Leettaschmidt

Today, the 193 members of the United Nations General Assembly unanimously approved a UN privacy resolution entitled "The right to privacy in the digital age."  The resolution, which was introduced by Brazil and Germany and sponsored by more than 50 member states, is aimed at upholding the right to privacy for everyone at a time when the United States and the United Kingdom have been conducting sweeping mass surveillance on billions of innocent individuals around the world from domestic soil.

The resolution reaffirms a core principle of international human rights law: Individuals should not be denied human rights simply because they live in another country from the one that is surveilling them.  We hope the resolution will make it harder for the US and its Five Eyes allies to justify their mass surveillance activities by claiming that their human rights obligations stop at their own borders.

The Resolution:

Requests the United Nations High Commissioner for Human Rights to submit a report to the General Assembly on the protection of the right to privacy, including in the context of domestic and extraterritorial surveillance and/or interception of digital communications and collection of personal data, including on a mass scale.

In short, this request opens the opportunity for further work on the issue by the United Nations on the protection of privacy across borders.  Fortunately, EFF and several other NGOs and legal scholars around the world have already developed a set of robust principles, called the 13 International Principles for the Application of Human Rights to Communications Surveillance—or more commonly, the “Necessary and Proportionate Principles.”

The Principles look beyond the current set of revelations to take a broad look at how modern communications surveillance technologies can be addressed consistently with human rights and the rule of law. The Principles can be used by states around the world to push for stronger legal protections at the United Nations and other international bodies as well as at home.

The Principles make clear that:

• Critical Internet infrastructure must be protected: No law should impose security holes in our technology in order to facilitate surveillance. Dumbing down the security of hundreds of millions innocent people who rely on secure technologies in order to ensure surveillance capabilities against the very few bad guys is both overbroad and short-sighted. The assumption underlying such efforts—that no communication can be truly secure—is inherently dangerous, leaving people at the mercy of good guys and bad guys alike. It must be rejected.

• Monitoring equals surveillance: Much of the expansive state surveillance revealed in the past year depends on confusion over whether actual "surveillance" has occurred and thus whether human rights obligations apply. Some have suggested that if information is merely collected and kept but not looked at by humans, no privacy invasion has occurred. Others argue that computers analyzing all communications in real-time for key words and other selectors is not "surveillance" for purposes of triggering legal protections. These differences in interpretation can mean the difference between targeted and mass surveillance of communications. Definitions matter. States should not be able to bypass privacy protections on the basis of arbitrary definitions.

• We must protect metadata: It’s time to move beyond the fallacy that information about communications is not as privacy invasive as communications themselves. Information about communications, also called metadata or non-content, can include the location of your cell phone, clickstream data, and search logs, and is just as invasive as reading your email or listening to your phone calls—if not more so. What is important is not the kind of data is collected, but its effect on the privacy of the individual. Thus, the law must require high standards for government access. Our metadata needs to be treated with the same level of privacy as our content.

• Privacy must be protected across borders: Privacy protections must be consistent across borders at home and abroad. Governments should not bypass national privacy protections by relying on secretive informal data sharing agreements with foreign states or private international companies. Individuals should not be denied privacy rights simply because they live in another country from the one that is surveilling them. Where data is flowing across borders, the law of the jurisdiction with the greatest privacy protections should apply.

• We must restore proportionality: Authorities must have prior authorization by an independent and impartial judicial entity in order to determine that a certain act of surveillance has a sufficiently high likelihood to provide evidence that will address a serious harm. Any decisions about surveillance must weigh the benefits against the costs of violating an individual's privacy and freedom of expression. Respect for due process also requires that any interference with fundamental rights must be properly enumerated in law that is consistently practiced and available to the public. A judge must ensure that freedoms are respected and limitations are appropriately applied.

You can read more about the crucial issues we are fighting for behind the Principles here. They have so far been endorsed by:

• Thousands of concerned citizens worldwide.

• More than 330 organizations supporting human rights, access to knowledge, the environment, women rights, free expression, and a free press. Sign the Principles on behalf of your organization here.

• More than 46 experts, academics, security researchers, political parties and elected officials from more than 17 countries. Sign the Principles as an expert or elected official by sending an email to rights (at) eff (dot) org.

Tell the world leaders: end mass surveillance at home and abroad. Sign the 13 Principles now Join the movement and tweet #privacyisaright.

After years of secret trade negotiations over the future of intellectual property rights (and limits on those rights), the public gets a chance to looks at the results. For those of us who care about free speech and a balanced intellectual property system that encourages innovation, creativity, and access to knowledge, it’s not a pretty picture.

Today Wikileaks published a complete draft of the Trans-Pacific Partnership (TPP) agreement’s chapter on “intellectual property rights.” The leaked text, from August 2013, confirms long-standing suspicions about the harm the agreement could do to users’ rights and a free and open Internet. From locking in excessive copyright term limits to further entrenching failed policies that give legal teeth to Digital Rights Management (DRM) tools, the TPP text we’ve seen today reflects a terrible but unsurprising truth: an agreement negotiated in near-total secrecy, including corporations but excluding the public, comes out as an anti-user wish list of industry-friendly policies.

Despite the Obama administration’s top U.S. negotiators’ fast approaching their self-imposed 2013 deadline to complete the agreement, today’s leak is the public’s first look at the sprawling text since a February 2011 leak [pdf] of the same chapter and a July 2012 leak of an individual section. And even as the public has been completely shut out, the U.S. Trade Representative has lobbied for wider latitude to negotiate and for “fast-track authority” to bypass Congressional review.

The document Wikileaks has published contains nearly 100 pages of bracketed text—meaning it includes annotated sections that are proposed and opposed by the negotiating countries. The text is not final, but the story it tells so far is unmistakable: United States negotiators (with occasional help from others) repeatedly pushing for restrictive policies, and facing only limited opposition, coming from countries like Chile, Canada, New Zealand, and Malaysia.

Copyright Terms

The leaked chapter features proposals for setting a new “floor” for copyright duration, ranging from the already problematic U.S. term of life of the author plus 70 years to an incredible life of the author plus 100 years, proposed by Mexico. Such bloated term lengths benefit only a vanishingly small portion of available works, and impoverish the public domain of our collective history. The U.S. is also pushing for countries to embrace terms lengths of 95 years for corporate and 120 years for unpublished works.

Extending term lengths in the U.S. was already a bad idea. The U.S. Trade Rep shouldn’t be compounding it by forcing other countries to follow suit. Countries around the world that have shorter term lengths than the U.S. celebrate the arrival each year of new works into the public domain, and the economic activity that can accompany them. Since the 1998 passage of the Sonny Bono Copyright Term Extension Act, however, the U.S. will see no new published works enter the public domain until 2019. The proposal in TPP would export that sort of restriction to all the countries that join it.

These expansive terms have also exacerbated the widely recognized problem of “orphan works” also known as “hostage works.” These are works where the rightsholder can’t be identified or located and, therefore, folks are afraid to use them, publish them online, etc, lest the rightsholder appear at last and file a lawsuit. As a result, millions of works effectively disappear from the cultural commons until their copyright terms at long last expire. Earlier this year, the U.S. Register of Copyrights advised a reduction or limitation in term length as a possible solution. Crystallizing U.S. term lengths in international agreements would frustrate efforts to enact such reasonable policies. This is a classic example of policy laundering, whereby corporate interests use secretive international forums to trump the democratic process at the national level.

Fair Use and Fair Dealing

Although the addition of the “3-step test” for fair use provisions was hailed by the U.S. Trade Representative as a major step forward for users’ rights in trade agreements, its original intention has been subverted. It now may serve as a ceiling on rights, and not a floor.

The agreement claims not to confine copyright limitations and exceptions further than earlier deals, such as the Berne Convention, but early analysis from groups like Knowledge Ecology International (KEI) suggests that’s not the case. Functionally, TPP as drafted creates a tightly circumscribed space in which countries can grant rights like fair use and fair dealing to its citizens.

Given the important role that flexibility in copyright has played in enabling innovation and free speech, it’s a terrible idea to restrict that flexibility in a trade agreement.

Intermediary liability

The newly leaked text reveals substantial disagreement over the language on copyright liability for Internet Service Providers (ISPs) and other online platforms. The February 2011 leak contained extensive language that would have imposed regulatory requirements to police users’ activities online and paved the way for systems like three-strikes take down policies and ISPs filtering and blocking access to websites that allegedly infringe or facilitate copyright infringement.

Even though the text appears to be very much in flux, it’s clear from the leaked chapter that Canada is pushing back hard against U.S. pressure to adopt draconian copyright enforcement measures. A majority of countries appear to be proposing language that would give them some flexibility to limit the liability of ISPs, so they can develop enforcement frameworks that best suit their national laws and priorities. That flexibility is essential to staving off copyright enforcement laws that in practice would violate users’ free speech and privacy. And yet the U.S., backed by Australia, opposes this language.

Anti-Circumvention

The leaked draft includes controversial language calling for laws prohibiting the circumvention of “technological protection measures,” also known as DRM. The U.S. has had such a law in place for over 15 years, and it’s been a disaster for free speech and competition, chilling the legitimate speech of innovators, filmmakers, security researchers, and many others. In fact, it’s so bad that President Obama and many in Congress have said it must be reformed. Just as much of the U.S. public is realizing our anti-circumvention law was a mistake in the first place, we’re not only trying to export it but also potentially impeding our own ability to fix it.

Despite numerous heroic proposals for fixes, most notably from Canada and Chile, the articles as drafted include many such dangerous provisions. Though the text remains unsettled, the current proposal calls for criminal liability for violations of these anti-circumvention provisions, except for when conducted by a non-profit.

Worse, because of the broad language, this criminal liability could apply to people circumventing these restrictions even where the underlying work is not covered by copyright.

Temporary Copies

The strict regulation of temporary copies reflected in the February 2011 leak was a startling throwback to an outmoded and dangerous idea: that copyright should apply even to ephemeral copies. The implications are staggering. Computers and networks create, in the normal course of operation, temporary and ephemeral copies. Regulations on these sorts of copies, as described in the earlier leak, would interfere with basic technical operations and give rightsholders an opportunity to sit on an essential chokepoint of the Internet.

Fortunately, negotiators may have recognized the fundamental folly of this proposal. Although the U.S. has yet to support any reasonable text on this topic, the draft leaked today included a proposed clarification that temporary copies may be exempted from copyright restrictions. Language from Chile, New Zealand, and Malaysia proposes that countries may make these exemptions for:

temporary acts of reproduction which are transient or incidental and an integral and essential part of a technological process and whose sole purpose is to enable (a) a lawful transmission in a network between third parties by an intermediary; or (b) a lawful use of a work; and which have no independent economic significance.

Similar language appears in a footnote proposed by a larger group of countries that does not include the U.S., and which negotiators have noted faces “no substantive objection to the concept” but which is not yet finalized.

Patents

The leaked draft reveals that the US is pushing hard for provisions expanding the reach of patent law and limiting ways in which a patent may be revoked. These proposals are meeting widespread opposition from the other participants. For example, the U.S. proposes—and nearly every other nation opposes—that patents be made available for inventions that are “plants and animals.”

The U.S. also proposes language that would prohibit denying “a patent solely on the basis that the product did not result in enhanced efficacy of the known product.” Again, nearly every other nation opposes the U.S. on this issue. And a good thing too. Setting the bar to patentability too low locks up innovation. Advocates for access to medicine argue that it allows pharmaceutical companies delay generic entry through “evergreening.” In other technology areas, the U.S. is seeing the terrible consequences of a flood of low-quality software patents, many of which are for minor improvements on existing technology. There’s no reason for an international treaty to export the problems of the U.S. patent regime.

Conclusion

The latest TPP leak confirms our longstanding fears about these negotiations. The USTR is pushing for regulations that would, for the most part, put the desires of major content and patent owners over the needs of the public. No wonder the negotiators want to keep the process secret. There are marginal improvements since February 2011, but they are not enough. Real and substantially balanced proposals will not happen unless and until negotiators can be held accountable to the public for the proposals they are making.

Rest assured: if they can't be challenged now, they will surely be challenged later. Internet users have proven that they will not stand for backroom deals that put their freedoms at risk.

Forget extra cupholders or power windows: the new Renault Zoe comes with a "feature" that absolutely nobody wants. Instead of selling consumers a complete car that they can use, repair, and upgrade as they see fit, Renault has opted to lock purchasers into a rental contract with a battery manufacturer and enforce that contract with digital rights management (DRM) restrictions that can remotely prevent the battery from charging at all.

We've long joined makers and tinkerers in warning that, as software becomes a part of more and more everyday devices, DRM and the legal restrictions on circumventing it will create hurdles to standard repairs and even operation. In the U.S., a car manufacturer who had wrapped its onboard software in technical restrictions could argue that attempts to get around those are in violation of the Digital Millennium Copyright Act (DMCA)—specifically section 1201, the notorious "anti-circumvention" provisions. These provisions make it illegal for users to circumvent DRM or help others do so, even if the purpose is perfectly legal otherwise.  Similar laws exist around the world, and are even written into some international trade agreements—including, according to a recently leaked draft, the Trans-Pacific Partnership Agreement.

Since the DMCA became law in 1998, Section 1201 has resulted in countless unintended consequences. It has chilled innovation, stifled the speech of legitimate security researchers, and interfered with consumer rights. Section 1201 came under particular fire this year because it may prevent consumers from unlocking their own phones to use with different carriers. After a broadly popular petition raised the issue, the White House acknowledged that the restriction is out of line with common sense.

The problem extends beyond inconvenience. In plenty of cases, DRM has led to users losing altogether the ability to watch, listen to, read, or play media that can't be "authenticated." Video games with online components now routinely reach an end-of-life period where the company providing the authentication decides it's no longer worth it to operate the servers. That raises the frightening possibility of a company like Renault deciding that it's not cost-effective anymore to verify new batteries—and leaving car owners high and dry.

And these are all just the problems with the DRM running as expected. Unfortunately, the intentional restrictions created by DRM can also create security vulnerabilities that can be exploited by other bad actors. The most prominent example may be the "rootkit" that Sony included on music CDs and which led in some cases to further malware infection. The stakes may be even higher when it comes to cars. Security researchers uncovering security problems in cars already face restrictions on publishing; that stands to get worse as DRM enters the picture.

As our friends at iFixit say, if you can't fix it, you don't own it. Users need the right to repair the things they buy, and that is incompatible with blanket restrictions on circumventing DRM.

Copyright maximalists like to point to the 1201 safety valve—a rulemaking procedure to identify narrow exemptions. But the process happens every three years in the Copyright Office, and it's pretty dysfunctional: the exemptions require extensive work, must be justified from scratch each time, and have no established appeal process. Permission to "jailbreak" cars can't even be considered until 2015, and even if it is granted, consumers may be wary to invest in a new car if their right to repair it could be revoked three years later.

There's a better way, but it requires legislation. Representative Zoe Lofgren and a group of bipartisan sponsors have proposed the Unlocking Technology Act, to limit the anti-circumvention provisions to cases where there is actual infringement. That's a common sense change that is long overdue.

More fundamentally, though, users must push back on the creeping imposition of DRM in more and more places. As EFF Fellow and former staff member Cory Doctorow has noted, computers are increasingly devices that we depend on for our own health and safety. It's critically important, then, that consumers actually own our stuff. Stay tuned: We’ll be pushing hard on this issue on many fronts in the coming year, and we’ll need your help.

David Plotz: People have a misguided belief in it, but, in general, the fact that anonymity is increasingly hard to get—Facebook doesn't permit it, most commenting on a lot of sites doesn't permit it—there's a loss when you don't have anonymity.

Emily Bazelon: Oh god, I am so not with you on this one. There is a loss if you're, like, a political dissident in Syria. If you are in this country, almost all of the time, there is a net gain for not having anonymous comments. We so err on the side of 'Oh, free speech, everywhere, everywhere, let people defame each other and not have any accountability for it.' And I think in free societies, that is generally a big mistake. And yes, you can make small exceptions for people who truly feel at risk, like victims of domestic violence are an example, but most of the time it is much healthier discourse when people have to own up to what they are saying.

 - Slate's Political Gabfest, Oct. 25, 2013

During last week's episode of Slate's Political Gabfest, a weekly podcast I normally adore, senior editor Emily Bazelon mocked the concept of online anonymity. Our society would be better off if everyone was forced to put their name to their words, she said, generalizing that online anonymous users are poisoning civil discourse with their largely vile and defamatory comments. She deemed only one class of user legitimately deserving of anonymity: "people who directly fear violence."

In this view of the Internet, everyone else's anonymity is worth sacrificing to silence the trolls.

It's easy to understand why some in the press have this perspective. If you work in online media, the bulk of your interactions involve news stories, which seem to draw the ugliest forms of discourse. If you're a public figure, you're faced with haters on Twitter who are obsessed with enumerating all the ways you suck. They're even worse in the comments on YouTube. A website, such as Slate, certainly has the right to determine the culture of its online community, and I don't have a position whether such sites, across the spectrum, should or should not allow anonymous comments, or even allow comments at all. I do, however, dispute this narrow vision of the Internet.

So, I spent the weekend brainstorming and jotting down all the kinds of people who would lose out if anonymity no longer existed in any form on the Internet.

Anonymity is important to:

• the people who run some of the funniest parody Twitter accounts, such as @FeministHulk (SMASH THE PATRIARCHY!) or @BPGlobalPr during the Deepwater Horizon aftermath. San Francisco would not be better off if we knew who was behind @KarltheFog, the most charming personification of a major city's climate phenomenon.
• the young LGBTQ youth seeking advice online about coming out to their parents.
• the marijuana grower who needs to ask questions on an online message board about lamps and fertilizer or complying with state law, without publicly admitting to committing a federal offense.
• the medical patient seeking advice from other patients in coping with a chronic disease, whether it's alopecia, irritable bowel syndrome, cancer or a sexually transmitted infection.
• the online dater, who wants to meet new people but only reveal her identities after she's determined that potential dates are not creeps.
• the business that wants no-pulled-punches feedback from its customers.
• the World of Warcraft player, or any other MMOG gamer, who only wants to engage with other players in character.
• artists. Anonymity is integral to the work of The Yes Men, Banksy and Keizer.
• the low-income neighborhood resident who wants to comment on an article about gang violence in her community, without incurring retribution in the form of spray paint and broken windows.
• the boyfriend who doesn’t want his girlfriend to know he’s posing questions on a forum about how to pick out a wedding ring and propose. On the other end: Anonymity is important to anyone seeking advice about divorce attorneys online.
• the youth from an orthodox religion who secretly posts reviews on hip hop albums or R-rated movies.
• the young, pregnant woman who is seeking out advice on reproductive health services.
• the person seeking mental health support from an online community. There's a reason that support groups so often end their names with “Anonymous.”
• the job seeker, in pursuit of cover letter and resume advice in a business blogger's comments, who doesn't want his current employer to know he is looking for work.
• many people's sexual lives, whether they're discussing online erotica or arranging kink meet-ups.
• Political Gabfest listeners. Each week, the hosts encourage listeners to post comments. Of the 262 largely positive customer reviews on iTunes, only a handful see value in using their real names.

Anonymity is important to anyone who doesn't want every facet of their online life tied to a Google search of their name. It is important to anyone who is repulsed by the idea of an unrelenting data broker logging everything she has ever said, or shown interest in, in a permanent marketing profile. And more.

Bazelon describes anonymous comments as "generally a big mistake" for free societies. I disagree and point to Common Sense by Thomas Paine, originally published under the anonymous byline, “an Englishman.” (Perhaps that could be Gabfest's next Audible recommendation.)

To suggest anonymity should be forbidden because of troll-noise is just as bad as suggesting a ban on protesting because the only demonstrators you have ever encountered are from the Westboro Baptist Church—the trolls of the picket world. People who say otherwise need to widen their experience and understanding of the online world. The online spaces we know and love would be doomed without anonymity, even if the security of that anonymity is far from absolute or impenetrable. The ability to explore other identities, to communicate incognito, to seek out communities and advice without revealing your identity is not only a net positive, but crucial to preserving a free and open Internet.