Apple Sues NSO Group For Targeting IPhone Users With Powerful Exploits

from the [applauds-super-cautiously] dept

NSO Group's year from hell continues. Apple is now suing the Israeli exploit hawker for hacking its customers' iPhones -- customers who include not only the supposed terrorists and dangerous criminals NSO claims its customers target with malware, but also journalists, activists, lawyers, ex-wives, religious leaders, US citizens, and government officials NSO claims its customers don't target.

Apple isn't the first major tech company to sue NSO over its malware. Facebook and WhatsApp sued NSO in 2019, alleging that the use of WhatsApp to deploy powerful exploits violated WhatsApp's terms of use. While this is almost certainly true (deploying malware via WhatsApp is definitely not allowed), WhatsApp appears to want a ruling that would expand the definition of "unauthorized access" under the CFAA (Computer Fraud and Abuse Act) that's already been stretched several times by DOJ prosecutors.

On one hand, it would be undeniably enjoyable see NSO get slapped with an order denying it access to WhatsApp and its users, on the other, it wouldn't be helpful at all to turn research (security and otherwise) that violates sites' terms of use into a federal crime.

Unfortunately, Apple's lawsuit [PDF] appears to be asking for something along the same lines. It also stretches the definition of legal standing, alleging it has the right to sue on the behalf of its users because reacting to the deployment of NSO malware has caused it to spend a bit of its billions closing security holes.

That being said, Apple's legal reps sure know how to open a lawsuit. Here's the first paragraph of the suit's introduction:

Defendants are notorious hackers—amoral 21st century mercenaries who have created highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse. They design, develop, sell, deliver, deploy, operate, and maintain offensive and destructive malware and spyware products and services that have been used to target, attack, and harm Apple users, Apple products, and Apple. For their own commercial gain, they enable their customers to abuse those products and services to target individuals including government officials, journalists, businesspeople, activists, academics, and even U.S. citizens.

Welp. That's not going to help NSO's presumably permanently damaged SEO. The next paragraph builds on NSO's "amoral mercenary" reputation by pointing to the US Commerce Department's recent blacklisting of the company -- an act that almost never targets companies operating in countries the US considers to be close allies.

It follows these accusations with NSO's own admissions of malfeasance.

NSO admits that its destructive products have led to violations of “fundamental human rights,” which have been widely recognized and condemned by human rights groups and governments, including the U.S. Government. To ensure that their products can be used by others to maximum effect, NSO reportedly provides ongoing technical support and other services to their clients as they deploy NSO’s spyware against Apple’s products and users, including journalists, human rights activists, dissidents, public officials, and others. Most recently, the Guardian reported that six Palestinian human rights defenders—one of whom is also a U.S. citizen—were attacked and surveilled using NSO’s spyware. Although NSO claims that its spyware “cannot be used to conduct cybersurveillance within the United States,” U.S. citizens have been surveilled by NSO’s spyware on mobile devices that can and do cross international borders.

Then it starts talking about the damage Apple itself has suffered as a result of NSO customers targeting iPhone users.

Defendants force Apple to engage in a continual arms race: Even as Apple develops solutions and enhances the security of its devices, Defendants are constantly updating their malware and exploits to overcome Apple’s own security upgrades.

These constant recovery and prevention efforts require significant resources and impose huge costs on Apple. Defendants’ unlawful malware activities have caused and continue to cause Apple significant damages in excess of $75,000 and in an amount to be proven at trial.

That's the amount of damages needed to keep a lawsuit in federal court. But further into the lawsuit, Apple specifically cites the law amended by the CFAA and quotes a much lower price for actual monetary damages.

Defendants’ actions caused Apple to incur a loss as defined by 18 U.S.C. § 1030(e)(11), in an amount in excess of $5,000 during a one-year period, including the expenditure of resources to investigate and remediate Defendants’ conduct.

That puts the CFAA in play as Apple advocates on behalf of its users and its own defensive efforts. But standing is a tricky thing, as is attempting to hold NSO directly responsible for the activities of its customers.

Apple attempts to show standing by claiming end users are only borrowing the software it creates, so iPhone users targeted by NSO malware are, in effect, having their rented homes damaged by home invaders. Apple is the landlord, so to speak, so it believes it is due direct compensation for something that happened to its tenants. This is a dangerous argument to make, considering its the same one the DOJ deployed when it was trying to force Apple to break encryption on the San Bernardino shooter's iPhone.

Defendants violated and attempted to violate 18 U.S.C. § 1030(a)(2) because they intentionally accessed and attempted to access the iOS operating system on Apple’s users’ devices without authorization and, on information and belief, obtained information from Apple’s users’ devices.

Defendants violated 18 U.S.C. § 1030(a)(4) because they knowingly and with the intent to defraud accessed the operating system on Apple’s users’ devices without authorization using information from Apple’s servers and then installed highly invasive spyware on those Apple users’ devices, and by means of such conduct furthered the intended fraud and obtained something of value.

[...]

Apple retains ownership of its operating-system software pursuant to its Software License Agreements.

We'll see whose stretching works better. Apple wants to be able to represent users who've been targeted, citing its licensing and its own (apparently minimal) expenses related to patching security holes. NSO, on the other hand, will want out of this suit and has deployed some creative arguments of its own defending itself against WhatsApp's litigation.

It remains to be seen whether its argument that it can't be sued directly for the actions of its customers will convince the court WhatsApp's lawsuit should be dismissed. But it has already seen another of its defenses shot down at the appellate level, which refused to extend sovereign immunity to the private company that sold exploits to government agencies. The Ninth Circuit refused to buy the argument that selling stuff to government agencies makes one an extension of that government agency for immunity purposes.

We'll see what the court makes of this one. We already know at least one of NSO's defenses is foreclosed by precedent. But we shouldn't necessarily cheer Apple on just because the target of its suit is reprehensible. A ruling in favor of Apple's CFAA allegations could prove disastrous for researchers and others who bypass terms of service restrictions for far less malignant reasons.

On the bright side, Apple is handing out a lot of money to researchers who've exposed plenty of malfeasance by NSO Group's customers.

Apple commends groups like the Citizen Lab and Amnesty Tech for their groundbreaking work to identify cybersurveillance abuses and help protect victims. To further strengthen efforts like these, Apple will be contributing $10 million, as well as any damages from the lawsuit, to organizations pursuing cybersurveillance research and advocacy.

Apple will also support the accomplished researchers at the Citizen Lab with pro-bono technical, threat intelligence, and engineering assistance to aid their independent research mission, and where appropriate, will offer the same assistance to other organizations doing critical work in this space.

On top of this, Apple will continue notifying users it believes have been targeted by NSO malware, which is only going to result in more negative press for the malware purveyor. If NSO wanted to be perceived as a skilled warrior in the fight against international crime and terrorism, it blew that chance when it decided to sell to notorious human rights abusers and engage in zero oversight of the use of its products. It earned the reputation it now has and will carry with it forever, no matter how this lawsuit plays out.

Filed Under: cfaa, exploits, iphones, license, malware, ownership, research, spyware
Companies: apple, nso group

It's Time To End The Anti-Circumvention Exemption Circus

from the pleading-for-your-rights dept

Copyright as we know it goes back to the Statute of Anne of 1710. A law that old is clearly going to struggle to cope with the enormous changes in technology that have taken place since then – notably the Internet. But even relatively recent copyright laws were framed in ways that have become unworkable for the digital world we live in.

For example, arguably one of the most important pieces of recent legislation in this area is the Digital Millennium Copyright Act (DMCA) in the US, and its sibling, the EU's Copyright Directive (EUCD). Both are wide-ranging, affecting many aspects of copyright, and a particularly problematic aspect of both concerns anti-circumvention. The DMCA and EUCD prohibit the bypassing of any "technical protection measure" (TPM) used to protect works under copyright. That typically means the much-hated Digital Rights Management (DRM), which aims to control who can do what with copyright material, and thus often gets in the way of people enjoying material that they have paid for.

The DMCA and EUCD introduced severe penalties for circumventing any such TPM, no matter how weak it is, and no matter how reasonable the need to do so may be. As a tiny recognition of this lack of proportion, the DMCA includes Section 1201, which provides a mechanism for giving people permission to circumvent protection:

The Digital Millennium Copyright Act (DMCA), codified in part in Title 17, section 1201, of the United States Code, generally makes it unlawful to circumvent technological measures used to prevent unauthorized access to copyrighted works, including copyrighted books, movies, videos, video games, and computer software. Section 1201, however, also directs the Librarian of Congress, upon the recommendation of the Register of Copyrights following a rulemaking proceeding, to determine whether the prohibition on circumvention is having, or is likely to have, an adverse effect on users' ability to make noninfringing uses of particular classes of copyrighted works. Upon such a determination, the Librarian may adopt limited temporary exemptions waiving the general prohibition against circumvention for such users for the ensuing three-year period.

The new temporary exemptions have just been announced. One of them is to allow copy protections on ebooks to be circumvented so that the visually impaired can use technology to help them access the texts. Wired reports:

The victory is tainted somewhat by the struggle it represents. Although the exemption protects people who circumvent digital copyright protections for the sake of accessibility – by using third-party programs to lift text and save it in a different file format, for example – that it's even necessary strikes many as a fundamental injustice.

Another exemption concerns text and data mining (TDM) – using automated techniques to analyze typically large quantities of text and data in order to find patterns and trends there. This kind of work allows existing facts to generate new ones, but often requires circumventing publishers' TPMs. The Authors Alliance reported on a new exemption to section 1201 of the DMCA that would permit TDM by researchers affiliated with academic institutions. But even here, there were restrictions that made it less useful than it could have been:

In the recommendation, Register Perlmutter also recommended adding a limitation that "circumvention be permitted only on copies of the copyrighted works that were lawfully acquired and that the institution owns or for which it has a non-time-limited license," and should not be permitted on works the institution had "rented or borrowed." This limitation has the potential to complicate the usability of the exemption with regards to TDM research on e-books: because e-books are generally licensed rather than owned, whether the exemption will permit TDM research on a certain e-book will depend on the terms of the license for that e-book.

Finally, there is an example of how outdated copyright laws are seriously hampering what is manifestly a legal activity: repairing digital equipment. Because software is involved, and that code is often protected, it has hitherto been illegal in the US to repair many digital devices. The new exemption will now allow circumvention for the purpose of repair, but with a major restriction, as explained by the iFixit site. The new exemption does not allow you to distribute repair tools that circumvent manufacturers' TPMs:

Without access to shared tools, the exemptions are largely academic. Right now, if you want to use this new exemption to repair your Xbox, you're going to have to whittle your own optical drive unlocking app or device from scratch. That just doesn't scale – most gamers are not security engineers.

It should not be necessary to beg every three years for limited and flawed exemptions, like the ones above, to overly-strong copyright laws; instead, people should have a right to carry out these perfectly reasonable activities. The DMCA and EUCD need to be amended, and their logic inverted, so that circumventing a TPM is always permitted, except when it is for an illegal purpose.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Originally published to the Walled Culture blog.

Filed Under: dmca, dmca 1201, drm, exemptions, research, tdm, technical protection measures, triennial review

Top Publishers Aim To Own The Entire Academic Research Publishing Stack; Here's How To Stop That Happening

from the protocols-not-platforms dept

Techdirt's coverage of open access -- the idea that the fruits of publicly-funded scholarship should be freely available to all -- shows that the results so far have been mixed. On the one hand, many journals have moved to an open access model. On the other, the overall subscription costs for academic institutions have not gone down, and neither have the excessive profit margins of academic publishers. Despite that success in fending off this attempt to re-invent the way academic work is disseminated, publishers want more. In particular, they want more money and more power. In an important new paper, a group of researchers warn that companies now aim to own the entire academic publishing stack:

Over the last decade, the four leading publishing houses have all acquired or developed a range of services aiming to develop vertical integration over the entire scientific process from literature search to data acquisition, analysis, writing, publishing and outreach. User profiles inform the corporations in real time on who is currently working on which problems and where. This information allows them to offer bespoke packaged workflow solutions to institutions. For any institution buying such a workflow package, the risk of vendor lock-in is very real: without any standards, it becomes technically and financially nearly impossible to substitute a chosen service provider with another one. In the best case, this non-substitutability will lead to a practically irreversible fragmentation of research objects and processes as long as a plurality of service providers would be maintained. In the worst case, it will lead to complete dependence of a single, dominant commercial provider.

Commenting on this paper, a post on the MeaseyLab blog calls this "academic capture":

For those of us who have lived through state capture, we felt powerless and could only watch as institutions were plundered. Right now, we are willing participants in the capture of our own academic freedom.

Academic capture: when the institutions' policies are significantly influenced by publishing companies for their profit.

Fortunately, there is a way to counter this growing threat, as the authors of the paper explain: adopt open standards.

To prevent commercial monopolization, to ensure cybersecurity, user/patient privacy, and future development, these standards need to be open, under the governance of the scholarly community. Open standards enable switching from one provider to another, allowing public institutions to develop tender or bidding processes, in which service providers can compete with each other with their services for the scientific workflow.

Techdirt readers will recognize this as exactly the idea that lies at the heart of Mike's influential essay "Protocols, Not Platforms: A Technological Approach to Free Speech". Activist and writer Cory Doctorow has also been pushing for the same thing -- what he calls "adversarial interoperability". It seems like an idea whose time has come, not just for academic publishing, but every aspect of today's digital world.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: academic capture, copyright, open access, protocols, publishing, research

The FTC Is Driving Away Good Economists In Favor Of Political Henchmen

from the let-them-speak dept

Shut up and get in line — that's the message Federal Trade Commission Chair Lina Khan recently broadcasted to FTC staffers. Within her first month as a new commissioner, Khan ordered a stop to all public speaking for "an all-hands-on-deck moment." Evidently, she wants the FTC speaking with only one voice — her own. The gag order is going to run out the top economists and harm the FTC's long-term effectiveness.

Khan rose to academic stardom at a young age as a vocal critic of Big Tech, especially Amazon. In her most famous writing, Amazon's Antitrust Paradox, she argued for stronger antitrust enforcement even when companies are lowering prices for consumers. Khan's preferred antitrust approach would be a complete overhaul of the current antitrust system and would require a lot of work. However, even if one agrees with Khan that antitrust needs to be rewritten and that this is an all-hands-on-deck moment, Khan's current regime will make that impossible by running out her employees, especially Ph.D. economists.

Imagine yourself as a recent Ph.D. in economics from a hotshot university. You're 30 years old, and you just spent 6 years in graduate school, earning $20,000. Before that, you may have spent two years as a research assistant to a professor, earning just as little. You're a top student in your program and have lots of career options in front of you. You could go work at Amazon or Netflix and earn $200,000 a year, base salary. After living on a strict diet of research and Top Ramen in graduate school, that sounds pretty good.

Traditionally, federal agencies, like the FTC, compete for the best economists the same way universities compete. They can't match the pay of an Amazon, but they can offer economists a valuable perk: the ability to do research and engage with the scientific community as part of the job.

For many economists, who have already demonstrated their passion for research by writing a dissertation and completing a Ph.D., doing research is a huge perk that most private companies don't offer. The FTC knows this. In their own job postings for PhD economists, the FTC explicitly emphasizes their economists' ability to do research. To date, that hiring strategy has worked pretty well for them. Many economists at the FTC are top-notch researchers, with thousands of citations, an impressive feat for a full-time researcher at a university. When the FTC hires new PhDs, they are saying "you can work in public service and still be a successful researcher."

Khan's recent policies signal the FTC is now less committed to research and independent thinking. Public academic seminars, where economists present their findings to colleagues throughout the profession, are a key part of the research and publication process. If you cut off economists' ability to present their research and get feedback, you cut off the ability to do research.

The real damage will take some time to show itself. Even if the gag order does not run out the current economists, who may be loyal to the FTC after years, the order will still hurt the agency over time. Any successful agency needs to hire quality employees year in and year out. If this policy persists, the FTC will have trouble down the line hiring and retaining high-quality employees, especially economists.

Khan might not think she needs these economists right now; after all, she has made clear she opposes the economic approach to antitrust. But when the FTC takes companies to court, as we can expect it will do even more often under Khan, it needs expert witnesses to persuasively argue its case. The private companies pay $1,000 per hour for economists at the top of the profession. The FTC must hire top talent too.

If you were against antitrust enforcement and wanted to ruin the FTC from within, Khan's strategy would be nearly perfect. Step 1: Run out all the competent lawyers and rigorous, scientific economists. Step 2: Bring forth a bunch of cases that are poorly argued and lack an economic defense. Step 3: Lose those cases at the current Supreme Court and set a bunch of precedents against the FTC.

Brian Albrecht is an assistant professor of economics at Kennesaw State University. He holds a Ph.D. in economics from the University of Minnesota. He is a Young Voices contributor and writes a weekly economics newsletter (pricetheory.substack.com). Follow him on Twitter: @briancalbrecht.

Filed Under: antitrust, economists, ftc, lina khan, panels, presentations, research

Facebook's Threat To NYU Researchers Is A Mistake, But It's The Inevitable Follow On To Overreaction To Cambridge Analytica

from the research-v-abuse dept

Late on Friday news came out that Facebook had sent a cease and desist letter to researchers at NYU working on the Ad Observatory project. At issue was that the project had asked people to install a browser extension that would share data back to NYU regarding what ads they saw. Facebook -- responding to significant criticism -- has put forth an ad library that allows researchers to search through what ads are being shown on Facebook and who is behind them (which is good transparency!), but it does not show how those ads were targeted. This is what the researchers at NYU were trying to collect data on. And that is a reasonable research goal.

Facebook has argued that this is a breach of Facebook's terms of service -- though it does seem notable that this is coming out right around the same time that these very same researchers discovered that Facebook's promise to properly label political ads isn't working so great (it's a tangent, but this is why promising to label political ads may be problematic in the first place: you're going to miss a bunch, especially on a platform this big).

The Knight 1st Amendment Center at Columbia is representing the researchers and is condemning this move (and the researchers are refusing to comply with the cease-and-desist). Here's the Knight Center's litigation director Alex Abdo:

“Frankly it’s shocking that Facebook is trying to suppress research into political disinformation in the lead-up to the election. There’s really no question more urgent right now than the question of how Facebook’s decisions are shaping and perhaps distorting political discourse. It would be terrible for democracy if Facebook is allowed to be the gatekeeper to journalism and research about Facebook.”

This is not the first time that the Knight Center and Facebook have clashed over research. Two years ago, the Center had asked Facebook to create a special safe harbor for journalists doing research on the platform, to avoid having them face CFAA claims. Facebook declined.

I think this is a bad move by Facebook and a huge mistake. I think it's a mistake on multiple levels: political, technological, legal and just on general PR. However, I will give one sliver of a defense to Facebook: it likely feels somewhat forced into this because of the years-long over-reaction to Cambridge Analytica. Cambridge Analytica did a bunch of bad stuff, and it started out as an "academic" claiming (misleadingly) that he was merely doing "academic research" on Facebook users -- creating a Facebook app that would get users to basically cough up data about their entire social graph. The "academic" then gave the data over to the company (violating the rules), which then became part of a political advertising machine. Eventually, Facebook was pretty significantly fined, in part because of Cambridge Analytica's ability to extricate and share that data.

You may note some similarities. Ostensibly academic researchers asking users to install something to collect some data about Facebook users, and then collecting that data for "research." Given what happened with Cambridge Analytica, you might see why some folks within Facebook would be reasonably gunshy about letting this happen again -- and that may explain the company's aggressive legal response. And, you and I can say "but NYU is a respected institution -- they're not going to abuse this data" but the guy who did the data for Cambridge Analytica was initially at Cambridge, also a respected university.

You might also argue that since Facebook has been dinged by the FTC, in part over this, and the consent decree doesn't really specify that this there are separate rules for "legitimate" research, it has to do this. Indeed, that's kind of what Facebook itself is now arguing in response to this:

However, I believe the scenario here is quite different for a few key reasons. The original data used (eventually) by Cambridge Analytica was created via a Facebook app, for which the developer had to sign an agreement with Facebook that promised not to use the data in this way. And he was using the setup of Facebook's own tools to extract this data. That is, it was Facebook's API making this information available.

This is very, very different from what the NYU researchers are doing. They're asking users to install a browser extension (i.e., outside the Facebook ecosystem and not using the Facebook API or signing any kind of agreement with Facebook) in order to extract data from their own computers (again, not via the Facebook API, or the Facebook servers). And while Facebook may not like it, it's problematic that the company is arguing that it can step in and argue that end users can't -- by their own choice -- install an app they want on their own computers to capture the data that is on their own computers.

So, I think there's a pretty strong argument that me on my computer installing software to collect data in my own browser is not "unauthorized access" in any sense of the term, no matter what Facebook or the FTC might think. In fact, I'd argue that thinking that me collecting data out of my own browser and willfully handing it over to someone I chose to is, frankly, none of Facebook's business -- and it suggesting that this is a form of "unauthorized access" (which has a specific meaning under the CFAA) is crazy.

Indeed, this gets back to the infamous (and dangerous) lawsuit between Facebook and Power, in which Facebook won a CFAA claim, in part because it had sent a cease-and-desist. I still think this case was wrongly decided and the ramifications are huge, and are one of the reasons why Facebook remains so dominant today. But, in that case, again, it involved a third party offering a service to end-users who willingly chose to use the software, in order to gain access to their Facebook data in order to interact with it in a different way (in Power's case via a universal social media dashboard).

Unfortunately, I fear that the similarities to the Power case make this dangerous for the NYU researchers -- though they make a much more sympathetic defendant than a for-profit startup. And, the facts here are somewhat distinguishable from the Power case (the app here is simply collecting data in a user's browser, rather than doing an independent login and sucking out data).

We should be able to install whatever software we want -- even if Facebook doesn't like it -- to access data on our own computers. Facebook should have no say in that, and shouldn't be able to reach into our computers with a legal effort to block it. If the services were somehow damaging Facebook's technology, I could understand the issue. But this is just about reading the information on your own computer sent by Facebook and collecting and sharing that information, and it's done entirely outside the Facebook ecosystem. Facebook should not only drop the threat, but it should actually support this kind of important research.

Filed Under: academic research, ad observatory, consent decree, political advertising, privacy, research, threats
Companies: facebook, nyu

Open Access Faces Many Problems; Here's One That The Indispensable Internet Archive Is Helping To Solve

from the now-would-be-a-good-time-to-make-a-donation dept

As Techdirt has reported many times, open access is a self-evidently great idea, but one that is still beset with many problems. That's not least because academic publishers are keen to remain in control of any transition to open access, and aim to maintain their extremely high profit margins whatever the publishing model. But there's one problem for open access that ironically derives from its greatest strength -- the fact that anyone can access journals at any time, for free. Because material is always available, librarians have tended not to worry about making some kind of backup. That's not the case for traditional journals, where there is potentially a big problem if a subscription is cancelled. The end of a subscription often means that readers lose their existing access to journals. To address this, librarians have come up with a variety of ways to ensure "post-cancellation access", explained well in a 2007 post on a blog about digital preservation, written by David Rosenthal. A recent article on the Internet Archive site provides some interesting statistics on the scale of the problem of creating permanent copies of open access titles:

Of the 14.8 million known open access articles published since 1996, the Internet Archive has archived, identified, and made available through the Wayback Machine 9.1 million of them... In the jargon of Open Access, we are counting only "gold" and "hybrid" articles which we expect to be available directly from the publisher, as opposed to preprints, such as in arxiv.org or institutional repositories. Another 3.2 million are believed to be preserved by one or more contracted preservation organizations, based on records kept by Keepers Registry... These copies are not intended to be accessible to anybody unless the publisher becomes inaccessible, in which case they are "triggered" and become accessible.

This leaves at least 2.4 million Open Access articles at risk of vanishing from the web... While many of these are still on publisher's websites, these have proven difficult to archive.

That's a pretty serious problem, and one which the Internet Archive is taking steps to address, for example by trawling through the petabytes of Web content that it has built up since 1996. There's an editable catalog with an open API that aims to provide "Perpetual Access to Millions of Open Research Publications From Around The World". Internet Archive has also created a full-text search index to over 25 million research articles and other scholarly documents.

Although few people are aware of this project, it is vital work. There is little point publishing open access titles, theoretically available to all, if their holdings simply disappear at some point in the future. The Internet Archive's copies will ensure that doesn't happen. They are yet another indication of the invaluable and unique role the site plays in the online world. Without it, we would already have lost so much of the amazing material that was once online, but which has since vanished except for the copies held by the Wayback Machine. Another good reason to support this incredible, free resource financially, and to help defend it from incredibly selfish attacks by publishers.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: culture, open access, research
Companies: internet archive

Sci-Hub Downloads Boost Article Citations -- And Help Academic Publishers

from the time-to-drop-the-legal-threats dept

Techdirt readers know that Sci-Hub is a site offering free online access to a large proportion of all the scientific research papers that have been published -- at the time of writing, it claims to hold 82,605,245 of them. It's an incredible resource, used by millions around the world. Those include students whose institutions can't afford the often pricey journal subscriptions, but also many academics in well-funded universities, who do have institutional access to the papers. The latter group often prefer Sci-Hub because it provides what traditional academic publishers don't: rapid, frictionless access to the world's knowledge. Given that Sci-Hub does the job far better than most publishers, it's no wonder that the copyright industry wants to shut down the service, for example by getting related domains blocked, or encouraging the FBI to investigate Sci-Hub's founder, Alexandra Elbakyan, for alleged links to Russian intelligence.

These legal battles are likely to continue for some time -- the copyright industry rarely gives up, even when its actions are ineffective or counterproductive. Academics don't care: ultimately what they want is for people to read -- and, crucially, to cite -- their work. So irrespective of the legal situation, an interesting question is: what effect do Sci-Hub downloads have on article citations? That's precisely what a new preprint, published on arXiv, seeks to answer. Here's the abstract:

Citations are often used as a metric of the impact of scientific publications. Here, we examine how the number of downloads from Sci-hub as well as various characteristics of publications and their authors predicts future citations. Using data from 12 leading journals in economics, consumer research, neuroscience, and multidisciplinary research, we found that articles downloaded from Sci-hub were cited 1.72 times more than papers not downloaded from Sci-hub and that the number of downloads from Sci-hub was a robust predictor of future citations.

The paper explains which journals were selected, and the various analytical approaches that were applied in order to obtain this result. In all, the researchers compared 4,646 articles that were downloaded from Sci-Hub to 4,015 from the same titles that were not downloaded. Assuming that those are representative, and that the statistical calculations are correct, the end result is important. It suggests that articles that are downloaded from Sci-Hub are nearly twice as likely to be cited as those that aren't -- a big boost that will doubtless be of great interest to academics, whose careers are greatly affected by how widely they are cited. It seems to confirm that Sci-Hub does indeed help spread knowledge, not just in terms of the free downloads it offers, but also by virtue of leading to more citations for downloaded papers, and thus a wider audience for them.

The new paper notes a rather paradoxical implication of the result. Alongside Sci-Hub, which is happy to operate outside copyright law, there are alternatives like open access journals, and preprints, which are fully within it. However, as a result of Sci-Hub's ability to boost citations:

[it] may help preserve the current publishing system because the lack of access to publications, which preprints and open access journals are trying to solve, may no longer be felt so strongly to find required increasing support.

In other words, according to this latest analysis, it turns out that the copyright industry is attacking a site whose success might be seen as a reason for not changing the current academic publishing system.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: academic journals, citations, copyright, information sharing, research, sharing
Companies: sci-hub

Knight Foundation Grant To Copia To Research Content Moderation, Governance, Rules & Norms For Internet Infrastructure

from the excited-to-dig-in dept

So many of the discussions around content moderation have focused on the so-called "edge-providers" (the companies that are more user-facing). We all know the stories about content moderation dealing with Facebook, Twitter, YouTube, Google, etc. But for a while now we've been concerned about how the debate will play out regarding content moderation at the infrastructure layers -- that is the behind-the-scenes providers that people don't always even know exist. This includes hosting companies, DNS providers, domain registrars, CDNs, broadband providers and many, many more.

So we're (in the form of our Copia Institute think tank) are excited to be a part of a new grant to research this issue, with a specific focus on how these infrastructure content moderation issues may impact competition, privacy, and liability. We're planning to do some (virtual, for the time being!) gatherings, and putting together some research about these issues as well.

This is the first time we've worked with the Knight Foundation, and we're excited that they were willing to step up and support such important work.

Filed Under: content moderation, governance, grant, infrastructure, internet infrastructure, platforms, protocols, research
Companies: copia institute, knight foundation

Why Is The US Trying To Keep COVID-19 Vaccine Data Locked Up? Share It With The Whole Damn World

from the lock-up-culture dept

The NY Times had a report over the weekend about how the US government was gearing up to accuse China of using cyberattacks to get at COVID-19 vaccine data:

The F.B.I. and the Department of Homeland Security are preparing to issue a warning that China’s most skilled hackers and spies are working to steal American research in the crash effort to develop vaccines and treatments for the coronavirus. The efforts are part of a surge in cybertheft and attacks by nations seeking advantage in the pandemic.

[....]

A draft of the forthcoming public warning, which officials say is likely to be issued in the days to come, says China is seeking “valuable intellectual property and public health data through illicit means related to vaccines, treatments and testing.” It focuses on cybertheft and action by “nontraditional actors,” a euphemism for researchers and students the Trump administration says are being activated to steal data from inside academic and private laboratories.

I am sure this might be happening, but rather than fretting about cyber attacks and hacks, shouldn't we be asking why this data is locked up in the first place? This is a massive global health crisis, and the best way to get to a real vaccine or treatment is by sharing as much data as possible and being as open as possible. It truly should not matter if the US develops a treatment first or if someone else does. I recognize that there are ridiculous leaders around the globe who are more focused on "owning" any eventual treatment, and perhaps even using it only for their own citizens, but this is insanely short-sighted on both sides of the equation.

First, we will develop any successful treatment much faster (and likely much better) by getting more smart people considering all the options and making suggestions on better approaches. That will save a huge number of lives. Second, it's a global pandemic, and the only way to really make sure it's not a problem in any particular region is to make sure it's not a problem anywhere. Solving for it in one country would then require constant vigilance to make sure it doesn't re-enter.

This really should be a moment of global cooperation to deal with the pandemic on a truly global basis. And yet, so many countries -- including the US -- are retreating into nonsense nationalistic stances that focus on locking up ideas and keeping things for "ourselves," rather than opening things up to the world and sharing broadly. What a shame.

Filed Under: china, covid-19, cyberattacks, hackers, innovation, research, sharing, vaccines