Latest TVEyes Ruling A Mixed Bag: Archiving & Sharing Privately Is Fair Use; Downloading & Sharing Publicly Is Not

from the some-good,-some-bad dept

Last year, we wrote about a big fair use win by TV monitoring company TVEyes -- a service used by governments, news companies and more to record, index and store TV broadcasts and make them searchable. Fox, a company that sometimes relies on fair use itself, sued TVEyes, alleging infringement and a violation of the infamous hot news doctrine. The court ruled pretty unambiguously in favor of fair use (yes, even as TVEyes is storing everything) for most of TVEyes basic operation (searching and indexing), and completely rejected the hot news claim. However, it did leave aside one area for further investigation: the features provided by TVEyes that allows users to save, archive, download, email and share clips as well as the feature for doing a "date-time search" (allowing users to retrieve video from a specific network based on the date and time of the broadcast. For those, the court wanted more evidence before deciding.

It has now ruled on that aspect and it's a partial win for fair use and a partial loss, which may be troubling. The court declared the archiving function to be fair use. But the downloading and "date time search" functions are not fair use. The emailing feature could be fair use, "but only if TVEyes develops and implements adequate protective measures."

Let's look at the details. First, the court decides that the archiving function is fair use because it is integral to TVEyes' overall service:

Democracy works best when public discourse is vibrant and debate thriving. But debate cannot thrive when the message itself (in this case, the broadcast) disappears after airing into an abyss. TVEyes' service allows researchers to study Fox News' coverage of an issue and compare it to other news stations; it allows targets of Fox News commentators to learn what is said about them on the network and respond; it allows other media networks to monitor Fox's coverage in order to criticize it. TVEyes helps promote the free exchange of ideas, and its archiving feature aids that purpose.

Archiving video clips to remain stored beyond 32 days and to facilitate successive reference is integral to TVEyes' service and its transformational purpose of media monitoring. And Fox has not identified any actual or potential market harm arising from archiving. I hold that the archiving function is fair use, complementing TVEyes' searching and indexing functions.

As for emailing and sharing, there the court says it is fair use... if TVEyes includes a few protections:

I agree that to prohibit e-mail sharing would prevent TVEyes users from realizing much of the benefit of its transformative service. For example, members of Congress rely on TVEyes to be made aware of what the media has to say about the issues of the day and about them. But their interns and staffers, not they, sit at computers querying keywords of interest through the TVEyes portal, and then e-mail the results up the chain of command. Without e-mail, the Congressman would be limited to either sharing a computer with his staffer or else having the staffer describe the contents of the clip to the Congressman without showing him the clip. In practice, the former is unrealistic and the latter fails to deliver "the full spectrum of information . . . [including] what was said, [and] how it was said with subtext body language, tone of voice, and facial expression-all crucial aspects of the presentation of, and commentary on, the news."

[....]

However, there is also substantial potential for abuse. In its current incarnation, TVEyes' e-mailing feature cannot discriminate between sharing with a boss and sharing with a friend, nor between sharing for inclusion in a study and sharing a clip for inclusion in a client sales pitch. Fair use cannot be found unless TVEyes develops necessary protections. What limits should be placed on subscribers who share links through social media? What can prevent subscribers from sharing for purposes not protected by § 107? If TVEyes cannot prevent indiscriminate sharing, it risks becoming a substitute for Fox's own website, thereby depriving Fox of advertising revenue.

This seems a bit strange to me, frankly. You still have to be a subscriber to make use of TVEyes, but then you can share clips freely online, which would seem to be a part of a reasonable news function, which should support fair use. But the court seems to think it's only fair use if it's kept "internally" via email.

Moving on to downloading, here, the court is not convinced that this is "integral" to the purpose of the product, citing a bunch of famed copyright cases, including the cases against Napster, ReDigi and MP3.com. Basically "downloading," according to the court, must be infringing, and thus not fair use.

I believe that TVEyes' downloading function goes well beyond TVEyes' transformative services of searching and indexing.... TVEyes is transformative because it allows users to search and monitor television news. Allowing them also to download unlimited clips to keep forever and distribute freely may be an attractive feature but it is not essential. Downloading also is not sufficiently related to the functions that make TVEyes valuable to the public, and poses undue danger to content-owners' copyrights.

The court completely rejects TVEyes argument that downloading is essential for offline use, because the court insists that broadband is basically available anywhere, so it's unlikely anyone will really need the service online.

Finally, there's the "date-time search" feature, which apparently is used in nearly 6% of all TVEyes' searches. Again, the court doesn't buy the fair use argument, saying that the date-time search isn't so much a "search" as it is a way for people to find something they already know is there, and that makes it much closer to the original programming and thus less "transformative."

The feature is not as much a "search" tool as a content delivery tool for users who already know what they seek. In such cases, TVEyes is not so transformational, since users should be able to procure the desired clip from Fox News or its licensing agents, albeit for a fee. Put simply, if a user wants to watch the first half of last Thursday's 0 'Reilly Factor, the Court sees no reason why he should not be asked to buy the DVD/

Unlike TVEyes' core business, its "Date-Time search" function duplicates Fox's existing functionality. Fox's contention that TVEyes' Date-Time search is likely to cannibalize Fox News website traffic and sales by its licensing agents is persuasive.

It does seem a bit worrying when courts get to decide which features of your service are okay and which are not. We generally want markets determining innovative features, rather than judges. And this ruling seems... particularly subjective on a number of points. There is no four factors test being done in any of these. It basically just takes the original ruling that the search and indexing is fair use, and then just focuses on whether these features are "essential" to that service to determine if they, too, are fair use. Again, it's troubling when a court is deciding if a feature that customers clearly like is "essential." That's not how innovation is supposed to work.

This case is still early and I expect that there will be appeals on both sides, so this ruling, by itself, isn't that important yet. What happens next, in terms of how the appeals court rules, is where things will get really interesting.

Filed Under: archiving, downloading, fair use, fox news, indexing, searching, tv
Companies: fox, news corp., tveyes

CIA Wanted To Throw The CFAA At Senate Staffers For Unauthorized Googling

from the stop-accessing-documents-we-couldn't-be-bothered-to-properly-secure! dept

Marcy Wheeler has picked up on an interesting claim made in the CIA's "We Did Nothing Wrong" report. This report -- an in-house investigation of the CIA's snooping on/hacking Senate staffers during the compilation of the Torture Report -- tossed out the Inspector General's findings and cleared the agency of any misconduct. It then went on to disingenuously claim that it was the Senate, not the CIA, that broke the rules.

According to the CIA's investigators, Senate staffers accessed documents they weren't supposed to see, apparently by "abusing" the shared network set up explicitly for the Torture Report compilation. What Wheeler spotted -- in a very thorough fisking of the CIA investigative report by Katherine Hawkins of Just Security -- is the attempted criminalization of Google searches.

As Hawkins summarizes, the crime report was based off a flaw in the Google search that CIA’s own contractor had built into the system.

"On February 7, 2014, the CIA’s Acting General Counsel Robert Eatinger (whose name is redacted from the OIG report) filed a crimes report against Senate staff with the Department of Justice. The OIG report found that the crimes report “was unfounded,” in part because Eatinger “had been provided inaccurate information on which the letter was based.” In particular, the OIG wrote:

[T]he crimes report stated that SSCI staffers might have exploited a software vulnerability on RDINet to obtain access to the [Panetta Review documents], in violation of the Computer Fraud and Abuse Act … The report was solely based on inaccurate information provided by the two [Office of the General Counsel] attorneys [to the Office of Security].

The OIG report found that there was indeed “a vulnerability” with the Google search tool that the CIA provided to the committee, which was “not configured to enforce access rights or search permissions within RDINet and its holdings” from 2009 to April 2013. But contrary to the CIA lawyer’s memorandum and the crimes report to DOJ, OIG found no evidence that Senate staff had deliberately “exploited” this flaw until CIA personnel “confronted them” with inappropriately accessed documents. Rather, it was SSCI staff who brought the vulnerability to the CIA’s attention. On November 1, 2012, a SSCI staff member alerted CIA staff that the search tool “was indexing the Majority staff work product on a shared drive,” and asked them to make it stop. The CIA did not act on this request for months. Then in 2013, a SSCI staff member requested “a number of detainee videos not provided to the SSCI by the CIA,” based on a spreadsheet that a CIA employee recognized as being from the Panetta Review. After this incident, in April 2013, CIA IT staff finally discovered and repaired the flaw with the Google search tool."

So, the CIA deployed an insecure system, was warned about it, but never bothered to do anything about it until it came across documents the Senate supposedly wasn't allowed to have.

As Hawkins points out in her Just Security post, the ongoing accusation that the Senate "hacked" the CIA's servers is pure BS. None other than Senator Feinstein addressed this bogus claim on the Senate floor in March of 2014:

[C]ommittee staff did not “hack” into CIA computers to obtain these documents as has been suggested in the press. The documents were identified using the search tool provided by the CIA to search the documents provided to the committee.

It was no hack, but the CIA attempted to hurl a Senate staffer into the jaws of the CFAA -- a law that magically turns those who discover security flaws into felons. In its February 2014 letter to Eric Holder, the CIA's counsel describes the alleged hacking as nefarious exploitation of its (admittedly insecure) search function.

The information made available to me indicates that in the November 2010 timeframe, the non-employee conducted a search that appeared intended to reach into part of the computer system to which the non-employee did not have authorized access. In such a circumstance, the system was designed to bring up on the workstation screen a page that advised the non-employee was not authorized to access that document. This page, however, had the security vulnerability that has since been discovered and remedied. The security vulnerability was that the page also contained a "URL" that indicated where the document was located on the system and if an individual copied the URL and pasted it into the browser's address bar, the individual could gain access to the document, copy it, bring that copy across the firewall, and paste it into a folder on his or her side of the firewall. The information made available to me indicates the non-employee copied the URL, pasted it directly into the browser's bar, and accessed the document.

That's incredibly poor security for a bunch of documents the CIA clearly didn't want the Senate to access. And it wasn't cheap, either. This custom Google search and server set-up was apparently a large portion of the $40 million spent to compile the Torture Report. And let's not forget that this vulnerability was undiscovered for over two years and not immediately patched when it eventually was discovered.

A staffer finding a flaw in a system isn't hacking, no matter how much the CIA wants it to be. But the CFAA allows the government to use the law's most charitable readings when prosecuting "hackers." The CIA finds wrongdoing everywhere but never in its own backyard. Its management, employees and contractors who presided over its illegal torture program will not be held accountable for their actions. But the CIA wanted the Senate to be held accountable for… holding the CIA accountable.

Hawkins again:

I know some of the staffers who wrote the torture report, including the probable subject of the crimes report to the DOJ. They do not leak and have never been credibly been accused of leaking. They do not confirm or deny information that is officially classified, no matter how obvious it is or how many years it has been in the public domain. They scrupulously continue to follow the classification restrictions that the CIA and the committee placed on them, no matter how absurd those restrictions are or how severe the crimes they conceal.

Nevertheless, the CIA searched their computer drives and their emails, and referred them to the DOJ for prosecution. Why? Because, in the course of an official Senate investigation into the torture program, they used a CIA-installed Google search tool to find CIA documents about the torture program. They read the documents, despite the fact that they contained a questionable stamp of “privilege,” and preserved them when they thought they were in danger of destruction. The staffers’ actions were not crimes or a security breach justifying a search of Senate computers. Their actions were oversight of an agency in sore need of it.

The CIA is a rogue agency, much like its counterparts, the FBI and NSA. It may be publicly embarrassed or wince at the criticism and condemnation thrown its way, but it ultimately answers to no one -- not even after its worst behavior has been exposed. It walks away from a damning report pretty much intact and has the gall to suggest Senate staffers be punished for walking in and out of its firesieve with damaging documents in their hands.

Filed Under: cfaa, cia, doj, misconfigured tool, searching, senate, senate intelligence committee, torture report

NSA FOIA Response Claims Data On Vendor Contracts 'Unsearchable'

from the it's-easier-to-not-find-something-when-you-don't-bother-looking-for-it dept

Trying to pry information loose from the NSA is nearly impossible. The ODNI has been dropping documents related to the NSA's various surveillance programs, but that's as a result of a lawsuit, something that goes completely unacknowledged at the ODNI's site. People requesting a peek into what the NSA has collected on them PERSONALLY have been universally met with a boilerplate response that "neither confirms nor denies" the existence of this data.

MuckRock has been filing dozens of FOIA requests in hopes of freeing up info on the many contractors employed by the NSA. Unsurprisingly, this has met with little success. While it did manage to secure 16 pages on French security firm Vupen, its other requests have been met with claims that no responsive documents have been found. This is hard to believe considering some of the requests are about known NSA contractors.

But one recent response went past baffling into the realm of the surreal in its assertion that the keywords MuckRock sought info on were just too "wide open" to be useful.

A search for overly broad keywords such as "CNO" and "computer network attack" would be tantamount to conducting a manual search through thousands of folders and then reading each document in order to determine whether the document pertains to a contract.

So, the agency that claims to be able to sift through millions of pieces of communications and data somehow claims it can't wrangle its own data. Of course, the NSA can't even search its own internal email, so asking it to run a keyword search for contract documents is probably out of the question. But this assertion by the NSA is a bit puzzling, as it almost implies a lot of what's being searched for isn't even digitized, as MuckRock points out.

In other words, the NSA is claiming that, for external contractors, large portions of its $10.8 billion budget are tracked primarily through paper indices not searchable even by relatively broad topic.

In addition, the agency's response appears to be saying that they don't even have a designated place to store paper copies of contracts, but place them in folders with other documents.

So, how does the agency track its interactions with its "vendors?" Does it even matter? The agency's own budget is secret (though not so much anymore), so a lack of solid accounting hardly matters. But it's still rather disturbing to see such a deliberately cavalier attitude towards accountability.

How do they keep track of their activities if they don't have an electronic contracts database? How do they, as a complex organization, determine budgetary needs if they cannot easily track their own spending? How do they measure the performance of vendor contracts, if as they claim, the contracts are shuffled to some paper file that may not see the light of day unless someone requests it through a FOIA request?

As MuckRock points out, this obfuscation is likely deliberate. The NSA is a data black hole. Lots of info flows in but it rarely, if ever, leaves. Any questions those charged with approving funding might have can be waved away by citing magic words like "national security," and that's even before its flacks in the halls of Congress start erecting roadblocks.

Almost certainly the NSA has very effective ways of searching its own internal files. After all, its defenders often boast about the number of geniuses it employs. It just has no compelling reason to do so. Even being compelled by courts to kick loose documents has its limits. As we saw just recently, a court order to declassify the government's secret opinion on the Section 215 collections was flat out refused by the DOJ. If the FISA court can't get the government to comply, then average citizens have no chance whatsoever.

MuckRock is continuing to assault the NSA's FOIA defenses. It's hoped that with enough requests, info will be pried loose that will indicate what sorts of keywords generate responsive documents -- and which ones result in ridiculous "this is impossible" statements from the agency.

Filed Under: contractors, foia, nsa, searching

Googling Juror Leads To Verdict Being Overturned

from the a-jury-of-disconnected-peers dept

We were just writing about courts requiring jurors to sign statements saying they would not Google details of cases they were hearing, and just like clockwork, we hear of a jury verdict that was overturned due to a Googling juror. The case is actually from a few years ago, and is only popping up now, because a higher court has said that the decision to overturn the jury verdict was reasonable. There was one other oddity in the case as well: the reason the juror Googled the information was because he was told ahead of time the names of parties involved in cases he might hear. Why? I have no clue... I would think that any court that does that would likely have a situation where almost everyone on the jury did at least a little searching and poking around.

Filed Under: juror, searching