No, California Law Review, Food Plating Does Not Deserve Copyright Protection

from the nope-nope-nope dept

Of all the mediums where intellectual property makes the least amount of sense, actual food and drink must certainly be among the most absurd. Not the trade dress of food packaging, mind you. I'm talking about the actual food and drink products themselves, be they craft beer or a plate of food. And, yet, you see this sort of thing crop up from time to time. A pizzeria somehow thinks it can trademark the taste of its pizza. Or, more apropos for today's post, a German court that says taking pictures of plated food could violate the copyright of the chef.

Plating food is now coming up again, with a post on the blog of the California Law Review site suggesting that plated food, if artistic enough, does in fact deserve copyright protection. While the entire post is detailed and thorough, the real question of whether plated food merits copyright protection has less to do with the creative aspect of plating -- of which there are some true creative aspects -- than with the question of fixability. To warrant copyright, a work must be both original in its creativity and created in a fixed medium. There are a couple of key historic cases that address what it means for a work to be in a fixed medium, helpfully laid out in this John Marshall Law School article.

In Kim Seng Company v. J&A Importers, Inc., the court examined whether Kim Seng’s “bowl-of-food” sculpture satisfied the fixation requirement of copyright law.31 Kim Seng admitted that the bowl-of-food sculpture was comprised of “a perishable Vietnamese dish purchased by [an employee] from a local restaurant.”32 In analyzing whether Kim Seng’s bowl-of-food sculpture met the fixation requirement, the court compared it to the living garden in Kelley v. Chicago Park District, which was inherently changeable and ultimately perishable.33

In Kelley v. Chicago Park District, the current leading case on copyrightability of organic works, the Seventh Circuit analyzed whether an artistically arranged garden was “fixed” for the purpose of the Copyright Act.34 A famous artist, Chapman Kelley, installed a wildflower display in Grant Park, a prominent public park in downtown Chicago.35 His garden received critical and popular acclaim, and was promoted as “living art.”36 Without permission from Kelley, the Chicago Park District dramatically modified the garden by reducing its size, reconfiguring the flower beds, and changing some of the planting materials.37 Kelley sued the Park District.38 The Seventh Circuit found that Kelley’s living garden could not be eligible for copyright protection because it “lack[ed] the kind of authorship and stable fixation normally required to support copyright.”39 In its opinion, the court clarified that it was “not suggesting that copyright attaches only to works that are static or fully permanent (no medium of expression lasts forever), or that artists who incorporate natural or living elements in their work can never claim copyright.”40 However, Kelley’s living garden was “not stable or permanent enough” to be a work of fixed authorship.

So here we have two cases where courts are deciding copyright protections specifically in part on the question of fixed medium. While the California Law Review's post focuses on the Kim Seng Company decision, trotting out several scholars who take issue with the court's interpretation of the fixability question, I believe the the Kelley decision is actually more powerful. The first complaint from select scholars is that concept art often includes repetition that serves as a stand in for non-degradable medium for fixability.

First, Professor Said’s claim that an artists’ conceptual art is fixed when repetitively performed applies with equal force to chefs who plate the same dish over and over. It is likely that, in practice, a chef would not want to copyright one particular iteration of a dish; any serving of “Who Killed the Goat?” would not last the average four months it takes to process an internet-submitted copyright claim.[56][56][56] Registration Processing Times, U.S. Copyright Office https://www.copyright.gov/registration/docs/processing-times-faqs.pdf [perma.cc/MHM9-DX5G] (last visited May 1, 2019).... Instead, Chef Anand’s nightly plating of “Who Killed the Goat?” would likely “repeat [itself] over and over,” warranting the exact kind of protection that Professor Said describes as being so repetitive as to achieve performance.

This only makes sense if you completely ignore the "transitory" language in the law, which states:

“A work is ‘fixed’ in a tangible medium of expression when its embodiment . . . is sufficiently permanent or stable to permit it to be perceived, reproduced, or otherwise communicated for a period of time more than transitory duration.”

A chef, brilliant and creative as he or she may be, creates and plates his or her food, that food literally transits to the table where it is enjoyed briefly before being destroyed via consumption, turned into mere caloric energy inside our bodies. Whatever the purpose of the law's language, it can't possibly have meant to assign copying restrictions to that. In the Kelley decision, we're talking about art fixed in plants that might last years and years and yet that still didn't warrant protection when Chicago decided to change the non-fixed expression around.

The second criticism is that the medium becomes fixed when people capture its image in photographs and video.

Second, Professor Said’s idea that “the first purposes of the fixation requirement lies in the use and enjoyment of the work by others” supports the notion that a dish is “fixed” when it becomes something more than just consumption.[58][58][58] Said, supra note 49, at 339 (citing Laura Heymann, How to Write a Life: Some Thoughts on Fixation and the Copyright/Privacy Divide, 51 WM. & MARY L. REV. 825, 842 (2009))....Certainly, the success of shows like Netflix’s Chef’s Table[59][59][59] Genevieve Van Hoorhis, When Will ‘Chef’s Table’ Return for Season 7? It Takes Time To Capture All That Tasty Goodness, Bustle (Feb. 22, 2019), https://www.bustle.com/p/when-will-chefs-table-return-for-season-7-it-takes-time-to-capture-all-that-tasty-goodness-15988094 [https://perma.cc/39KK-NJU7].... and the trend of posting food to social media proves that it exists long enough to be enjoyed by others.[

Except that's ridiculous. If anything, all these examples show is that the fixed medium of photography and film deserve the copyrights in question, not the non-fixed work expressed via food.

To be clear, none of this is to say that chef's can't be extremely talented both in taste and in artfully plating their food. No matter how artistic they may be, however, either the medium is fixed or it isn't. And as someone who can destroy a plate of food, I can tell you that medium ain't fixed.

Filed Under: copyright, fixed, food, plating, protection, transitory

The Flipside To Figuring Out What Content Do You Block: Cloudflare's Project Galileo Focuses On Who It Should Protect

from the case-studies dept

There has been so much discussion lately about the impossibility of doing content moderation well, but it's notable that the vast majority of that discussion focuses on what content to ban or to block entirely. I do wish there was more talk about alternatives, some of which already exist (from things like demonetization to refusing to algorithmically promote -- though, for the most part, these solutions just seem to annoy people even more). But there is something of a flipside to this debate which applies in perhaps somewhat more rare circumstances: what content or speakers to specifically protect.

I'm thinking of this, in particular, as Cloudflare has announced the 5th anniversary of its (until now, mostly secretive) Project Galileo offering, in which the company provides free security to around 600 organizations which are likely targets of attacks from well resourced attackers:

Through the Project, Cloudflare protects—at no cost—nearly 600 organizations around the world engaged in some of the most politically and artistically important work online. Because of their work, these organizations are attacked frequently, often with some of the fiercest cyber attacks we’ve seen.

Since it launched in 2014, we haven't talked about Galileo much externally because we worry that drawing more attention to these organizations may put them at increased risk. Internally, however, it's a source of pride for our whole team and is something we dedicate significant resources to. And, for me personally, many of the moments that mark my most meaningful accomplishments were born from our work protecting Project Galileo recipients.

The promise of Project Galileo is simple: Cloudflare will provide our full set of security services to any politically or artistically important organizations at no cost so long as they are either non-profits or small commercial entities. I'm still on the distribution list that receives an email whenever someone applies to be a Project Galileo participant, and those emails remain the first I open every morning.

At a first glance, this might not seem like much of a story at all: internet company does something good to protect those at risk doesn't necessarily seem that interesting at first, especially during a moment in time when everyone is so focused on attacking every internet company for bringing about all the evils of the world. However, I do think there are some very important lessons to be learned here, and some of them very much apply to the debates about content moderation. In some sense, Project Galileo is like the usual content moderation debates, but in reverse.

I was particularly interested in how Cloudflare chose which organizations to protect, and spoke with the company's CEO, Matthew Prince last week to get a more in-depth explanation. As he explained, they partnered up with a wide variety of trustworthy organizations (including EFF, Open Technology Institute, the ACLU, Access Now, CDT, Mozilla, Committee to Protect Journalists and the Freedom of the Press Foundation, among others), and would let those organizations nominate organizations which might be at risk or if organizations approached Cloudflare about being included in Project Galileo, Cloudflare could run their application by those trusted partners. What started with 15 partner organizations has now nearly doubled to 28.

Of course, such a system likely wouldn't work well in the other direction (figuring out what accounts to ban or otherwise punish) as people would undoubtedly flip out and attack them -- as many did a few years ago when Twitter announced its Trust and Safety Council of partner organizations that it relied on for advice on how it handled its trust and safety questions. Many critics of Twitter and its policies have continued to falsely insist that the organizations in this list are some sort of Star Chamber making decisions on who is allowed to use Twitter and who is not -- so any move to actually have such a system in place would likely be met with resistance.

However, there is something interesting about having a more thorough process involving outside experts, than just trusting a company to make these decisions entirely internally. It's obviously somewhat different with Cloudflare, in part because it's providing underlying security services that are not as upfront as the various social media sites, and also because it's about picking out who to "protect" rather than who to block. But it is worth looking at and thinking about all of the different challenges there are when it comes to content moderation that go beyond what most people normally talk about.

For what it's worth, this is also quite important as more and more politicians around the globe are gearing up to "regulate" content moderation in one way or another. It's one thing to say that social media sites should be required by law to block certain accounts (or to not block certain accounts), but think about how any of those laws might also apply to services like Project Galileo, and you can see why there should be caution in rushing in with regulatory solutions. The approach taken with something like Project Galileo ought to be entirely different than the process of determining whether or not a platform has decided to remove Nazi propagandists. But it's doubtful that those proposing new regulations are thinking that far ahead, and I worry that some new proposals may sweep up Project Galileo in a manner where it may become more difficult for Cloudflare to continue to run such a program.

Still, in this era when everyone is so focused on the bad stuff online and how to stop it, it's at least worth acknowledging a cool project from Cloudflare to note the good stuff online and how to protect it.

Filed Under: computer security, content moderation, project galileo, protection, security
Companies: cloudflare

Stupid Law Making Assaulting Journalists A Federal Crime Revived By Congress

from the scoring-cheap-points-to-impress-the-cheapest-seats dept

As an overreaction to President Trump's mostly-hyperbolic verbal attacks on the journalism profession, a few legislators from the other side of the political fence have revived their stupid idea from last year. Here's the law's author in his own words twit:

If you can't read/see this tweet, consider yourself lucky. Here it is in all its hashtagged glory:

A #freepress is essential to a healthy democracy. We must send a strong, clear message that such violence will not be tolerated – that’s why I introduced the Journalist Protection Act today w/ @SenBlumenthal & @SenatorMenendez.

This dumb law was defended in an inane but noisy statement by Rep. Eric Swalwell.

“From tweeting #FakeNews to proclaiming his contempt for the media during campaign rallies, the president has created a hostile environment for members of the press,” said Swalwell in a statement. “We must protect journalists in every corner of our country if they are attacked physically while doing their job, and send a strong, clear message that such violence will not be tolerated.

Yes. Swalwell's official statement on his zombie legislation contained a hashtag. Here's what the "Journalist Protection Act" [PDF] does: turns an existent crime into a slightly worse crime if the victim is someone the federal government considers a journalist. "Bodily injury" or "serious bodily injury" are the flavors of the felony enhancement, adding 3-to-6 years to violators' sentences respectively.

Fortunately, the definition for journalist is broad enough to keep bloggers and livestreamers in the loop. Unfortunately, this just means more people are going to face enhanced sentences for harming members of our nation's newest protected group.

Once again: this isn't a good idea for anyone. It's never a good idea to give extra protections to people who practice certain careers, whether they're journalists or cops. Blues Lives Matter laws elevate cops above the people they serve. The Journalist Protection Act makes journalists' lives worth more than those of the people they cover. One set of laws is "justified" by an imaginary "war on cops." The other is "justified" by a bunch of boneheaded public statements by the Blowhard in Chief.

In both cases, the only thing happening is legislators scoring easy points preaching to the converted… and hoping the converted remember the stupidity they enacted in their names when reelection time comes around.

No real journalist should want this. Unfortunately, a bunch of journalistic groups are acting like it's just the thing this nation's been missing. The Society of Professional Journalists is offering its endorsement. So is the NewsMedia Alliance. Scrolling through the feed of tweets referencing this law reveals a disappointing number of journalist groups buying into this bullshit. This administration does pose a threat to journalism, but it takes the form of a crackdown on whistleblowers and placing journalists under surveillance, if not under indictment. It has very little to do with Trump encouraging physical violence against members of the press.

This isn't anything any member of these groups should honestly want, unless they're cool with legislators turning cops, bank CEOs, international arms dealers, bitcoin speculators, or other groups of people a certain percentage of the public finds loathsome into "protected classes." If it's cool for your own kind, you can't bitch too much when it starts elevating exactly the sort of people you don't like.

Filed Under: bob menendez, eric walwell, extra crimes, journalism, journalism protection act, journalists lives matter, protection, richard blumenthal

California Police Department Can't Keep It Real; Deploys Fake Press Releases And Fake Affidavits

from the sooner-or-later,-your-word-means-nothing dept

The Santa Maria (CA) Police Department -- like the FBI -- is in the fake news business. Last February, it issued a bogus press release via online service Nixle, falsely stating it had apprehended two suspects. This was picked up by local news sources and redistributed. It wasn't until until December that the ruse was uncovered. The Sun -- which hadn't released a story on the bogus press release -- discovered this fact in a pile of court documents. (h/t Dave Maass)

Police allege in the court documents that members of the local MS-13 gang planned to kill the two men, referred to in court documents as John Doe No. 1 and John Doe No. 2. Police had gleaned this information from telephone surveillance on several suspects in the case, according to the documents. The police acted by putting out the false press release, expecting local news media to report the fake story and the MS-13 gang members to stop pursuing the John Does.

The police chief confirmed the PD had issued the fake press release knowingly. He also remained unapologetic, stating that misleading journalists served a greater good: keeping two gang targets alive. He has yet to remove the bogus press release from Nixle, even though it violates the service's terms, which forbid knowingly publishing "fraudulent, deceptive, or misleading communications."

[S]anta Maria Police Chief Ralph Martin wasn’t aware what the terms of service were or that they existed when initially asked by the Sun. At first, Martin said he’d more than likely take the press release down, but then he changed his mind.

“I don’t have any plans to take it down,” Martin said, adding that he has yet to be notified by Nixle. “If it violates their policy then it’s Nixle’s policy to contact us.”

The department has also refused to apologize to the news services it misled, most of which rightly feel this diminishes the public's trust in its public servants.

According to Chief Martin, it was a "moral and ethical" decision to lie to the public. He also says this is the first time in his 40 years as a cop he's seen this sort of thing done. Of course, it's now much more difficult to take this assertion at face value, especially when Martin's refusing to remove fake news from a site after it's already served its purpose.

This may be the first time the Santa Maria PD has deceived the press, but it's certainly not the first time it's deployed fake "facts" as a means to an end. The Sun reported earlier the PD had -- on multiple occasions -- presented fake sworn affidavits and statements to criminal suspects in hopes of provoking confessions or securing plea bargains.

Police reports obtained by the Sun verified [Jesus] Quevedo’s claims, showing SMPD Gang Task Force officers had indeed presented Quevedo with a search warrant issued by Judge Beebe on April 15, with a false document included.

“I had previously prepared a ruse affidavit,” [Detective David] Cohen wrote in his report in Quevedo’s case. “The ruse affidavit contained details of two crimes for which Quevedo was being investigated. Many of the details were true, and many were fabricated.”

The ruse highlights several actual unsolved robberies, including a home invasion in Santa Ynez, where an eyewitness describes a man matching Quevedo’s characteristics fleeing the scene. A mugshot of a smiling Quevedo is circled with a “100%” marked over his name, indicating the victim of the invasion also had positively identified Quevedo as the robber.

Other fabrications include an anonymous neighbor seeing a car matching Quevedo’s parked outside the scene of one of the robberies, as well as statements from confidential citizens alleging Quevedo’s strong ties to the Mexican Mafia.

Other convicts have contacted The Sun claiming to have been subjected to the same ruse. Those claims are probably as trustworthy as the police chief's, but evidence appears to show this ruse has not only been used more than once, but that the District Attorney's office feels it's a perfectly legal strategy.

Asked to comment, the Santa Maria Police Department referred all questions regarding Quevedo’s case—and the ruse tactic in general—to Chief Deputy District Attorney Steve Foley and Deputy District Attorney Bramsen. Bramsen did not return phone calls from the Sun, though Foley confirmed Cohen had met with Bramsen before employing the ruse.

“Our office was consulted by the police department on this particular ruse,” Foley said. “The police did in fact say, ‘Would this be a legal ruse?’ and [Bramsen] researched it and felt, based on her legal research, it was a legal ruse.”

The DA's office clarified it had simply said the fake affidavit plan was legally in the clear, but it had never told the PD to follow through with it… as if there were really any distance between those two stances. The office maintains this is all part of its "ethical" prosecution of lawbreakers.

It also said, ridiculously, that attempting to trick people into confessions or plea agreements with fake witness statements and fake evidence isn't actually an attempt to trick people into confessions or plea agreements.

In a written opposition to the motion, the DA argued there was nothing improper about the use of the ruse affidavit in Quevedo’s case, because prosecutors and police never intended the document to be used in court, either to obtain a search warrant or to coerce a false confession.

Ah. The PD was only interested in coercing a true confession. I guess that makes it ok.

Or not. The judge presiding over Quevado's case didn't find it quite as legally-acceptable as the DA did.

While the judge stopped short of issuing any sanctions against Cohen, Parker, or the DA’s office, she ruled all evidence obtained through the use of the ruse affidavit would be inadmissible in Quevedo’s case.

“The police can do a lot of things,” she said. “But when they use a false affidavit, intending for it to be believed as true, with the judiciary’s signature, that conduct cannot be tolerated.”

If the PD feels the ends justify the deceptive means, how exactly does it justify making its own evidence inadmissible? If the "end" is to get criminals off the street, how does undercutting the prosecution achieve that end?

The public isn't just being deceived by fake press releases. It's being deceived about the effectiveness of its law enforcement agencies, who are willing to damage their own cases in their hurry to file charges and commence prosecutions.

Filed Under: california, fake news, fake press release, law enforcement, lies, police, protection, santa maria

To The NSA, The Word 'Security' Is Synonymous With 'Gaping, Unpatched Holes In US Developers' Software'

from the Vulnerability-EXPLOITATION-Process dept

A former Defense Intelligence Agency officer has taken to LinkedIn to point out to all of us griping about the broken Vulnerability Equities Process -- exposed by hackers holding NSA zero-days -- have it all wrong. Michael Tanji says the NSA isn't here to protect developers from malicious attacks. It never was and it's never going to be.

Intelligence agencies exist to gather information, analyze it, and deliver their findings to policymakers so that they can make decisions about how to deal with threats to the nation. Period. You can, and agencies often do, dress this up and expand on it in order to motivate the workforce, or more likely grab more money and authority, but when it comes down to it, stealing and making sense of other people’s information is the job. Doing code reviews and QA for Cisco is not the mission.

Suck it up, Cisco. That gaping hole uncovered by the Shadow Brokers was discovered at least three years ago by the NSA and if it chose not to tell you about it, it had its reasons. Namely: national security.

The Obama administration made sympathetic noises in the wake of the Snowden leaks, suggesting the NSA err on the side of disclosure. It simultaneously gave the agency no reason to ever do that by appending "unless national security, etc." to the statement.

But part of the phrase "national security" is the word "security." (And the other part -- "national" -- suggests this directive also covers protecting US companies from attacks, not just the more amorphous "American public.") Allowing tech companies who provide network security software and hardware to other prime hacking targets to remain unaware of security holes doesn't exactly serve the nation or its security. So, while Tanji may claim the NSA isn't in the QA business, it sort of is. The thing is the NSA prefers to exploit QA issues, rather than give affected developers a chance to patch them.

And if an NSA operative left behind a bag of tech tools in a compromised server, it really doesn't do much for the argument that the government can be trusted with encryption backdoors -- the sort of thing FBI Director James Comey is still hoping will materialize as a result of his never ending "going dark" sales pitch. Julian Sanchez, writing for Cato, points out the NSA's mistake should lead to some pretty severe trust issues.

This hack also ought to give pause to anyone swayed by the government’s assurances that we can mandate government backdoors in encryption software and services, allowing the “good guys” (law enforcement and intelligence agencies) to access the communications of criminals and terrorists without compromising the security of millions of innocent users. If even the NSA’s most closely guarded hacking tools cannot be secured, why would any reasonable person believe that keys to cryptographic backdoors could be adequately protected by far less sophisticated law enforcement agencies? The Equation Group hack is a disturbingly concrete demonstration of what network security experts have been saying all along: Once you create a backdoor, there is no realistic way to guarantee that only the good guys will be able to walk through it.

So, that's one huge problem with both the hoarding of exploits and the NSA's refusal to actually participate in the Vulnerability Equities Process. The definition the NSA has chosen for "national security" doesn't mesh with statements made by its cybersecurity overseers.

Back in 2014, federal cybersecurity coordinator Michael Daniel insisted in a post on the White House blog that the process is strongly weighted in favor of disclosure. The government, he assured the public, understands that “[b]uilding up a huge stockpile of undisclosed vulnerabilities while leaving the Internet vulnerable and the American people unprotected would not be in our national security interest.”

Maybe things have changed in the past couple of years, but they haven't changed as much as Michael Tanji claims. He states that the NSA is no longer charged with playing cyber-defense.

The one element in the intelligence community that was charged with supporting defense is no more. I didn’t like it then, and it seems pretty damn foolish now, but there you are, all in the name of “agility.” NSA’s IAD had the potential to do the things that all the security and privacy pundits imagine should be done for the private sector, but their job was still keeping Uncle Sam secure, not Wal-Mart.

That's simply not true. The NSA may secretly wish it had been completely rerouted to "attack" mode. That would more easily justify the hoarding of vulnerabilities and its ongoing refusal to hand over info to affected developers. But it's still supposed to be playing defense -- which means it has an obligation to both the American public who use software/hardware the NSA would rather see left unpatched, as well as the developers it's purposefully leaving open to malicious attacks.

The NSA has decided the best way to handle these competing directives is to muddy the waters by making them inseparable.

Because computers are now the easiest way to spy on people, and because everyone — even U.S. adversaries — uses the same Internet, there has long been what officials like to call a "healthy" or "creative" tension between the foreign espionage mission and the information assurance mission of the NSA.

Crudely put, the IA's cyber mission is to find security holes in Internet infrastructure and common software and patch them; the signals intelligence mission is to find the same holes and keep them open as long as possible so they can be used to spy on foreigners.

When the two directorates merge, some fear that the much larger and better funded signals intelligence mission will simply absorb the IA mission.

As it stands now, the offensive side of the NSA's cybersquad is roughly twice the size of its defensive team -- which clearly indicates which end of the equation the NSA believes is more important to its national security mission.

The NSA's actions in regards to the Vulnerability Equities Process shows it believes some forms of national security are more equal than others. It's far more interested in ensuring its collections continue to be fed than it is with patching security holes -- holes it has often created -- that affect millions of US citizens and dozens of hacker-tempting firms.

It also shows the government is not to be trusted when it demands "good guy only" access. It can't protect the backdoors it's already created and it has only the slightest interest in protecting the nation from the bad guys that will inevitably find its secret entrances.

Filed Under: defense, hacking, nsa, offense, protection, vep, vulnerabilities

European Greens Present Draft Law On Protecting Whistleblowers

from the pushing-back-against-trade-secrets dept

It's a sad commentary on the state of transparency these days that whistleblowers have come to play such an important role in revealing wrongdoing and abuse, as numerous stories on Techdirt attest. At the same time, whistleblowers enjoy very little protection around the world. Indeed, a countervailing trend to strengthen protection for so-called "trade secrets" makes it increasingly risky to be a whistleblower today. A case in point is the European Union's new law on trade secrets, which completed its passage through the EU legislative process last month. Although it contains some protections for whistleblowers, many feel they are insufficient. Here, for example is Julia Reda, the representative of the Pirate Party in the European Parliament:

The new law also created major uncertainties about the role of whistleblowers and investigative journalists. All information, including information about malpractice, can be protected as a trade secret. As a result, the burden of proof that the public interest outweighs the business interest will now always lie with the whistleblower.

To remedy those flaws, the Greens/EFA group in the European Parliament has put together a draft law. As well as the detailed text, there is a FAQ and a useful two-page summary, which is probably the best place to start. The proposed EU Directive would introduce a uniform law protecting whistleblowers across the European Union. It would apply to both current and former employees and contractors, in all business sectors, both private and public."Protected Disclosures" in this context:

concern harms or threats to the public interest that have occurred, are occurring at the time of the disclosure, or are likely to occur. Protection is given also to whistle-blowers who disclose inaccurate information in honest error.

The intention behind the disclosure doesn't matter: what counts is whether it is in the public interest. Whistleblowers may use any channels, whether official or unofficial, and can be anonymous. One of the most important aspects of the proposal is the protection that would be offered:

exemptions from criminal proceedings related to the protected disclosure, including but not limited to prosecution for the disclosure of classified information, trade secrets or otherwise confidential information, exemptions from civil proceedings and disciplinary measures, and prohibitions of other forms of reprisal, including inter alia dismissal, demotion, withholding of promotion, coercion, intimidation, etc. Action taken against individuals other than the person who made the protected disclosure (for example colleagues or family members) may also constitute prohibited reprisal.

The situation regarding classified information and trade secrets is further clarified in the FAQ:

The Directive protects whistle-blowers who disclose trade secrets as well as confidential information related to national security, though a specific procedure is envisaged for the latter. In case of an overlap or clash between the whistle-blower protection directive and the trade secrets directive, the provisions to protect whistle-blowers must be complied with. The same is true where the information relates to national security issues. Thus, protection of trade secrets may not be invoked to the detriment of the whistle-blower concerned, even if the information revealed is not actually illegal in itself.

That approach is likely to be unpopular with many EU governments and businesses, which will make turning this whistleblower proposal into law a tough battle. Nonetheless, the Greens obviously hope that releasing this draft -- which has no formal legal status -- will help to raise awareness of the need to protect whistleblowers, and ultimately prod the European Commission into proposing its own solution to the problem.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: eu, protection, whistleblowers

Apple Engineering VP: The FBI Wants Us To Make Everyone Less Safe

from the that's-a-problem dept

As so many have tried to frame the Apple v. FBI fight as one of "privacy v. security," the fact is that it's really about security v. security, where it really comes down to what are you more afraid of: the off-chance that someone will secretly plan a terrorist attack on an encrypted iPhone, or the much more likely issue with millions of phones being stolen or hacked into by criminals looking to swipe your private information. Apple's VP of software engineering, Craig Federighi, had now taken to the pages of the Washington Post to try to highlight this issue, and explain that the FBI and DOJ are really trying to make everyone a lot less safe.

But the threat to our personal information is just the tip of the iceberg. Your phone is more than a personal device. In today’s mobile, networked world, it’s part of the security perimeter that protects your family and co-workers. Our nation’s vital infrastructure -- such as power grids and transportation hubs -- becomes more vulnerable when individual devices get hacked. Criminals and terrorists who want to infiltrate systems and disrupt sensitive networks may start their attacks through access to just one person’s smartphone.

And he also has a good response to those, like Manhattan DA Cyrus Vance, who insist that they just want Apple "to go back" to the way they had security on phones prior to iOS 8. In other words, make everyone less secure. Their argument is that if that was okay a few years ago, why isn't it okay now. And the answer is that security holes are found over time and they make systems less and less secure. So taking a step back is not just like going back a couple of years, but much, much worse, because now lots of people know how to get past the security features:

Of course, despite our best efforts, nothing is 100 percent secure. Humans are fallible. Our engineers write millions of lines of code, and even the very best can make mistakes. A mistake can become a point of weakness, something for attackers to exploit. Identifying and fixing those problems are critical parts of our mission to keep customers safe. Doing anything to hamper that mission would be a serious mistake.

That’s why it’s so disappointing that the FBI, Justice Department and others in law enforcement are pressing us to turn back the clock to a less-secure time and less-secure technologies. They have suggested that the safeguards of iOS 7 were good enough and that we should simply go back to the security standards of 2013. But the security of iOS 7, while cutting-edge at the time, has since been breached by hackers. What’s worse, some of their methods have been productized and are now available for sale to attackers who are less skilled but often more malicious.

And, as he notes, the FBI's demands in the San Bernardino case are akin to doing the same thing to the security of iOS 8: creating a vulnerability that will almost certainly "spread around the world in the blink of an eye." It's a good, straightforward piece explaining why the FBI and DOJ's demands are so dangerous here.

Filed Under: craig federighi, encryption, protection, security
Companies: apple

Rep. Grayson Attempts To Build A Journalist Shield Law Out Of A One-Line Amendment, But Will It Do Any Good?

from the there-are-journalists-the-government-likes,-and-then-there's-everyone-else dept

It looks like the government might be forced to hold another uncomfortable discussion about who is/isn't a journalist. Among the many amendments to the DOJ's appropriation bill was one from Rep. Alan Grayson, which forbids the use of DOJ funding to force journalists to turn over sources.

The description of the amendment is only one sentence long, but it's provoking a much larger discussion.

None of the funds made available by this Act may be used to compel a person to testify about information or sources that the person states in a motion to quash the subpoena that he has obtained as a journalist or reporter and that he regards as confidential.

"...as a journalist or reporter…" -- What does that mean?

In the non-specifics of a short amendment, it could mean anything. In a practical sense, its definition is likely far narrower. Legislators have periodically mounted attempts at a "shield" law for journalists. Unfortunately, their efforts have either been beaten back by administrations that love prosecuting leakers or that were sabotaged by their own far-too-limited ideas of who might qualify for the elusive "journalist" designation.

This -- despite its open-endedness -- will probably end up being no better than previous efforts. On one hand, it could be argued that the term is almost all-inclusive. Here's Joel Kurtzberg -- who defended James Risen in his fight against the DOJ -- on what he sees is the problem with Grayson's amendment.

“If this became law, it would provide significantly needed protection to journalists who need to be able to keep their promises to confidential sources in order to do their jobs,” he says. “The difficulty with it, however, is that it appears to provide protection for anyone who claims in motion papers to have obtained confidential information as a journalist."

Kurtzberg says if the amendment passes the Senate and becomes law anyone who claims to be a journalist could be off the hook from testifying.

This seems like a rather odd argument to be coming from someone's whose client would have definitely benefitted from some sort of journalistic shield law. It's almost as though he's of the same mindset as some of our representatives: "real" journalists write for well-known papers and draw salaries. No one outside of this narrow definition should be shielded from the government's vengeance, no matter how much journalism they actually perform. (It's an act, not a position.)

A legal rep (Barry Pollack) for an entity frequently considered to be "NOT JOURNALISM" by legislators (Wikileaks) sees this wording as implying the opposite.

“I wouldn't say it offers no real-world protection,” he says. “It offers limited and imperfect protection. It would constrain what the Department of Justice could do. Anyone has a better chance if the opponent has one arm tied behind its back. But it is the referee, not the opponent, who makes the decision.”

As he sees it, the courts could still compel testimony because there is no federal law offering explicit protections for journalists. The DOJ may not be able to spend money prosecuting journalists, but the courts would not be compelled to recognize a protection that officially doesn't exist.

“Unless the law changes, judges may continue to rule against journalists, even without the Department of Justice openly advocating for that result,” Pollack says.

And if it's not the judges, it may be the administration itself, which has never been kind to whistleblowers or journalists. The usual mouthpiece for prosecutions is the Department of Justice, so this amendment -- if it sticks -- will make for some interesting courtroom maneuvers in the future.

Grayson himself doesn't see any real issues with the amendment as worded. According to him, the fact that lying to the government is a crime will be a sufficient deterrent to potential abuse.

Grayson points to former House Speaker Dennis Hastert’s recent indictment for allegedly lying to the FBI when asked if non-journalists could misuse the provision.

“If you go to court and lie about anything, or lie to federal agents ... then that itself is a crime and will lead to you being in prison,” he says.

The potential for this sort of abuse isn't what worries journalists about shield laws. It's the abuse coming from the top down. Grayson's amendment means well, but his feeling that the government -- via the courts -- will interpret this open-ended "reporter or journalist" designation "reasonably and favorably" puts a bit too much faith in a system that has shown a preference for doing exactly the opposite.

Filed Under: alan grayson, journalism, protection, shield law

The DOJ Isn't Interested In Protecting FBI Whistleblowers From Retaliation

from the a.-ignore-b.-drag-feet dept

You don't hear much about FBI whistleblowers. Many other agencies have had wrongdoing exposed by employees (and the government has often seen fit to slap the whistles out of their mouths with harsh prosecution), but the FBI isn't one of them. Forty-three years ago, whistleblowers broke into the FBI and retrieved damning documents, but no one's really broken out of the FBI to do the same. In fact, the FBI would rather not talk about whistleblowing at all.

An optimist might chalk this up to the FBI being a tightly-run organization that polices itself for malfeasance and wrongdoing. They'd be wrong, of course. Just within the past year, the FBI has twice thwarted its own oversight and may soon face budgetary constraints if it won't turn over the documents the DOJ's Inspector General is seeking.

There's a reason no one blows the whistle at the FBI and this GAO report spells it out: unlike every other government agency, the DOJ's internal policies contain nothing to shield FBI whistleblowers from retaliation.

Unlike employees of other executive branch agencies, FBI employees do not have a process to seek corrective action if they experience retaliation based on a disclosure of wrongdoing to their supervisors or others in their chain of command who are not designated officials. This difference is due, in part, to DOJ’s decisions about how to implement the statute governing FBI whistleblowers. When issuing its regulations in 1999, DOJ officials did not include supervisors in the list of entities designated to receive protected disclosures, stating that Congress intended DOJ to limit the universe of recipients of protected disclosures, in part because of the sensitive information to which FBI employees have access.

To ostensibly protect means, methods and (presumably) the country itself, the DOJ eliminated several options whistleblowers could pursue when taking their complaints through official channels. A 2012 Presidential Policy Directive aimed at increasing whistleblower protections failed to move the needle.

In response to this requirement, DOJ reviewed its regulations and in an April 2014 report recommended adding more senior officials in FBI field offices to the list of designated entities, but did not recommend adding all supervisors. DOJ cited a number of reasons for this, including concerns about striking the right balance between the benefits of an expanded list and the additional resources and time needed to handle a possible increase in complaints. By dismissing retaliation complaints based on a disclosure made to an employee’s supervisor or someone in that person’s chain of command, DOJ leaves some FBI whistleblowers—such as the 17 complainants we identified—without protection from retaliation.

The DOJ is plainly uninterested in sheltering those who would point out FBI wrongdoing. It has set up a minefield most whistleblowers are unable to navigate.

We concluded that, without clear information on how to make a protected disclosure, FBI whistleblowers may not be aware that, depending on how they report their allegation, they may not be able to seek corrective action if they experience retaliation.

So, with no roadmap and extremely limited protections, whistleblowers who do manage to bring their complaints up through proper channels are often subjected to retaliatory actions for which they have no remedy.

[I]n 2002, former FBI agent Jane Turner filed a whistleblower complaint with DOJ alleging that her colleagues had stolen items from Ground Zero after the September 11, 2001, terrorist attacks. She was then given a “does not meet expectations” rating, placed on leave, and notified of proposed removal.

This retalitation was reported by Agent Turner to the DOJ, which then slowly ground its heavy wheels of so-called justice for more than a decade.

[The] DOJ ultimately found in her favor in 2013—over 10 years later.

Turner's case isn't an anomaly. The GAO found that, while the DOJ was often quick to dismiss retaliation complaints simply because the whistleblower failed to properly navigate its labyrinthine reporting restrictions, it was seldom interested in moving quickly on behalf of those who managed to luck into complete compliance.

The 4 complaints we reviewed in our 2015 report that met threshold regulatory requirements and that DOJ ultimately adjudicated on the merits, took up to 10.6 years to resolve, and DOJ did not provide parties with expected time frames for its decisions throughout these cases.

The DOJ blames this on "case complexity" and "staffing priorities." The latter excuse is likely the most honest. The DOJ is far more inclined to prosecute whistleblowers than protect whistleblowers. Blowing the whistle at the FBI means being subjected to vindictive actions with little to no recourse. The DOJ may decide to take a whistleblower's case, but will do little, if anything, to escalate its response. In the meantime, whistleblowers are apparently supposed to take a number and wait things out in a hostile environment.

Will this GAO report result in better protections? Highly doubtful, considering a directive issued by the President's office itself failed to produce any significant change. Even the agency's inside oversight -- the Office of the Inspector General -- is finding the DOJ completely unresponsive to its complaints about FBI stonewalling and obfuscation. It's highly unlikely the DOJ will handle lower-level whistleblower complaints with more speed or openness.

The DOJ, along with the FBI, has successfully neutralized most forms of accountability. The OIG is openly ignored. FOIA requests are frequently greeted with massive amounts of withheld documents and redactions. When pressed, the nation's top law enforcement agency tends to wrap itself in a patchwork of undeclared wars (drugs, terrorism) and claims accountability will lead to an unsafe and unsecured country. Meanwhile, its own underling agencies go rogue while tangled, useless policies keep whistleblowers from ever opening their mouths.

Filed Under: doj, fbi, protection, whistleblowers

Cop Accidentally Shoots Man, Ignores Emergency Responder, Other Cops In Order To Text Union Rep

from the 'I-feared-for-my-employment' dept

Late last month, rookie NYPD officer Peter Liang shot an unarmed resident of a Brooklyn housing project while entering an unlit stairwell. While opening a door, Liang's gun "discharged" (as they say). The bullet struck Akai Gurley in the chest, killing him.

It was an accident, but an avoidable one. Liang claims to have been opening the door to the stairwell with a flashlight in one hand and his gun in the other. While opening the door (possibly using his "gun hand), he inadvertently fired his weapon. That his gun was drawn was questionable enough. But this error in judgment was further compounded by his actions immediately following the discovery that he had shot someone in the stairwell.

The New York Daily News reports that in the crucial minutes following the shooting, Liang and his partner did not try to get medical attention for the grievously wounded man and could not be reached by either their commanding officer or the 911 dispatcher who fielded a call from a neighbor reporting gunshots.

Let that sink in for a moment. An accidental shot hits a man in the chest and the two officers on the scene have zero interest in ensuring the victim receives medical attention. Both officers (both rookies) decided to go off the grid rather than deal with the mess they had created.

Liang knew he had screwed up. But he chose to protect himself as a man he shot lay dying. Instead of responding to queries and calls, he was texting his union representative.

If there's any entity that can keep cops from being held accountable for their actions, it's police unions. Through the power of labor agreements and arbitration hearings, unions can reinstate cops despicable enough that their own departments have disowned them. Liang may only be a rookie but he already recognizes who holds the most power.

His partner may have been following Liang's lead or was equally unsure of where to turn in the wake of this unfortunate incident. He may not have texted a union rep, but he also did nothing to ensure the victim received medical attention. He also chose to remain incommunicado. That decision may have been prompted by the fact that not only had the two officers been forbidden from performing this sort of patrol (called a "vertical") by their supervisor, but they also had no idea where they were.

Mistakes happen. But this collection of errors snowballed into an accidental shooting of an unarmed man. That part is excusable, but only if entirely separated from the events following the shooting. Texting a union rep shows that Liang's primary concern was for his own livelihood rather than the well-being of anyone around him. His partner's compliant silence pushes this situation from merely tragic into the arena of the possibly criminal.

The Daily News cites court insiders as saying "while the shooting may have been a mishap, the cops' subsequent conduct can amount to criminal liability."

While I can appreciate the fact that the instinct for self-preservation can often override better judgment, police officers are held -- or should be -- to a higher standard. When someone's life is ebbing away thanks to your screwup, you need to take care of them first and worry about the extent of your ass coverage later. Police officers are already well-insulated against accountability. Talking to a union rep as a man lays dying is, no sickening pun intended, overkill.

Filed Under: akai gurley, nypd, peter liang, police, police brutality, police unions, protection