The EU-Canada Trade Agreement CETA Still Isn’t Done, And May Be Partially Undone Because Of Its Corporate Sovereignty Provisions

Legal Issues

from the well,-we-did-warn-you dept

The EU-Canada Comprehensive Economic and Trade Agreement (CETA) is one of several long-running trade deal sagas covered by Techdirt. It seemed to be almost over in 2017. After a constant on-off excitement about whether CETA would survive, it was ratified by the European Union. But it still needed to be approved by all the EU Member States’ national parliaments before it came into force. The chief stumbling block to national ratification was the investor-state dispute settlement (ISDS) provisions, which would allow investors to sue governments over laws or decisions which could potentially harm future profits. This imposition of corporate sovereignty through trade deals is an issue that Techdirt has been covering for many years. Despite widespread concerns about ISDS, in 2019 the Court of Justice of the European Union, the EU’s top court, ruled that corporate sovereignty was compatible with EU law, apparently removing the last obstacle to CETA’s ratification by Member States.

And yet here we are, eight years after the final text of CETA was “celebrated“, and another major problem has emerged. The Irish Supreme Court has just ruled that ratification of CETA would be unconstitutional without holding a countrywide referendum on it. The argument that was used successfully to convince the court to halt Ireland’s ratification is the following:

The court was told during the March hearing that “sovereignty” was at the heart of the appeal, with the Dublin South Central [member of the Irish parliament] expressing concerns about the constitutionality of provisions in Ceta for “investor courts” to decide complaints by Canadians who invest in EU member states.

It was submitted the State cannot authorise the treaty “without the mandate of the people”, by way of a referendum.

Yes, it’s corporate sovereignty rearing its ugly head again, just as it has done many times in the past. But there’s a big difference now. As Techdirt wrote a few weeks ago, governments are finally waking up to the dangers of ISDS, and are actively seeking to withdraw from the Energy Charter Treaty, which also contains corporate sovereignty provisions.

Since politicians are themselves turning against the idea, it would not be surprising if its opponents succeed in convincing a majority of the Irish people to vote against allowing ISDS in CETA in the new referendum, whenever that is held. And if Ireland refuses to ratify ISDS in CETA, that would nullify the ISDS provisions across the whole of the EU. CETA would then come into effect, but without its worst feature.

Follow me @glynmoody on Twitter, or Mastodon.

Filed Under: canada, ceta, cjeu, corporate sovereignty, eu, ireland, isds, referendum

Swiss Data Protection Commissioner Orders Government To Publicly Release Surveillance Tech Export Licenses

Privacy

from the radical,-if-forced,-transparency dept

This is a very cool development in the world of government transparency.

It’s not often a government entity forces another entity to expose information it would desperately like to keep secret. But it happened in Switzerland, following an open records court battle by Tagblatt, which sought information on export licenses granted to local surveillance tech purveyors. The agency in charge of the licenses didn’t want these revealed. The agency in charge of making determinations about what can be withheld from the public said, “Too bad.”

In an enormous breakthrough for those seeking transparency and accountability to the shadowy surveillance industry, the Swiss Government has been forced to publish the list of export licenses for surveillance technologies and other equipment, including details of their cost and destination.

The decision by the Federal Information and Data Protection Commissioner comes on the heels of consistent pressure from Privacy International, Swiss journalists, and several Members of Parliament on policymakers, government officials, and companies in Switzerland over the past year and a half. The commissioner’s decision was the result of a FOI challenge filed against the State Secretariat for Economic Affairs (SECO) for its refusal to reveal information regarding the destination of the pending exports for surveillance technologies.

The beneficiary of this release by SECO is, of course, everyone who’s interested in government accountability and transparency, especially when it involves an area of government work that tends to shrouded in often impenetrable secrecy.

The most direct beneficiary — Swiss news agency Tagblatt — has plenty to say about the release of this information, including how much SECO simply did not want to reveal the countries Swiss surveillance tech providers sell to. (The following was translated by Google Translate, so apologies for the clunky English.)

The Seco does not act entirely voluntarily: Our newspaper only received the list after it requested access to the administration in 2013 based on the principle of transparency. At the end of 2014, the federal data protection officer recommended granting access, although Seco wanted to refuse this. [The Data Protection Commissioner] picks [Seco’s] arguments to pieces. It didn’t even provide a minimal justification. But that’s not all: Seco was unable to prove why the announcement of the recipients was affecting Switzerland’s foreign policy relations.

Those are the arguments SECO raised in its failed attempt to keep these export licenses under wraps. And this is why it didn’t want to release this information.

The elite RAB unit in Bangladesh is being pilloried for human rights violations. Ethiopia is a repressive country. It ranks 137th out of 179 in the press freedom rankings. Azerbaijan, an authoritarian regime, performs even worse. All three countries recently procured surveillance technology in Switzerland. This is shown in a list by the State Secretariat for Economic Affairs (Seco) of the export applications approved in 2014. 

The technology these countries acquired from Swiss tech purveyors are IMSI catchers — cell tower spoofers capable of forcing all phones in the area to connect to it so investigators can locate sought devices or (if enabled) intercept communications. Twenty-one export licenses were issued in 2014, with the list encompassing a long list of human rights abusers.

While Ethiopia, Kuwait, Qatar, Lebanon, Indonesia, Lithuania and Thailand received Imsi catchers from Switzerland for larger sums, Seco only issued temporary permits for recipients such as Azerbaijan, Bangladesh, Hong Kong, Morocco and Tunisia .

The approved list for full licenses doesn’t exactly suggest a whole lot of discretion from Swiss IMSI manufacturers. Nor does it say much about SECO, which allowed these sales (and demonstrations) to happen. The list of denied license applications (which includes Russia, Yemen, and Turkmenistan) suggests some restraint by SECO. But the fact that Swiss spy tech makers requested the licenses shows they are just as willing to sell to terrible governments as other surveillance tech purveyors who’ve made international headlines repeatedly. (Yes, we’re talking about Israel’s NSO Group. And, to a lesser extent, Italy’s Hacking Team.)

And it’s not just IMSI catchers. Plenty of human rights violators were on the list of potential customers for internet surveillance tech sold by Swiss companies. That those violators were unable to access this tech is largely due to the Snowden leaks, which forced a lot of countries to look more closely at their own spying efforts and surveillance contractors.

In early 2014 several companies withdrew their licences for internet monitoring as well as several, but not all for mobile phone monitoring, following the media spotlight in late 2013, questions raised by Swiss Members of Parliament, and the refusal of the Government to make a decision on the licences, For the very first time, SECO has now been forced to release under Freedom of Information, that the retracted requests were destined for Ethiopia, Indonesia, Yemen, Qatar, Malaysia, Namibia, two licences for Oman, Russia, Chad, Taiwan, Turkmenistan, UAE, and China.

That’s a pretty nasty group of customers to want to sell to. And that the companies appear to have been deterred by a series of leaks suggests they were more motivated by potential backlash from the Snowden revelations, rather than any sense of responsibility or propriety. You don’t have to sell to the worst governments in the world. But, like far too many other surveillance tech purveyors, Swiss companies seemed more than willing to sell powerful spy tech to governments they knew with certainty would abuse it.

Filed Under: data protection, export licenses, privacy, seco, surveillance, switzerland, transparency
Companies: tagblatt

The US Finally Has A Chance For A Federal Privacy Law. It Should Take It

Privacy

from the stop-playing-politics dept

Strong privacy rights are a crucial first step to a healthy and productive online ecosystem. The European Union figured this out years ago, enacting the General Data Protection Regulation. In contrast, the U.S., the land of tech innovation, is tripping over its own feet at the finish line and hoping nobody notices we’ll be without a consistent and consequential law protecting internet users for at least a few more years. It’s well past time to put politics and personal gripes aside and bring up the American Data Privacy and Protection Act (ADPPA) for a vote in the House of Representatives before the end of the year.

We’re a few weeks into the lame-duck congressional session, and any progress made in House ADPPA negotiations is at best secret, at worst non-existent. With so many disillusioned by the state of governing in the US, it would be easy to shrug this off as the usual gridlock. 

But this impasse defies political logic—we are well past the point of principled opposition, competing ideological stances, or genuine concern for internet users. It must be emphasized over and over again: the main debates that kept comprehensive federal privacy legislation from happening are mostly settled. Republicans agreed to a limited (but significant) private right of action, meaning that users have a right to sue companies for violating their privacy rights. Democrats have overwhelmingly agreed to a federal preemption clause that still preserves many state-level privacy laws, though not hypothetical future legislation.

Beyond minor technical tweaks that folks can easily sit down and hammer out, three major misconceptions about ADPPA continue to drive the conversation: the notion that ADPPA’s provisions will leave Americans worse off on privacy in the future, the idea that ADPPA is soft on industry, and the implicit view that keeping the status quo is preferable to passing ADPPA. It’s hard to overstate that federal legislators from California, bowing to bad faith arguments from territorial state privacy regulators, are the overwhelming drivers of these concerns. 

When California’s privacy leaders and congressional delegation could not continue to falsely claim that their state laws are stronger than the ADPPA (they are not), they started hanging on to a different argument from the preemption debate: that states would not be allowed to “innovate” and that users would be “stuck” with the protections Congress passed. This argument at least is rooted in reality—the ADPPA will certainly bar states from enacting new comprehensive privacy laws. But it fails to engage with the content of the legislation before us and the stark reality of privacy protections in this country. 

To be clear: ADPPA opponents claiming the mantle of potential future innovation at the state level are doing so in defense of state laws that are universally weaker than ADPPA. If state lawmakers, including in California, want to increase privacy protections for their residents, the clear solution is to pass ADPPA now rather than be content with weaker protections that might improve. The pledge of better choices in the future has always been an empty promise at both state and federal levels. To give up a real privacy bill for an empty promise defies logic.

The remaining voices of dissent argue that ADPPA would benefit the tech industry, pointing to support from some companies as evidence. This fails to reckon with myriad reasons why companies might support regulation. 

First, industry would naturally want regulators to address shady players operating on the margins who seriously violate individual privacy and poison the market with questionable business practices. ADPPA’s limits on the invasive third-party data broker industry are a good example of this. Second, many businesses (particularly major players) would rather abide by clear, uniform, stable federal rules—even if they come at a cost—than deal with operating in a chaotic environment with many different state laws. And it does come at a cost – ADPPA has some of the strongest boundaries on the online advertising ecosystem in general, ensuring that current pernicious practices would have to change. What would actually be a gift to bad actors in industry is the underlying, unspoken consensus of those who are delaying the passage of ADPPA: keeping the status quo.

The implicit perspective of those opposed to moving on comprehensive privacy legislation now is that the status quo is preferable to meaningful reform. With Republicans likely wanting to start from scratch on privacy legislation from a position of power in the House, it will be a very long time before we’re back this close to the finish line—with no guarantee that anything approaching ADPPA’s high standards will ever again come to a vote. 

We’d be stuck with the status quo for a while, a patchwork of state privacy law covering fewer than 1 in 5 people in the U.S. Having several different legislative frameworks to follow wouldn’t be ideal for companies, but none of those bills are, in any way, stronger than ADPPA. Less powerful laws might be better than none—but not for the millions who wouldn’t fall under those protections. Talk about a gift to industry.

A better future is possible for all, and it already cleared what looked like impossible odds. It shouldn’t die now because members of congress don’t want to do their job, which is simple: bring ADPPA up for a vote.

David Morar is a policy fellow at the Open Technology Institute.

Filed Under: adppa, california, pre-emption, privacy, privacy law

Guy Who Sued YouTube Because Someone Else Copied A Bit Of His YouTube Video Loses (Again)

Copyright

from the not-how-any-of-this-works dept

You may recall that, back in August, we wrote about the bizarre situation of a company called “Business Casual” and its CEO, Alex Edson. Business Casual makes highly produced videos. It made a few on historical topics, including taking some public domain images and modifying them significantly to make “paralax images” that added a sort of 3D feel. Edson/Business Casual claim (credibly!) that RT Arabic, the Arabic language wing of Russia Today, owned by TV-Novosti, copied parts of some of their videos. There were some DMCA claims he filed and then a lawsuit against TV-Novosti.

All that is… perfectly reasonable?

But then, for unclear reasons, Edson decided to sue YouTube/Google as well, claiming direct infringement among other things. That lawsuit did not go well. Not well at all.

It got much more bizarre over the summer, because Edson’s lawyer, Ron Coleman (who these days seems to specialize in fighting ridiculously bad culture war lawsuits which have no chance of success) kept filing for delays on filing for permission to file an amended complaint, saying that Edson was dealing with debilitating health problems. But… the very day that he filed the third such “Edson’s ill, we need more time,” motion (directly stating that Edson “is in agonizing pain and cannot function at this time“), a very healthy looking Edson was releasing a two hour long video on YouTube (complete with a very bad Putin impersonator) explaining — poorly — some details of copyright law, and claiming that YouTube is an “anti-American” company. He also claims, in truly dramatic fashion, that YouTube’s lawyers are “pathological liars” among other things.

While YouTube’s lawyers alerted the judge to this video, the judge ignored it and still granted the extension. Coleman eventually got around to submitting the actual filing. And, right before Thanksgiving the judge ruled on it — again highlighting how truly bad the legal arguments being made are.

First, Edson/Business Casual argue that YouTube failed to apply its “repeat infringer” policy to TV-Novosti by not suspending the account (or rather, suspending it only briefly). But, as the judge notes, the DMCA’s repeat infringer policy requirement (DMCA 512(i)), are only about whether or not a website is eligible for the DMCA’s safe harbors. It’s not its very own cause of action. But Coleman seems to think it is. The judge disabuses him of this:

Plainly, the plaintiff here is attempting to assert an independent claim against YouTube for its alleged failure to discontinue TV-Novosti’s account in accordance with its Repeat Infringer Policy. Lest there be any doubt on this point, the plaintiff asserts in its motion papers that YouTube’s failure to “terminate the accounts of repeat infringers . is why we are here.” Pl.’s Reply at 1. But as this Court already made clear, Business Casual “misconstrues the safe harbor provisions of the DMCA and how [those provisions] interact with the other federal copyright laws.” First Opinion, 2022 WL 837596, at *5. The DMCA does not establish an affirmative cause of action. Rather, the DMCA provides internet service providers (“ISPs”) with potential “safe harbor” defenses that will shield ISPs from liability for copyright infringement so long as certain statutory criteria, including the maintenance of a policy for terminating “repeat infringers,” are met. See Arista Records LLC v. Usenet.com, Inc., No. 07-cv-8822, 2008 WL 4974823, at *4 (S.D.N.Y. Nov. 24, 2008); Martin v. Tumblr, Inc., No. 15-cv-8338, 2017 WL 11665339, at *4 (S.D.N.Y. Feb. 10, 2017) (DMCA provision “does not create a right of action, but rather creates a defense to liability, or safe harbor”); see also 17 U.S.C. § 512(i)(l)(A) (an ISP will qualify for the “limitations on liability established by this section . only if the [ISP] . has adopted and reasonably implemented” a “policy that provides for the termination” of “repeat infringers”). Put differently, an ISP’s compliance with the DMCA’s safe harbor provisions does not come into play until a plaintiff pleads a viable copyright infringement claim against the ISP in the first instance, at which point, the ISP may assert its eligibility for a safe harbor as a defense to liability. See Arista Records, 2008 WL 4974823, at *4 (DMCA’s “limitations of liability apply if the provider is found to be already liable under existing principles of law”).

In short, Business Casual cannot transform the DMCA’s prerequisites for a safe harbor defense into the basis for an affirmative claim against YouTube. That is not how the statute was written, and it is not for the Court to permit a cause of action that Congress did not create. The allegations concerning YouTube’s failure to terminate TV-Novosti’s channels would be relevant here only if the plaintiff had first pleaded a plausible claim for copyright infringement, thereby shifting the burden to YouTube to establish its entitlement to a DMCA safe harbor defense.

But… therein lies a problem. Because there is no plausible claim of liability for YouTube. There may well be a plausible claim against TV-Novosti, but that doesn’t magically make YouTube liable as well. Indeed, this case is complicated by the fact that Business Casual uploads its videos to YouTube granting YouTube a license to them. That doesn’t mean that TV-Novosti gets a license, but it does mean that suing YouTube for infringement (especially direct infringement) makes no sense, as it already has a license to the work, and therefore cannot be infringing:

In any event, the plaintiff’s Amended Complaint fails to state a claim for direct copyright infringement because it is devoid of allegations casting doubt on the existence, validity, or enforceability of the License. As noted in the First Opinion, “it is a hallmark principle of copyright law that licensors may not sue their licensees for copyright infringement,” Jasper v. Sony Music Ent., Inc., 378 F. Supp. 2d 334, 339 (S.D.N.Y. 2005), and here, Business Casual granted to YouTube a broad License to “use,” “reproduce, distribute, prepare derivative works [from], display, and perform” the content in Business Casual’s YouTube videos, see First Opinion, 2022 WL 837596, at *5. Accordingly, under the plain language of the License, Business Casual cannot hold YouTube directly liable for hosting or displaying video content that Business Casual has uploaded to YouTube’s platform. That would include the hosting or displaying of the copyrighted video segments that appeared on TV-Novosti’s YouTube channel, because Business Casual had authorized YouTube to display those segments when it uploaded the Rockefeller and J.P. Morgan Videos to YouTube.

Business Casual tried to argue that nothing in the license allowed YouTube to then license that work to TV-Novosti, but as the judge explains, that’s not how any of this works.

But this argument misunderstands the import of the License and the nature of YouTube’s license defense. The relevant question here is not whether YouTube was entitled to authorize TV-Novosti’s use of Business Casual’s copyrighted video content. Rather, the question is whether YouTube’s use of the plaintiff’s content — here, the display of copyrighted video segments that Business Casual had previously uploaded to YouTube — fell within YouTube’s broad rights as the licensee of the plaintiff’s YouTube videos. As discussed above, the License does cover that use.

What about contributory or vicarious infringement? No, those don’t fly either. Those things require at least some level of knowledge or profiting off of the infringement by YouTube, which is not shown at all.

Like the Original Complaint, the Amended Complaint contains no allegation that YouTube knew of the allegedly infringing TVNovosti videos before Business Casual lodged its DMCA takedown notices. To the contrary, the Amended Complaint alleges that TVNovosti manipulated the video content for the precise purpose of evading YouTube’s detection. Moreover, because YouTube promptly and permanently removed the First, Second, and Third RT Videos from its platform once it received the plaintiff’s DMCA notices, the Amended Complaint does not permit an inference that YouTube acted in concert with TV-Novosti.

The Amended Complaint also fails to state a claim for vicarious infringement. To hold a defendant vicariously liable for another party’s infringing act, a plaintiff must allege plausibly that the defendant “profit[ed] from [the] direct infringement while declining to exercise a right to stop or limit it.” Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 545 U.S. 913, 930 (2005). In this case, the plaintiff’s allegations foreclose an inference that YouTube declined to exercise its right to stop TV-Novosti’s alleged infringement. To the contrary, the allegations indicate that YouTube removed the First, Second, and Third RT Videos, and thereby stopped the alleged infringement, shortly after Business Casual notified YouTube of its copyright concerns.

One other point that the Business Casual complaint kept making is that it took YouTube 23 days to remove one of the videos after receiving one of its DMCA takedown notices. This is used to argue that YouTube wasn’t expeditiously removing infringing works. But, this is presented out of context. As the judge makes clear:

Finally, the Amended Complaint takes issue with the fact that YouTube removed the Second RT Video 23 days after receiving the plaintiff’s second DMCA notice. To the extent the plaintiff intends to suggest that the length of this 23-day period renders YouTube secondarily liable for TV-Novosti’s infringement, such an argument is meritless. As before, Business Casual “has not pointed to any authority” suggesting that YouTube was obligated to investigate Business Casual’s complaint on “a more compressed timeline.” First Opinion, 2022 WL 837596, at *4. Moreover, the new allegations in the Amended Complaint indicate that YouTube spent the 23-day period actively communicating with Business Casual and evaluating the alleged infringement, see Am. Compl. tt 118-119, 123-126, foreclosing any inference that YouTube simply sat back and allowed the alleged infringement to occur. Accordingly, the purported delay in YouTube’s removal of the Second RT Video does not support a contributory or vicarious infringement claim against YouTube.

In other words, while it did take 23 days, much of that was spent with YouTube communicating back and forth with Business Casual to make sure the work was actually infringing. That’s not ignoring infringement, it’s making sure that it’s not incorrectly taking down non-infringing videos.

Of course, Business Casual immediately appealed, and copyright cases can be a bit of a crapshoot in the appeals court, including the 2nd Circuit. But this seems like a fairly slam dunk bullshit case by someone who does not appear to understand the fundamentals of copyright law, but seems more focused on creating a stupid culture war by misstating how copyright works.

Filed Under: alex edson, copyright, direct infringement, dmca, dmca 512, licenses, notice and takedown, repeat infringer policy, ron coleman
Companies: business casual, google, youtube

Daily Deal: The 2022 Ultimate Big Data Bundle

Deals

from the good-deals-on-cool-stuff dept

The 2022 Ultimate Big Data Bundle has 10 courses to help you learn how to analyze and to understand large data sets. Courses cover Python, Pandas, Cluster Analysis, and more. It’s on sale for $25.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

LAPD Thinks Best Response To Leaked Recording Of Councilmembers’ Racist Remarks Is Going After Reddit Users

Legal Issues

from the maybe-the-real-problem-is-the-councilmembers dept

The Los Angeles Police Department is here to serve and protect… the powerful. The rest of you are on your own.

Earlier this year, someone leaked an audio recording of a closed-door meeting attended by the city’s Latino lawmakers. The comments made during this meeting were extremely disturbing, exposing the racism and bigotry of the meeting’s attendees.

In this surreptitiously recorded conversation from October 2021, Los Angeles City Council President Nury Martinez — while speaking with Councilmembers Kevin de León and Gil Cedillo as well as Los Angeles County Federation of Labor President Ron Herrera — made racist remarks and insults about various elected officials.

Martinez focused in particular on Councilmember Mike Bonin, who is white, and Bonin’s young son, who is Black. At one point, Martinez called Bonin a “little bitch” and referred to his son as “Parece changuito,” or “like a monkey.” She also said Bonin’s son had misbehaved on a parade float and needed a “beatdown.”

The recording didn’t surface until nearly a year later. It debuted at Reddit, posted by a now-suspended user. There’s more to the recording, none of it good.

“I see a lot of little short dark people,” Martinez said of that section of Koreatown, employing stereotypes long used against Oaxacans in Mexico and in the United States.

“I was like, I don’t know where these people are from, I don’t know what village they came [from], how they got here,” Martinez said, before adding “Tan feos” — “They’re ugly.”

Martinez says “F— that guy … He’s with the Blacks” while speaking about Los Angeles County Dist. Atty. George Gascón.

The correct response from law enforcement would have been to do nothing. If councilmembers didn’t want to come off as bigoted idiots, they shouldn’t have said the things they did. But power protects power and the LAPD has decided to get involved, wielding a wiretapping statute in hopes of finding out who created and leaked this recording.

Police have sought a search warrant for the Reddit website as they try to identify the person who leaked a racist discussion between Los Angeles City Council members and a powerful labor leader, causing a scandal that has rocked the community and shaken faith in its lawmakers.

The LAPD is trying to determine the origin of the recording that appeared on the site in October, according to a Tuesday statement.

“The investigation involves interviews of persons present and any potential witnesses that have insight into this investigation. A search warrant request has been initiated to Reddit in order to identify the person responsible for posting the recording,” said the statement.

Wrong. Wrong wrong wrong wrong wrong. The problem is the councilmembers, not the person who leaked the recording. Chances are, the person who made the surreptitious recording had attended similar meetings, heard similar slurs uttered, and decided they’d had enough of it. This is public service. This is not, as the LAPD claims, something to be investigated.

Unfortunately, California is not a one-party consent state. According to state law, everyone being recorded must consent to the recording, which makes this recording illegal. Whether or not prosecutors think this is worth prosecuting remains to be seen, but for now, the LAPD is applying a tentative jackboot to the First Amendment, choosing to punish protected expression just because it has a statute it can abuse to deter others from similarly recording disturbing conversations between public officials.

The LAPD made a choice here. It could have taken a report from (presumably) a councilmember caught on tape and tossed the paperwork into a filing cabinet where it would never be looked at again. Instead, it decided it would help powerful bigots identify the source of the recording — something that will likely result in both civil and criminal cases against this person. The PD didn’t need to come down on the side of evil. But that is what it has chosen to do with its discretion. And now, a very powerful force is aiding powerful people in their quest to punish the person who exposed them for who they are.

Filed Under: gil cedillo, kevin de leon, lapd, leaks, nury martinez, ron herrera, wiretapping
Companies: reddit

State TikTok Bans Are A Dumb Performance And Don’t Fix The Actual Underlying Problem

Privacy

from the zero-calorie-performance dept

For decades, U.S. politicians leaders utterly refused to support most meaningful privacy protections for consumers. They opposed any nationwide privacy law, however straightforward. They opposed privacy rules for broadband ISPs. They also fought tooth and nail to ensure the nation’s top privacy enforcement agency, the FTC, lacked the authority, staff, funds, or resources to actually do its job.

This greed-centric apathy created a wild west data monetization industry across telecom, app makers, hardware vendors, and data brokers that sees little real accountability, in turn resulting in just an endless parade of scams, hacks, breaches, and other privacy and security violations.

Those same policymakers are now freaking out because one app and one app only, TikTok, has taken full advantage of the lax privacy and security environment these policymakers directly created.

Hyperventilating about TikTok has become one of the GOP’s policies du jour, gifting a rotating crop of performative GOP politicians (like the FCC’s Brendan Carr) repeated TV appearances.

At the same time, numerous states have announced they’ll be banning the use of TikTok on all government devices. South Dakota Governor Kristi proudly announced such a ban last week. Maryland Governor Larry Hogan joined her shortly thereafter. Georgia lawmakers are planning a similar ban.

Not to be outdone, Texas Governor Greg Abbott has announced he’s working on a similar ban. In a letter to state lawmakers, Abbott lamented the potential privacy violation TikTok represents:

“TikTok harvests vast amounts of data from its users’ devices—including when, where, and how they conduct Internet activity—and offers this trove of potentially sensitive information to the Chinese government.”

Here’s the thing these grandstanding politicians either don’t understand or are ignoring: nearly every app, service, and device in your home is hoovering up just an endless trove of information on your every waking moment, from when you wake up in the morning, to which path you took to work, then selling that poorly protected data to absolutely any nitwit (including governments) for a nickel.

In this reality, fixating exclusively on TikTok is both dumb and performative. Yeah, TikTok probably shouldn’t be on government employee phones. That said, neither should dozens if not hundreds of other apps and services repeatedly found to be over-collecting and poorly securing user data. The delusion that you’re safe simply if the app isn’t Chinese is just toddler thinking.

These policymakers have created such an unaccountable dumpster fire, you could ban TikTok today and the Chinese government could simply turn around, and in a matter of hours, buy most if not more of the same sensitive user data from a rotating crop of data brokers. Brokers who increasingly face only the lightest of occasional wrist slaps for the overcollection and oversharing of user data, something that’s become exponentially more problematic post-Dobbs.

Actually fixing this problem requires properly funding and staffing privacy regulators. It requires passing a baseline nationwide privacy law for the Internet era. It requires holding companies (and executives personally) meaningfully accountable for lax security and privacy standards.

We, of course, don’t want to actually do that, because actually caring about privacy, security, consumer empowerment, and market health would cost numerous U.S. companies billions of dollars annually. So instead we’ve embraced silly performances, such as singularly freaking out about a single app in a sea of problematic apps, devices, hardware, and services.

What’s dressed up to resemble a good faith concern about national security and privacy is really just a distraction from our longstanding failures on consumer protection, privacy/security standards, and accountability.

Again it’s your right to singularly hyperventilate about TikTok as the root of all evil, and TikTok absolutely has been caught doing sleazy things. But if you’re focusing on TikTok and TikTok only, completely oblivious as to how our repeated abandonment of privacy and accountability created the problem, you’re just flapping your arms around and making noise for the camera.

Filed Under: apps, china, data brokers, devices, ftc, georgia, maryland, privacy, security, surveillance, texas, wireless
Companies: tiktok

Appeals Court Reminds Cop That Calling Normal Human Behavior Suspicious Is No Way To Secure A Conviction

Legal Issues

from the being-a-human-being-isn't-evidence-of-wrongdoing dept

Since cops are trained to view everything as suspicious, they tend to believe everything is suspicious. The list of things considered to be suspicious often contradicts other things on the list of things considered suspicious. That should be considered suspicious, but somehow cops never think it is.

Even if they don’t believe everything is suspicious, they swear that pretty much everything is while testifying in court. Because if you don’t claim normal human activity is “reasonably suspicious,” it makes it very difficult to salvage unconstitutional stops and searches.

The cop involved in this gun possession case hoped to convince a court a driver’s very normal reaction was inherently suspicious, but the Fourth Circuit Court of Appeals is far from convinced. Overturning the lower court’s dismissal of the arrestee’s motion to suppress, the Appeals Court says it doesn’t see the things the cop saw that he felt justified (illegally) extending the stop and performing a search of the car. (via Short Circuit)

Here’s how the Appeals Court describes [PDF] what it saw, which is not what Officer Helms claimed.

When Officer Helms turned on his lights, Phillips’s vehicle was essentially parallel with a turn lane that led to a well-lit parking lot. Phillips hit her brakes just four seconds after Officer Helms’s lights came on and activated her blinker three seconds after hitting her brakes. Phillips came to a complete stop seventeen seconds after Officer Helms turned his lights on.

After Phillips came to a stop, Officer Helms approached the driver’s side of the vehicle. His body camera captured his exchange with Phillips. Shortly after Officer Helms approached Phillips’s vehicle, she began searching for her license. While Officer Helms testified that Phillips’s hands were shaking during the encounter, her hands did not appear to be shaking while she was handing Officer Helms her license or her insurance information. The next time that Phillips’s hands were in view, it still was not evident that she was shaking.

The first part — the time it took for Phillips to stop — is noted because it contradicts the lower court’s findings. The second part is essential because the officer’s own body cam contradicts what he claimed he observed.

Officer Helms continued to insist Phillips was shaking, an observation (one not based on actual observation, mind you) he made to the other officer arriving on the scene. And then, with the ticket already printed, he decided to extend the stop.

When a backup officer arrived, Officer Helms told him that he was suspicious of the vehicle’s occupants because Phillips was shaking and tapping on the car door. At approximately the same time, Officer Helms printed Phillips’s warning ticket. Soon thereafter, Officer Helms approached Phillips’s vehicle, asked Phillips to exit the vehicle, and told her he would be leading his canine around the vehicle to sniff for illegal drugs. After the canine indicated that there were drugs in the vehicle, officers performed a full search. During the search, they located two handguns in Miller’s backpack.

Teresa Miller was only a passenger in the car. She was riding in the backseat. Her backpack was searched because… well, apparently the officer felt this search was justified because of the dog’s alert on the car. But there’s nothing on the record that says the officer asked the dog to sniff the backpack on its own. Either way, the search was performed, contraband was found, and Miller was charged.

The lower court rejected her suppression attempt. It said it couldn’t tell from the footage whether or not the driver was shaking. It also said Phillips was “slow to pull over” and passed a couple of well-lit streets before pulling over on a “dimly-lit section of Route 7.” For some reason, the district court also added that Route 7 was a “known drug corridor,” something that’s completely irrelevant because the car wasn’t travelling on the drug corridor and there were no drugs discovered in the car.

The Appeals Court says the lower court is wrong.

Here, the video evidence from Officer Helms’s dashboard camera shows that Phillips stopped within a reasonable amount of time. Phillips could not have pulled into the well-lit parking lot that Officer Helms intended her to because she was parallel with the entrance when Officer Helms activated his lights. And contrary to the district court’s findings, the video shows Phillips did not pass any other area, well-lit or otherwise, where she could have safely stopped. There were no earlier exits, and the road did not have a shoulder. Next, Phillips began braking just four seconds after Officer Helms turned his lights on, indicating that she was in the process of stopping. Four seconds is a reasonable time for a person to react and determine that an officer intends to pull her over. While it ultimately took Phillips thirteen seconds to come to a complete stop after first engaging her brakes, she stopped at the first available place on the road where she could safely do so. Under these facts, she came to a stop in a reasonable amount of time.

It’s also wrong about the supposed “shaking” Officer Helms claimed to observe.

While the district court is correct that the video does not show Phillips’s hands the entire time, the video clarity is quite good, and shows that her hands were not shaking. Moreover, her hands can be seen both at the beginning of the encounter and at the end, and the video footage shows that her demeanor did not change throughout the conversation. Thus, the district court clearly erred by finding that Phillips was shaking during the traffic stop.

Then there’s the “tapping” Officer Helms told another officer he believed was indicative of the driver’s nervousness while weaving together his reasonable suspicion tapestry. It’s indicative of nothing, says the Fourth Circuit.

The only (arguably) nervous behavior the Government can point to after Officer Helms’s statement is Phillips tapping her fingers on the car door. But tapping is not an indicator of excessive or sustained nervousness because it is completely consistent with law abiding behavior. Although fidgeting may certainly be a sign of nervousness, tapping one’s fingers may just as likely be a sign of annoyance, impatience, or even boredom—any of which may be expected when a person is stopped by a police officer and is awaiting the results of a license check. By itself, tapping one’s fingers is a very weak indicator of nervousness.

Away goes the evidence. The conviction and sentence are vacated. At long last, Miller is actually free to go. Pretending something is happening when it actually isn’t turns out to be a great way to violate rights. And when rights are violated, every so often the victim of the violations scores a win in court.

Filed Under: 4th amendment, 4th circuit, police stops, probable cause, search, suspicion

Pro Tip: If Your Game Gets Trashed In Reviews For Sucking, Don’t Blame It On ‘Woke Reviewers’

Say That Again

from the woke-or-broke? dept

There are lots of shitty ways game developers and publishers can handle their games getting crappy reviews. The best bet would obviously be to read the reviews from customers, learn something from them, and make a better product. Far too often, however, developers and publishers instead try to disappear bad reviews, fake reviews, or otherwise juice their review scores.

But then there’s the writer and director for Days Gone, John Garvin. Garvin stared at a wide swath of negative reviews for the game, most of which largely panned the game for being unoriginal, having a poor gameplay experience, and otherwise being all kinds of “meh.” Garvin then distilled this into an explanation for why the game was reviewed so poorly into the following list:

Three reasons:

1. it had tech issues like bugs, streaming and frame rate;
2. it had reviewers who couldn’t be bothered to actually play the game
3. And three, it had woke reviewers who couldn’t handle a gruff white biker looking at his date’s ass

Garvin wrote that in a now-deleted tweet. You will immediately notice that the list consists of two-thirds of blaming reviewers for the negative reviews. On the one hand, there is a certain amount of this that is understandable. After all, being a creative and having people you don’t know call your baby ugly is never a fun thing.

But that’s also something you sign up for when you release a creative work to the public. There’s no evidence presented by Garvin that reviewers hadn’t “bothered to actually play the game.” That statement is just made as though it’s expected to be taken as gospel. And the “woke reviewers” thing appears to be largely nonsense. There is a scene in the game that went semi-viral that consists of the player character following a female character. She bends over while asking if what she was looking at is what the player is looking for. He looks at her backside and basically says yes. It’s fairly dumb and a bit gross, but certainly nothing that the gaming public is going to lose its mind over. Were that the case, every GTA game would be completely panned by reviewers as well.

But because a certain segment of the population now seems to think you can shout “teh woke!” at any problem to make it not your fault, well, here we are. It’s a crappy way to run a game studio, frankly. If your customers are telling you what’s wrong with your product, that should be useful information to internalize and use for the future.

Or I guess you just blame the “woke,” and suddenly your product that is reviewed poorly and hasn’t sold particularly well is no longer your problem.

Filed Under: days gone, john garvin, reviewers, reviews, video games
Companies: bend studio

Italy Bans Facial Recognition Tech… Except For Cops

(Mis)Uses of Technology

from the not-much-of-a-ban-then,-is-it dept

In March, the Italian government not-so-politely asked Clearview to leave, bestowing upon the toxic facial recognition tech company a $21 million fine as a parting gift. Citing the company’s, um, clear violations of the GDPR, the government added to the tab Clearview has racked up in Europe, now surpassing $50 million.

The company, of course, denied all wrongdoing or liability, stating it does not do business in any of the countries in which it had been fined. But that’s hardly the point. The point is Clearview’s webscraping affects everyone everywhere, no matter where Clearview actually offers access to its multi-billion image database or its facial recognition AI. The laws were still violated, even if Clearview had never physically set foot in those countries.

European governments are paying more attention to facial recognition tech these days. The European Union has some pretty strong privacy laws which make carefree deployments of facial recognition tech — especially by private parties — almost impossible. But, like everywhere in the world, European citizens are raising concerns about pervasive surveillance tech, something that becomes much more worrying when it turns people going about their day-to-day business into little more than data points in massive government collections.

The ban currently in effect in Italy is a bit weird, though. It seemingly forbids use by everyone, including government entities, but contains a massive loophole that would make law enforcement entities the only ones permitted to use the “banned” tech.

Italy prohibited the use of facial recognition and ‘smart glasses’ on Monday as its Data Protection Agency issued a rebuke to two municipalities experimenting with the technologies.

Facial recognition systems using biometric data will not be allowed until a specific law is adopted or at least until the end of next year, the privacy watchdog said.

The exception is when such technologies play a role in judicial investigations or the fight against crime.

Yeah, that’s a pretty big exception. And it’s really weird because the prohibition was seemingly prompted by law enforcement’s planned use of the tech.

The agency was reacting to measures taken in the southern Italian city of Lecce, where authorities said they would begin using a technology based on facial recognition.

[…]

The privacy watchdog also targeted the Tuscan city of Arezzo, where local police were due to be equipped with infrared super glasses that can recognise car number plates.

The Reuters report doesn’t provide details on what Lecce’s facial recognition plans entailed, but one imagines the word “authorities” also covers local law enforcement officials. And while the second incident refers only to “super glasses” with built-in plate recognition, presumably the goal is to add facial recognition tech to the eyewear in the future.

And it’s not really a ban. I mean, it’s obviously not a ban when law enforcement still has basically on-demand access to facial recognition tech. But the Data Protection Agency refers to this as a “moratorium” that simply pauses facial recognition use while the government figures out how to best regulate it.

Still, there’s an outside chance a meaningful ban that covers law enforcement deployment could be put in place. As Thomas Macaulay reports for The Next Web, one Italian lawmaker wants something wider reaching and far more permanent put in place.

Last week, Brando Benifei, an Italian MEP and Co-Rapporter of the AI Act, called for the EU’s new regulation to include an outright ban on biometric mass surveillance.

“Today there are two different loopholes in the ‘ban’ proposed by the Commission: private spaces and ‘ex-post’ recognition are not covered, but there are also exceptions regarding some criminal investigations and prosecutions,” he said. “We should — and I will do my best to — have a complete ban in the Parliament.”

This development will be worth keeping an eye on, especially once the exception to the ban starts getting some use. Pretty much everything law enforcement does can be described as “investigatory” or “fighting crime.” Until this exemption is refined or restricted meaningfully, this ban will have almost zero effect on use of the tech by Italian law enforcement agencies.

Filed Under: data protection agency, facial recognition, italy, police, privacy, surveillance