EU Law Enforcement Preps To Start Sharing Sensitive Data With A Number Of Human Rights Abusers

from the gotta-destroy-lives-to-save-lives-I-guess dept

The EU Commission made a lot of noise about protecting the data of European citizens, resulting in the passage of a law that's almost impossible to avoid breaking. I guess those protections won't be extended to anyone a number of governments consider to be threats to national security. Even worse, this data will be shared with governments known for executing their critics. (h/t War On Privacy)

European Union officials have begun talks with counterparts in several Middle Eastern countries, including Egypt and Turkey, about proposed data-sharing deals that would allow Europol to exchange personal information about suspects with local law enforcement authorities.

In some circumstances, the deals could allow the transfer of data concerning a person’s race and ethnic origin, their political opinions and religious beliefs, trade-union memberships, genetic data and data concerning their health and sex life.

The deals are being sought by the EU as part of efforts to bolster counter-terrorism policing across the continent despite concerns being raised about the human rights records of the countries by the bloc’s own data protection watchdog.

When someone starts talking about terrorism and national security, all rational thought goes out the window. The EU will share data with Egypt, which recently made the news for executing nine people who claimed their "confessions" were tortured out of them.

Turkey isn't much of an improvement, seeing how its government also likes to jail critics -- going so far as to use other countries' laws against foreigners to punish non-Turkish citizens for insulting the president.

It's hard to see how all of the data being shared is relevant to multi-national terrorism investigations. In fact, much of what would be shared seems more like blackmail material than evidence tying people to terrorist groups or acts. Why else would the EU include data about targets' sex lives?

In normal countries under normal circumstances, data about political and religious affiliations would be off limits, as would medical information and trade union memberships. This isn't a case of creeping totalitarianism. This is full-blown enabling of existing totalitarian states, weaponizing the massive amount of data European law enforcement agencies collect on investigation targets.

The EU Commission claims this set of very personal data will only be disclosed if Europol believes it should be. Not very reassuring.

“The transfer of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data and data concerning a person's health and sex life by Europol shall be prohibited, unless it is strictly necessary and proportionate in individual cases for preventing or combating criminal offences as referred to in the Agreement and subject to appropriate safeguards,” the directives say.

The same EU government that condemned Egypt's ongoing human rights abuses has no problem giving it data ammo to use against critics, dissidents, and activists. It seems like the claims about "appropriate safeguards" will be ignored if Europol feels the data it could obtain from other countries necessitates increased quid pro quo. Whatever oversight Europol has is probably no better than any other massive law enforcement/counter-terrorist agency, which usually ranges from slim to none.

Human rights abuses aren't going to stop as long as major nation-states continue to treat abusive governments as equals on the national security playing field. Just as certainly as Turkey has weaponized US-based social media moderation tools to silence critics, other governments seeking to permanently silence critics will weaponize this proposed data sharing to achieve the same ends. The world won't be any safer, but it might be just a bit more silent.

Filed Under: data sharing, egypt, eu, law enforcement, personal information, privacy, turkey

Lawyer: Yahoo Lost Sec. 230 Immunity Because It Didn't Hand Over Personal Info; Court: GTFO

from the please-allow-me-to-entertain-you-with-my-legal-theories dept

Sometimes litigants start out with a good case... or at least a credible one. Then they ruin it by getting creative. The day-to-day work of adjudicating may be a bit dry, but novel legal arguments rarely provide anything more than entertainment for bystanders.

Lawyer and author Thomas Hall originally sued three individuals for alleged online harassment. According to his first complaint, Hall had drawn the ire of supposed white supremacists who bombarded him with hundreds of "threatening and disparaging emails." Hall sought a restraining order against the three defendants, but apparently needed a bit more personal info before he could get that order approved. [via Eric Goldman]

That's when he got creative. Having received no help from Yahoo in identifying the people behind the alleged harassment campaign, Hall decided to sue Yahoo as well. That's when the case went from credible to WTF. From the decision [PDF]:

On August 29 2014, Hall filed the instant action against Lund, Jessop, and Dunk for intentional infliction of emotional distress, libel, false light invasion of privacy, and invasion of privacy. In addition to those named or identified in the previous harassment action, Hall named as a defendant derHoaxster@gmail.com (derHoaxster), and alleged that derHoaxster had “published multiple statements disparaging Plaintiff as dishonest in his law practice and in his personal life.” Hall also named Yahoo as a defendant, based on allegations that Yahoo had published or republished threatening and defamatory statements made by Lund, Jessop, Dunk, and derHoaxster.

Yahoo, naturally, claimed it had done no such thing. It also pointed out postings by third parties were the third parties' problem, not Yahoo's. Hall, however, argued Yahoo could be proven to be responsible for the supposed republished content. The court humored him. Hall did not fail to disappoint.

On July 17, 2015, Hall filed a first amended complaint (FAC) that included the same causes of action alleged in his initial complaint as well as a new fifth cause of action against Yahoo for intentional interference with contract. In the new cause of action, Hall alleged that Yahoo had flooded his America Online (AOL) email account with more than 2000 emails denigrating AOL’s services. Hall’s FAC also alleged that Yahoo was not shielded by the CDA because Yahoo had failed to identify the users of the screen names who had posted defamatory statements about him, and that Yahoo itself was the “content provider” of those statements.

This was Hall's attempt to peel back Yahoo's Section 230 immunity. It's an interesting theory -- Yahoo's failure to identify strips it of immunity. It's also one without any legal basis. This amended complaint didn't do much for Hall. Yahoo responded with one of its own under California's anti-SLAPP law. In support of its motion, Yahoo submitted an affidavit stating it did not create any of the content in its forums, bulletin boards, chatrooms, etc.

Hall simply doubled down.

Hall opposed the demurrer and anti-SLAPP motion, arguing that Yahoo was not shielded from liability under the CDA because it had not provided, in response to Hall’s discovery requests, telephone numbers for the users of the screen names “pddunk@yahoo.com” and “derHoaxster@yahoo.com.”

The anti-SLAPP motion was granted and Hall appealed. The appeals court takes particular interest in Hall's bizarre Section 230 theories.

Hall’s argument that Yahoo was required to identify the persons who posted the objectionable content by providing the names, addresses, telephone numbers, or other identifying information for such persons is legally unsupported. The CDA contains no such requirement, and Hall cites no authority that construes the statute to impose such a requirement. Delfino v. Agilent Technologies, Inc. (2006) 145 Cal.App.4th 790 (Delfino), a case on which Hall relies, undermines rather than supports his position. The court in Delfino concluded that because “there was no evidence that Agilent [the interactive computer service provider] played any role whatsoever in ‘the creation or development’ of” the objectionable content that was the subject of the action, it clearly satisfied the third element required for a finding of CDA immunity. (Id. at p. 807.) Here, there was undisputed evidence that Yahoo was not responsible, in whole or in part, for the content of the emails and posts that are the subject of Hall’s claims. The trial court accordingly did not err by granting the anti-SLAPP motion.

As the court points out earlier in the decision, Yahoo's declaration that it did not post or publish the allegedly defamatory content went uncontested by Hall. Instead, Hall picked his misunderstanding of Section 230 as the hill to die on. On top of having his lawsuit dismissed (both for failure to state a claim and under California's anti-SLAPP law), Hall will now be paying Yahoo's legal cost.

The decision here is another reminder of two things:

1. There is still no federal anti-SLAPP law, something that would greatly discourage baseless lawsuits like these from being brought in federal court. It would also discourage the same behavior in state courts, which is where this one was filed.

2. Section 230 provides important protections for service providers who are almost always the easiest party to find and serve, even if they've done nothing else but provide a platform for people to speak their minds.

Filed Under: cda 230, intermediary liability, personal information, section 230, thomas hall
Companies: yahoo

Yes, You Can Reconcile The Wide Sharing Of Personal Medical Research Data With Greater Participant Control

from the this-is-how-to-do-it dept

Although the benefits of sharing big datasets are well-known, so are the privacy issues that can arise as a result. The tension between a desire to share information widely and the need to respect the wishes of those to whom it refers is probably most acute in the medical world. Although the hope is that aggregating health data on a large scale can provide new insights into diseases and their treatments, doing so makes issues of consent even trickier to deal with. A new study of Parkinson's disease from Sage Bionetworks, which describes itself as a "non-profit biomedical research organization," takes a particularly interesting approach. Unusually, it used an iPhone app to gather data directly from the participants:

The mPower app, built by Sage with support from the Robert Wood Johnson Foundation, collects data on capacities affected by Parkinson's disease, including dexterity, balance and gait, memory, and certain vocal characteristics, through tasks that make use of iPhone sensors. For example, to measure dexterity, participants complete a speed tapping exercise on their iPhone’s touchscreen. To evaluate speech, participants use their iPhone's microphone to record themselves pronouncing a vowel -- saying Aaaaah -- for 10 seconds. The app also allows participants to track when each task is completed alongside the time they take their medication, to help determine the effects of that medicine on their symptoms. Participants also complete regular surveys, rating the severity of their symptoms and what they think makes them better or worse.

That's a clever use of smartphone capabilities to allow people to become active participants in the study -- citizen scientists, almost -- but hardly a major breakthrough. What is much more impressive is the way in which the study has handled the issue of how widely the resulting data will be shared, and with whom:

Unlike traditional studies, mPower participants are able to choose who to share their data with. Sharing options include only those researchers associated with mPower, or qualified researchers worldwide. So far, over 75 percent of the more than 12,000 mPower participants chose to share their data broadly with researchers. This cutting-edge consent process, which is the driving force behind the decision to widely release the mPower data set, is outlined in a third paper published today in Nature Biotechnology, and represents a sea of change in participant control over data sharing.

There's a double benefit here. Not only are participants given direct control over how their data will be used, but a broader range of "qualified researchers" can gain access. To be classed as "qualifying," researchers must:

demonstrate their awareness and understanding of the data-sharing framework and applied ethics through a short, 18-question examination;

validate their identity to Sage Bionetworks through a variety of approved methods, such as an academic letter from a signing official, a notarized letter attesting to identity or a copy of a professional license;

make a public statement of intended data use, which we can in turn feed back to participants in the spirit of engagement and transparency;

explicitly agree to a 'contract' of data sharing, including the following: (i) downloading, initialing, signing, scanning and uploading a researcher oath to adhere to a code of behavior; (ii) complying with any data-specific conditions of use.

As you might expect, the researchers at Sage Bionetworks are great believers in openness:

As part of living our philosophy, all of our tools, platforms, and products are open source. Our software is available in Github, and our non-software creative works are licensed under the Creative Commons Attribution 3.0 Unported license except for legacy publications in closed journals.

We now dedicate funds to pay author processing charges for full Open Access on research publications and are actively working to free up our backfile of closed publications.

Open source, open access, open data released with informed consent: this is what open science looks like.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: control, medical info, openness, parkinsons, personal information, privacy, research

Australian Tribunal Says User's IP Address And URLs Visited Are Not Personal Information

from the too-remote dept

Techdirt has been writing about the question of what constitutes personal information in an online context for over half a decade. A recent decision in Australia, reported by the Guardian, suggests that the matter is far from settled around the world. The case concerns a journalist, Ben Grubb, who has been trying to get his personal data from the mobile phone company he uses, Telstra. Initially, the Australian privacy commissioner ruled that Telstra had failed to comply with local privacy laws when it refused to hand over the data, but that decision was overturned on appeal by an administrative appeals tribunal (AAT) on the following grounds:

In the AAT decision deputy president Stephanie Forgie took a narrow approach to defining personal information. She said that information such as IP and URL data were too remote to be considered personal information.

"That data is no longer about Mr Grubb or the fact that he made a call or sent a message or about the number or address to which he sent it. It is not about the content of the call or the message. The data is all about the way in which Telstra delivers the call or the message. That is not about Mr Grubb," she wrote.

That ignores just how much information even a single URL reveals about the visitor to the site and page in question. Moreover, putting all those URLs together can create an extremely detailed picture of the person concerned -- from things like their general character and beliefs to current concerns. It's an extension of the incorrect argument trotted out by governments that gathering and storing metadata isn't as intrusive as retaining content, when exactly the opposite is true. Since metadata is pre-sorted into handy conceptual categories, analysing and aggregating the information is extremely easy, even on a huge scale -- just ask the NSA and GCHQ.

However, the Australian privacy commissioner is not taking things lying down:

The privacy commissioner, Timothy Pilgrim, has launched a federal court challenge to a ruling that a journalist was not entitled to access parts of his personal mobile phone data.

The landmark challenge is believed to be the first time the Office of the Australian Information Commissioner has sought to appeal a case before the federal court.

As the Guardian rightly notes, the outcome of the case is likely to have important ramifications for future requests involving personal information under the country's privacy laws.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, ben grubb, ip addresses, metadata, personal information, urls
Companies: telstra

Cox Claims Rightscorp's 'Extortionate' Lawsuit Really A Backdoor Way To Get Subscribers' Info

from the cox-blocked dept

Rightscorp (via two music publishers) has dragged Cox into court to test its novel (read: legally unsound) theory that complying with the DMCA means cutting off service to "repeat infringers." The theory itself is largely untested, but far from promising. But that isn't stopping BMG and Round Hill Music (with Rightscorp as a not-so-silent partner) from taking a flyer on a bad legal bet. Certainly, the theory would be advantageous to the shakedown efforts Rightscorp generously refers to as a "business model," but, so far, the only thing being offered as "evidence" of repeat infringement is Rightscorp's own declarations.

Those declarations are highly suspect. Cox has filed an opposition to Rightscorp's Motion to Compel that highlights the anti-piracy company's extortion-esque tactics.

In a statement that leaves little to the imagination, Cox notes that Rightscorp is “threatening” subscribers with “extortionate” letters.

“Rightscorp is in the business of threatening Internet users on behalf of copyright owners. Rightscorp specifically threatens subscribers of ISPs with loss of their Internet service — a punishment that is not within Rightscorp’s control — unless the subscribers pay a settlement demand,” Cox writes (pdf).

Cox has refused to participate in Rightscorp's quasi-legal activities. While the company is not opposed to passing on infringement allegations, it did ask Rightscorp to remove the threatening language (cutting off service, $150,000 per infringement claim) first. Rightscorp refused to do so. This impasse is obviously unacceptable to Rightscorp, which depends on the (very) occasional settlement payment to keep its business barely afloat.

As Cox points out, Rightscorp has decided the best course of action is to maintain its unsteady perch on the edge of legality. In the filing, Cox alleges that Rightscorp tried to make the ISP a "business partner" in its shakedown attempts.

“Rightscorp had a history of interactions with Cox in which Rightscorp offered Cox a share of the settlement revenue stream in return for Cox’s cooperation in transmitting extortionate letters to Cox’s customers. Cox rebuffed Rightscorp’s approach,” Cox informs the court.

But that's not the only legally-dubious tactic the "cutting edge" anti-piracy firm has deployed. It's also attempting to use this lawsuit's discovery process to sidestep subpoena limitations.

The motion lays bare one of Plaintiffs’ primary reasons for bringing this lawsuit. Plaintiffs seek to circumvent the Cable Privacy Act process and instead use discovery in this case to force Cox to reveal, en masse, PII for possibly tens of thousands of Internet subscribers who Plaintiffs speculate might be violating their copyrights. The Cable Privacy Act expressly prohibits Cox from disclosing its subscribers’ PII, for good reason: Internet subscribers have a compelling privacy interest in the confidentiality of their personal information, which can of course be vulnerable to exploitation for myriad improper purposes. If a copyright holder earnestly believes that an unnamed Internet subscriber is infringing upon its copyrights, the proper course is to bring a “John Doe” lawsuit against the subscriber and then to use third-party subpoena power to obtain identifying information from the user’s Internet Service Provider. That legitimate procedure allows notice to the subscriber and an opportunity for the subscriber to act to protect his or her rights. It also relieves the ISP of the unfair responsibility of adjudicating which of the two competing interests (the subscriber’s or the accuser’s) should trump the other.

[...]

Plaintiffs nominally (Rightscorp in reality) claim to have identified “approximately 150,000” infringers, including several hundred “egregious infringers,” among Cox’s subscribers. But Plaintiffs apparently have only IP addresses to go on. (Doc. 72, Corrected Br. at 3.) Plaintiffs have not filed any “John Doe” lawsuits against Cox customers and have not sought information from Cox by subpoena. More importantly, Plaintiffs do not seek, and have not sought, leave to add “John Doe” defendants in this case.

[...]

The practical dynamics of this motion are suspect: If there are 150,000 infringers among Cox subscribers, as Plaintiffs claim, why would they limit themselves (at least for now) to just 500 “egregious infringers”? Will Plaintiffs seek to depose or serve Rule 45 subpoenas on those 500? Will Plaintiffs now seek to add those 500 as co-defendants? Why do Plaintiffs want a blank-check “open order” to continually demand that Cox reveal more identities at later stages in this action? When tested in practical terms, Plaintiffs’ motion makes no sense, and their arguments plainly are an obvious pretext for some other motive.

"Pretext for some other motive" basically describes the entirety of Rightscorp's business model. It subpoenas ISPs for subscriber info, under the unspoken pretext that further legal action is in the offing. But instead of suing file sharers, the company instead uses the information to harass subscribers into paying "settlements" for alleged infringement.

Despite the damning claims made by Cox, the court has partially granted the questionable Motion to Compel. The ISP has been ordered to turn over the "Top 250 IP Addresses recorded to have infringed in the six months prior to filing the Complaint." This distinction is important, because as Cox points out in its opposing motion, the plaintiffs' constantly-widening net had managed to drag in alleged infringers whose infringement didn't occur until after the lawsuit was filed.

Plaintiffs’ stated justifications for their extraordinary request do not help Plaintiffs’ cause. Plaintiffs acknowledge that they “must establish direct infringement of the copyrighted works asserted in this case,” and imply that their motion serves that end. (Doc. 72, Corrected Br. at 4.) But that implication is illogical because Plaintiffs seek PII for 500 subscribers of the 150,000 supposedly implicated here. Surely Plaintiffs are not prepared to concede that their claims fail for the works that the other 149,500 subscribers allegedly infringed. Notably, of the 500 allegedly “egregious infringers” the Plaintiffs hand-picked, 250 allegedly infringed after this lawsuit was filed. (Doc. 72, Corrected Br. at 4.) Those subscribers’ alleged infringements, therefore, cannot have formed a basis for Plaintiffs’ claims in this suit. And nowhere do Plaintiffs even assert that Rightscorp sent purported DMCA notices to Cox with respect to those particular subscribers.

Cox has come out swinging in the early going, and its assertions confirm much of what has been written about Rightscorp and its tactics. This aggressive stance should help uncover plenty of damning details, none of which should have a positive effect on Rightscorp's shriveling stock price.

Filed Under: copyright, copyright trolling, extortion, lawsuits, personal information, shakedown, subpoenas
Companies: bmg, cox, rightscorp, round hill music

Copyright Troll Malibu Media Demands Comcast Tell It What Content Subscribers Accessed Online

from the chutzpah dept

Remember Malibu Media? That's the copyright troll that has run into some trouble with some of its lawsuits lately and may be in for even more trouble. In November, we noted that they had very aggressively tried to argue that Verizon should shut up and hand over private info on subscribers after Verizon had pushed back on some subpoenas. It sounds like Malibu recently tried the same thing with Comcast... and Comcast has hit back hard. What's incredible is that the lawyers for Malibu Media are so clumsy or sloppy that they didn't even remove Verizon's name from the request. Comcast lawyers wasted little time in highlighting the many problems with Malibu Media's demands:

As a preliminary matter, there are several confusing elements in the Subpoenas that affect Comcast's approach to responding. First, the two 2088 Subpoenas instruct Comcast to designate the person(s) "who are the most knowledgeable about the subject matter categories set forth in Exhibit though there is no "Exhibit A" appended to either of the two Subpoenas that Comcast received in that case. There are, as identified elsewhere in those Subpoenas, "Schedules A and B" but no "Exhibit A." Moreover, the Schedule A attached to the Subpoenas does not set forth any subject matter categories, but rather identifies documents requested for production. Conversely, Schedule B sets forth subject matter categories. We accordingly assume that there is no "Exhibit A" and that the reference to Exhibit A (or Schedule A) with respect to subject matter categories should be "Schedule B" However, if there is an Exhibit A that happens to be left out, or this assumption is otherwise misplaced, please notify us immediately.

Second, the three Subpoenas' Schedules A and refer to "Verizon Internet Services" and to documents pertaining to Verizon (and, thus, not to Comcast). Of course, Comcast would not have any documents relating to Verizon or its Internet Services, nor could there be any person(s) at Comcast knowledgeable about such Verizon documents. We assume these references to Verizon were intended to identify Comcast, and respond below accordingly. But if that is incorrect, there would be no documents produced, and no deponent identified, for the separate reason that Comcast would not have any responsive material(s) or information related to Verizon records.

Of course, it's not just because of stupid mistakes by Malibu Media's lawyers that Comcast is standing up against the troll. Apparently the subpoenas are asking for a hell of a lot of info, including details about individuals' internet usage, which Comcast reasonably finds to be excessive.

More substantively, Comcast may not provide to any third party documents or information that include a subscriber's personally identifiable information without first ensuring compliance with the requirements of Section 631(c) of the Communications Act, 47 U.S.C. 551(c). That Section generally prohibits cable operators from disclosing such information without the subscriber's express written consent, and also imposes an affirmative obligation on a cable operator to "take such actions as are necessary to prevent unauthorized access to such information by a person other than the subscriber or cable operator." Id. 551(c)(1). Section 631(c)(2) provides three exceptions to the general ban on disclosing PII without the subscribers' express consent. Only one is applicable to your requests as you have not included any signed consents from the subscribers. Specifically, Section 631(c)(2)(B) states that disclosure is permitted "pursuant to a court order authorizing such disclosure, if the subscriber is notified of such order by the person to whom the order is directed."

We note that at a prior stage of this case you obtained a court order authorizing disclosure of PII for the individuals identified and named in Schedules A and to the Subpoenas. Indeed, the information gained in response to that earlier order allowed such identification of the subscribers in the present Subpoenas. But that court order only authorized disclosure of subscriber names and addresses, and MAC addresses. Schedules A and B to the present Subpoenas call for a great deal more than names and addresses; rather, they seek PII relating (among other things) to the DMCA record(s) for the identified subscribers, the identified subscribers' internet bandwidth usage, specific content watched or accessed by the subscribers, and bills and invoices relating to use of the service, which in turn would reveal the identified subscribers' viewing habits, service selections, costs paid, and other sensitive information. Moreover, some of the documents you seek also concern Comcast confidential and proprietary information on the operation of Comcast's network, and other document requests refer to subscriber service usage that Comcast does not track or monitor.

The letter goes on to note additional problems with Malibu Media's demands that someone from Comcast show up in court. It amazes me how some of these copyright trolls act at times, and their assumptions that big companies like Verizon and Comcast don't have lawyers.

Filed Under: copyright troll, fishing expedition, personal information
Companies: comcast, malibu media

Hack Attack In South Korea Gets Access To Data On Over 70% Of Everyone In The Country

from the hacked dept

We've talked about some massive data breaches in the past, but a recent hack attack in South Korea apparently resulted in personal information on 35 million people being copied. The country has a population somewhere around 49 million... meaning that over 70% of South Koreans had their personal info copied by someone. Authorities are blaming China, though it's not clear if that's really the case. Either way, whoever did the hack got "user IDs, passwords, social security numbers, names, mobile phone numbers and email addresses." At least the SSNs and passwords were encrypted, so it's not quite as bad as it could have been. But it basically sounds like if you have internet access in South Korea, someone probably got your data.

Filed Under: data, hack, personal information, south korea