"The law should be predictable as to what is mandated and what is forbidden"

One of the strongest arguments against the proposed copyright statutory instrument is that it is so vague as to make it impossible to predict what it might require of internet intermediaries. The proposal is entirely silent in relation to the most basic issues where one might expect clarity. What type of injunction might be granted? Site blocking? Three strikes? Deep packet inspection? Hash value blocking? What types of intermediaries might be affected - ISPs, search engines, hosting providers, cloud computing providers? Who will have to pay the legal costs of applications for injunctions? Who will have to pay the ongoing cost of implementing any injunction?

Crucially, this vagueness is highlighted by comments of Charleton J., the very High Court judge whose ruling in EMI v. UPC has been relied upon by Sean Sherlock as justification for this statutory instrument. However, when examined closely neither his judgment in that case nor his later extrajudicial pronouncements support this claim. In particular, in a recent speech to the Fordham Intellectual Property Conference, he said:

Legislation such as the [UK Digital Economy] Act of 2010, has at least the predictability of express statement as to the objects to be achieved. In respect of each of the possible solutions of diversion, interruption, warning and cut-off, the British have OfCom looking at the appropriate technical machinery with which to achieve these ends. When this machinery is approved, then, in those circumstances, any court faced with these difficult cases will be in a position to fairly, if not precisely, predict what they can use as a technical solution with a view to granting or refusing to grant injunctions.

This strongly accords with the European law principle that the law should be predictable as to what is mandated and what is forbidden and enables a judge to also know what is expected in the judicial sphere in particular circumstances. As I said in another part of the judgment in EMI v. UPC, if any judge were merely to act on the basis of what the Court felt was right, without having a legislative basis, the Court would be putting itself back in the position of judges in the late 19th and 20th century who used the tort of conspiracy and the remedy of an injunction against the trade union movement and thereby caused public controversy, rendered uncertain the concept of the rule of law and undermined their own authority.

It may also be well for the judicial mind to observe that the separation of powers is a definite guiding principle against doing what might seem desirable, but which is not provided for in legislation.

"The law should be predictable as to what is mandated and what is forbidden and enables a judge to also know what is expected in the judicial sphere in particular circumstances". Can the DJEI honestly claim that their proposed statutory instrument meets these criteria?

Copyright proposals block innovation and free expression

I have an opinion piece in today's Irish Times arguing against current government proposals which would allow internet blocking and more. Here's an excerpt:

As currently drafted, the statutory instrument provides that the High Court may grant an injunction against an internet intermediary who is entirely innocent of any wrongdoing – but does not specify even the most basic details regarding how this power might be exercised.

What type of injunction might be granted? On what criteria? Against what types of intermediary – internet service providers, discussion forums, search engines, social networking sites, video hosting sites? Who will bear the costs of these injunctions? Who will be responsible if, as often happens, an unrelated website is wrongfully blocked?

This lack of detail makes it impossible to predict how this law might be applied, and means that clarification will come only after repeated and expensive trips to the High Court.

The Internet Service Providers Association of Ireland (whose members include Google) has opposed the legislation, noting the proposal creates “business uncertainty for those running or considering establishing internet services from Ireland” in a way which may have “drastic consequences” for them: in short, it will act as a deterrent to the next generation of Irish internet businesses which may relocate to warmer legal climes. Significantly, the Department of Enterprise has not produced a Regulatory Impact Assessment of the measure.

Full text

More on the music industry case against Ireland

Today's Irish Times confirms that the litigation is intended to put pressure on the government in drafting a statutory instrument to allow blocking. Excerpt:

THE IRISH arm of multinational music group EMI has launched a High Court action against the State as part of its bid to stop the illegal downloading of music...

The Government recently pledged to issue an order to allow copyright holders to compel internet service providers (ISPs) to block access to websites that they consider are engaged in piracy. However, EMI Records (Ireland) remains unhappy with what it perceives to be foot-dragging on the part of the Government in tackling this issue. It is concerned that the matter could be delayed again, and that even if a statutory instrument is issued, its contents may not be satisfactory. Chief executive Willie Kavanagh is adamant that the instrument should give companies such as his the right to seek court injunctions against ISPs that allow access to music piracy websites. Mr Kavanagh said yesterday that EMI asked the Government to show them the forthcoming instrument, but it has not yet received it, “leading me to believe it’s unlikely to satisfy the music industry’s requirement for injunctive relief”.

Incidentally, the coverage is misleading in an important aspect - this is a concerted action brought by all the major music companies (including Sony, Universal, Warner and WEA) not merely EMI. It's also disappointing to see a story uncritically repeat the claims of one side to litigation without offering either a response from the other side or an independent perspective.

Previously

Music Industry v. Ireland

The long suffering Irish taxpayer will be delighted to learn that the music industry has joined the queue of those seeking a payout and yesterday issued a summons against the State in the High Court for alleged failure to implement aspects of EU copyright law.

The background to this case lies in the October 2010 judgment of Charleton J. in EMI v. UPC where he held that Irish law did not permit an order to be made against an ISP requiring blocking of websites and went on to say that: "In failing to provide legislative provisions for blocking, diverting and interrupting internet [filesharing] Ireland is not yet fully in compliance with its obligations under European law." Immediately after that decision there was some sabre-rattling from the music industry which threatened to sue the State for damages caused by filesharing, on the theory that if blocking laws were in place then filesharing would go away. (Ignoring research such as that from Ofcom which has found that site blocking is easily evaded.)

Since then, however, the music industry appears to have fallen silent on this threat, presumably on the basis that it would get what it wanted through a statutory instrument which would permit blocking. This statutory instrument isn't yet in place but has been promised by mid January 2012, making the timing of this case all the more interesting - on the face of it, the music industry seems to have jumped the gun by bringing an action before that legislation is in place. Curiously, the normally vocal IRMA have nothing on their website and no press release seems to have been put out - perhaps this was intended as a shot across the bow of the State in case the statutory instrument doesn't meet music industry demands? Or perhaps the music industry feels the need to ramp up the pressure in light of the Data Protection Commissioner's ruling against Eircom's three strikes system?

As to the legal basis for the action, the music industry will presumably be relying on the well-known principle in Francovich v. Italy under which damages are possible against a state for failure to transpose a directive if three conditions are met:

first, that the result prescribed by the directive should entail the grant of rights to individuals; secondly, that it should be possible to identify the content of those rights on the basis of the provisions of the directive; and thirdly, that there should be a causal link between the breach of the State's obligation and the loss and damage suffered by the injured parties.

While I'm not aware of any other action of this sort being brought against a country for failure to implement copyright law, the third element would seem to be problematic for the music industry - establishing a causal link between Irish law and filesharing will be difficult, particularly given the evidence from elsewhere that blocking is ineffective.

Data Protection Commissioner investigating Eircom's "three strikes" system

Between the bank holiday weekend and the Sunday Times paywall Mark Tighe's story last week revealing that the Data Protection Commissioner is investigating the Eircom / IRMA three strikes system didn't receive the attention it deserved. However the investigation has the potential to entirely derail the system and needs to be considered further.

First, the background. I'm disappointed but not surprised to find that my 2009 prediction - that Eircom would end up falsely accusing innocent users - has come to pass in relation to 300 users:

THE "three strikes" scheme to prevent music piracy, which is operated by Eircom at the behest of record companies, is being investigated by the data protection commissioner (DPC) after customers said they were sent warning letters in error. The investigation began after an Eircom customer complained that he had wrongly received a "first strike" letter. The company has admitted it incorrectly issued such warnings to a "limited number" of customers.

So why did Eircom falsely accuse users?

This was due to a software failure caused when the clocks went back last October, it said.

Far from being a technical sounding "software failure", this appears to show up ineptitude in relation to a very basic aspect of network management - i.e. making sure that the server clock reflects daylight savings time. As a result, it seems that users found themselves being accused on the basis of what somebody else did from the same IP address either an hour earlier or an hour later. Consequently, the users who were wrongfully accused should consider themselves lucky that this incompetence did not lead to their being accused of a serious crime - for example, being arrested and having their homes searched due to the wrong time being used (as happened to these Indian users).

The significance of this case goes beyond simple technical failings, however, as the complaint to the Data Protection Commissioner has triggered a wider investigation of the legality of the entire three strikes system:

The DPC said it was investigating the complaint "including whether the subject matter gives rise to any questions as to the proportionality of the graduated response system operated by Eircom and the music industry".

This is unsurprising - when the Eircom / IRMA three strikes settlement was being agreed the Data Protection Commissioner identified significant data protection problems with it. These problems remain, notwithstanding the deeply flawed High Court judgment which approved of the system - a judgment which, for example, decided on the question of whether or not IP addresses are personal data without once considering the views of the Article 29 Working Party. It is not surprising that the Data Protection Commissioner was not convinced by that judgment (the judgment was problematic at least in part because the Commissioner was not represented - the only parties before the court had a vested interest in the system being implemented). However, until a concrete complaint arose no further action could be taken.

The complaint in this case has now triggered that action, and it seems likely that the Commissioner will reach a decision reflecting his previous views that using IP addresses to cut off customers' internet connections is disproportionate and does not constitute "fair use" of personal information. If so, the Commissioner has the power and indeed the duty to issue an enforcement notice which would prevent Eircom from using personal data for this purpose - which would ultimately seem likely to put the matter back before the courts. Watch this space.

The Pirate Bay block takes effect

Today, September 1st, is the day that the Eircom is scheduled to start blocking The Pirate Bay. It will be interesting to see how it is implemented and whether there are any technical side effects (along the lines of the recent IWF / Wikipedia fiasco). If you're an Eircom customer, perhaps you might post a comment as to whether you can still access thepiratebay.org or the other URLs / IP addresses which are being blocked or whether you've noticed any other effects of the blocking.

Eircom, three strikes and false positives

I've said before now that the three strikes system which Eircom has agreed to use is likely to result in innocent people being wrongly accused.

Some of these cases will be due to Eircom's own incompetence in issuing up to 250,000 wireless routers with easily guessable passwords - which will result in some people piggybacking on Eircom users' connnections. But there is a wider problem, in that the investigators used by the music industry have a track record of making false copyright infringement claims.

A particularly interesting study from the University of Washington (Zeropaid story | Full details and paper) shows the risks.

In that study, the researchers document receiving 487 notices under the DMCA: all wrongfully alleging that files were being illegally shared over BitTorrent. Among the alleged culprits were three laserjet printers which between them were accused on nine separate occasions of downloading movies. (Bad printers! No toner for you tonight.)

The research conclusions?

Practically any Internet user can be framed for copyright infringement today.
By profiling copyright enforcement in the popular BitTorrent file sharing system, we were able to generate hundreds of real DMCA takedown notices for computers at the University of Washington that never downloaded nor shared any content whatsoever.

Further, we were able to remotely generate complaints for nonsense devices including several printers and a (non-NAT) wireless access point. Our results demonstrate several simple techniques that a malicious user could use to frame arbitrary network endpoints.

Even without being explicitly framed, innocent users may still receive complaints.
Because of the inconclusive techniques used to identify infringing BitTorrent users, users may receive DMCA complaints even if they have not been explicitly framed by a malicious user and even if they have never used P2P software!

In light of these findings, I wonder how reliable the evidence presented by the music industry to Eircom will be, and whether the flaws identified in this study will be addressed. So far, all we have to go on are leaked details of a draft protocol between Eircom and the music industry on the information to be provided with each accusation.

Those details are, however, too vague at this stage to be useful.

For example, the draft apparently provides that "the information which will be provided by the record companies will be of the same type as that used in the three previous disclosure actions in the Irish High Court". What precisely does this mean? Similarly, the protocol appears to require the music industry to provide "the digital fingerprint/hash for copyright material detected". Does this mean that before a complaint can be made, the investigators must download the entire file allegedly shared by the user? There is also apparently provision for "reputable annual independent certification that the necessary ... I.T. ... controls relating to the obtaining, generating and processing of data by Detecnet ... have been complied with". Will this require certification that the types of problems identified by the University of Washington and others have been solved? In fairness to Eircom, it does appear that it has made some efforts to include elements in the agreement which might meet some of these problems. But without more detail on the agreement it's impossible to be confident that innocent users (or printers!) will not be wrongly accused.

Eircom to block the Pirate Bay from September; UPC not so keen

In the latest twist in the Irish filesharing wars, it's emerged today that Eircom will start blocking access to The Pirate Bay from the first of September, while UPC has rejected music industry demands that it do so also. (The Irish Times | RTE). So what's going on?

First - the Eircom situation. When Eircom settled the case brought against it by the music industry it agreed - in addition to implementing a three strikes system against its users - not to oppose any application to the court to block access to The Pirate Bay. The predictable result was that an unopposed application would be granted without any real judicial scrutiny - and this has now happened. On the 24th of July, on the consent of Eircom, Mr. Justice Charleton in the High Court granted an order requiring it to:

block or otherwise disable access by its subscribers to the website thePirateBay.org and related domain names, IP addresses and URLs ... together with such other domain names, IP addresses and URLs as may reasonably be notified as related domain names by [the music company plaintiffs] to [eircom] from time to time.

That order requires Eircom to put such a block in place from the start of September (and, remarkably, to block additional sites designated by the plaintiffs as "related" - something presumably designed to avoid evasion but which may be prone to abuse). Crucially, however, Mr. Justice Charleton stressed that he had only heard one side, and that consequently any decision he made was on the basis of one side putting forward an unopposed application - expressly noting that had the matter being argued, a different conclusion might have been reached by a different court. In short, the order has no precedential value.

Despite this, however, the music industry appears to have been emboldened by the order, which takes us on to the UPC situation. It seems that the plaintiffs then wrote to UPC demanding that it also block The Pirate Bay, lest customers "migrate" from Eircom, and threatening immediate proceedings unless it blocked access also. UPC - which is already being sued by the music industry in separate proceedings essentially demanding it implement "three strikes" - has rejected this demand, and indicated that it will vigorously defend any additional action also.

The current state of play raises some interesting questions. For example: Will users begin to migrate from Eircom? Is it appropriate for a court - even on consent - to make an order which will have the effect of blocking user access to a great deal of legitimate content? (While the percentage of legal torrents on The Pirate Bay might be contested, there's no doubt but that it indexes a great deal of legitimate content.) Should such an order allow plaintiffs to (apparently unilaterally) determine which sites are "related" and require those to be blocked also? Why have Eircom been so shy about revealing the existence of the blocking? Expect these, and other issues to come to the fore over the next few days.

Adrian Weckler has more, including the UPC press release.

Eircom briefing note on "three strikes" filesharing settlement leaked

I've just stumbled on a document on scribd which purports to be a "Briefing Note on arrangement between Eircom and the Irish Recorded Music Association (IRMA) with regard to Copyright Infringement" dating from March. While there's no indication as to who posted the document or whether it is authentic, it certainly appears to be genuine and to reflect Eircom's position. There are some very interesting details in the document as to how Eircom proposes to implement "three strikes" and here's an excerpt:

Under the draft protocol, the notification shall include the following information (at a minimum):
* details of copyright holder (name and address);
* why the notification is being sent (i.e. setting out the breach of copyright);
* the actual copyright work that has been infringed (information on copyright material, for example artist, song, title and album title);
* the IP address;
* the time stamp of when the investigation was initiated;
* the time stamp of when the investigation was completed, the peer to peer application/software used by the customer;
* and, the digital fingerprint/hash for copyright material detected;

The last item, the digital fingerprint/hash of the copyright material detected, allows eircom to verify that the copyright work identified by the record companies is in fact owned by them.

In addition, the information which will be provided by the record companies will be of the same type as that used in the three previous disclosure actions in the Irish High Court involving the parties and eircom will not act upon a notification from the record companies that does not contain the information set out above.

eircom has also requested that the record companies provide independent certification that the notification has been lawfully obtained by and on behalf of the record companies.

The record companies are also to provide reputable annual independent certification that the necessary legal, I.T., entity level and regulatory controls relating to the obtaining, generating and processing of data by Detecnet (or any other supplier engaged by the record companies) have been complied with.

Full text.

Update (19.08.09): Torrentfreak and SiliconRepublic have since run stories about this document.

The Music Industry v. ISPs - Round 2 - UPC and BT vow to fight

Adrian Weckler has the press releases:

UPC

The company is now preparing its defence and intends to vigorously defend its position in Court...

UPC has made its position clear from the outset -- it will not agree to a request that goes beyond what is currently provided under existing legislation. There is no basis under Irish law requiring ISPs to control, access or block the internet content its users download. In addition, the rights holders' proposal gives rise to serious concerns for data privacy and consumer contract law.

Irish and European law maintains a careful balance between the rights and obligations of copyright owners, internet users and ISPs. The three strikes policy that was agreed in private with eircom as part of the settlement, and any attempt to impose in upon the industry generally, seriously undermines that balance.

It is unfortunate that the rightsholders did not take up UPC's suggestion that it convene a stakeholder forum in which their concerns could be addressed. UPC indicated that it would be willing to participate in such a forum provided all relevant parties that have a vested interest in this matter were included (eg ISPs, the Data Protection Commission, the National Consumer Agency and relevant Departments of the Government). (Emphasis added)

BT are more laconic:

BT Ireland believes there is no legal basis for such a claim and the proceedings will accordingly be strongly defended.

The Music Industry v. ISPs - Round 2

After their inconclusive action against Eircom, this time the music industry is suing UPC and BT. Proceedings were issued on Tuesday according to the (stupidly not hot-linkable) search facility on courts.ie. Expect the cat to be put among the pigeons shortly.

I believe that litigation demanding that ISPs monitor what their users do and/or disconnect users based on three unproven allegations is unjustified - for the reasons why, see the Digital Rights Ireland site in relation to user monitoring and three strikes.