India Says Google & Facebook Should Prescreen All User Generated Content To Stop Jerks

Free Speech

from the don't-disparage-me,-bro dept

If you thought pushing companies to monitor for infringement or terrorism were bad enough, apparently officials in the Indian government have asked Google, Facebook, Microsoft and Yahoo to pre-screen all user-generated content to try to remove “disparaging, inflammatory or defamatory” content from being posted.

At the meeting, Mr. Sibal showed attendees a Facebook page that maligned the Congress Party?s president, Sonia Gandhi. ?This is unacceptable,? he told attendees, the executive said, and he asked them to find a way to monitor what is posted on their sites.

In the second meeting with the same executives in late November, Mr. Sibal told them that he expected them to use human beings to screen content, not technology, the executive said.

The three executives said Mr. Sibal has told these companies that he expects them to set up a proactive prescreening system, with staffers looking for objectionable content and deleting it before it is posted.

Apparently, Kapil Sibal, India’s Minister for Telecommunications, doesn’t comprehend the scale of what he’s asking, or the fact that it’s impossible. How does one become a bureaucrat in charge of a technology field when one can’t comprehend such basic concepts? Oh crap, do I have to pre-screen for such “disparaging” remarks now?

Seriously, we’re seeing this kind of insanity more and more these days, where politicians, who clearly have absolutely no freaking clue about the technology they’re regulating, are coming up with positively insane suggestions, with no comprehension about the ramifications. The end effect in this case, would almost certainly be the end of any kind of user-generated content system in India. Is that really what Sibal wants?

Filed Under: defamation, india, kapil sibal, monitoring, social media, user generated content
Companies: facebook, google, microsoft, yahoo

Can Defenders Of SOPA Explain How You Define Taking Deliberate Action To Avoid Taking Action?

Copyright

from the the-problem-of-definitions dept

The Congressional Internet Caucus group held a recent panel discussion around SOPA, which is worth listening to. But one point struck me in particular. We’ve pointed out in the past the ridiculously convoluted language in the bill, that makes any site “dedicated to theft of U.S. property” if it “is taking, or has taken deliberate actions to avoid confirming a high probability of the use of the U.S.-directed site to carry out acts that constitute” infringement. During the debate, supporters of SOPA defended this provision as nothing special, because you have to take “deliberate action.”

But, let’s be clear here. The “deliberate action” you have to take is to not take action. Think about that, and about how easy it is to abuse. How do you show that someone took deliberate action to not take action? You just show they didn’t take action. You have a double negative issue here. The reality is that this provision means “you must take action.” Not taking action is seen as deliberate action to “avoid confirming” that “high probability.” Basically, any site that doesn’t want to face massive liability, which could cause your site to disappear and all of your revenue partners to cut you off, would simply have to start monitoring proactively. If you don’t take action, you get accused of deliberately choosing not to take action.

See how ridiculous this is? The law is worded in such a weasel way that it allows defenders of the law to say there’s no requirement for action and that it only punishes “deliberate” actions — but actually reading the text shows that the “deliberate action” you have to take is to not take action. Thus, the only sensible course of action under the bill to avoid being declared “dedicated to theft of U.S. property” is to proactively monitor and block. That’s a massive change to the regulatory framework of the internet, disguised as something different through a sneaky language choice.

Filed Under: copyright, monitoring, protect ip, sopa

Russian Internet Content Monitoring System To Go Live In December

Privacy

from the don't-give-them-ideas dept

Back in April of this year, the Russian government put out a tender:

The stated purpose of the monitoring system was quite specific:

Here’s what it would be searching for:

It’s hard to see how a system costing just half-a-million dollars could achieve all that. And as Russian commentators have pointed out, allowing just a few months for the development and testing is equally suspicious:

In other words, perhaps the whole tendering process was a formality, and things had already been moving forward on this front in the background for some time. Support for that theory comes from the fact that despite the “impossible 3 months” of development, the system will indeed be rolled out next month:

As that points out, the danger is that once such a system is up and running, it will be progressively extended to include first “unofficial” media sites like blogs, and then, eventually, everything online. That might also explain why the tender quotes such a ridiculously small figure: the final system would be pretty expensive, but revealing that fact in the original tender would give away the true scope.

The question then becomes: what will the authorities do with all that information? Since 2010, Roskomnadzor has been able to require online mass media to remove illegal comments, so it will presumably do the same when content is flagged up by the new system. But the very breadth of the online search is troubling, including as it does things like “false information about federal and regional officials”, something that could clearly be used against whistle-blowers.

Moreover, the danger here is not just for Russian citizens. Once again we are seeing a government striving to keep a much closer watch on key parts of the Internet ? in this case, mass media sites. Assuming it succeeds — or at least claims to have succeeded — that is likely to encourage other countries to do the same.

Although it would be nice to think that only “repressive” governments would even think of doing such a thing, recent proposals by politicians in the US and Europe regarding blocking sites and spying on users indicate how naïve that would be.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: monitoring, privacy, russia

Germany To Put Special Monitoring Software On School Computers To Search For Infringement

Privacy

from the preserving-monopolies-at-any-cost dept

Just under a month ago, the “Chaos Computer Club” (CCC), which styles itself as “the largest European hacker club”, had some disturbing news for Germans:

Since then, a debate has raged about the extent to which these technologies are permitted by German law when tackling crime. But now it seems that such electronic spying is being institutionalized further thanks to a deal between the Culture Ministers of the German States and publishers of educational materials that allows school computers to be searched annually for unauthorised copies (post in German on Netzpolitik.org):

Nor is this some mere statistical exercise: there will be real consequences for school authorities and teachers accused of having unauthorized copies:

Although the spyware has not yet been introduced, the contract was signed last December and came into force in January this year. It is yet another example of politicians and their advisers agreeing to what look like easy technical fixes to issues, but not thinking through the consequences.

As the Netzpolitik.org article asks: who will be responsible for ensuring that the spy software does its job without breaking the German data protection laws? Has anyone thought about the security issues of introducing this software into schools? Will the software work on all platforms – and if it doesn’t, what happens to schools using Macs or GNU/Linux?

Even leaving aside such issues, you have to wonder what on earth the German States’ Culture Ministers were thinking when they agreed to allow this gross invasion of privacy of teachers and students. Perhaps they hoped that the fuss would all blow over after a while; in the wake of the other revelations about the German government spying on its citizens through software on their computers, that seems unlikely now.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: germany, monitoring, privacy, schools, spying

France Suspends 3 Strikes Monitoring Following Data Breach

Copyright

from the oops dept

Over the weekend, TorrentFreak reported that the company that French “three strikes and you’re off the internet” agency Hadopi had hired to help it track down infringers, Trident Media Guard, had been hacked, though, in reality it appears to be much more of a simple data breach caused by TMG poor setup. The breach left open a lot of details of the tracking system, including IP addresses linked to the whole 3 strikes process. In response, it appears that Hadopi has “temporarily suspended” its work with TMG, perhaps to measure the damage and see if it can actually learn to lock down its computers. In the meantime, however, as TorrentFreak points out, there are no other providers doing this monitoring — meaning that (at least for a little while), it appears 3 strikes monitoring has stopped in France.

Filed Under: breach, copyright, france, monitoring
Companies: hadopi, triton media group

Samsung Accused Of Installing Secret Keyloggers On New Laptops 'To Monitor Performance' [Updated]

Computers

from the that's-not-going-to-go-over-well dept

See update at the bottom

According to a report by Mohamed Hassan at Network World, Samsung has been installing secret keyloggers on laptops. After setting up a new laptop, he ran a scan and found an installation of StarLogger, a commercial keylogger program. It’s a rather nefarious piece of software:

This key logger is completely undetectable and starts up whenever your computer starts up. See everything being typed: emails, messages, documents, web pages, usernames, passwords, and more. StarLogger can email its results at specified intervals to any email address undetected so you don’t even have to be at the computer your[sic] are monitoring to get the information. The screen capture images can also be attached automatically to the emails as well as automatically deleted.

Hassan claims to have found the same keylogger on two separate laptops from Samsung, and after calling the company, finally had a supervisor claim that the company did it to monitor usage:

On March 1, 2011, I called and logged incident 2101163379 with Samsung Support (SS). First, as Sony BMG did six years ago, the SS personnel denied the presence of such software on its laptops. After having been informed of the two models where the software was found and the location, SS changed its story by referring the author to Microsoft since “all Samsung did was to manufacture the hardware.” When told that did not make sense, SS personnel relented and escalated the incident to one of the support supervisors.

The supervisor who spoke with me was not sure how this software ended up in the new laptop thus put me on hold. He confirmed that yes, Samsung did knowingly put this software on the laptop to, as he put it, “monitor the performance of the machine and to find out how it is being used.”

Of course, it’s entirely possible that the supervisor was confused as well. Frankly, like some others, I find it hard to believe that Samsung corporate policy could be so clueless as to install secret keyloggers on all laptops. If it is true, however, I imagine the company will be facing one hell of a lawsuit in the very near future.

Update: It looks like my skepticism on this story may have been justified. Samsung is claiming that the researcher got a false positive, and confused a language folder for a keylogger:

“Our findings indicate that the person mentioned in the article used a security program called VIPRE that mistook a folder created by Microsoft?s Live Application for a key logging software, during a virus scan.

“The confusion arose because VIPRE mistook Microsoft’s Live Application multi-language support folder, labelled ‘SL,’ as StarLogger. Depending on the language, under C:Windows folders are created labelled ‘SL’ for Slovene, ‘KO’ for Korean, ‘EN’ for English.”

Filed Under: keylogger, monitoring, rootkit
Companies: samsung

Is Project Vigilant A Hoax?

Rumors, Conspiracies, etc.

from the looking-questionable dept

We just wrote about the new publicity campaign from a group called Project Vigilant, linking to three separate articles discussing how it was a private organization monitoring internet traffic and providing it to the US government. The whole thing seemed dubious on a legal basis, and now plenty of people are questioning whether or not the whole thing is real or some sort of hoax or publicity stunt. Julian Sanchez points out that the “parent company” behind the Project, one “BBHC Global” looks painfully amateurish (and right now appears down). Then, a bunch of security experts are skeptical of the whole concept, noting that if it’s been around for 14 years, how come no one’s heard of it, and it hasn’t participated in any serious security efforts. Others point out that it’s almost certainly a publicity stunt of some kind, pointing out that the website was registered just last year. The suggestion there is it’s an attempt to jumpstart a new security company. I’m guessing it’s more of a hoax to try to show how gullible some people are.

Filed Under: hoax, monitoring, project vigilant, security
Companies: project vigilant

Which ISPs Hand Private Surfing Info Over To Secretive Private Group Who Monitors It For The Feds?

Privacy

from the feeling-safe? dept

So this is just bizarre. I saw a Wired report about a talk by a guy named Chet Uber, who claimed he helped connect Adrian Lamo to the feds in order to turn in Bradley Manning (the Army intelligence analyst accused of leaking content to Wikileaks), but Uber’s little talk raised a number of other issues unrelated to Manning/Lamo. Specifically, towards the end of this Forbes piece about Uber and his organization, Project Vigilant comes a little shocker about how the firm spies on internet traffic for the US government:

According to Uber, one of Project Vigilant’s manifold methods for gathering intelligence includes collecting information from a dozen regional U.S. Internet service providers (ISPs). Uber declined to name those ISPs, but said that because the companies included a provision allowing them to share users’ Internet activities with third parties in their end user license agreements (EULAs), Vigilant was able to legally gather data from those Internet carriers and use it to craft reports for federal agencies. A Vigilant press release says that the organization tracks more than 250 million IP addresses a day and can “develop portfolios on any name, screen name or IP address.”

“We don’t do anything illegal,” says Uber. “If an ISP has a EULA to let us monitor traffic, we can work with them. If they don’t, we can’t.”

And whether that massive data gathering violates privacy? The organization says it never looks at personally identifying information, though just how it defines that information isn’t clear, nor is how it scrubs its data mining for sensitive details.

Uh… what? Given the uproar and then Congressional smackdown to ISPs that tried to monitor such information for advertising purposes, that doesn’t seem right at all. Sneaking a clause into an EULA saying that it’s handing all your info over to a private party who will monitor it for the feds (maybe) and whoever else they want doesn’t really seem aboveboard or legal despite the claims. It’s also highly unlikely that it “never looks at personally identifying information.” Nearly everyone who’s ever claimed that has been proven wrong later.

The whole thing seems really sketchy, and as Glenn Greenwald notes, it appears to be an attempt to skirt the law:

There are serious obstacles that impede the Government’s ability to create these electronic dossiers themselves. It requires both huge resources and expertise. Various statutes enacted in the mid-1970s — such as the Privacy Act of 1974 — impose transparency requirements and other forms of accountability on programs whereby the Government collects data on citizens. And the fact that much of the data about you ends up in the hands of private corporations can create further obstacles, because the tools which the Government has to compel private companies to turn over this information is limited (the fact that the FBI is sometimes unable to obtain your “transactional” Internet data without a court order — i.e., whom you email, who emails you, what Google searches you enter, and what websites you visit –is what has caused the Obama administration to demand that Congress amend the Patriot Act to vest them with the power to obtain all of that with no judicial supervision).

But the emergence of a private market that sells this data to the Government (or, in the case of Project Vigilance, is funded in order to hand it over voluntarily) has eliminated those obstacles. As a result, the Government is able to circumvent the legal and logistical restrictions on maintaining vast dossiers on citizens, and is doing exactly that. While advertisers really only care about your online profile (IP address) in order to assess what you do and who you are, the Government wants your online activities linked to your actual name and other identifying information.

So, since Uber and Project Vigilant won’t say who these 12 ISPs are, can anyone help us out? What are the 12 ISPs out there who, via sneaky language in their EULAs are simply handing over your private data to some company to sell to the US government?

Filed Under: government, isps, monitoring
Companies: project vigilant