We have said quite a bit about the perils of DRM and how many in the entertainment industry still insist on its use despite the fact that it is pointless as a deterrent to piracy and only leads to frustration for paying customers. Recently, we spoke about how DRM is bad for book publishers and that their insistent use of DRM was part of the reason they ended up in the DOJ's sights. Fortunately, it looks like some publishers are learning from these follies. Tor has just announced that it and all its sister companies' books will be DRM free by July of this year.

Our authors and readers have been asking for this for a long time. They’re a technically sophisticated bunch, and DRM is a constant annoyance to them. It prevents them from using legitimately-purchased e-books in perfectly legal ways, like moving them from one kind of e-reader to another.

This is an exciting move for anyone concerned about the future of ebooks. That ability for readers to transfer their books from one device to another will help as technology advances and becomes far better. It is also excellent to hear that not only are readers voicing their dislike of DRM, but authors as well. That is what is really great about this. It often seems like publishers care little about the opinions of authors when it comes to these types of decisions. This news shows that some publishers are listening. Let's hope that other publishers learn from Tor's example and begin to listen as well.

There's the old saying that "when all you have is a hammer, everything looks like a nail." But how is it that when you have big dead animals to get rid of, people reach for dynamite? Clearly, people just like to blow things up.

• The Colorado Forest service wants to remove six frozen cows from a mountain cabin, and they've looked into using explosives to try to get rid of these carcasses. There's a bit of urgency for removing these frozen cows because if they aren't removed soon, they'll thaw out, decay and potentially ruin a popular hot springs attraction nearby. [url]
• The infamous "Oregon Whale" isn't an urban legend. In 1970, the Oregon Dept. of Transportation tried to vaporize a beached sperm whale, but the explosion just created a big, smelly mess. [url]
• The US Department of Agriculture actually has an official procedure for "Obliterating Animal Carcasses With Explosives" published in 1995. So that makes everything cool—don't forget to put on your goggles. [url]
• To find some more bizarre/crazy stuff, check out some things that other StumbleUpon users have found. [url]  

By the way, StumbleUpon can also recommend some good Techdirt articles, too.

Update: Several people have asserted that Quayle's amendment actually made CISPA better, not worse. I've now posted my thoughts on that.

Up until this afternoon, the final vote on CISPA was supposed to be tomorrow. Then, abruptly, it was moved up today—and the House voted in favor of its passage with a vote of 248-168. But that's not even the worst part.

The vote followed the debate on amendments, several of which were passed. Among them was an absolutely terrible change (pdf and embedded below—scroll to amendment #6) to the definition of what the government can do with shared information, put forth by Rep. Quayle. Astonishingly, it was described as limiting the government's power, even though it in fact expands it by adding more items to the list of acceptable purposes for which shared information can be used. Even more astonishingly, it passed with a near-unanimous vote. The CISPA that was just approved by the House is much worse than the CISPA being discussed as recently as this morning.

Previously, CISPA allowed the government to use information for "cybersecurity" or "national security" purposes. Those purposes have not been limited or removed. Instead, three more valid uses have been added: investigation and prosecution of cybersecurity crime, protection of individuals, and protection of children. Cybersecurity crime is defined as any crime involving network disruption or hacking, plus any violation of the CFAA.

Basically this means CISPA can no longer be called a cybersecurity bill at all. The government would be able to search information it collects under CISPA for the purposes of investigating American citizens with complete immunity from all privacy protections as long as they can claim someone committed a "cybersecurity crime". Basically it says the 4th Amendment does not apply online, at all. Moreover, the government could do whatever it wants with the data as long as it can claim that someone was in danger of bodily harm, or that children were somehow threatened—again, notwithstanding absolutely any other law that would normally limit the government's power.

Somehow, incredibly, this was described as limiting CISPA, but it accomplishes the exact opposite. This is very, very bad.

There were some good amendments adopted too—clarifying some definitions, including the fact that merely violating a TOS does not constitute unauthorized network access—but frankly none of them matter in the light of this change. CISPA is now a completely unsupportable bill that rewrites (and effectively eliminates) all privacy laws for any situation that involves a computer. Far from the defense against malevolent foreign entities that the bill was described as by its authors, it is now an explicit attack on the freedoms of every American.

We've praised Hasbro in the past for embracing and supporting the fan culture that surrounds the My Little Pony cartoon, but we've also pointed out that they aren't always so accommodating. This story, unfortunately, falls into the latter category. Callum points us to a rather disturbing tale from the operator of an Australian blog about Nerf, another Hasbro product, who got quite a shock out of what he thought was a friendly gesture by the company.

It started wonderfully: he was contacted by a Hasbro product manager who was asking for his mailing address so she could send him some free samples of a rare-in-Australia Nerf gun to offer as a promotional giveaway on the blog. He gave it to her, and soon after got something in the mail from Hasbro: a legal nastygram.

Not the nastiest of nastygrams, sure—in fact he makes a point of saying how polite it was. Which is why he decided to comply with its request that he take down some photos of an unreleased Nerf gun from the blog, which Hasbro claimed were copyrighted and confidential. The letter also asked him to tell them where he got the images, and he responded explaining that he's not sure where they came from because he gets photos sent to him constantly—and also reminded them that journalists and their sources have certain protections under Australian law. They emailed back and said they wanted to talk more on the phone; he responded saying the matter seemed to be resolved and he couldn't see any point in talking further. In the mean time, he got another email from another product manager confirming that they were sending him free samples! He was understandably confused, and then things got genuinely nasty:

Flash forward to today- I forgot all about this for a bit and didn't reply to the latest letter from the lawyers. Then I get stories from neighbours that some strange woman and some burly, repo-looking type is hanging around my apartment block. How creepy is that?

Sadly they weren't here to give me free stuff. Turns out they're from Hasbro's lawyers!!! I told them the same stuff all over again and tried to explain that I got a bunch of stuff from ebay and taobao – of course they haven't heard of taobao and seem to want me to do their job for them.

Yup. They sent people to his house to investigate and intimidate him. All while at the same time trying to court him with free stuff from another arm of the organization. At first, naturally, he wondered if the offer of free samples was a ruse to track him down, but Hasbro's lawyers roundly denied that and as the story began to gain traction, Hasbro released a statement on the Nerf Facebook page:

We appreciate the opportunity to provide the following statement concerning Hasbro’s investigation into “leaked” IP information regarding its NERF brand products. As with anything, there are two sides to every story. While we cannot comment on the details of any ongoing investigation, Hasbro takes all circumstances of its stolen and leaked IP very seriously and will continue to investigate sources of unauthorized information and products as it relates to its brands. We would like to clarify one of the inaccuracies that has been reported. While a local Hasbro Australia marketing team did reach out to the Urban Taggers website to engage in promotional activity for which it required its address, it was completely unrelated to the confidential global investigation being conducted on Hasbro’s behalf by independent investigators looking into sources of leaked IP information. Hasbro greatly values and appreciates its fan communities and is very proud of its strong relationships with many bloggers and sites that cover our brands and products.

I'm inclined to believe them—but that doesn't make their behavior all that much less shameful. This is a problem a lot of big companies have: their legal departments and their marketing departments are completely disconnected, so one is out there encouraging activity that the other is trying to squash. It's why you get nonsense like Viacom suing YouTube over videos they uploaded themselves. This may have just been a coincidence with really horrible timing, but at the end of the day it's no way to treat a customer—much less a super-customer who promotes your products to others.

Oh, and he never got his free Nerf guns.

We've argued, repeatedly, that the backers of various cybersecurity bills have failed to give a real reason for why such bills are needed. What is the imminent threat and why does it need legislation? The only point of issue that has made some sense is that you can envision areas where it would be quite useful for companies and governments to share specific threat- or attack-related information, for the purpose of stopping that (or related) threats and attacks. But that's a very limited scenario. The entire framework of CISPA ignores that, which is why it's unclear if the bill even could be fixed. That said, Julian Sanchez, over at the Cato Institute, has posted an interesting analysis of what information sharing regulation should look like. First, he discusses the problem with the CISPA setup:

CISPA worked by creating a sweeping exception to all other privacy and surveillance laws, granting blanket immunity to any “entity” that chose to share vaguely defined “cyber threat information”—potentially including the contents of e-mails or other online communications—with both private actors and the government. When civil liberties advocates cried foul at the prospect of such vast quantities of private data being handed over to government on a silver platter, the bill’s supporters tried to placate them by tacking on an array of after-the-fact anonymization requirements and use restrictions—forbidding the use of the data except for a “cybersecurity purpose” or for “the protection of the national security of the United States.”

That wasn’t much consolation to anyone who’s watched how the government has tried to interpret similar “purpose” restrictions in the past. In 2002, for example, then–Solicitor General Ted Olson argued for a highly expansive view of the “foreign intelligence purposes” for which information obtained through national security wiretaps could be used, including using evidence of misconduct unrelated to terrorism or espionage to force people to become informants. If a wiretap turned up evidence of tax evasion or rape, for instance, Olson suggested the government “could go to that individual and say we’ve got this information and we’re prosecuting and you might be able to help us. I don’t want to foreclose that.” It’s no great leap to imagine a future solicitor general arguing that extorting the cooperation of hackers, penetration testers, or other tech professionals would similarly serve a “cybersecurity purpose.”

Basically, take a broad, vaguely defined law for a specific purpose... but leave it open to allowing the government to stretch that definition, and the government will almost always do so.

But, again, you can see cases where information sharing could be useful, so Sanchez suggests what might make sense there:

Instead of indiscriminately adding a cybersecurity loophole to every statute on the books, why not figure out which specific kinds of information are useful to security professionals without compromising privacy, figure out which laws raise obstacles to that sharing, and then craft appropriately narrow exemptions? (One assumes the intelligence agencies can be afforded more discretion about when to share the information already in their own possession—whatever else one might say about it, “oversharing” is not among the NSA’s problems.)

The exceptions could be appropriately narrowly tailored depending on the sensitivity of the information involved. For instance, different sections of the Electronic Communications Privacy Act deal with different kinds of data. Subsections (1) and (2) of 18 USC §2702 deal with the contents of communications in transit through or stored by a communications provider, generally prohibiting use or disclosure of that information without specific consent. Subsection (3) covers subscriber information and transactional data about those communications, and generally permits voluntary sharing, but specifically prohibits sharing with governmental entities. Since that transactional information is typically less sensitive than communications themselves, an exemption there might allow providers a fair amount of discretion to determine what constitutes “cyber threat information” and permit sharing with government also, subject to the appropriate anonymization and use requirements. For the more sensitive contents, the exception might be limited to a relatively specific laundry list of kinds of data that are both unquestionably security-related and limited in their implications for privacy, such as malware signatures and attack payloads.

In other words, let's more carefully define the real problem here. The government is insisting that information needs to be shared, but that's not "the problem." Information can be shared already. The reason that CISPA works by creating a huge immunity umbrella is that the "problem" with sharing isn't that information can't be shared, but that certain already overburdensome regulations block certain kinds of sharing in situations where it makes sense. The answer isn't to remove all liability for the oversharing of info, but to narrowly create exceptions to where key information that actually is necessary to be shared can have that done without violating the law. In other words, as you dig deeper, it appears that the problem isn't about sharing information -- it's about a series of existing laws that failed to take into account future realities. So, a much more targeted and reasonable solution is to figure out exactly where that friction is, and to clear out those blockages. But, that's not what CISPA does.

The NY Times has an article about yet another ridiculous bit of copyright law, the fact that moviemakers have to license artwork, even if they own the physical piece to show it in a movie. And it gets even worse, when you find out that the ridiculous position of the Artists Rights Society (think the RIAA/MPAA for artists) is that the newly released 3D version of Titanic needs a new license, because its use of artwork is somehow not covered by the original license:

It is there in the new 3-D version of “Titanic,” as it was in James Cameron’s original film: a modified version of Picasso’s painting “Les Demoiselles d’Avignon” aboard the ship as it sinks.

Of course that 1907 masterpiece was never lost to the North Atlantic. It has been at the Museum of Modern Art for decades — which is precisely the reason the Picasso estate, which owns the copyright to the image, refused Mr. Cameron’s original request to include it in his 1997 movie.

But Mr. Cameron used it anyway.

After Artists Rights Society, a company that guards intellectual property rights for more than 50,000 visual artists or their estates, including Picasso’s, complained, however, Mr. Cameron agreed to pay a fee for the right to use the image.

With the rerelease of “Titanic,” the society wants Mr. Cameron to pay again, asserting that the 3-D version is a new work, not covered under the previous agreement.

Of course, I recognize that ownership of the image is different than holding the copyright in the image -- though I'm a bit surprised that most art purchases don't include a copyright assignment or at least a permissive license as well. But it strikes me as ridiculous that the use of such images in a movie -- especially in passing -- isn't a clear case of fair use. This highlights the ridiculousness of the "permission-based society" we live in, where even if you own something, you don't really own it.

Why do we let this kind of craziness happen? Why don't we, as a society, stand up and point out that it makes no sense. If you have possession of the painting, why shouldn't you be allowed to use it in a movie? Even if you don't have the painting. How is having that painting in the movie, in any way, harming the economic value of the painting? The answer is that it is not. If anything, it's increasing the prestige and value of the painting... and it's doing all of that for free.

Think of it in a slightly different context. These days, when other products are seen in movies -- like a can of Coke, for example -- it's often there because of product placement. That is, the provider paid for it to be in the movie. Couldn't you make an argument that artwork that shows up in movies gets the same sort of benefit of the attention of the moviegoers? Why is it, then, that filmmakers are expected to pay a license to have the artwork, but get paid to have the Coke can?

When the MPAA came out with its annual report about the movie market worldwide, it showed that China was a huge growth market. However, now it appears that perhaps some of that growth was the result of Hollywood studios bribing Chinese officials. For years, China has limited how many Western movies can be released in the country. While Hollywood loves to decry all of the "piracy" in China, much of it is due to the fact that the movies can't be released there under the law. That's a situation where the problem is not piracy, nor the MPAA itself (even as it whines about Chinese piracy), but local laws. However, there has been a loosening of those restrictions lately -- and the SEC is exploring whether or not that came about due to bribes from the studios:

The Securities and Exchange Commission has sent letters of inquiry to at least five movie studios in the past two months, including News Corp's 20th Century Fox, Disney, and DreamWorks Animation, a person familiar with the matter said.

The letters ask for information about potential inappropriate payments and how the companies dealt with certain government officials in China, said the person, who was not authorized to speak publicly about the letters.

That said, there is an interesting tidbit in the Reuters article about all of this, that really serves to highlight how ridiculous the MPAA's fight against "piracy" is. It shows that despite the fact that piracy is rampant for Hollywood movies -- once the MPAA was able to get legit movies into the country, people flocked to the theaters. In other words, despite the cheaper pirated options -- or even free options -- people have no problem paying for the legit product when it's offered in a quality fashion:

China's booming middle class is increasingly willing to pay tickets prices for a cinema experience, forgoing cheap pirated DVDs and free internet downloads.

Once again, this seems to demonstrate why the problem is not piracy. If consumers are offered what they want in a reasonable manner, they are more than willing to pay -- and the Hollywood studios seem to recognize this implicitly (which is why they may have bribed Chinese officials to release authorized versions in that market, even with "piracy" being so common).

We've been arguing for quite some time now that we'd like to see the actual evidence for why a "cybersecurity" bill is actually needed. We've heard fearmongering and warnings of planes falling from the skies, but no evidence that there's a real problem here -- or, if there is a problem, that it needs a legislative solution. And yet, still, CISPA moves forward. Of course, while we still believe that some amendments could fix some of the more egregious problems with CISPA, there is still the big question of whether or not it's needed at all. Larry Downes has taken on the question of whether or not CISPA can be fixed and has decided that it cannot be, and that it represents a real threat to some key elements of the internet ecosystem. He lists out some key rules for policy makers (and goes into great detail on each, so click through):

• Don’t legislate technology using definitions that are either too specific or too general
• Don’t legislate technology until you can articulate concrete and calculable harms
• Don’t encourage or require information sharing with the government unless it’s unavoidable

All of this seems quite reasonable... which is why it's an uphill battle to get people to follow through on it.

The UK apparently has a law that protects the identity of the victims of sexual assault and rape. It's understandable why such laws exist. However, once a name gets out, as it has in a recent high profile case involving footballer Ched Evans (sentenced to five years in jail for raping a woman), does it really make sense to arrest Twitter users for mentioning her name? Now, this is no Ryan Giggs-type case, despite the superficial similarities. This does involve the victim of a horrific crime. However, at some point, you have to come to terms with reality, and recognize that even if you don't want the name out there, it's out there. Apparently it was such common knowledge that the name was trending as one of the most popular topics on Twitter. At that point, what good does arresting Twitter users do? It doesn't put the genie back in the bottle, and it's unlikely to make people not share other names. It just enrages people for telling them they can't talk about something they want to talk about.

The laws on these types of issues were designed to prevent the press from broadcasting the name. The problem here is that in the internet age, we've all become the press -- even as most people think of these tools as being more like a typical conversation. And that's where the law breaks down. While it may be legal to arrest folks on Twitter for mentioning this woman's name, it clearly goes beyond the purpose or intent of the law, and doesn't seem to do much good.

Voltage Pictures, the maker of The Hurt Locker, was one of the first companies to bring ridiculous copyright trolling practices to the US, where they sue thousands of people based solely on a questionably-sourced IP address. In fact, last year, the company sued nearly 25,000 people in one shot for supposedly file sharing the movie. Of course, the goal is not to actually go to court on any of these cases. Instead, it's just about getting people to pay up -- and so these "companies" are adapting.. And, as TorrentFreak noes, it appears that Voltage Pictures, (with an assist from Dunlap, Grubb and Weaver -- the tiny DC law firm that started "US Copyright Group" to do these kinds of cases, but which has gone nowhere) hasn't learned not to do this any more. It's just suing another 2,514 people for sharing, pretty much guaranteeing that no kids ever want to work for them in the future. However, it's also learned a few other things -- including how to get around the fact that many ISPs are pushing back on these kinds of things. For example, while plenty of ISPs have fought back against these lawsuits, in this lawsuit, Voltage Pictures only sued users who were subscribers of Charter Communications. Charter has shown a willingness to hand over such data when asked. So one way to avoid having ISPs challenge you in court is to focus on the ISP least likely to challenge your notices. Also, the new lawsuit is filed in Florida, which seems to have become the breeding ground for these kinds of troll fights lately -- so apparently Voltage and Dunlap, Grubb and Weaver think that perhaps this case might last long enough for them to get enough names and get enough people to pay to make it worthwhile. It would be nice if the court were to kill off the subpoena and note that it appears to be an abuse of power again.

Remember how we said that there were a few key amendments that were necessary to make CISPA even close to palatable? Yeah, well, the House Intelligence Committee House Rules Committee issued its rules for the House debate over CISPA... and basically barred the discussion on all of those key amendments. In other words, for all the talk of how they knew they had to make changes and were willing to compromise and come to a real solution? Yeah, it seems like that was all for show.

Amazingly, CDT, who had been a major player fighting against CISPA had backed off its opposition on Tuesday, believing that the authors of CISPA really were willing to negotiate some changes in good faith. This fact was trumpeted by supporters of the bill to show "proof" that they were listening to constructive ideas. However, by barring the consideration of these amendments, they've shown their true colors. CDT is back to fully opposing the bill.

We've written plenty about the absolutely ridiculous Special 301 Report put out each year by the USTR. It's a list that the US uses to name and shame countries that it considers "naughty" when it comes to not passing intellectual property laws that the US likes. Of course, there is no actual methodology behind the list. Basically, various industry groups (i.e., RIAA, MPAA, PHRMA etc.) send in their thoughts about which countries they don't like, and the USTR magically takes their complaints and produces the list. This leads to bizarre things like naming Canada one of the worst of the worst, despite having stricter copyright laws than the US already.

Consumers International has decided that there's no reason that the USTR gets to have all the fun, so it's been releasing its own IP Watchlist ranking countries based on how pro- or anti-consumer local IP laws. In other words, Consumer International judges IP laws around the globe based on IP's actual purpose: to benefit the public. The actual report (pdf and embedded below) is a good read.

The US actually does fairly well. We're helped along by the fact that we actually have things like "fair use" in the law. The UK, however, comes in near the bottom. The report also highlights the ridiculousness of pushing stronger enforcement in some of the poorest countries in the world:

Malawi is a politically-troubled, least-developed country where more than half of the population lives below the international poverty line of $1.25 per day. One would have thought that IP enforcement should take a back seat in such a country, in favour of measures designed to ensure the satisfaction of the population’s basic needs of food, water, clothing, shelter, and medical care.

Yet Malawi was one of four poor countries in which Interpol chose to conduct an anti-counterfeiting campaign in 2009, and in which the local police often join IP-holder organisations in conducting copyright raids against local traders. Is this noholds-barred, developed-country model of IP protection and enforcement truly the most appropriate model for countries like Malawi?

It's worth noting, by the way, that the top three countries on Consumer International's list -- Israel, Indonesia and India -- were also on the USTR's Special 301 "Priority Watch List" as having the worst IP regimes last year. But, as Consumer International shows, they actually have the best IP regimes when it comes to serving the needs of the public. That seems to show just how ridiculous the USTR's Special 301 list really is.

Governments around the world are seeking to monitor more and more of their citizens' online activities -- and it's not just the most obviously repressive regimes doing this. In the US, there is CISPA, while the UK is drawing up the Communications Capability Development Programme. Thomas Steen alerts us to a further escalation of this desire to spy on the public, in Norway. The secret service there (known by the acronym PST) want details about comments posted on all Web sites retained (via Google Translate):

"This will make it possible to identify which IP address to publish a given post at a particular time," writes PST letter also signed the acting chief Roger Berg.

The current requirement is to store information detailing where, when, how and with whom Norwegians communicate using the phone, mobile or e-mail. The latest proposal would be a major extension to that, since it would require data about highly personal content to be stored. Here's how the PST would access that information:

If it becomes subject to compulsory saving for six months, it will mean that the district court, upon request from the PST, may require that those who have online discussion must submit the information about who wrote a given post and when it was done.

In addition, prosecutors called a "rush of competence" in cases where data is needed very quickly. Then the police and PST require data directly from the supplier, but as the court approve it afterwards.

Aside from that retrospective approval for data grabs, the other worrying aspect of this proposal from the Norwegian secret service is that, if implemented, it would establish a precedent that other countries may seek to follow.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

One thing I always find particularly silly in the mainstream media is when they claim "exclusive" on a story. News is not "ownable," and the second someone gets a story out, that news is out there and the facts are available to anyone else. So every time I see publications claim "exclusive!" it makes me laugh. It may be exclusive for a few seconds, at best. But, old school journalists seem to get really really picky about those things, as evidenced by this particularly stupid argument over who gets "credit" for a story. It seems that the NY Times and Reuters both had reporters working on the story, and the NYTimes tweeted the news out about 26 seconds before Reuters did -- but the Reuters reporter is still demanding credit -- first claiming (incorrectly) that he tweeted it first, but then noting (correctly) that they published first. The simple fact is that no one cares, other than a couple of journalists. No one keeps score, and no one owns the news. After all, if we have to go back to the "original" source, then wouldn't it be the person the story is actually about?