Tag Archives: Internet

submission

Submission – Telecommunications (Interception Capability & Security) Bill

Full text of the Tech Liberty submission to the Law & Order Select Committee concerning the Telecommunications (Interception Capability & Security) Bill.

Summary

In general we support the ability of the government to have interception capabilities on telecommunications where possible, when those interception capabilities have suitable oversight and control. We have made some technical suggestions on how Part 2 – Interception Duties could be improved and clarified:

  • Publish a list of service providers with interception responsibilities.
  • Remove the ability for the Minister to ban the resale of overseas services.
  • Clarify the duty to decrypt to indicate that it does not require network providers to supply deliberately weakened encryption with government backdoors.

We reject the idea that the GCSB should have oversight and control of communications networks in New Zealand. No need for this has been established and the use of an agency whose main focus is spying on external organisations is inappropriate and open to abuse. We therefore recommend the removal of Part 3 – Network Security in its entirety, possibly to be replaced by the establishment of a coordinating and consultative, not controlling, network security body.

Finally, we find the idea of evidence being presented in court that cannot be seen by the defendant and their lawyer to be extremely offensive to the right to a fair trial as promised by section 25 of the Bill of Rights Act. We therefore recommend the removal of Subpart 8 – Protecting Classified Information (sections 96-98). If this is retained we recommend that the appointment of a special advocate as in 97(3)(c) should be mandatory rather than optional.
Continue reading Submission – Telecommunications (Interception Capability & Security) Bill →

article, surveillance

GCSB’s new powers for wide-spread spying on New Zealanders

14 Comments

There have recently been a number of revelations about the US government spying on its citizenry and other people around the world (a good summary). Many people have been shocked to find out the extent of the US’s spying and access into theoretically private systems.

What many New Zealanders don’t realise is that the NZ government is currently changing both the GCSB Act of 2003 and the Telecommunications Interception Capability Act of 2004 to allow similar levels of access to New Zealand communications for the GCSB (Government Communications Security Bureau).

Current law

The current TICA law already gives the GCSB, Police or SIS the technical capability to intercept all NZ communications if they have a valid warrant.

The GCSB can get warrants to spy on the communications of foreign people and organisations, although they can spy without a warrant if it doesn’t require the installation of any device (e.g. wireless/satellite/radio/mobile).

TICS – Telecommunications Interception Capability and Security Bill

The new TICS Bill clarifies and expands on these interception capabilities. It also allows them to be extended to service providers (people who offer “goods, services, equipment, and facilities that enable or facilitate telecommunication”) such as email providers, Trademe forums, Mega, etc.

TICS continues the existing regime where these interception powers can only be accessed with a valid warrant, but keep reading for the new exceptions to this in the GCSB Bill.

Furthermore, the TICS Bill also creates a new role for the GCSB, ensuring the security of New Zealand’s telecommunications infrastructure. This includes wide powers of oversight and control of how communications networks are managed and implemented in order to “protect New Zealand’s national security or economic wellbeing”.

GCSB – Government Communications Security Bureau and Related Legislation Amendment Bill

The new GCSB Bill gives the GCSB three purposes (we’ll come back to these):

  • 8A – Information assurance and cybersecurity. (Expanded from protecting government communications to a much wider responsibility for New Zealand’s communications.)
  • 8B – Intelligence gathering, analysis and sharing. (Similar to the existing law except that it adds “gathering information about information infrastructures” to the existing spying on foreign people/organisations.)
  • 8C – Helping the Police, SIS and Defence Force by providing advice and assistance in helping them execute their own legally obtained warrants. (This is entirely new.)

The bill doesn’t significantly change how the GCSB can apply for an interception or search warrant, but it does add a whole new class of “access authorisation”. To quote section 15A(1)( b)

The Director may apply in writing to the Minister for the issue of an access authorisation authorising the accessing of 1 or more specified information infrastructures or classes of information infrastructures that the Bureau cannot otherwise lawfully access.

These authorisations are granted at the whim of the Minister (although see below) and are incredibly wide-ranging and open-ended. There are no recommendations of limits (other than what the Minister sees fit to impose) and there is no automatic expiry. And just in case you thought that the TICA/TICS law might provide some protection, the GCSB Bill goes on to add section 15A(5):

This section applies despite anything in any other Act.

Most importantly these new access authorisations can be used for purpose 8A (cybersecurity) as well as 8B (information gathering). As paragraph 36 of the Regulatory Impact Statement explains: “an amendment will also be required to allow the GCSB to see who (namely NZ individuals and companies) is being attacked”. That is to say, the GCSB believes that it needs to be able spy on New Zealanders to maintain ther security. Based on what we know from recent reports in GCSB activities, we assume that the GCSB particularly intends to collect communications metadata (i.e. who speaks to who, when and how often but not what they say).

If you had any doubts about whether this applies to NZ communications, section 15B then further clarifies that for any access authorisations “for the purpose of intercepting the private communications of a New Zealand citizen or permanent resident of New Zealand under section 8A (cybersecurity)” the authorisation must be approved by the Commissioner of Security Warrants as well as the Minister.

And finally if you were hoping that section 14, which controls the ability of the GCSB to target New Zealanders would provide any protection, this only applies when the GCSB is performing duties under section 8B (intelligence gathering) and not section 8A (cybersecurity).

Putting it all together

The GCSB believes it needs to monitor the communications of New Zealanders in order to ensure that it can protect them from attacks.

TICA and TICS establish the technical capability for the GCSB to spy on any communications, subject to the limits in that law and the GCSB Act.

A section 15A(1)(b) access authorisation can give GCSB power to access any communications system it wants for the purpose of spying or information security, irrespective of any legal controls in any other law. This will allow it access to the facilities provided by TICS/TICA.

The GCSB will be spying on New Zealanders.

Conclusion

These new laws are not some minor adjustments to the work of the GCSB and how interception works. They are not just about letting the GCSB provide technical assistance to the Police, SIS and Defence Force.

While people in the USA are getting upset about the revelations of the extent of NSA spying there, these new laws give the GCSB far greater control of New Zealand communications networks, and practically unlimited capacity to intercept New Zealand communications.

These new laws are the point at which New Zealand switches from being a society that investigates “bad guys” subject to judicial oversight, to being a surveillance state where the government is always watching and recording everyone just in case they’re thinking about doing anything wrong.

We don’t want to live in that society. We believe that these new laws contravene the right in the NZ Bill of Rights to be free from unreasonable search and seizure, and will have a chilling effect on the rights to free expression and freedom of association.

We think that these laws need to be stopped.

article, filtering

DIA now filtering .. Google?

2 Comments

Update 1st August 2013

The DIA have now confirmed that they did filter some sites hosted by Google and that this caused problems for both the filter and some internet users.

Officials provided an oral briefing on the incident reported regarding a degradation of service noted by some users of certain services. The Filter Operations Team worked with the provider of those services in question. It was discovered that hentai and cgi based child abuse sites hosted on the blogspot.com domain, a resource operated by Google Inc were included in the list in error.These sites were then shown to the IRG. It was then explained that a list refresh, removed the sites in question, and subsequently resolved this issue.

The problem was further compounded by the severe congestion in the networks of one of the upstream providers used by the system. A review of the Filter’s failsafe systems was undertaken. Steps have been added to ensure that the IPs of large hosting providers are flagged and placed on a white list with a reporting mechanism for the removal of the content from the site. Additional resources were requested from the upstream provider in question to ensure traffic congestion can be avoided in the future.

Back in 2011 we spotted the first indications of how the Department of Internal Affairs Internet filter, used by 90% of all New Zealand Internet connections, actually operates. At the time, we noticed an address – 124.150.165.62 – appearing where it shouldn’t in traceroutes to a site.

Performance Problems

Now that same address has popped up in traces to Google addresses, specifically googlehosted.l.googleusercontent.com (74.125.237.11). As noted in this thread on Geekzone, some people have  been experiencing performance problems reaching some Google services.

These performance problems could be caused by a Google-load of traffic to that IP being routed to the DIA’s filtering server which may not be coping with the volume. Note that the filter will only be blocking one web address (URL) at that IP and letting the rest of the traffic through.

Of course this won’t affect you if you are using an ISP that doesn’t use the filter. Check the list of ISPs here.

Making the link

As noted back in 2011, the address appearing in traces where they shouldn’t be are controlled by Fastcom, who list the Department of Internet Affairs as an important customer and which they host infrastructure for.

Filtering problems

This was always one of the fears when the filter was introduced – that it would reduce the stability and performance of the New Zealand internet. It appears that this has now happened. Two questions:

  1. Will the DIA remove the entry for this IP now that they realise the problems it’s causing?
  2. How will the DIA block web addresses hosted at high volume websites such as Google (or Wikipedia) when the filter can’t cope?

Seeking more information

Have you been experiencing any issues accessing Google? Can you provide a traceroute for us? Post a comment below.

Rumours and hearsay

Thanks to the people who contacted us with more information, we just wish you were prepared to speak on the record. So far we have heard the following from people that we typically find to be reliable:

  1. That the DIA has denied filtering that IP address.
  2. That a senior ISP engineer says that the IP address was definitely filtered by the DIA filter and that they have seen the relevant BGP records.
  3. That the filtering of at least one Google IP address has been removed but that there might be more.
  4. That Google was greatly annoyed by the block and contacted the Minister to get it removed.

We’ll update these rumours as we can confirm/deny them. Please email any information to thomas@techliberty.org.nz. We will do our best to keep your name confidential if requested, but suggest using an anonymous remailer for the best anonymity.

article

Does the TICS Bill really give the GCSB control and oversight of NZ telecommunications?

After our recent article looking at the TICS (Telecommunications Interception Capability & Security Bill), we were contacted by Brad Ward, the Programme Manager of the Telecommunication Review at the Ministry of Business, Innovation and Employment (MoBIE).

He had some issues with what we wrote, and in particular he rejected our claim that the bill gave the GCSB sweeping new powers of oversight and control over NZ telecommunictions networks, writing that (emphasis added):

The new formal framework for network security does not give “sweeping powers of oversight and control” to the GCSB, and it does not give the GCSB “final control of network design and operation.”

The GCSB already works in partnership with network operators on network security issues, to agree on measures that are proportionate and risk-based. The Bill will formalise and build on this existing approach.

The Bill emphasises that network operators and the GCSB are to work cooperatively and collaboratively on identifying and addressing network security risks.

In the event that the network operator and the GCSB are unable to agree, the Bill establishes a Ministerial direction power that can be used where significant national security concerns are involved, and as a last resort. This Ministerial power relates to network security issues.

The GCSB would apply to the Minister responsible for the GCSB to direct a network operator to take specific steps to prevent, mitigate or remove the security risk.

The Minister can receive any submissions on this directly from the network operator, and is required to consult with the Minister for Communications and Information Technology and the Minister of Trade.

When exercising the direction power, the Minister is required to take into account the principle that the direction should be proportionate to the network security risk. This means considering whether costs would be higher than reasonably required to address the risk, and whether there would be undue harm to competition or innovation in telecommunications markets.

Looking at the law

Firstly, while it is nice that the Bill suggests that network operators should work in partnership with the GCSB over security, the reality is that there is no choice. Let’s quote section 45(1):

A network operator must engage with the Director as soon as practicable after becoming aware of any network security risk, or proposed decision, course of action, or change that may raise a network security risk.

A network security risk is defined as: “any actual or potential security risk arising from (a) the design, build, or operation of a public telecommunications network; or (b) any interconnection to or between public telecommunications networks in New Zealand or with telecommunications networks overseas”.

Further more in section 47(1) (edited for clarity/length), “a network operator must notify the Director of any proposed decision, course of action, or change made by or on behalf of the network operator regarding procurement of…, changes to…, and ownership control… of anything that falls within an area of specified security interest.”

This applies to areas of specified security interest which are defined in section 45(1) as (slightly edited for clarity) “network operations centres, lawful intercept equipment, any part of a public telecommunications network that manages or stores aggregated customer information or administration authentication credentials, and any place in a network where data aggregates in large volumes being either data in transit or stored data”.

The compliance process

So, what happens after this engagement/notification if the GCSB thinks it would raise a network security risk? Sections 49 to 54 have the process:

  1. Director of the GCSB notifies the network operator and then again in writing in s49(1)(a) and s49(2)
  2. Network operator must immediately stop work. s49(1)(b)
  3. Network operator can propose an alternative. a49(3)
  4. GCSB considers the network operator’s proposed alternative and possibly accepts it. s50(1) and s50(2)
  5. Network operator must implement the response. s51
  6. If the GCSB is not happy with the proposal it may refer the matter to the Minister (the Prime Minister normally has responsibility for the GCSB) to make a direction. s52
  7. Network operator may choose to make a submission to the Minister. s53(2)(b)
  8. The Minister must consult with the Minister for Communications & Information technology and the Minister of Trade. s54(3)
  9. The Minister may direct the network operator to either cease/refrain from an activity or make changes to or remove any system or operation on the network. s54(2)
  10. If the network operator refuses to comply with an s54 Ministerial direction, this is treated as serious non-compliance. s82(b)
  11. The GCSB can servce an enforcement notice on the network operator. s85(2)
  12. The GCSB can apply to the High Court for a court order. s86(1)
  13. The High Court can make an order (subject to normal apeals). s87
  14. The High Court can make the network operator pay a fine of up to $500,000 and/or $50,000 per day of continuing non-compliance. s92 and s93

In other words, the Bill may suggest that the GCSB and network operators should cooperate, but the content of the law and the procedure I have just outlined makes it very clear to everyone involved where the power really lies. Indeed, the expectation that network operators will do what they’re told is so clear that we wouldn’t expect any fines to be issued because there won’t be a lot of point fighting any directions from the GCSB.

But it’s only security issues!

Now one might claim as Brad Ward has that “This Ministerial power relates to network security issues.”

However when it comes to network design and operation, everything has an impact on network security. What you buy, what systems they run, who you buy them from, how they get delivered to you, where they’re installed, how they’re configured, who you’ve employed, how well they’re trained, etc, etc, etc – network security is not one attribute but is a product of the system as whole.

Conclusion

We stand by our original statement that the TICS Bill as written will give the GCSB sweeping powers of oversight and control over New Zealand telecommunications networks.

One final point of interest is – why is a government bureaucrat trying to deny this is the case? Does the Bill as written not reflect the intention of the people who wrote it, or is this a case of the government trying to pull the wool over people’s eyes?

article

Govt proposes GCSB control over NZ communications in new TICS Bill

6 Comments

The government has announced two new Bills for reforming the GCSB and expanding their powers. The first is the GCSB and Related Legislation Amendment Bill (PDF) and the second is the Telecommunications (Interception Capability and Security) Bill (PDF).

This article is a summary of the major parts of the TICS Bill.

The TICS Bill is a replacement for the Telecommunications (Interception Capability) Act 2004. This law forced communications providers (ISPs, telcos, data networks, etc) to provide “lawful intercept” capabilities so that the Police, SIS and GCSB could access communications once they had a suitable warrant. The new bill expands and clarifies these requirements.

However, the addition of the word “security” is the key to what has changed. The new bill now gives the GCSB sweeping powers of oversight and control over the design, deployment and operation of all data and telecommunications networks run by network providers in New Zealand. The stated reasons are to both protect New Zealand’s infrastructure and to ensure that surveillance agencies can spy on traffic when required. As part of this, the GCSB will have the power to stop network providers from reselling overseas services that do not provide these capabilities.

Summary of major elements of the TICS Bill

Interception

From the Bill:

A network operator must ensure that every public telecommunications network that the operator owns, controls, or operates, and every telecommunications service that the operator provides in New Zealand, has full interception capability.

Note that the surveillance agencies still need to have a legally issued warrant (under the Search & Surveillance Act, NZ SIS Act, or GCSB Act) to actually intercept any communications and there are obligations to avoid capturing communications that are not covered by the warrant.

The new Bill splits communications providers into multiple classes, with small, wholesale and infrastructure providers having reduced obligations. Providers must either have a full intercept capability, to be “intercept ready”, or to be “intercept accessible”. Membership of these classes can be varied by direction of the Minister.

The Bill specifies that the law applies to companies whether based in New Zealand or overseas. It then goes on to give the Minister the power to ban the resale of an off-shore telecommunications service in New Zealand if it does not provide interception capabilities. This could stop the resale of foreign-hosted VPNs, instant message services, email, etc.

Finally, there is more detail about how intercepted data should be formatted and delivered (apparently this has caused problems under the existing law).

Encryption and decryption

Network operators must decrypt the intercepted communications if they have provided the encryption, but there is no obligation to do so if the encryption is provided by others.

What does this mean for providers such as Mega (file locker) or LastPass (password storage) who have a business model based on the fact that they supply a cloud product that uses encryption but have deliberately designed it so that they can not decrypt the files themselves? This gives users the assurance that they can trust them with their data. Will the government close them down unless they provide a backdoor into the system?

Network security

There is a major new role for the GCSB in overseeing the design and operation of commercially available data and voice communications networks.

The Bill says that network providers and the GCSB are to work co-operatively and collaboratively on identifying and addressing network risks. If they fail to cooperate sufficiently, the law provides for penalties of up to $500,000 with an additional $50,000 per day.

Network operators must notify the GCSB of any proposed decision, course of action or changes made by them in regards to purchases, network changes or ownership/control of the “specified security interest”. This includes their network operations centre (NOC), lawful intercept equipment, customer databases, databases of user accounts, and “any place where data aggregates in large volumes”.

The GCSB can also demand any other information about the security and interception capabilities of the network including copies of contracts, specifications, and so on. That the information is commercially sensitive or held in confidence is not a defense.

Compliance

All network operators will have to register themselves with the government. The register will be administered by the Police and available to the Police, SIS and GCSB.

The register will include the numbers of customers, names of responsible contact people within the organisation, the regions they operate in and the types of services they provide. Providers of infrastructure services (e.g. companies that provide fibre links but not the equipment for communicating over those links) will also have to give the names of their customers to the register. There are penalties for non-compliance.

The government can insist that communications providers must obtain secret-level security clearances for some of their staff. It does not say what will happen if none of the technical staff qualify for a security clearance.

Liability and protecting classified information

People who do any act in good faith under the new law will be protected from subsequent prosecution or lawsuits. i.e. the new law is superior to other NZ laws or existing contracts.

There is also a provision that allows the courts to receive classified information in a court case in the absence of the defendant or the defendant’s lawyer. This applies to information that might reveal details of the interception methods used by the surveillance agency or is about particular operations in relation to any of the functions of the surveillance agency, or is provided as secret information from the surveillance agencies of another country. It can also be used if that disclosure would prejudice security of NZ, prejudice the maintenance of law, or endanger the safety of any person. The judge in the case can appoint someone with an appropriate security clearance to represent the interests of the defendant for these parts of the trial.

Analysis and comment

The new TICS Bill is a major expansion of government power over the internet and other communications networks in New Zealand. While the existing TICA Act already mandated the provision of lawful intercept capabilities, handing over final control of network design and operation to the GCSB in the name of “security” seems incredibly wide and open ended.

Adding an additional level of government bureaucracy to the design and operation of these systems would appear to be a fairly significant hindrance to the ability of network operators to run their businesses.

There also must be concern about the GCSB being able to ban the resale of any services that do not provide lawful intercept capability. This means that New Zealanders will be prevented from protecting their communications from the New Zealand government – but equally they will be prevented from protecting their communications from foreign governments too. (We can safely assume that a foreign service that gives access to the NZ govt will also provide it to others.) These rules could wipe out businesses such as file lockers and password stores that rely on providing secure storage to their users.

One must ask where the justification for this expansion of power is coming from. Has New Zealand already been materially affected by attacks on our communications infrastructure? It seems clear that while the GCSB may not be that competent at exercising the powers they already have, they have done a fine job of convincing the government that they can handle a lot more.

There are many other parts of concern and there will need to be more analysis of the interception capabilities in conjunction with the new GCSB bill. One that does stick out as particularly offensive to civil liberties are the provisions for convicting people based on secret evidence. How can you defend yourself fairly when you can’t even find out the evidence presented against you?

We will be doing further work on analysing this bill and would welcome contributions, particularly from those within the industry who already have experience working with TICA requirements.

article

Anti cyber-bullying proposal marches on

A cabinet paper (PDF) shows that the Government has accepted most of the Law Commission’s proposals to control and punish cyber-bullying and other ‘digital harms’. This includes:

  • Clarification of existing laws such as the Harassment Act to explicitly say that they apply to modern communications technology.
  • Establishment of an agency (probably NetSafe) that will provide non-coercive mediation of online issues.
  • More encouragement of anti-bullying measures in schools.
  • New criminal offences for “using a communications device with the intention to cause harm” and “incitement to suicide”.
  • Establishment of a new regime with wide ranging censorship powers for controlling online speech, including new tighter standards for what speech is acceptable online.

One significant change is that the paper rejects the establishment of a separate Communications Tribunal (staffed by District Court judges with specialist knowledge in this area) in favour of passing it to the District Court as a whole. This would seem a step backwards in many ways as we question whether the average District Court judge is up to the task of understanding the technology involved.

Our response

Read our response to the Law Commission’s original proposals: What’s Wrong with the Communications (New Media) Bill and can it be fixed?

Many of these problems remain in the current proposal.

From a civil liberties point of view, the most serious concerns are around the idea that online speech should be held to a different and significantly higher standard than offline speech, a position we strongly object to. There is also a concern around why harming someone via online communication is seen as so much worse than other forms – it would make more sense to us to concentrate on the extent of the harm caused, not the means by which it was delivered.

From a purely practical point of view, when we consider the wide-ranging use of anonymity and foreign services on the internet, combined with the speed at which many situations blow up online, we still question how much good these proposals will be able to do.

Other Reactions

Our page listing reactions to the initial report.

No Right Turn reports that the proposal is the return of the offence of criminal libel:

Back in the dark ages, when spousal rape was legal and homosexuality was a crime, there was a criminal offence in this country of “criminal libel”. Publishing material “designed to insult any person or likely to injure his reputation by exposing him to hatred, contempt and ridicule” wasn’t just a matter for defamation lawyers; it was a crime punishable by two years imprisonment. The law was clearly incompatible with the Bill of Rights Act (not to mention with modern ideas about defamation being a tort), and so it was repealed in 1992. Now Judith Collins wants to bring it back – but only on the internet.

Lawyer Steven Price points out some of the hurdles you’ll have to get over to actually use the new new censorship regime and then questions the wisdom of handing over decision making around some complex technical and Bill of Rights issues to the next District Court judge off the bench.

Blogger David Farrar generally favours the proposal but questions the communications principles.

InternetNZ points out that the proposal has some worrying flaws.

Do New Zealanders want web-based email services to be subject to take-down orders? Do people understand that such orders, as outlined in the Cabinet paper, could be based on lower legal standards than is the case today – and could be imposed on people without them being part of the Court’s proceedings?

Vikram Kumar worries that the proposals will cause collateral damage to the NZ internet.

NZ Herald editorial in favour.

article, copyright

RIANZ withdraws again and copyright notices insufficient

Three brief items about the Copyright Act and the Copyright Tribunal:

1. RIANZ withdraws from another defended hearing

Another defended hearing was scheduled to go to the Copyright Tribunal this month but RIANZ has withdrawn the complaint (info from phone call to Copyright Tribunal). No further details of the case are known, so was it another fatally flawed case like the first withdrawn case or is RIANZ just not prepared to fly down to Christchurch to appear before the Tribunal?

2. Second Copyright Tribunal Decision

A second decision has been made with the Copyright Tribunal ordering a 50 year old father to pay $557 to RIANZ for sharing two songs (one twice). As in the last judgement, the evidence would appear to show that the defendant did not really understand the process nor what they had been accused of – rather it seems likely that their 8 and 12 year old sons might have done it. There is also evidence to show that they didn’t understand the first two notices they received enough to be able to take action to prevent the third enforcement notice.

3. Copyright Act working as intended – kind of

Finally we come to a case where the Copyright Act did work as intended – but only after the intervention of Tech Liberty. We received a communication from someone who had received an initial detection notice.

Just got this and as a 52 year old single mum I can’t understand what they mean about that the alleged infringed song has been communicated to the public? Is the infringement about the song being downloaded of shared publicly or both? I’m horribly confused. My teenage daughter says she can’t stand the song and I don’t even know the song. Perhaps my older 2 adult children or my boarders have done this? Any advice would be very much appreciated.

Her confusion is quite understandable when you look at the notice (identifying details removed):

Notice Number: xxxxxxxxx
Infringement Notice Date: xxxxxx
Notice Type: Detection Notice
Infringing IP Address: xxx.xxx.xxx.xxx
Infringing Date: xx/xx/xx
Name of the file: Chris Brown – Beautiful People.mp3
Unique identity of the file:
Copyright Owner: Sony Music Entertainment Incorporated
Type of Copyright Work: Sound recording (14(1)(b))
Restricted Act: Copyright has been infringed by this account holder communicating the work to the public (16(1)(f))
File Sharing Application: Azureus 4.5.0.4

What is this meant to mean to someone who doesn’t understand what file sharing is? The information included by Slingshot may have explained the law but made a very poor effort at explaining what she was accused of. We rewrote it for her:

They’re saying that someone at your house has installed a piece of software called Azureus (also called Vuze) and they’ve used that to download a song called Beautiful People by Chris Brown. The Azureus software not only downloads the song, it also uploads it to other people who want it (this is why it’s called peer to peer file sharing). Sony/RIANZ have detected this upload and have made a complaint to Slingshot who have passed it on to you.

The response came quickly:

Thank you so much for getting back to me and for taking the time and all the information, very much appreciated. :) I have found out that one of my son’s friends has done this and he says he won’t do it again. He is a good family friend so thats fine. I will get the guys to delete the Azurus or Vuse and to check for any other peer to peer programs.

Surely a good outcome for RIANZ with a junior copyright infringer stopped after the first warning.

But it seems that the current format of the notices is not good enough. Non-technical people don’t understand what they’re accused of and have no idea what they should do to stop it happening again. And, after all, it’s often the non-technical people who are the account holders while someone else sharing the same account may be the one doing the infringing.

It seems clear from these first few cases that the notices need to be improved so that they do a better job of explaining both the accusation and what they need to do to stop it happening again.

article, copyright

First Copyright Tribunal case demonstrates flaws in the law

4 Comments

The first decision from the Copyright Tribunal has now been announced and RIANZ has been successful in getting a penalty of $616.57 awarded to them. Read the text of the decision linked from this NBR article.

Facts of the Case

The respondent admits to downloading one of the tracks using uTorrent but seems confused as to how she could have received two notices for downloading it twice (she’s actually been accused of uploading it). She also acknowledges that she was in the wrong and goes on to say that she had deleted the track and removed the software from her computer.

The respondent also denies having downloaded the second track and says that she also doesn’t think anyone else in her household would have done it.

The decision

The respondent has been ordered to pay $616.57 to RIANZ (the applicant) calculated as:

  • $6.57 as the cost of buying the three tracks on iTunes.
  • $50 towards the $75 cost of the three notices.
  • $200 to reimburse the Copyright Tribunal fee.
  • $360 ($120 per track) as a deterrent.

Commentary

The respondent’s perspective

From reading the quotes from the respondent’s submission, as far as they’re concerned they got penalised $616.57 for downloading a single song. (They got two notices for that song because it was being uploaded as well, and they deny ever downloading or sharing the song mentioned in the final notice.)

Anonymity

The Copyright Tribunal does not publish the name of the respondent accused of copyright infringement. This will be a relief to the other 11 people waiting for their decisions.

Ignorance about filesharing

It seems clear from the quoted part of the respondent’s submission that they have no real idea about how file sharing via bittorrent works. RIANZ and the Tribunal both also seem somewhat blind to the reality that a default uTorrent installation will set itselt to automatically restart whenever the computer is restarted, and will thus keep sharing until stopped.

Can’t prove a negative

The Tribunal basically ignores the respondent denying that they downloaded the second track, saying that the law presumes that the notices are correct and that the respondent must show evidence that this is not true. The great difficulty involved in trying to prove that something didn’t happen is not touched on by the Tribunal.

Quality of notices

The decision includes no discussion of the quality of the notices. This is disappointing as all of the notices we have seen to date have been flawed in one or more ways.

We also note that the second notice was sent on 19th June while the third notice was sent on 30th July. This means that the infringement would have had to have occurred between the 19th of July and the 30th of July to not have occurred during the stand down period. The timing looks a bit tight but the date of the infringement is not given in the decision.

Tribunal rejects RIANZ creative maths

The Tribunal rejected RIANZ’s attempt to rewrite the law by making up numbers about how many times the tracks might been uploaded and then arguing that the respondent should have to pay that many times for each track. However, the Tribunal did allow that uploading might be taken into account when calculating the deterrent penalty.

Tribunal rejects RIANZ arguments re flagrancy

RIANZ claimed that a) installing uTorrent, b) infringing over 8 months, c) repeated infringement, indicated flagrancy and therefore a heavy penalty. The Tribunal noted that these will be common to nearly all cases appearing before the Tribunal and therefore the behaviour could not be seen to be particularly flagrant.

Tribunal ignores apology and efforts to stop file sharing

While the Tribunal notes that the respondent acknowledged wrongdoing, apologised and attempted to stop file sharing (possibly being defeated by lack of technical understanding), they do not seem to acknowledge this when setting the deterrent penalty.

Deterrent penalty

The Tribunal seems to have made up the principle that the deterrent penalty should be higher than the part of the penalty concerned with reimbursement, and therefore arbitrarily adds on another $360 ($120 per infringement). There is no acknowledgement that for many people a penalty of $256 is already a significant punishment.

Do they now have a license?

The decision does not establish whether the respondent now has a license to possess the music in question after paying the cost of buying it in iTunes as part of the penalty.

Conclusion

On the face of it this decision isn’t too bad. The respondent admits they copied some music and the guilty judgement has apeared with minimum fuss and legal expenses. There was no possibility of their internet connection being disconnected – although we suspect that the respondent will be very reluctant to have their name on an internet account in the future.

This decision sets a benchmark penalty of approximately $600 for a typical infringing file-sharing case appearing before the Tribunal. While low compared to the ludicrous sums awarded by US courts (e.g. US$12,500 per track award awarded against Tenenbaum for a total of US$675,000) it seems high compared to penalties for some other NZ offences. Accordingly we think that this amount is still too high for what is infringement on a very small scale with someone who admits guilt, apologises and tries to stop file sharing.

Flawed law

However, this case once again demonstrates two of the key weaknesses of the law:

  1. There is no way to prove your innocence. No one in New Zealand keeps the kind of detailed network logs that would be necessary to prove that you hadn’t done what you were accused of. All you can do is assert that you didn’t do it and the Tribunal has just shown that they will ignore this.
  2. The responsibility falls on the account holder, not the people using the internet to infringe copyright. In this case the respondent admitted she had downloaded the first track, apologised and had taken steps to stop it happening again. She denied downloading the third track that triggered off the penalty and suggested that someone else might have done it. Obviously we can’t know if she was telling the truth, but the reality is that most internet connections are shared and this could easily happen.

These two points are going to come up again and again. It seems certain that in many cases justice will not be done, with the account holder taking the fall for sloppy detective work on the part of RIANZ and the ISP, or the actions of other people sharing their internet account (see another case involving shared internet use).

We believe the law is unjust and needs to be dropped before too many people are punished for things that they didn’t do.

article, copyright

RIANZ withdraw one of first cases to Copyright Tribunal

33 Comments

The RIANZ has withdrawn one of the first three cases to go to the Copyright Tribunal. The withdrawal happened after all submissions had been made but before the formal hearing at the Tribunal.

Tech Liberty helped the defendant with her submission along with assistance from Susan Chalmers at InternetNZ and a very solid pro bono contribution from Kate Duckworth at Baldwins.

The case

The defendant was a student in a flatting situation and was the account holder for the flat’s shared internet account. She has never used file sharing software and we had to explain to her what it was and how it worked. It seems likely that one of her flatmates had it installed.

The flat never received the first detection notice and they didn’t really understand the second warning notice. She did show it to her flatmates and asked them to stop doing anything they were doing. They denied doing anything, so she checked to make sure that their wireless network was properly protected by a password in case they had been hacked. The third notice was a mess – addressed to the wrong person, Telecom eventually withdrew it and replaced it with another one.

Then came the notice from the Ministry of Justice that action was being taken against the account holder. The defendant was very upset and worried, and contacted her local Citizen’s Advice Bureau for help, who put her on to us.

The claims

RIANZ claimed a total of $2669.25 in penalties. This was made up as follows:

  1. $1075.50 as the cost of the music.
  2. $373.75 to repay the cost of the notices and tribunal fee.
  3. $1250 as a deterrent.

The cost of the music was calculated as being five tracks (total number of notices) multiplied by the $2.39 cost of each track on the iTunes store. The observant may notice that this works out to $11.95 rather than $1075.50. RIANZ decided, based on some self-serving research, that each track had probably been downloaded 90 times and therefore the cost should be multipled by 90. There is no basis in the Copyright Act or Tribunal regulations for this claim.

The effects

When we met the defendant she was very worried about the case and what it would mean for her. It caused her significant distress and preparing a defence interrupted both her studies and her part time job. The thought of a $2669 penalty weighed heavily on her and her plans for the future.

She immediately cancelled the flat’s internet account and her and her flatmates were from that point without an internet connection at home. Obviously this was not good for their studies, social lives or personal business (e.g. online banking).

The flatmates refused to acknowledge any responsibility or offer to pay any money towards the penalty. Relationships in the flat broke down and the defendant left the flat soon after.

The defence

The defence concentrated on three aspects:

  1. The unfairness of the account holder being penalised for someone elses alleged infringement.
  2. Technical faults with the notices (see below).
  3. Criticism of the outrageously high sum requested by RIANZ as a penalty.

You may note that there is no denial that the infringing had occurred. This was not because the defendant admitted doing it or even that one of her flatmates admitted it. It’s because there is really no way to prove that the allegations are true or false.

The notices from Telecom had a number of technical faults, of which the main ones were:

  • Telecom sent out an incorrect notice then withdrew it and sent out another. Even the corrected notice had some errors and used different infringement numbers and the whole situation was very confusing.
  • The second and third notices did not specify which first and second notices they were following on from, as required by the regulations. This made working out the timelines very difficult.
  • The corrected third and final enforcement notice was sent for an infringement that happened within the 28 day stand down period after the warning notice, which means it was not a valid enforcement notice.

The defendant did ask the Copyright Tribunal for a formal hearing which she intended to attend.

The withdrawal

The defendant sent a submission to the Copyright Tribunal along with her request for a formal hearing.

A couple of weeks later she received notice from the Tribunal that RIANZ had withdrawn their claim and the file was closed. We do not know why RIANZ chose to withdraw their claim.

The law is unjust and unfair

This case exemplifies just how unjust and unfair the law is.

If you are the account holder you will be responsible for the actions of anyone using the account. There is no way for non-technical people to monitor or control what their flatmates or other people sharing the internet connection are doing. Even IT professionals would struggle to do so with the normal tools available on a home network.

The provisions in the law allowing for an internet account to be cut off have been suspended for now. This was because it is becoming increasingly clear that an internet account is becoming critical for engaging in modern society. However, the effect of this law was still the same – the defendant panicked at these allegations and cancelled her account, cutting off her entire flat from the internet.

The law is meant to act as a deterrent to infringing copyright, but the way it is written it is actually an incentive. “Just use a connection that doesn’t have your name on the account and they’ll be be the one who is penalised!” The only deterrent is to becoming an internet account holder.

Protecting yourself

How can you protect yourself against this unfair and unjust law?

  1. Don’t be the account holder. See if you can persuade your flatmates, family member or business to be the internet account holder so that they’ll be the ones who are penalised. Of course this is just protecting yourself at the expense of someone else.
  2. Don’t use peer to peer file-sharing software to download copyrighted material without permission of the copyright holder. Tell anyone sharing your connection not to do so either.
  3. If you do receive a notice, examine it very carefully to check whether it is valid. Our article about valid infringement notices might help.
  4. If you get a second, warning, notice, cancel your account with that ISP and switch to a new one. This will reset the count.
  5. If you get summonsed to the Tribunal, spend the time to write a proper submission in your defence and ask for a formal hearing.

Ultimately, the only real protection is to get the law changed.

Feel free to contact us if you have received copyright infringement notices and would like some advice or assistance.

article

Useful links re the Law Commission’s Digital Harms report

2 Comments

A summary of articles and other information about the Law Commissions Harmful Digital Communications report (PDF) and the associated Communications (New Media) Bill (PDF).

Please send any updates or other useful links and we’ll incorporate them. Last updated: 10/9/2012.

Tech Liberty

Lawyer Steven Price

Lawyer John Edwards

Stephen Bell at Computerworld

Mike O’Donnell from Trademe at Stuff

David Farrar at Kiwiblog

Chris Barton at NZ Herald

Media 3

Richard Boock at Stuff

Netsafe

InternetNZ

Police Minister Judith Collins