's cable or wireless Internet access might somehow be linked to planning a terrorist attack, sending child pornography, or engaging in cyberbullying. I would happy to think about the potential for cable theft to play a role in terrorist plots. In fact, I think most would agree that there is no likelihood whatsoever and that the government should stop trying link provisions in their "cyberbullying bill" that have nothing to do with cyberbullying.

The odds, as Geist points out, are almost nonexistent. But very slim odds are a legislator's best friend. No one wants to be caught out by the unexpected, especially when they had a chance to head it off back when the bill was being written. So, a lot of "just in case" rhetoric is deployed, accompanied by fearful projections.

If this line of reasoning is allowed to proceed, Canadians could be looking at the possibility of legal penalties for running unsecured WiFi connections. It seems implausible, but this has been witnessed before. Back in 2010, a German court stated that those running open WiFi connections could be fined for not securing their networks (thus "enabling" illegal activity). Copyright maximalists have made the argument several times that an open WiFi connection is "negligent." When the realization sinks in that it's easier to target the listed subscriber rather than find out who exactly was performing criminal activities on an open WiFi connection, you can be sure that the solution will be routed along the path of least resistance: holding the subscriber responsible for the actions of others.

And, as Geist points out, the mission creep in this bill is astounding. What was meant to target cyberbullies has instead become a playground for legislators. A nearly non-existent threat is being used to beef up the penalties for cable theft, as though that part of the equation were the greatest deterrent to illegal activities. It's also concerning that the additional powers being granted to law enforcement outside of the cyberbullying scope were omitted from the government's official "introduction" to the bill (posted without the bill's text). This omission seems to indicate that the crowd-pleasing "cyberbullying" angle will allow legislators to copy-and-paste whole sections from a previously unsuccessful "lawful access" bill, itself defended with cries of "child pornography."

Filed Under: bob dechert, canada, child porn, cyberbullying, mission creep, open wifi, politics, terrorism

Six Strikes Administrator: Loss Of Open WiFi Access At Cafes Is Acceptable Collateral Damage

from the really-now? dept

We recently covered some of the details of various "six strikes" policies being implemented by most of the large broadband providers in the US, noting that with Verizon's, it appeared that small businesses that offered free and open WiFi could get in trouble for doing so. TorrentFreak has followed up with Jill Lesser, the executive director of the Center for Copyright Information (CCI), the organization coordinating these plans, and discovered that this impact on small businesses is not an error, and Lesser does not seem to see a problem with it, arguing that offering such open and free WiFi is a violation of the terms of service for most small businesses.

“In addition, the terms of service on such accounts do not allow them to be used to provide free WiFi or ‘hotspots’ so the hypothetical cafe owner offering public WiFi will not be subject to the CAS if they are following their terms of service.”

Similarly, she says that if it impacts small businesses or home-based businesses that use residential accounts, she doesn't see it as a problem, since those businesses shouldn't "allow" their employees to "engage in copyright theft." Of course, it's not theft, but infringement -- and it's frustrating that someone like Lesser would misrepresent these things.

That said, her cavalier attitude towards these very common scenarios, which will have real impacts on a variety of small businesses, is unfortunate and dangerous. The importance of a fully working broadband connection to small businesses todays cannot be overstated. To suggest that all of this is okay because they're not following an almost universally ignored term in the terms of service on such accounts seems to be dismissing things way too simply.

The end result of this is likely to be a lot less public and open WiFi at a time when we actually need much more open access. That may not matter to the RIAA and MPAA -- who still don't understand the importance and value of internet access -- but it matters an awful lot to the pubilc and a variety of small businesses.

Filed Under: jill lesser, open wifi, six strikes, small businesses
Companies: cci, verizon