And Calvin's Eggs Too
]]>
]]>
(1) the order is an unconstitutional prior restraint on First Amendment protected speech about their academic research,(2) the Computer Fraud and Abuse Act does not prohibit communication of information about computers or computer security, and
(3) the MBTA's publication of the defendants' research and presentation slides undermines its claim to injunctive relief.
Illustrating the First Amendment issue, EFF, which is representing the students, points out in this statement by Kurt Opsahl that while the MBTA has been issuing statements to the media about the research, the students are unable to speak in response under the original TRO.
]]>
I want you to watch a video that goes beyond that statistic, although it's where I found it. It's a video produced by Dr. Michael Wesch, an anthropologist at Kansas State University who teaches a class on Digital Ethnography and who studied the YouTube phenomenon. He calls it participatory observation. After studying hundreds of thousands of videos, he came up with that statistic.
This video, "An anthropological introduction to YouTube", is a presentation he gave at the Library of Congress on June 23, 2008. Aside from being fascinating, it's fun and enjoyable to watch.
If you watch it, you'll find out why fair use matters, what it makes possible, and how big media is endangering it with their closed and restricted concept of what fair use allows. Actually, they'd prefer to kill fair use altogether. It's only fair if *they* do it. Yoo hoo, Disney, where did you get the idea for Mickey Mouse? Or Cinderella? Or Snow White?
If you can watch it without dropping your litigation against YouTube, Viacom, you need to see a doctor right away. Seriously. I hope YouTube lawyers play it for the judge if you insist on going to trial.
Watch the part about the song that ended up being professionally released. It made the company some money. Cluestick: there is more than one business model, for those who can get with the new. Sooner or later, your shareholders will be furious with you if you don't course-correct and modernize. Yes. They will. Eventually, your shareholders will be YouTubers, you know. And you'll be what media used to be.
"When you discuss security issues, if you are telling the truth, that should be something protected at the core of the First Amendment," said Kurt Opsahl, senior staff attorney for the non-profit EFF. "If you are truthfully telling the world about a dangerous situation, and (it is) a situation which is dangerous not because the security researcher exposes the vulnerability (but) because the person who made the product . . . made the vulnerability, (then) this should be core speech."
Opsahl was speaking at a press conference at the DefCon hacker conference in Las Vegas on Saturday after District Judge Douglas Woodlock of the U.S. District Court in Massachusetts granted a temporary restraining order requested by the Massachusetts Bay Transit Authority.
The MBTA sought to bar three students enrolled at the Massachusetts Institute of Technology -- Zack Anderson, R.J. Ryan and Alessandro Chiesa -- from presenting a talk at DefCon about vulnerabilities in magnetic stripe tickets and RFID cards that are used in the MBTA's payment system. The MBTA feared that the students planned to teach the audience how to fraudulently add credit to a payment ticket or card in order to ride the transit system for free.
Opsahl said the judge, in making his decision, misinterpreted a part of the federal Computer Fraud and Abuse Act that refers to computer intruders or hackers. Such a person is described in part in the statute as someone who "knowingly causes the transmission of a program, information, code, or command to a computer or computer system."
Opsahl says the judge, during the hearing, likened the students' conference presentation to transmitting code to a computer.
"The statute on its face appears to be discussing sending code or similar types of information to a computer," Opsahl said. "It does not appear to contemplate somebody who is giving a talk to humans. Nevertheless, the court . . . believed that the act of giving a presentation to a group of humans was covered by the computer fraud, computer intrusion statute. We believe this is wrong."
EFF staff attorney Marcia Hoffman told reporters that the decision set a very dangerous precedent.
"Basically, what the court is suggesting here is that giving a presentation involving security to other security researchers is a violation of federal law," she said. "As far as I know, this is completely unprecedented, and it has a tremendous chilling effect on sharing this sort of research. . . . And we intend to fight it with everything we've got."
The students were scheduled to present their talk on Sunday about vulnerabilities in the subway's fare collection system. According to a description of the talk in a printed program given to conference attendees, the students planned to demonstrate how they reverse-engineered the mag stripe on CharlieTickets and cracked the encryption on RFID-enabled CharlieCards that are used in the Boston system. They also planned to release several open source tools that they created in the course of their research.
But the MBTA contended that disclosure of the flaws, before the MBTA had a chance to fix them, would cause irreparable harm to the transit system, particularly if it allowed someone to increase the amount of funds stored on a card or ticket and ride the transit system for free.
The MBTA filed its motion for a restraining order on Friday, August 9th, but Opsahl and Hofmann said that rather than make an immediate decision, District Judge Woodlock ordered a hearing for Saturday morning and allowed the EFF, which represented the students, to participate by telephone from San Francisco, even though none of the non-profit's lawyers is licensed to practice in Massachusetts.
The court's restraining order bars the students from disclosing any information for ten days that could allow someone to defraud the transit system and ride the subway for free.
EFF lawyers and the students refused to discuss details of the now-cancelled presentation but did provide a timeline of events leading up to the MBTA's suit and also shed light on how the matter unfolded, disputing claims in the MBTA's court filings that the students had refused to give the MBTA information about the vulnerabilities they discovered.
According to MBTA's court filings, the agency first learned about the planned presentation on July 30th from an unnamed vendor, described in the only as "someone responsible for components of the MBTA's fare collection system" (.pdf). The next day the agency contacted MIT computer science professor Ron Rivest, the students' instructor, and told him that the FBI was investigating the issue.
"We didn't find that to be a very pleasing way to start a nice dialogue with them," Anderson said. "We got a little concerned about what was happening."
A few days later on Monday, August 4, a detective with the transit police and an FBI agent met with the MIT students, Rivest, and an MIT lawyer to discuss their concerns and inquire about the nature of the student's talk. The students say when they left that meeting they believed, due to verbal comments made to them during the meeting, that the issue had been resolved, and that the MBTA no longer had a problem with their talk. [Note: A previous story said the parties had met on August 5th, a date listed in MBTA's court filings. The students said that date was a misprint.]
The FBI's Boston office did not respond to a call asking to confirm if there is an ongoing investigation of the students, but Opsahl said as far as he knows, there is no FBI investigation.
Efforts to reach the MBTA for comment were not successful, but according to the MBTA's court filings, the students failed to respond to a request to provide the transit authority with copies of the conference presentation or with details about the vulnerabilities they found in the payment card system, and this was the reason for taking the students to court.
But the students say this isn't true.
They say the MBTA did ask for some material -- not a copy of their conference presentation -- which they provided on Friday at around 4:30 pm, which they say was around the same time the MBTA was heading to the courthouse to request the restraining order.
That material was a confidential vulnerability assessment report (.pdf) describing, in a more substantial way than the conference presentation slides do, the flaws in the MTBA payment system. The report became a public document on Saturday when the MBTA included it among other papers it submitted to the court on Saturday.
The students maintain they didn't understand that the MBTA was specifically expecting a copy of their presentation until Friday, when they learned the MBTA was filing for a restraining order.
"And at that point we declined to provide the slides until we had an opportunity to see what the complaint said," Hofmann said.
Even though the MBTA received the vulnerability assessment report at that point, the students point out, it did not withdraw the lawsuit.
But according to an MBTA systems project manager, who filed a declaration with the court, the MBTA asked specifically for materials from their presentation and concluded after receiving the report that it likely did not constitute the materials that the students were planning to present at DefCon. In an e-mail that Anderson sent with the report he wrote, "Note that we absolutely are not disclosing everything we found in this report."
The students have been criticized by some for not following the generally accepted responsible disclosure guidelines (written by former hacker Rain Forest Puppy) in which a researcher discloses vulnerabilities to a company or agency first, to give that party an opportunity to fix the problems, before disclosing the flaws publicly.
The students say they had intended to contact the MBTA a week prior to July 30th, when the transit authority was still apparently unaware of the presentation. They refused to say what occurred at that time to prompt them to want to make contact with the MBTA, but said their intent was to provide the MBTA with details that they wouldn't be discussing in their public talk. Ultimately, however, they didn't act on the impulse because Rivest, who agreed to facilitate the contact, was out of town at a conference. Shortly thereafter, the MBTA discovered the talk and contacted Rivest.
The students maintain that they never intended to teach audience members how to de-fraud the transit system, despite provocative comments they wrote in the published description of their talk.
A description of their talk that is printed in the conference program schedule begins with the sentence "Want free subway rides for life?" The line was removed from an online version of the description after the MBTA met with the students on August 4th, but the students wouldn't comment about why the change was made.
Opsahl called the provocative language "rhetoric" and said it was always the students' intention to hold back key details from their talk that would help someone attack the MBTA system.
"Please understand that, rhetoric aside, the intention was to provide an interesting and useful talk, but not one that would enable people to defraud the Massachusetts Bay Transit System," he said.
As it stands now, the next step, before the temporary restraining order expires, will be to determine whether or not it should become a preliminary injunction to extend the gag for longer, Opsahl said.
Hofmann said it's unclear right now whether the EFF will continue to represent the students if further litigation is pursued, given that they have no one on staff who can practice in Massachusetts. They will have to evaluate the situation when and if it comes up.
As for the students' 1 pm speakers' slot on Sunday, DefCon has apparently already found a replacement. Brenno de Winter, a Dutch journalist and security consultant, told reporters on Saturday that he has offered to fill in -- essentially to give the same or a similar talk about vulnerabilities with transit fare cards, thought without the focus on the Boston transit system.
]]>One of the stupendous librarians at the University of Minnesota Law School sent me a news story that shows just how far some trademark policing will go. Specifically, to Talkeetna, Alaska, which, according to Wikipedia, has a population of 772 and lies a two-and-a-half-hour drive north of Anchorage. (Cue Michelle Shocked ballad.) The extraordinary zeal of this particular cease-and-desist letter shows itself, not just in the number of miles it was sent, but in the extremely minor violation it protested. As the Anchorage Daily News explains:
Talkeetna batik artist Barbara Holmes heard from the group behind the “got milk?” brand this month.
Holmes made the mistake of advertising T-shirts and “onesies” — those snappable one-piece underclothes for babies — hand-lettered with the words “got breastmilk?”
She whipped up 10 of the little things from her downtown Talkeetna home with an outhouse and no running water. She sold six at a holiday fair in the senior center two years ago, then moved on to other projects.
The letter from the board’s Sacramento law firm showed up a few weeks ago.
Wow. You can’t make this stuff up! Every fact makes the story more absurd: ten … hand-lettered … parody onesies .. sold at the senior center holiday fair … by a woman in Talkeetna,Alaska with no running water. Hand-lettered!
Unlike many recipients of C&Ds, Ms. Holmes has retained a spunky local lawyer (himself out of central casting: a former commercial salmon fisherman with long white hair and beard and a David-and-Goliath plaintiff-side practice who blogs as “Alaska Backwoods Lawyer.”) His letter in reply refuses the demand by counsel for the California Milk Processing Board that Ms. Holmes send them all the equipment used to make the offending products and an accounting of her profits.
Morals of the story:
1. Partly influenced by aspects of trademark law that encourage overactive policing, too many brand managers authorize their lawyers to churn out C&Ds without even thinking.
2. Worse, trademark law can allow markholders to pick and choose which messages earn their disapproval. There is no shortage of “Got Milk?” parodies out there — try going to a mall and not seeing one on a t-shirt. But only some get singled out by the Milk Board, including animal-rights critics and at least one other breastfeeding one.
3. We need to rethink trademark fair use.
In light of today's FCC ruling against Comcast, Electronic Frontier Foundation (EFF) has released a software tool dubbed, "Switzerland," for internet users to check ISP interference of their connections.
Fred von Lohmann, EFF Senior Intellectual Property Attorney says: "The sad truth is that the FCC is ill-equipped to detect ISPs interfering with your Internet connection. It's up to concerned Internet users to investigate possible network neutrality violations, and EFF's Switzerland software is designed to help with that effort. Comcast isn't the first, and certainly won't be the last, ISP to meddle surreptitiously with its subscribers' Internet communications for its own benefit."
]]>I read in Dispatches From the Culture Wars about Scott Conover, who was arrested for taking a picture of a policeman during a traffic stop.Conover quotes the police officer as saying "... you took a picture of me. It's illegal to take a picture of a law enforcement officer... if you don't give it to me, you're going to jail".
The arrest was, technically, for pointing a laser at a police officer (the officer claims he thought Conover was pointing a laser at him, but he arrested Conover even after discovering that it was a cell phone, which, y'know, looks a lot like a laser, dunnit). A commenter on the Dispatches blog points out how "The law they charged him under is 39-13-605, which requires that 'the photograph... was taken for the purpose of sexual arousal or gratification of the defendant'."... Seems like a bit of a stretch.
The police officer's affidavit also makes for entertaining reading.
(Thanks, Bernardo!)