Brindle

As the White House doubles down on its attempt to pass legislation to fast track secret trade agreements like the Trans-Pacific Partnership (TPP) agreement, their oft-repeated refrain about these deals' digital copyright enforcement provisions is that these policies would not alter U.S. law. In a 2013 interview, US Trade Representative said this about the TPP's copyright provisions:

what we have in there are things that are already in U.S. law about making sure, whether it is copyright or other protections, are fully enforced around the world.

But such claims are very misleading. Leaked texts have confirmed again and again that the TPP contains Hollywood's wish list of anti-user policies—the result of years of lobbying and schmoozing with trade delegates. What they want is the most restrictive interpretation of U.S. policy to become the international "norm" by which all other TPP countries will be forced to conform their national laws. This does not mean that the TPP exactly mirrors the language of U.S. copyright rules, namely, the Digital Millennium Copyright Act (DMCA). It's that the policies are abstracted enough so that U.S. law could still be compliant with them, while the other nations could be pressured to enact harsher restrictions.

What the White House never seems to mention is how U.S. lawmakers are in the process of conducting a comprehensive review of its own innovation policies. Congress, led by Rep. Bob Goodlatte, has held hearings on various aspects of U.S. copyright rules for close to two years. This followed a speech by the Register of Copyrights, Maria Pallante, who recommended various reforms to U.S. copyright rules, including shortening the term of copyright by twenty years (unless the copyright is renewed). President Obama, meanwhile, is still proposing provisions in the TPP that would lock us into existing, broken rules.

Let's check out some of the provisions from the latest leaked version of the TPP's Intellectual Property chapter, and identify some of the language that could be expanded to become more restrictive, or simply lock us into rules that are in serious need of reform.

Excessive Copyright Terms

TPP will require all signatory nations to adopt at least the United States' current copyright term, which is the life of the author plus 70 years—the term created by the Sonny Bono Copyright Term Extension Act of 1998. As we mentioned above, U.S. officials are already calling to shorten the automatic term of protection to the length outlined in the Berne Convention, passed in 1886, which set it at a minimum of the life of the author plus 50 years. So the TPP's requirements go beyond the Berne Convention’s requirement. If adopted in the final agreement—which seems very likely—countries will be forced to mirror the United States' excessive lengths that resulted from heavy lobbying from Hollywood (particularly Disney). And Congress could be dissuaded from reducing copyright terms. It is wrong for the White House to push for these terms when we may have the chance to shorten them, especially in light of growing evidence that such long terms harm people's ability to access to knowledge and culture.

Criminalizing DRM Circumvention

The TPP almost completely mirrors US law criminalizing acts of getting around DRM (aka technological protection measures, which is what it's called in international legal instruments). As we know from years of experiencing the adverse effects of DRM anti-circumvention rules, our system needs drastic reform here in the United States for a raft of reasons—including allowing users full access to content they have paid for, allowing archival of our digital heritage, and ensuring that users can repair their devices and keep them secure. It would be a huge mistake to lock us into policies that harm free speech, innovation, privacy, and access to knowledge.

Internet Service Providers (ISP) Liability

This portion of the agreement is still controversial (at least it was in May 2014 when the last leaked draft was written) so it's hard to say what the final provisions will look like. U.S. safe harbor rules, which limit the liability that intermediaries like ISPs and websites shoulder for their users, have been crucial to enabling new platforms and services to thrive in the United States. However, the safe harbor rules have not been without problems. Our Takedown Hall of Shame documents just a few examples of Internet services that have been forced to take down, block, or filter important and legal content, because they fear the consequences of not going far enough to respond to infringement accusations. This is another area where we ought to learn from the deficiencies of the U.S. system to inform us and pass better rules, and yet again, the White House is seeking to lock us into a flawed system.

Criminal Penalties for File Sharing

Like U.S. law, the TPP has a dangerously low threshold for criminal copyright infringement where even non-commercial acts can be criminally prosecuted. But the TPP's criminal penalty provisions diverges from U.S. law in several ways. The TPP calls for a vague requirement that prison sentences and monetary fines must be "sufficiently high" to deter people from infringing again. That provision could lead to pressure to increase already high penalties. Also, U.S. law has a more specific definition of property that can be subject to seizure, while the TPP would enable authorities to seize a broader category of "materials and implements" related to the alleged infringing activity.

Fair Use: The TPP does not contain rules like the United States' flexible fair use regime. Although the agreement now suggests a "three-step test" for copyright exceptions and limitations, that test might limit the scope of copyright exceptions The language in the TPP could even be used to constrain fair use, or discourage new specific exceptions and limitations passed legislatively or through court precedents.

Criminalization of Investigative Journalism and Whistleblowing

The most recent leak of the TPP's Intellectual Property chapter revealed some of the most atrocious, human-rights-violating provisions we had seen yet. If it remains as written, these trade secret rules could be used to enact new laws to crackdown on whistleblowers and journalists. In many ways this echoes provisions in the Computer Fraud and Abuse Act (CFAA), which was used to charge Aaron Swartz with heavy-handed criminal penalties for accessing and downloading articles from the research database, JSTOR. EFF is already working to reform the CFAA, and yet the TPP contains trade secret provisions that could be used to expand state efforts to crack down on journalists using the Internet to expose corporate wrongdoing.

All of these examples illustrate that when the White House claims that the TPP's rules would not change US law, they are being disingenuous at best. Even where its provisions do not explicitly require U.S. lawmakers to pass new law, TPP is a scheme to make more restrictive rules the international standard. Lobbyists for entertainment companies use the secretive trade negotiation process to enact their vision of more draconian, anti-innovation copyright law, and then use those trade agreements to move domestic law and policy in the wring direction. This kind of shady, undemocratic international policy laundering scheme has been going on for over two decades. This is why we need to stop TPP and put an end to this copyright creep.

~

If you're in the US, take action to stop TPP and other anti-user trade deals from getting fast-tracked through Congress by contacting your lawmaker about trade promotion authority:

Want to know if GCHQ spied on you? Now you can find out. Privacy International (PI) has just launched a website that lets anyone find out if their communications were intercepted by the NSA and then shared with GCHQ.

The website is the result of a February 6 ruling by the Investigatory Powers Tribunal (IPT). Similar to the Foreign Intelligence Surveillance Court in the US, the IPT is a special court in the UK established by the Regulation of Investigatory Powers Act (RIPA) that deals with issues of surveillance and human rights.

The February 6^th ruling held that intelligence sharing between GCHQ and NSA done prior to December 2014 was unlawful. The decision, which applied to information collected by the NSA through Prism and Upstream, was based on the secrecy of the rules governing sharing of that information. This followed a December ruling in which the court held that information sharing between the NSA and GCHQ could continue because the oversight of the data-collection program had been made public, bringing it into compliance with European law. Privacy International disagreed with the decision made by the tribunal on this point and is appealing to the European Court of Human Rights.   

As Privacy International points out, “The [February] decision was the first time in the Tribunal’s history that it had ruled against the actions of the intelligence and security services.”

But what does the ruling mean? That’s where Privacy International comes in.

Because of the ruling, there is an opportunity for people to try to find out if their communications were among those shared by NSA with GCHQ. Intelligence agencies use information like ip addresses and email addresses as “selectors” when sifting through the massive quantities of data they collect. GCHQ will comply with the IPT’s ruling by searching “selectors” it received from the NSA prior to December 2014.

But this won't happen automatically. People need to actually file requests with the IPT. To help people do so, PI is collecting people’s names, numbers, and emails in order to assist them in asserting their rights and finding out whether those selectors were subject to unlawful sharing. If they were, PI will help individuals seek a declaration that that person’s privacy rights have been violated under Article 8 and Article 10 of the UK Human Rights Act, the law that codified the European Convention on Human Rights into UK law. Once the IPT issues a declaration for an individual, that individual can also request that their records be deleted. There’s no need to be a UK citizen—anyone can participate.

One thing to note: In order to determine who is affected, PI will have to pass selectors on to IPT and GCHQ. PI notes that “GCHQ are only allowed to keep your details for the purposes of establishing whether or not they spied on you illegally and for the duration of the investigation by the IPT.” But those whose selectors (for instance, a phone number and a legal name) are not publicly associated with each other may want to be careful, because the GCHQ would now know that they are associated.

But the risk is relatively low, and the payoff is that the more people who sign on and learn that they’ve been affected by GCHQ and NSA spying, the clearer it becomes that reform to surveillance is urgently needed. Eric King, Deputy Director of Privacy International, put it best:

There are few chances that people have to directly challenge the seemingly unrestrained surveillance state, but individuals now have a historic opportunity [to] finally hold GCHQ accountable for their unlawful actions.

To participate in Privacy International’s campaign, sign up here. To learn more, read PI’s FAQ here.

Last week, we received some welcome news: the Federal Communications Commission (FCC) publicly confirmed that it is finally going to put its open internet rules on the right legal footing by reclassifying broadband providers as common carriers.  That said, the goal was never just reclassification; that’s just an essential step for open internet rules to survive the inevitable court challenge.  The real goal, though, has always been for the FCC to adopt targeted rules of the road for broadband. Will it?

That’s still hard to know, because the FCC has been pretty quiet, at least publicly, on the details of the final rules that will be put to a vote on February 26.  Here are some thoughts on what we know so far – and what we’d like to know. 

The FCC’s statements have stressed three bright-line rules:

• No Blocking: broadband providers may not block access to legal content, applications, services, or non-harmful devices.
• No Throttling: broadband providers may not impair or degrade lawful Internet traffic on the basis of content, applications, services, or non-harmful devices.
• No Paid Prioritization: broadband providers may not favor some lawful Internet traffic over other lawful traffic in exchange for consideration – in other words, no “fast lanes” – including fast lanes for affiliates.

These are all good ideas.  If net neutrality means anything, it means no unfair discrimination based on application or service, and these rules seem aimed at just that. But there’s at least one worrisome bit: the repeated reference to “lawful content.”  Does the FCC intend to suggest that throttling unlawful content is OK?  How are ISPs to determine what is and is not lawful without snooping on their users?  Can an ISP block access to the Pirate Bay without fear of violating open internet rules?

Another good idea is requiring providers to be more transparent.  We can’t hold broadband providers accountable if we don’t know what they’re up to.  The FCC can make that requirement more meaningful, though, if it makes sure that “transparency” includes an obligation to make the information public and fully accessible, online, so watchdog groups can parse it and make it understandable for the general public.

Also good: the FCC has promised to forbear from rate regulation and imposing new taxes and fees.  It also promises that there won’t be “burdensome” filing requirements or accounting. Let's hope it fulfills those promises.

Less good: the FCC appears to have taken the notion of unbundling off the table completely.  That’s too bad, because unbundling rules (meaning, rules requiring service providers to lease out their lines on fair and nondiscriminatory terms) were essential to the existence of real service competition in the early days of the Internet.  Those 20^th century rules probably could not be adopted wholesale for broadband, but we urged the FCC to seek further comment on what rules might be appropriate for the 21^st century.  It should still do so, perhaps in a separate proceeding.

Back in May, the FCC asked for comment on whether and how it should address interconnection and it has now promised to address ISP interconnection practices that are unjust and unreasonable.  Based on what we know, the FCC plans to address such complaints on a case-by-case basis.  That, unfortunately, could be a recipe for litigation and confusion, as the FCC, providers, and customers fight over what qualifies as “unjust and unreasonable.”

The same concern applies to the FCC’s promise to adopt a “general conduct” rule.  The FCC says its proposal will “create a general Open Internet conduct standard that ISPs cannot harm consumers or edge providers.” Understandably, the FCC wants to have the flexibility to address future unfair practices that we can’t yet anticipate, without having another decade-long fight.  But it’s also very easy to see it as a recipe for FCC overreach.

The FCC could help put these concerns to rest (or at least alleviate them) by sharing more details about its proposal with the public, before the February 26^th vote.  So why haven't they done so?

One reason is standard legal procedure doesn’t require it. The law that ultimately governs FCC rulemaking procedures doesn’t require the FCC to publish every iteration of the rules it votes on—it just needs to base the rules on the public record. Having taken in more than 4 million comments about net neutrality in the past year, the FCC likely feels it has an adequate public record that reflects input from all sides of this debate. And it may be concerned that releasing the full rules in advance of the meeting could lead to calls for another full comment period, which would delay what has already been a pretty exhausting process for everyone. 

So we get it -- but we won't pretend it's not an issue. We hope we are close to sustainable and sensible open Internet rules, and there are things to like about what we're heard so far.  But we are also worried about some of what the FCC seems to be contemplating, and we certainly can’t fully support rules we haven’t read.  Instead of trusting the FCC to do the right thing, we need to verify, and that means we need more details—but not more delay. 

In the South Carolina prison system, accessing Facebook is an offense on par with murder, rape, rioting, escape and hostage-taking.

Back in 2012, the South Carolina Department of Corrections (SCDC) made “Creating and/or Assisting With A Social Networking Site” a Level 1 offense [PDF], a category reserved for the most violent violations of prison conduct policies. It’s one of the most common Level 1 offense charges brought against inmates, many of whom, like most social network users, want to remain in contact with friends and family in the outside world and keep up on current events. Some inmates ask their families to access their online accounts for them, while many access the Internet themselves through a contraband cell phone (possession of which is yet another Level 1 offense).

Through a request under South Carolina’s Freedom of Information Act, EFF found that, over the last three years, prison officials have brought more than 400 disciplinary cases for “social networking”—almost always for using Facebook. The offenses come with heavy penalties, such as years in solitary confinement and deprivation of virtually all privileges, including visitation and telephone access. In 16 cases, inmates were sentenced to more than a decade in what’s called disciplinary detention, with at least one inmate receiving more than 37 years in isolation.

The sentences are so long because SCDC issues a separate Level 1 violation for each day that an inmate accesses a social network. An inmate who posts five status updates over five days, would receive five separate Level 1 violations, while an inmate who posted 100 updates in one day would receive only one.

In other words, if a South Carolina inmate caused a riot, took three hostages, murdered them, stole their clothes, and then escaped, he could still wind up with fewer Level 1 offenses than an inmate who updated Facebook every day for two weeks.

So extreme is the application of this policy that SCDC is forced to regularly suspend solitary confinement sentences because of a lack of space in disciplinary segregation. In many cases, the punishments associated with using social media are so unnecessarily long that inmates will never actually serve them since they exceed their underlying prison sentences.

Prison systems have a legitimate interest in keeping contraband devices out of their facilities and preventing inmates from engaging in illegal activities through the Internet. But South Carolina’s policy goes too far, and not only because of the shockingly disproportionate punishments. The policy is also incredibly broad; it can be applied to any reason an inmate may ask someone outside to access the Internet for them, such as having a family member manage their online financial affairs, working with activists to organize an online legal defense campaign, sending letters to online news sites, or just staying in touch with family and friends to create the type of community support crucial to reintegrating into society.

There is also a censorship component.

Facebook has processed hundreds of requests from SCDC officers who want inmates’ profiles taken down. Facebook’s stated policy is to suspend these pages under the auspices of Terms of Service (ToS) violations—specifically, purported violations of terms banning users from using aliases or sharing passwords with third parties—effectively allowing SCDC to censor inmates’ online speech. Yet, as described below, Facebook goes beyond its stated policy and agrees to SCDC requests to censor inmate pages even when no ToS violation has been alleged. In addition, Facebook seems to have taken no action against SCDC investigators who regularly violate these same terms in uncovering inmate profiles.

What’s more, this process is veiled in secrecy, with both Facebook and SCDC failing to create a public record paper trail documenting the takedown of inmate pages.

It’s time for South Carolinians to demand a review of this policy and for Facebook to reevaluate its role in helping prison systems censor and excessively punish inmates.

Social Media in South Carolina Lockups

Prisons and jails across the country have been looking for new ways to keep inmates off the Internet, not only by investing in controversial new cell-tracking technologies such as Stingrays and DRTboxes, but also using social networks as avenue to find and punish inmates.

South Carolina adopted a Level 1 social media offense [PDF] to punish “Creating and/or Assisting With A Social Networking Site,” defined as: “The facilitation, conspiracy, aiding, abetting in the creation or updating of an Internet web site or social networking site.”

SCDC defines “social networking” very broadly, covering everything from YouTube and Twitter to blogs and email, although all of the cases EFF reviewed [PDF] involved Facebook. Investigations are conducted by corrections officers and inmates are convicted during disciplinary hearings that often last mere minutes.

Since the policy was implemented, SCDC has brought 432 disciplinary cases against 397 inmates, with more than 40 inmates receiving more than two years in solitary confinement [PDF].

Here are some of the most severe social media punishments we’ve seen:

• In October 2013, Tyheem Henry received 13,680 days (37.5 years) in disciplinary detention and lost 27,360 day (74 years) worth of telephone, visitation, and canteen privileges, and 69 days of good time—all for 38 posts on Facebook. 
• In June 2014, Walter Brown received 12,600 days (34.5 years) in disciplinary detention and lost 25,200 days (69 years) in telephone, visitation, and canteen privileges, and 875 days (2.4 years) of good time—all for 35 posts on Facebook.
• In May 2014, Jonathan McClain received 9,000 days (24.6 years) in disciplinary detention and lost 18,000 days (49 years) in telephone, visitation, and canteen privileges, and 30 days of good time—all for 25 posts on Facebook.

The average punishment length for a “social networking” case was 512 days in disciplinary detention, and the average length of lost privileges was even longer.  

So disproportionate are these punishments that South Carolina doesn’t have space in disciplinary detention for all the offenders and “regularly” is forced to put the punishments on hold. In the cases of the three above inmates, SCDC says that none will serve the full punishment since they will be released from prison within the next five to 10 years.

As punishment for social media use, inmates also lose “good time” days that would had otherwise resulted in early release. Since 2012, inmates have collectively lost 14,564 “good time” days, the equivalent of 44 extra years in prison. In fiscal terms, that’s approximately $842,000 [PDF] more that taxpayers will have to pay to keep inmates behind bars—just because they posted on Facebook.

Social Media Investigations

SCDC investigators uses a variety of tools to catch inmates on social media. Sometimes, evidence is obtained during cell phone searches. Other times, investigators simply hear inmates talking about accessing Facebook.

In summer 2014, SCDC launched a mechanism for crowdsourcing social media investigations with a prominent button on the front page of its website, encouraging the public to report inmates using social media to SCDC. In only eight months, SCDC has collected more 230 submissions from the public about inmates using social networks and cell phones.

SCDC also uses outside contractors in its investigations, paying $12,500 to an unnamed entity for unspecified services. All but the price tag was redacted from the document [PDF] provided to EFF under South Carolina’s Freedom of Information Act.

Certain other tactics are more alarming. In response to inquiries from EFF [PDF], SCDC acknowledged that staff obtained inmate passwords through various means, including from inmates informing on inmates, family members, and the inmates themselves. In violation of Facebook’s Terms of Service, SCDC staff have used those passwords to access inmate accounts.

SCDC investigators have also created fake social media profiles in order to catch inmates in the act—again, a clear violation of Facebook’s Terms of Service. Unfortunately, all information regarding these investigations is shielded from disclosure under the state’s Freedom of Information Act.

In addition to the potential legal issues these practices may raise, the policies also pose problems for Facebook, which, as of February 3, has processed 512 “deactivation requests” from South Carolina corrections officers since 2012.

Facebook: Prison Censor

Facebook has made it all too easy for prisons to report inmates for having profiles: the site has a form titled “Inmate Account Takedown Request.” A corrections officer only needs to enter a few pieces of information about the inmate—the inmate’s name, profile link, and the crime for which they’re being imprisoned, but not the purported violation of Facebook’s Terms of Service—to get the inmate’s profile taken down.

In direct discussions with EFF, Facebook repeatedly asserted it does not enforce prison policies. Rather, according to Facebook, when a corrections officer contacts Facebook about an inmate page, Facebook staff may suspend the account on the grounds that the inmate violated the site’s Terms of Service.

Specifically, Facebook pointed to terms that forbid users from sharing their passwords or otherwise allowing other people to access their accounts, a practice common among inmates. Facebook claims that they suspend inmate accounts for violations of this policy not only because of the ToS violation, but also because it protects the inmate’s privacy. Facebook also forbids the use of aliases, which inmates also frequently employ.

However, prisons are very aware of how to exploit Facebook’s Terms of Service, with the Federal Bureau of Prisons even quoting the terms in handbooks [PDF] and presentations [PDF], adding that "Facebook also deactivates prisoner pages, regardless of who set up the page."

Facebook says this isn't true, but its claim that it does not enforce prison policies is contradicted by correspondence that shows Facebook explicitly censored a South Carolina inmate’s page when no ToS violation was alleged.

In July 2014, a South Carolina corrections officer emailed Facebook asking for the removal of the profile of an inmate who had violated prison policy by accessing Facebook through a cell phone. Accessing Facebook through a contraband cell phone in itself does not seem to be a ToS violation. But as the below email shows, Facebook still removed the page—not for a ToS violation, but for breach of “inmate regulations.”

Remarkably, this email exchange occurred after Facebook assured EFF it was not doing this exact thing.

This was the only email chain [PDF] between Facebook and SCDC that EFF received in response to the FOIA request. That’s because Facebook’s system allows for secret censorship. Inmate takedown requests usually occur through Facebook’s online form, which, as a Facebook employee told SCDC in a follow-up email, does not generate a receipt email. This means that more than 500 inmate take down requests have been filed without any kind of paper trail accessible to the inmate or the public—a lack of transparency that is simply not acceptable when government-instigated censorship is involved.

Even if you take Facebook at its word—i.e., that it only enforces its own Terms of Service (despite the evidence to the contrary)—Facebook is guilty of applying a double standard when it comes to ToS violations. SCDC’s practices of logging into inmate’s accounts and creating fake profiles is a clear violation of not only its ToS, but also the very same terms inmates are accused of violating. Despite SCDC’s rule-breaking, Facebook allows SCDC to maintain its own public Facebook page, where it posts career fair notices and positive news stories about its programs.

When EFF pointed this out, Facebook said it would remove any of SCDC’s secret alias pages we could identify—but this is a next to impossible feat given that information about such secret aliases isn’t publicly available through South Carolina’s FOIA.

Ensuring Accountability

South Carolina may be unique only in the frequency and severity with which it enforces social media punishments. In New Mexico, an inmate was sentenced to 90 days in solitary confinement after his family members accessed Facebook on his behalf. In Alabama, a law was recently passed to make it a misdemeanor to serve as a go-between for an inmate who wants to post information to the Internet.

These policies have not gone unchallenged. An Arizona law forbidding inmates from accessing the Internet through a third party was struck down as unconstitutional. The Florida Department of Corrections backtracked on a policy proposal similar to South Carolina's after the Florida Justice Institute and other civil liberties groups threatened litigation [PDF].  Just last week, the ACLU of Indiana filed a lawsuit alleging First Amendment violations when prison officials punished an inmate after his sister launched a social media campaign to get him freed.

SCDC has set up a system that allows prison administrators to hold inmates longer, in harsher conditions, and to largely cut them off from the rest of the world. South Carolinians should demand an immediate review of how this policy is applied.  

We’re also calling on Facebook to embrace the position that inmate communication often has public value, such as when inmates raise issues about possibly unconstitutional prison conditions and other irregularities in the criminal justice system.

Steps Facebook should take include:

• Stop censoring inmates without first evaluating whether a serious ToS violation has occurred (such as harassing a victim or engaging in a criminal enterprise).
• Eliminate the inmate takedown feature, or, at the very least, ensure that a public record (such as a receipt email) is generated every time a prison official files a takedown request and every time Facebook complies.
• Revise its transparency report to include detailed numbers of takedown requests Facebook has received, what agency sent each request, and how Facebook responded.
• Hold law enforcement agencies, such as prisons, accountable for abusing Facebook’s ToS.

Balancing the rights of inmates with public safety is a tricky task, but prisons—and the companies that assist them—must consider proportionality and fairness for justice to be truly served.  

Correction: The New Mexico inmate was sentenced to 90 days, not 60 six days.