Category Archives: article

Original articles by Tech Liberty

article

Does the TICS Bill really give the GCSB control and oversight of NZ telecommunications?

After our recent article looking at the TICS (Telecommunications Interception Capability & Security Bill), we were contacted by Brad Ward, the Programme Manager of the Telecommunication Review at the Ministry of Business, Innovation and Employment (MoBIE).

He had some issues with what we wrote, and in particular he rejected our claim that the bill gave the GCSB sweeping new powers of oversight and control over NZ telecommunictions networks, writing that (emphasis added):

The new formal framework for network security does not give “sweeping powers of oversight and control” to the GCSB, and it does not give the GCSB “final control of network design and operation.”

The GCSB already works in partnership with network operators on network security issues, to agree on measures that are proportionate and risk-based. The Bill will formalise and build on this existing approach.

The Bill emphasises that network operators and the GCSB are to work cooperatively and collaboratively on identifying and addressing network security risks.

In the event that the network operator and the GCSB are unable to agree, the Bill establishes a Ministerial direction power that can be used where significant national security concerns are involved, and as a last resort. This Ministerial power relates to network security issues.

The GCSB would apply to the Minister responsible for the GCSB to direct a network operator to take specific steps to prevent, mitigate or remove the security risk.

The Minister can receive any submissions on this directly from the network operator, and is required to consult with the Minister for Communications and Information Technology and the Minister of Trade.

When exercising the direction power, the Minister is required to take into account the principle that the direction should be proportionate to the network security risk. This means considering whether costs would be higher than reasonably required to address the risk, and whether there would be undue harm to competition or innovation in telecommunications markets.

Looking at the law

Firstly, while it is nice that the Bill suggests that network operators should work in partnership with the GCSB over security, the reality is that there is no choice. Let’s quote section 45(1):

A network operator must engage with the Director as soon as practicable after becoming aware of any network security risk, or proposed decision, course of action, or change that may raise a network security risk.

A network security risk is defined as: “any actual or potential security risk arising from (a) the design, build, or operation of a public telecommunications network; or (b) any interconnection to or between public telecommunications networks in New Zealand or with telecommunications networks overseas”.

Further more in section 47(1) (edited for clarity/length), “a network operator must notify the Director of any proposed decision, course of action, or change made by or on behalf of the network operator regarding procurement of…, changes to…, and ownership control… of anything that falls within an area of specified security interest.”

This applies to areas of specified security interest which are defined in section 45(1) as (slightly edited for clarity) “network operations centres, lawful intercept equipment, any part of a public telecommunications network that manages or stores aggregated customer information or administration authentication credentials, and any place in a network where data aggregates in large volumes being either data in transit or stored data”.

The compliance process

So, what happens after this engagement/notification if the GCSB thinks it would raise a network security risk? Sections 49 to 54 have the process:

  1. Director of the GCSB notifies the network operator and then again in writing in s49(1)(a) and s49(2)
  2. Network operator must immediately stop work. s49(1)(b)
  3. Network operator can propose an alternative. a49(3)
  4. GCSB considers the network operator’s proposed alternative and possibly accepts it. s50(1) and s50(2)
  5. Network operator must implement the response. s51
  6. If the GCSB is not happy with the proposal it may refer the matter to the Minister (the Prime Minister normally has responsibility for the GCSB) to make a direction. s52
  7. Network operator may choose to make a submission to the Minister. s53(2)(b)
  8. The Minister must consult with the Minister for Communications & Information technology and the Minister of Trade. s54(3)
  9. The Minister may direct the network operator to either cease/refrain from an activity or make changes to or remove any system or operation on the network. s54(2)
  10. If the network operator refuses to comply with an s54 Ministerial direction, this is treated as serious non-compliance. s82(b)
  11. The GCSB can servce an enforcement notice on the network operator. s85(2)
  12. The GCSB can apply to the High Court for a court order. s86(1)
  13. The High Court can make an order (subject to normal apeals). s87
  14. The High Court can make the network operator pay a fine of up to $500,000 and/or $50,000 per day of continuing non-compliance. s92 and s93

In other words, the Bill may suggest that the GCSB and network operators should cooperate, but the content of the law and the procedure I have just outlined makes it very clear to everyone involved where the power really lies. Indeed, the expectation that network operators will do what they’re told is so clear that we wouldn’t expect any fines to be issued because there won’t be a lot of point fighting any directions from the GCSB.

But it’s only security issues!

Now one might claim as Brad Ward has that “This Ministerial power relates to network security issues.”

However when it comes to network design and operation, everything has an impact on network security. What you buy, what systems they run, who you buy them from, how they get delivered to you, where they’re installed, how they’re configured, who you’ve employed, how well they’re trained, etc, etc, etc – network security is not one attribute but is a product of the system as whole.

Conclusion

We stand by our original statement that the TICS Bill as written will give the GCSB sweeping powers of oversight and control over New Zealand telecommunications networks.

One final point of interest is – why is a government bureaucrat trying to deny this is the case? Does the Bill as written not reflect the intention of the people who wrote it, or is this a case of the government trying to pull the wool over people’s eyes?

article

Govt proposes GCSB control over NZ communications in new TICS Bill

6 Comments

The government has announced two new Bills for reforming the GCSB and expanding their powers. The first is the GCSB and Related Legislation Amendment Bill (PDF) and the second is the Telecommunications (Interception Capability and Security) Bill (PDF).

This article is a summary of the major parts of the TICS Bill.

The TICS Bill is a replacement for the Telecommunications (Interception Capability) Act 2004. This law forced communications providers (ISPs, telcos, data networks, etc) to provide “lawful intercept” capabilities so that the Police, SIS and GCSB could access communications once they had a suitable warrant. The new bill expands and clarifies these requirements.

However, the addition of the word “security” is the key to what has changed. The new bill now gives the GCSB sweeping powers of oversight and control over the design, deployment and operation of all data and telecommunications networks run by network providers in New Zealand. The stated reasons are to both protect New Zealand’s infrastructure and to ensure that surveillance agencies can spy on traffic when required. As part of this, the GCSB will have the power to stop network providers from reselling overseas services that do not provide these capabilities.

Summary of major elements of the TICS Bill

Interception

From the Bill:

A network operator must ensure that every public telecommunications network that the operator owns, controls, or operates, and every telecommunications service that the operator provides in New Zealand, has full interception capability.

Note that the surveillance agencies still need to have a legally issued warrant (under the Search & Surveillance Act, NZ SIS Act, or GCSB Act) to actually intercept any communications and there are obligations to avoid capturing communications that are not covered by the warrant.

The new Bill splits communications providers into multiple classes, with small, wholesale and infrastructure providers having reduced obligations. Providers must either have a full intercept capability, to be “intercept ready”, or to be “intercept accessible”. Membership of these classes can be varied by direction of the Minister.

The Bill specifies that the law applies to companies whether based in New Zealand or overseas. It then goes on to give the Minister the power to ban the resale of an off-shore telecommunications service in New Zealand if it does not provide interception capabilities. This could stop the resale of foreign-hosted VPNs, instant message services, email, etc.

Finally, there is more detail about how intercepted data should be formatted and delivered (apparently this has caused problems under the existing law).

Encryption and decryption

Network operators must decrypt the intercepted communications if they have provided the encryption, but there is no obligation to do so if the encryption is provided by others.

What does this mean for providers such as Mega (file locker) or LastPass (password storage) who have a business model based on the fact that they supply a cloud product that uses encryption but have deliberately designed it so that they can not decrypt the files themselves? This gives users the assurance that they can trust them with their data. Will the government close them down unless they provide a backdoor into the system?

Network security

There is a major new role for the GCSB in overseeing the design and operation of commercially available data and voice communications networks.

The Bill says that network providers and the GCSB are to work co-operatively and collaboratively on identifying and addressing network risks. If they fail to cooperate sufficiently, the law provides for penalties of up to $500,000 with an additional $50,000 per day.

Network operators must notify the GCSB of any proposed decision, course of action or changes made by them in regards to purchases, network changes or ownership/control of the “specified security interest”. This includes their network operations centre (NOC), lawful intercept equipment, customer databases, databases of user accounts, and “any place where data aggregates in large volumes”.

The GCSB can also demand any other information about the security and interception capabilities of the network including copies of contracts, specifications, and so on. That the information is commercially sensitive or held in confidence is not a defense.

Compliance

All network operators will have to register themselves with the government. The register will be administered by the Police and available to the Police, SIS and GCSB.

The register will include the numbers of customers, names of responsible contact people within the organisation, the regions they operate in and the types of services they provide. Providers of infrastructure services (e.g. companies that provide fibre links but not the equipment for communicating over those links) will also have to give the names of their customers to the register. There are penalties for non-compliance.

The government can insist that communications providers must obtain secret-level security clearances for some of their staff. It does not say what will happen if none of the technical staff qualify for a security clearance.

Liability and protecting classified information

People who do any act in good faith under the new law will be protected from subsequent prosecution or lawsuits. i.e. the new law is superior to other NZ laws or existing contracts.

There is also a provision that allows the courts to receive classified information in a court case in the absence of the defendant or the defendant’s lawyer. This applies to information that might reveal details of the interception methods used by the surveillance agency or is about particular operations in relation to any of the functions of the surveillance agency, or is provided as secret information from the surveillance agencies of another country. It can also be used if that disclosure would prejudice security of NZ, prejudice the maintenance of law, or endanger the safety of any person. The judge in the case can appoint someone with an appropriate security clearance to represent the interests of the defendant for these parts of the trial.

Analysis and comment

The new TICS Bill is a major expansion of government power over the internet and other communications networks in New Zealand. While the existing TICA Act already mandated the provision of lawful intercept capabilities, handing over final control of network design and operation to the GCSB in the name of “security” seems incredibly wide and open ended.

Adding an additional level of government bureaucracy to the design and operation of these systems would appear to be a fairly significant hindrance to the ability of network operators to run their businesses.

There also must be concern about the GCSB being able to ban the resale of any services that do not provide lawful intercept capability. This means that New Zealanders will be prevented from protecting their communications from the New Zealand government – but equally they will be prevented from protecting their communications from foreign governments too. (We can safely assume that a foreign service that gives access to the NZ govt will also provide it to others.) These rules could wipe out businesses such as file lockers and password stores that rely on providing secure storage to their users.

One must ask where the justification for this expansion of power is coming from. Has New Zealand already been materially affected by attacks on our communications infrastructure? It seems clear that while the GCSB may not be that competent at exercising the powers they already have, they have done a fine job of convincing the government that they can handle a lot more.

There are many other parts of concern and there will need to be more analysis of the interception capabilities in conjunction with the new GCSB bill. One that does stick out as particularly offensive to civil liberties are the provisions for convicting people based on secret evidence. How can you defend yourself fairly when you can’t even find out the evidence presented against you?

We will be doing further work on analysing this bill and would welcome contributions, particularly from those within the industry who already have experience working with TICA requirements.

article

Anti cyber-bullying proposal marches on

A cabinet paper (PDF) shows that the Government has accepted most of the Law Commission’s proposals to control and punish cyber-bullying and other ‘digital harms’. This includes:

  • Clarification of existing laws such as the Harassment Act to explicitly say that they apply to modern communications technology.
  • Establishment of an agency (probably NetSafe) that will provide non-coercive mediation of online issues.
  • More encouragement of anti-bullying measures in schools.
  • New criminal offences for “using a communications device with the intention to cause harm” and “incitement to suicide”.
  • Establishment of a new regime with wide ranging censorship powers for controlling online speech, including new tighter standards for what speech is acceptable online.

One significant change is that the paper rejects the establishment of a separate Communications Tribunal (staffed by District Court judges with specialist knowledge in this area) in favour of passing it to the District Court as a whole. This would seem a step backwards in many ways as we question whether the average District Court judge is up to the task of understanding the technology involved.

Our response

Read our response to the Law Commission’s original proposals: What’s Wrong with the Communications (New Media) Bill and can it be fixed?

Many of these problems remain in the current proposal.

From a civil liberties point of view, the most serious concerns are around the idea that online speech should be held to a different and significantly higher standard than offline speech, a position we strongly object to. There is also a concern around why harming someone via online communication is seen as so much worse than other forms – it would make more sense to us to concentrate on the extent of the harm caused, not the means by which it was delivered.

From a purely practical point of view, when we consider the wide-ranging use of anonymity and foreign services on the internet, combined with the speed at which many situations blow up online, we still question how much good these proposals will be able to do.

Other Reactions

Our page listing reactions to the initial report.

No Right Turn reports that the proposal is the return of the offence of criminal libel:

Back in the dark ages, when spousal rape was legal and homosexuality was a crime, there was a criminal offence in this country of “criminal libel”. Publishing material “designed to insult any person or likely to injure his reputation by exposing him to hatred, contempt and ridicule” wasn’t just a matter for defamation lawyers; it was a crime punishable by two years imprisonment. The law was clearly incompatible with the Bill of Rights Act (not to mention with modern ideas about defamation being a tort), and so it was repealed in 1992. Now Judith Collins wants to bring it back – but only on the internet.

Lawyer Steven Price points out some of the hurdles you’ll have to get over to actually use the new new censorship regime and then questions the wisdom of handing over decision making around some complex technical and Bill of Rights issues to the next District Court judge off the bench.

Blogger David Farrar generally favours the proposal but questions the communications principles.

InternetNZ points out that the proposal has some worrying flaws.

Do New Zealanders want web-based email services to be subject to take-down orders? Do people understand that such orders, as outlined in the Cabinet paper, could be based on lower legal standards than is the case today – and could be imposed on people without them being part of the Court’s proceedings?

Vikram Kumar worries that the proposals will cause collateral damage to the NZ internet.

NZ Herald editorial in favour.

article, surveillance

Update on NZ Police use of aerial surveillance drones

1 Comment

We’ve been keeping track of the Police use of new surveillance and tracking technology. We asked them what they’ve been doing with drones and here are the more interesting/informative answers (Police letter, 19th February 2013):

  • The Police currently have one aerial drone.
  • They don’t have a specific budget for it and claim not to know how much they’ve spent on it so far.
  • They say that they can use it for tracking people and cars but promise to do it in accordance with the Search & Surveillance Act. We note that our interpretation of this says that they need a tracking warrant to use an electronic tracking system but we don’t know if the Police agree with this.
  • The Police believe that their current policy concerning video recording operations and events also covers their use of drones.
  • The Police have been contacted by the Privacy Commissioner re their use of drones and will be meeting with them soon.
  • The Police expect their drone trials to finish by the end of 2013.

You may also wish to read this article about drones by David Beatson at NZ Pundit.

We’re going to be following up to get more information. If there’s any questions you want asked, please leave them in the comments.

article

NZTA’s passive electronic tracking system

4 Comments

Updated: see note below. Further updated 13/8/2013 to add commentary about the security of hashing. Further updated 5/11/2014 to link to NZTA letter showing that data is being shared with CERA, Police and Ministry of Transport.

One of the issues with modern technology when it comes to privacy and tracking is that it isn’t always obvious what data we should be worrying about.

The latest example of this is the NZTA’s trial of a passive monitoring system called Blip Track to monitor traffic congestion on the Puhoi to Warkworth road.

The BlipTrack system relies on the Bluetooth functionality built in to many mobile phones and related accessories, car stereos, and mapping devices. Each Bluetooth device broadcasts a unique MAC address if the device is set to be visible. By detecting the same MAC address at different locations, the Blip Track system can work out how long it took for the device to travel between the two points and therefore make some assumptions about how congested the road is. (See the BECA report (PDF) for more information about how the system works.)

With mobile phones being very personal devices that we tend to carry everywhere we go, it seemed obvious to us that this sort of technology could be used to track people. We asked NZTA about this and their response was:

We do not consider that the Privacy Act 1993 applies. This is because the information collected is not personal information.

NZTA declined to give us a copy of the legal advice they have received on the privacy issues.

The BECA report linked before also touches on the topic:

Although there may be potential sensitivities for using Bluetooth, the MAC address numbers can only be identified / observed if the Bluetooth device is active and the privacy settings have been set to allow it (i.e. the Bluetooth is set to ‘visible’). Also, unlike number plates or cell phone IDE numbers, there is no way of tracking the MAC address number back to the owner as there are a variety of types of device with Bluetooth, and no database matching these devices to their owners.

What is “personal information”?

The Privacy Commissioner defines personal information as follows:

Information about a living human being. The information needs to identify that person, or be capable of identifying that person.

While the Bluetooth MAC address can’t be used to work out who someone is, that’s not to say that someone who already has a person’s MAC address can’t use it to find out where they’ve been. For example, an NZTA employee with access to the database could look up the MAC address of their partner’s mobile phone to see if they were telling the truth about where they were last night.

We reject NZTA’s interpretation; we believe that the Bluetooth unique identifier is personal information, that the NZTA is collecting it without consent and storing it without permission. This is in breach of the Privacy Act.

We also note that there is no need to store the unique Bluetooth address in the database after the match has been made. Anonymising this would remove much of the potential for misuse. (See Update below.)

Sharing data with law enforcement

More interestingly, this data could also be made available to the Police. While the Police are limited by the Search & Surveillance Act in the use of electronic tracking systems, is there anything stopping them from asking NZTA to look up their database?

Of course, even if NZTA did count it as personal information, we note that the Privacy Act has some very large holes when it comes to sharing data with the Police and provides no real oversight of such sharing.

Conclusion

We’re not trying to say NZTA are bad people or that what they are doing is particularly wrong. They’re currently using the technology for a reasonable purpose and at least already have some protocols around what data they can share with other agencies.

However, even though they’ve tried to think about the privacy implications of the technology they’re using, they still haven’t fully understood the risks of collecting and storing data of this type.

The technology involved in this type passive tracking system is continually getting cheaper. It would make perfect sense for NZTA to extend it across the road network to help them with their planning. At the same time, this would establish a national database that would enable NZTA or anyone else with access to it to track people. In particular this data could be made available to the Police with no significant oversight.

We believe that our privacy and data collection/sharing laws need to be updated to take account of new technologies and the power of big data.

Update

We have been sent further information (PDF) about the BlipTrack system. From the document:

When a BlipTrack™ sensor detects a Bluetooth Device in its proximity, the sensor will generate a one way hash code from the Bluetooth address of the detected device using a SHA-256 algorithm. Only Bluetooth hash codes are transmitted to the central server. There is no way to revert hash codes back to real Bluetooth addresses, thereby preventing access to the Bluetooth MAC addresses of the tracked devices.

In case the BlipTrack™ data was compromised, the attacker could try to correlate data between multiple systems and possibly, over time, be able to link a hash code of a Bluetooth device address to a record in another system, that could contain user information. To prevent this, BlipTrack supports Re-Hashing of Bluetooth Address device Hashes. By Re-Hashing the Hash codes using a new salt on a daily basis, a detected Bluetooth device will only have the same hash code for one day. The next day that user will be seen as a new user.

However, people familiar with this type of cryptography expressed grave doubt that the protections outlined would be sufficient to protect the information from even basic attacks. Details of the BlipTrack implementation are vague, but the number of possible MAC addresses are small making it likely that without very careful precautions a brute-force attack against the hash using modern computers could reveal all the original MAC addresses even for days when the salt is not accessible.

BlipTrack, in an example of having their cake and eating it too, then go on to claim that MAC addresses do not link to personal user information. If this was the case, you might wonder why they go to such lengths to stop them being available in their database. More to the point, we’ve already explained why we believe that they are personal information in the terms of the Privacy Act – and therefore would require permission to capture them in the first place.

 

Update 2

In response to an OIA request (PDF), NZTA has revealed that BlipTrack data has been shared with NZ Police, CERA and the Ministry of Transport. They say that this is just aggregated statistical data.

article, copyright

RIANZ withdraws again and copyright notices insufficient

Three brief items about the Copyright Act and the Copyright Tribunal:

1. RIANZ withdraws from another defended hearing

Another defended hearing was scheduled to go to the Copyright Tribunal this month but RIANZ has withdrawn the complaint (info from phone call to Copyright Tribunal). No further details of the case are known, so was it another fatally flawed case like the first withdrawn case or is RIANZ just not prepared to fly down to Christchurch to appear before the Tribunal?

2. Second Copyright Tribunal Decision

A second decision has been made with the Copyright Tribunal ordering a 50 year old father to pay $557 to RIANZ for sharing two songs (one twice). As in the last judgement, the evidence would appear to show that the defendant did not really understand the process nor what they had been accused of – rather it seems likely that their 8 and 12 year old sons might have done it. There is also evidence to show that they didn’t understand the first two notices they received enough to be able to take action to prevent the third enforcement notice.

3. Copyright Act working as intended – kind of

Finally we come to a case where the Copyright Act did work as intended – but only after the intervention of Tech Liberty. We received a communication from someone who had received an initial detection notice.

Just got this and as a 52 year old single mum I can’t understand what they mean about that the alleged infringed song has been communicated to the public? Is the infringement about the song being downloaded of shared publicly or both? I’m horribly confused. My teenage daughter says she can’t stand the song and I don’t even know the song. Perhaps my older 2 adult children or my boarders have done this? Any advice would be very much appreciated.

Her confusion is quite understandable when you look at the notice (identifying details removed):

Notice Number: xxxxxxxxx
Infringement Notice Date: xxxxxx
Notice Type: Detection Notice
Infringing IP Address: xxx.xxx.xxx.xxx
Infringing Date: xx/xx/xx
Name of the file: Chris Brown – Beautiful People.mp3
Unique identity of the file:
Copyright Owner: Sony Music Entertainment Incorporated
Type of Copyright Work: Sound recording (14(1)(b))
Restricted Act: Copyright has been infringed by this account holder communicating the work to the public (16(1)(f))
File Sharing Application: Azureus 4.5.0.4

What is this meant to mean to someone who doesn’t understand what file sharing is? The information included by Slingshot may have explained the law but made a very poor effort at explaining what she was accused of. We rewrote it for her:

They’re saying that someone at your house has installed a piece of software called Azureus (also called Vuze) and they’ve used that to download a song called Beautiful People by Chris Brown. The Azureus software not only downloads the song, it also uploads it to other people who want it (this is why it’s called peer to peer file sharing). Sony/RIANZ have detected this upload and have made a complaint to Slingshot who have passed it on to you.

The response came quickly:

Thank you so much for getting back to me and for taking the time and all the information, very much appreciated. :) I have found out that one of my son’s friends has done this and he says he won’t do it again. He is a good family friend so thats fine. I will get the guys to delete the Azurus or Vuse and to check for any other peer to peer programs.

Surely a good outcome for RIANZ with a junior copyright infringer stopped after the first warning.

But it seems that the current format of the notices is not good enough. Non-technical people don’t understand what they’re accused of and have no idea what they should do to stop it happening again. And, after all, it’s often the non-technical people who are the account holders while someone else sharing the same account may be the one doing the infringing.

It seems clear from these first few cases that the notices need to be improved so that they do a better job of explaining both the accusation and what they need to do to stop it happening again.

article, copyright

First Copyright Tribunal case demonstrates flaws in the law

4 Comments

The first decision from the Copyright Tribunal has now been announced and RIANZ has been successful in getting a penalty of $616.57 awarded to them. Read the text of the decision linked from this NBR article.

Facts of the Case

The respondent admits to downloading one of the tracks using uTorrent but seems confused as to how she could have received two notices for downloading it twice (she’s actually been accused of uploading it). She also acknowledges that she was in the wrong and goes on to say that she had deleted the track and removed the software from her computer.

The respondent also denies having downloaded the second track and says that she also doesn’t think anyone else in her household would have done it.

The decision

The respondent has been ordered to pay $616.57 to RIANZ (the applicant) calculated as:

  • $6.57 as the cost of buying the three tracks on iTunes.
  • $50 towards the $75 cost of the three notices.
  • $200 to reimburse the Copyright Tribunal fee.
  • $360 ($120 per track) as a deterrent.

Commentary

The respondent’s perspective

From reading the quotes from the respondent’s submission, as far as they’re concerned they got penalised $616.57 for downloading a single song. (They got two notices for that song because it was being uploaded as well, and they deny ever downloading or sharing the song mentioned in the final notice.)

Anonymity

The Copyright Tribunal does not publish the name of the respondent accused of copyright infringement. This will be a relief to the other 11 people waiting for their decisions.

Ignorance about filesharing

It seems clear from the quoted part of the respondent’s submission that they have no real idea about how file sharing via bittorrent works. RIANZ and the Tribunal both also seem somewhat blind to the reality that a default uTorrent installation will set itselt to automatically restart whenever the computer is restarted, and will thus keep sharing until stopped.

Can’t prove a negative

The Tribunal basically ignores the respondent denying that they downloaded the second track, saying that the law presumes that the notices are correct and that the respondent must show evidence that this is not true. The great difficulty involved in trying to prove that something didn’t happen is not touched on by the Tribunal.

Quality of notices

The decision includes no discussion of the quality of the notices. This is disappointing as all of the notices we have seen to date have been flawed in one or more ways.

We also note that the second notice was sent on 19th June while the third notice was sent on 30th July. This means that the infringement would have had to have occurred between the 19th of July and the 30th of July to not have occurred during the stand down period. The timing looks a bit tight but the date of the infringement is not given in the decision.

Tribunal rejects RIANZ creative maths

The Tribunal rejected RIANZ’s attempt to rewrite the law by making up numbers about how many times the tracks might been uploaded and then arguing that the respondent should have to pay that many times for each track. However, the Tribunal did allow that uploading might be taken into account when calculating the deterrent penalty.

Tribunal rejects RIANZ arguments re flagrancy

RIANZ claimed that a) installing uTorrent, b) infringing over 8 months, c) repeated infringement, indicated flagrancy and therefore a heavy penalty. The Tribunal noted that these will be common to nearly all cases appearing before the Tribunal and therefore the behaviour could not be seen to be particularly flagrant.

Tribunal ignores apology and efforts to stop file sharing

While the Tribunal notes that the respondent acknowledged wrongdoing, apologised and attempted to stop file sharing (possibly being defeated by lack of technical understanding), they do not seem to acknowledge this when setting the deterrent penalty.

Deterrent penalty

The Tribunal seems to have made up the principle that the deterrent penalty should be higher than the part of the penalty concerned with reimbursement, and therefore arbitrarily adds on another $360 ($120 per infringement). There is no acknowledgement that for many people a penalty of $256 is already a significant punishment.

Do they now have a license?

The decision does not establish whether the respondent now has a license to possess the music in question after paying the cost of buying it in iTunes as part of the penalty.

Conclusion

On the face of it this decision isn’t too bad. The respondent admits they copied some music and the guilty judgement has apeared with minimum fuss and legal expenses. There was no possibility of their internet connection being disconnected – although we suspect that the respondent will be very reluctant to have their name on an internet account in the future.

This decision sets a benchmark penalty of approximately $600 for a typical infringing file-sharing case appearing before the Tribunal. While low compared to the ludicrous sums awarded by US courts (e.g. US$12,500 per track award awarded against Tenenbaum for a total of US$675,000) it seems high compared to penalties for some other NZ offences. Accordingly we think that this amount is still too high for what is infringement on a very small scale with someone who admits guilt, apologises and tries to stop file sharing.

Flawed law

However, this case once again demonstrates two of the key weaknesses of the law:

  1. There is no way to prove your innocence. No one in New Zealand keeps the kind of detailed network logs that would be necessary to prove that you hadn’t done what you were accused of. All you can do is assert that you didn’t do it and the Tribunal has just shown that they will ignore this.
  2. The responsibility falls on the account holder, not the people using the internet to infringe copyright. In this case the respondent admitted she had downloaded the first track, apologised and had taken steps to stop it happening again. She denied downloading the third track that triggered off the penalty and suggested that someone else might have done it. Obviously we can’t know if she was telling the truth, but the reality is that most internet connections are shared and this could easily happen.

These two points are going to come up again and again. It seems certain that in many cases justice will not be done, with the account holder taking the fall for sloppy detective work on the part of RIANZ and the ISP, or the actions of other people sharing their internet account (see another case involving shared internet use).

We believe the law is unjust and needs to be dropped before too many people are punished for things that they didn’t do.

article, copyright

Copyright Act – IPAP Reports

2 Comments

When the new three-strikes copyright infringement scheme was implemented, it included section 122T that imposed some obligations on IPAPs (ISPs) to collect and retain data, and publish an annual report. As Sam Russell reminded us today, the first of these reports was due by 31st December 2012 for the period 1st October to 30th September.

Here’s the reports we know of:

  • Actrix – the most minimal report yet (but claim that they received no notices).
  • DTS – no complaints received.
  • Maxnet – no complaints received and a very minimal report (bottom of page).
  • Orcon – received 234 complaints, sent 198 notices, received 16 challenges.
  • Slingshot (PDF) – received 473 complaints, sent 398 notices, received 14 challenges.
  • Telecom – takes a very minimal approach, just states it has complied.
  • TelstraClear – received 818 complaints, issued 540 notices, received 25 challenges.
  • Vodafone – received 538 complaints, issued 350 notices, received 21 challenges.
  • Xtreme – received 2 complaints, issued 0 notices.

We have asked 2 Degrees, Compass, Inspire, Snap, Vocus, and Xnet where their reports are.

We’ll add more as we find them and do some collation/analysis when we have enough. One thing that is noticeable is that very few of the notices are being challenged by the recipients.

article

Police use of new surveillance technology

The NZ Police are continuing to expand their use of technology to watch and track people in New Zealand. We’ve already discussed automated number plate recognition, but information has emerged about two new initiatives:

The first is Signal – a tool used to scan and collate publicly availably data from multiple social media sites such as Twitter, Facebook and Youtube. This data can then be analysed to establish connections between people and events, and was used during the Rugby World Cup to monitor both boy racers and political protesters.

The second is the trialling of aerial surveillance drones. As part of the trials they have already been used in some Police investigations.

We’re not reflexively opposed to the NZ Police using tools to do their job better, but we do have some concerns about how they can be used to infringe our rights to go about our lawful business without unwarranted surveillance and tracking. We believe that it is not healthy in a democratic society for our every movement and action to be monitored, stored and analysed by the government.

We’ve made requests to the Police for more information about both of these initiatives and will report more once we receive it.

General Principles

One thing that is of concern is that the Police seem to be being quite secretive about their use of technology. It seems that they wait for someone to find out about it before releasing information in dribs and drabs, sometimes after prompting from the Ombudsman. If the Police aren’t proud of what they’re doing to more efficiently fight crime, perhaps they shouldn’t be doing it at all.

A second concern is that our laws, even including the new Search & Surveillance Act, might already be out of date when it comes to the Police use of such technology. For example, are there any controls on amassing publicly available data to such an extent that modern data analysis software can make some assumptions about very private behaviour?

We’d like to see two things:

  1. The NZ Police taking a more proactive role in disclosing what they are doing and how they are doing it. They may even wish to do more consulting with community groups and watchdogs such as Tech Liberty and the NZ Council for Civil Liberties.
  2. Work on a new set of standards and principles to inform the Police’s (and other agencies) use of new technology and “big data” systems. These should cover data integrity, retention, security, auditing and notification. This is something that Tech Liberty is currently working on.
article, copyright

Text of the RIANZ submission to the Copyright Tribunal

6 Comments

We recently wrote about RIANZ withdrawing one of the first cases to go to the Copyright Tribunal. We made some reference to RIANZ’s claims and their attempts to rewrite the law and regulations to justify a claim based on the number of times the works might have been downloaded.

We’ve now made RIANZ’s submission to the Copyright Tribunal available for download (PDF, 8.5MB).

Some points of interest include:

  • RIANZ admitting in footnote 25 that it might not be the account holder who downloaded the works but someone else sharing the connection.
  • The attempted rewrite of the NZ Copyright Act and regulations in para 30 to enable RIANZ to claim for each potential download.
  • The argument that the lack of challenges to the notices and the continuing file sharing showed that the infringer was flagrantly breaching the law, rather than being completely clueless about it.
  • The justification for asking for $1250 worth of deterrent penalties.
  • That RIANZ use Mark Monitor to track file sharing activity, a system that only downloads part of the work from the person they’re accusing.

Feel free to add a comment with anything else interesting you find.