In the wake of the leaks about NSA's spying activities around the world, one of the interesting subsidiary questions is: who else had access to this stuff? We know that the UK did, and now there are indications the Dutch did as well, according to this report on DutchNews.nl:

Justice minister Ivo Opstelten on Tuesday refused to comment on claims the Dutch security service AIVD works together with the US secret services in collecting information from email and social media traffic.

…

Dutch security service AIVD has also received information on email and social media traffic via US spy system PRISM, the Telegraaf reports on Tuesday.

Some pretty dramatic claims are being made:

If the AIVD lists an American address as suspicious, it is supplied all the information within five minutes, a source told the paper. The source worked for the department which monitored potential Dutch Muslim extremists, the paper said.

Dutch companies also cooperated with the US authorities' request for information, the source said, claiming that 'there are agents ready to deal with requests for information inside companies and institutions.'

'There are a couple of those secret programmes like Prism active in the Netherlands,' the source is quoted as saying.

There are a few points to note here. First, this is a report about a story in the Dutch newspaper Telegraaf, which draws on unnamed sources. So the chain of information is quite long, and it's likely that details have been lost or mischaracterized along the way. It's also worth noting that PRISM is not the only system mentioned here for gleaning information about people. That's probably muddying the waters yet more, as sources reveal tantalizing information about other spying initiatives that then get subsumed under the general heading of PRISM, simply because it's in the headlines at the moment.

That's not to minimize the shocking nature of these revelations -- the idea that spies around the world may be accessing within minutes any private information they want, is troubling -- merely to note that the picture we have of what is going on remains frustratingly vague. And that, of course, is an argument for more transparency from the authorities, both in the US and elsewhere, about what is really happening to our personal information when we go online, and who has access to it.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Recent news that Angelina Jolie underwent a preventive double mastectomy because of her elevated risk of developing breast cancer has drawn attention to the Myriad Genetics case currently before the US Supreme Court, and to the whole area of gene patents. Myriad's monopoly has allowed it to set a high price for its tests -- $3000 -- and this is bound to have acted as a disincentive for those who were unable to afford such a sum. It is therefore quite likely that people have died as a result of Myriad's patents.

Here's another case where placing patenting above patients could lead to unnecessary deaths. It involves the SARS-like novel coronavirus that was first noted in Saudi Arabia, as this Reuters story explains:

The virus was identified in September last year, three months after a scientist took a sample from Saudi Arabia to the Erasmus Medical Center in the Netherlands.

"There was a lag of three months where we were not aware of the discovery of the virus," Saudi Arabia's Deputy Health Minister Ziad Memish told the Geneva meeting.

He said it was taken out of the country without permission and Saudi Arabia only learned of its discovery from ProMED, a U.S.-based internet-based reporting system.

The Rotterdam-based Erasmus lab then patented the process for synthesizing the virus, meaning that anyone else who wanted to use their method to study it would have to pay the lab.

The patenting had delayed the development of diagnostic kits and serologic tests for the disease, Memish said.

Fortunately, the virus does not seem to have spread widely during that three-month delay, but next time we might not be so lucky. It seems bordering suicidal that concerns about patenting should over-ride health concerns, especially when a viral pandemic could potentially kill a hundred million people, as it did in 1918. Let's hope that the Supreme Court recognizes this as yet another reason not to allow patents on genes, and that this becomes part of a broader move to share freely vital knowledge that can save lives and alleviate suffering around the world.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

When we wrote last year about a Dutch idea to give police there the power to break into computers -- even those located abroad -- we and many others pointed out a number of deep flaws with the plan. Undeterred, the Dutch government seems to be going ahead with the scheme, as Bits of Freedom explains:

The police should be allowed to hack into mobile phones and computers, even when these are located abroad. This is proposed by the Dutch government on May 2nd of 2013. While this appears to be a powerful asset for law enforcement, in reality it creates unnecessary vulnerabilities for citizens.

Not content with that really bad idea, there's a couple of others tacked on for good measure, as the BBC reports:

The bill would also make it a crime for a suspect to refuse to decipher encrypted files during a police investigation.

It is expected the draft legislation will be put to parliament by the end of the year.

The bill singles out child pornography and terrorism as two areas of special concern. The publication of stolen data would also become punishable.

It's easy to see how the last of those could be abused to silence inconvenient whistleblowers. Bits of Freedom sums up well the key danger with the bill:

other countries, such as China, will use the powers as a justification for their own activities. They will follow the Dutch example by allowing their police to use the same methods, including hacking abroad, in order to delete controversial data. Civilians will become the victims in an arms race between hacking governments.

Indeed, it's worth considering for a moment what the Chinese response will be when it finds Dutch police, with the full approval of the Dutch government, deleting files or installing spyware on computers on its territory. It won't matter if the latter were involved in breaking into Dutch systems, or controlling a global botnet: national pride will be at stake over what will effectively be an attack on Chinese citizens and property. So as not to lose "face", a robust response is guaranteed. Is the Netherlands (population 6,065,459 16,788,973) really ready to take on China (population 1,353,821,000) over this?

Follow me @glynmoody on Twitter or identi.ca, and on Google+

A few folks sent over this story of Dutch Member of Parliament (MP) Henk Krol being fined about $1,000 for "hacking." He claims that he was just exposing poor security on the part of a Dutch medical laboratory called "Diagnostics for You," which he felt was especially important since there are stricter privacy rules for medical info. Of course, "hacking" is used loosely here: basically, a patient overheard an employee at Diagnostics for You reveal the system password while he was in the lobby, and that patient passed the password along to Krol. So, the "flaw" could be as simple as a stupid employee revealing their password out loud (though, you could argue that a system like that should require two-factor authentication or some other more advanced security than a simple password).

Either way, the court recognized that Krol's intentions may have been in the right place, but faulted him for viewing and printing "more files than necessary" to make his point -- and also for going to the press with his findings at around the same time he notified the laboratory. The court said simply finding the flaw and even downloading some records to prove it to the lab would have been fine, but that he went too far (even if he carefully redacted personal info). And then going to the press immediately when the problem seemed to be more a case of a bad employee revealing their password, just seemed like too much. As the court noted: "the problem was not so acute that immediate use of media was necessary."

Of course, this kind of thing is often a struggle when it comes to security hacking. Different people have different opinions on whether or not it's appropriate to go to the press, and also how much information to access. But it seems to be handled on a case by case basis, rather than with clear rules. There are some norms among security researchers -- and that tends to include giving a company some period of time to fix things -- but this remains an area of the law that is sometimes a bit fuzzy. You want companies to respond quickly to security flaws, and sometimes going to the press ensures getting a real response faster. But, it also seems less likely to cause significant damage if you contact them first.

Perhaps MP Krol can now try to pass some legislation with standards on how to handle security breaches found without having them turn into legal cases against the researchers.

For many years, we've discussed how Europe allows for a "database right" on collections of works, while the US forbids it. The US considers a database right improper, since copyright is not supposed to apply to facts and isn't supposed to be given out solely based on the "sweat of the brow," but rather to incentivize creativity. The Europeans, on the other hand, argued that the labor of putting together a database needed to be protected to create the necessary incentives for a thriving information/database industry. In many ways, this has created a useful natural experiment concerning copyright law and whether or not it actually creates incentives. The data has been overwhelming. Without a database right, the database industry in the US has thrived, while the same market in the EU has stagnated.

And yet, many in Europe (and some in the US) still see good things in such a government granted monopoly. We were just talking about how clinging to this outdated and clearly failed concept was now threatening important moves towards open data.

Thankfully, it appears that at least one European country has realized how damaging such rights are, and is moving in the other direction. The Dutch government, which has a number of politicians who really seem to get this stuff, is apparently trying to "modernize" its copyright law by removing protection for any "non-original" works such as databases. The link from the Future of Copyright site notes that the database right -- called "geschriftenbescherming" -- is being removed, as officials are noting that copyright should be focused on creativity, not merely protecting the upfront investments of publishers and printers:

The modernization of copyright law in the Netherlands will be done in two ways. Firstly, modern copyright will only serve to protect creative performances. Since ‘geschriftenbescherming’ does not cover any creative performance, this will now be removed. Secondly, the Dutch government believes copyright should not inadvertently preclude the creative reuse of existing material or the innovative use of information and easy exchange thereof. The protection of non-original works is often invoked to regulate parallel import instead of merely protecting the publisher’s or printer’s investment. By removing the additional protection under copyright law, the exchange and re-use of these works may be simplified. Also this could remove a legal barrier to the use of open data.

As noted in that last sentence, this story is almost the polar opposite to the one we just had about this same concept being used to hold back open data. This would be a nice step forward for the Dutch, and hopefully other European countries will quickly get with the program as well.

Update: In the comments someone points out that this is related to the EU Court of Justice ruling we wrote about last year, which noted that copyright rights need to include an element of creativity and that you can't just copyright facts.

Update 2: More information from the comments, which argues that, despite great similarities between the database right and geschriftenbescherming, this only impacts the latter not the former. The specific issue appears to be that geschriftenbescherming falls under copyright law and copyright law requires creativity (as noted in the story from last year). Yet database rights, fall under the database directive, and don't require any creativity (which is silly, for reasons we explained earlier). We apologize for any confusion and would like to thank the commenter for adding further details.

Here are two copyright stories coming out of the Netherlands, one good and one bad. The first is that the Dutch government has rejected an effort to make downloading copyrighted works for personal use infringement. There is, of course, an existing "you must be a criminal" tax on blank media there, which is part of the reason why such downloads are considered okay. Of course, now we only have to wonder how long it will be until the Netherlands shows up on the US's Special 301 report for "naughty" countries who don't follow Hollywood's extreme maximalist positions.

Of course, the entertainment industry may be much happier about a different copyright issue in the Netherlands. A court ruling in The Hague found that "embedding or linking to radio-streams without a license constitutes a violation of copyright." This is particularly crazy because it includes linking to a station's own stream. Yes, you read that right. This isn't talking about pointing to infringing streams, but to legitimate ones. And the court still found it to be infringing.

‘Nederland.fm’ embeds radio-streams from other (official) radio websites, while ‘Op.fm’ offers hyperlinks to those streams. Buma/Stemra argued that the websites enable users to listen to the music offered on the streams, and that this should be constituted as a ‘publication’ of the music to the public. The court followed this reasoning, primarily based on the fact that ‘Nederland.nl’ and ‘Op.nl’ not only offer streams or links, but they capture the consumer on their page, by playing the music within their own environment and because this environment, including ads, stays visible after clicking the links and buttons of radio stations.

That makes no sense at all. Just because someone makes money in some other manner doesn't mean they automatically owe money to someone else when they were using their legal streams. Unfortunately, we keep seeing wacky rulings like this around the globe that just muddy the picture when it comes to creating sensible copyright policies.

The US Patriot Act has suddenly scared an entire nation, and it's not the US itself this time. The Netherlands is currently going nuts about the US government being able to request medical details of all its citizens when the Dutch Electronic Patient Database (EPD) is implemented next month. This will not be the only country that freaks out because of the Patriot Act, as this sort of thing is likely to happen a lot more often. A recent study explained that US government agencies can secretly request anyone's data if they are using a cloud-computing service which 'conducts systematic business in the US'. It is already sufficient when the service provider is somehow a subsidiary of a US company.

That turns out to be a problem in the Netherlands, because the company that has developed the EPD and will be hosting the patients' data on its cloud computing systems is the US-based CSC. The Dutch government and the organization responsible for implementing the EPD are convinced there is no problem, because there are clear contracts which have assigned Dutch jurisdiction, and fortunately the Dutch have stringent data protection laws that will protect patients' sensitive data. Because that's what data protection laws do, right?

False! At least with regard to information law, researchers from Amsterdam University warn that this analysis is way too simplistic. According to the scholars, it is quite possible the US government agencies can circumvent data protection laws and could easily request access to medical information of every single person in the Netherlands. The study doesn't just cover the Netherlands (though it is especially timely for that), but rather looks at how these risks may apply more globally. Here are just a few of the findings that should raise eyebrows across the globe:

"When using a cloud service provider that is subject to U.S. jurisdiction, data may be requested directly from the company in question in the United States. […] From a legal point of view, access to such information cannot be denied and cloud service providers can give no guarantees in this respect. […] The possibility that foreign governments request information is a risk that cannot be eliminated by contractual guarantees. Nor do Dutch privacy laws offer any safeguards in this respect. […] It is a persistent misconception that U.S. jurisdiction does not apply if the data government requests for information do not apply to Dutch users of the cloud. […] legal protection under specific U.S. laws applies primarily to U.S. citizens and residents. […] Given the nature of intelligence work, it is not possible to gain insight into actual requests for information by the U.S. authorities […] Cloud providers will typically not be able to disclose whether such requests are made"

If the above doesn't yet lead to a new international outrage against the US Patriot Act, then the following sentence on the extra-territorial effects of the Patriot Act should at least send shivers down the spines of sovereignty-loving non-US government officials:

"The transition to cloud computing will, in principle, result in a lower degree of autonomy [...]"

Over the last year or so, there's been concern about Skype's commitment to privacy following its acquisition by Microsoft. Now a situation in the Netherlands is serving to renew those fears. As highlighted by Slashdot, it appears that Skype handed over information on a 16-year-old user to a private information technology firm that was investigating some denial of service attacks against PayPal.

The security firm, iSIGHT, was hired by PayPal to investigate the attacks, and an employee of the company reached out to Skype seeking information about one user who he thought might be involved. And Skype coughed up the info -- including username, real name, email address and home address -- no questions asked. As the article notes, there was no court order or anything like that. Just a guy from a private company asking and Skype said, "sure, here's all the info."

There are questions about whether this move violated some European privacy directives. At the very least it seems clear that it violated Skype's own policies, which include not providing customer data unless required by law, or if official law enforcement is involved. In this case, neither thing is true. One hopes that this is just a one-off mistake by Skype, but it's worrying nonetheless.

Torrentfreak reports on a really scary ruling coming out of the Netherlands, in which a court found hosting company XS Networks liable and ordered it to pay up because it hosted a torrent site. We've discussed issues of secondary liability, but this goes well beyond what we've seen elsewhere. As TorrentFreak explains, super-aggressive Dutch anti-piracy organization BREIN was trying to shut down the site SumoTorrent and get information about its operators. XS Networks, who briefly hosted the site, pointed out that it required a court order to turn over any info. This is a perfectly reasonable stance. However, it later backed down and reached an "agreement" with BREIN to hand over some info. By that time SumoTorrent had moved on to another host, and the info that XS Networks had to give to BREIN was incorrect or useless. BREIN then claimed that XS Networks was responsible for this situation and sued for damages.

This is the point that any reasonable court would laugh at BREIN and tell its boss Tim Kuik to learn a little something about suing the proper party, rather than a tool provider (especially one who simply asked for a court order before coughing up private info and who later was clearly willing to negotiate in good faith). Instead, the court went in the other direction, and said that SumoTorrent "is clearly facilitating copyright infringement" and that XS Networks should have magically known that to be the case, and shut the site down when BREIN first asked. Even if you're a copyright system supporter, this ruling should scare you. It takes away any sort of due process. Most reasonable people admit that whether or not a site is illegal should require at least a basic adversarial trial in which the site is able to make its case. But here the court ignores all of that, and the fact that it hadn't yet proved SumoTorrent guilty of infringement, and just insists that XS Networks should have magically accepted that BREIN must be right. Talk about a recipe for abuse by BREIN and other copyright holders.

If you're a hosting company in the Netherlands, your legal liability just shot way, way up. Apparently, if you don't magically kick off every site that might be enabling someone to break the law, you yourself may be liable for any illegal actions done on the site (even without such illegality ever being proved). That seems like a great recipe to get a bunch of Dutch hosting companies to reconsider even being in business.

Techdirt readers with long memories may recall a fantasy proposal from Orrin Hatch that would have seen technological means deployed to destroy the computers of those who downloaded unauthorized copies of files. Of course, the idea was so ridiculous it went nowhere. Now, nine years later, a similar idea has turned up, but with a rather better chance of being implemented, since it comes from a national government:

On 15 October, the Dutch ministry of Justice and Security proposed powers for the police to break into computers, install spyware, search computers and destroy data. These powers would extend to computers located outside the Netherlands.

The plan of allowing the police to break into domestic computers and install spyware is bad enough, as the German experience shows. There, it turned out that the malware employed had such serious flaws that anyone could take control of a machine infected with it. But the idea of giving Dutch investigators permission to break into computers anywhere in the world is even worse. The article from the digital rights group Bits of Freedom, quoted above, explains why:

If the Dutch government gets the power to break into foreign computers, this gives other governments the basis to break into Dutch computers which infringe the laws of their country. The end result could be less security for all computer users, instead of more. This is even more true with regard to the power to destroy data on foreign computers; it is likely that other governments would be very interested in using such a power against Dutch interests.

Even totally law-abiding users might be caught up in this digital war:

Furthermore, providing the government the power to break into computers provides a perverse incentive to keep information security weak. Millions of computers could remain badly secured because the government does not have an incentive to publish vulnerabilities quickly because it needs to exploit these vulnerabilities for enforcement purposes.

It's not really down to governments to publish details of flaws, but it's possible they might be less inclined to encourage the public to patch them, if they want to use the vulnerabilities themselves. This would doubtless lead to criminals taking advantage of widespread holes in security, with personal data being stolen, and financial systems compromised.

All-in-all, the Dutch proposal has to be one of the most foolish ever presented by a government in this area, and shows the folly of trying to come up with quick fixes for the currently-fashionable issue of "cybercrime", instead of really thinking through the consequences. Let's hope calmer heads prevail, and the proposal is withdrawn.

Follow me @glynmoody on Twitter or identi.ca, and on Google+