"Ireland's SOPA" will be vague and open-ended

[23.01.12 Hello Redditors! Here's a FAQ with more information.]

Adrian Weckler has a worrying piece on government proposals for blocking legislation in today's Sunday Business Post (paywalled). I've taken the liberty of extracting some of the highlights:

Is Ireland about to introduce a law that will allow music companies to order Internet service providers to block access to websites? I rang up the Minister of State at the department of Enterprise, Jobs and Innovation, Sean Sherlock, to find out. "The statutory instrument to be introduced is completely different to Sopa [Stop Online Piracy Act] in America" he told me. "We are simply addressing the High Court judgment handed down by Mr Justice Peter Charleton in relation to copyright law... I will introduce this imminently, by the end of January." That's a yes, then ...

The Irish governments new “statutory instrument” threatens to do some of the same things as Sopa, mainly introducing the power to force ISPs to block websites suspected of having copyrighted material on them.

While that means curtains for the Pirate Bay (which few people here will miss), it also leaves open the possibility for a judge to order ISPs to block YouTube, Facebook and Twitter.

Why? Because, with their billions of users, YouTube, Facebook and Twitter inherently find some copyright protected material leaked onto their web services. The new law will give music and movie firms the legal footing to get ISPs blocking. That may not go down too well with Google and Facebook, which are two of Dublin's biggest employers. It probably won't sit easily, either, with the IDA, which may have to alter its pitch to large US social media firms who may have been thinking of setting up in Ireland. (That includes Twitter.)

Given the seismic nature of the proposed change to Irish internet access, surely more detailed primary legislation would be in order here? For example, could there be a limit to enforcement of the injunctions? What defences might be available? Could there be exceptions?  "We will probably need a test case to come before the courts before primary legislation such as that could be considered," said Sherlock. In other words: don't look at us, guv. We may be the government, but this kind of law-making is really a matter for judges. We don't really do that kind of thing ...

Politically, this is a no-win scenario. Even with the government about to open the legal doors for the music and movie companies to start directing ISPs' access policies, the content creation industry is frothing and fuming. Ironically, by taking a leave-it-to-m'lud approach, the government is also now attracting the anger of an increasing tranche of the technology and digital community. It is unusual to alienate both sides of a legislative argument ...

So this really is turning out to be a lose-lose episode for the government. Yet the issue wields vast significance for both sides of the debate (the music industry and the digital technology industry). It could also have profound, long-lasting consequences for Irish industry.

The clear implication from that interview with Sean Sherlock is that the proposed measures will be lacking in any real detail, leaving it entirely up to the judges as to what types of blocking might emerge. (Possibly going beyond web blocking to also target hosting and other services.)

This ambiguity - as well as jeopardising fundamental rights - will create intolerable uncertainty for businesses such as Google who might find themselves at risk of business threatening and unpredictable injunctions and will certainly deter others from setting up in Ireland.

Instead, any action should only take place by primary legislation which the Oireachtas would have a chance to scrutinise and debate. As I said previously in a letter on behalf of Digital Rights Ireland:

It is significant that Charleton J. in EMI v. UPC [2010] IEHC 377 referred to any legislative intervention being properly a matter for the Oireachtas. The Opinion of the Advocate General in Scarlet (Extended) v. SABAM (Case C-70/10) similarly referred to a need for legislation in this area to be "democratically legitimised" (at para. 113).

It would be undesirable in any event for a matter dealing with fundamental rights to be disposed of by way of secondary legislation. It is all the more undesirable in this case, however, given the vague and open-ended nature of the powers involved. This is, in effect, a case of delegation heaped on delegation - rather than rules governing blocking and other remedies being made by primary legislation, or even secondary legislation, they are instead effectively being made by delegation to the judiciary.

Although it's the 11th hour, it's not too late for the Irish government to see sense and abandon this proposal. If you agree then you should let Sean Sherlock and your TDs what you think of it.

The (legal) case against an Irish SOPA

The publicity and success of the anti-SOPA campaign in the US has put internet blocking on the agenda worldwide and Paul Quigley's excellent column in the Journal explains how Ireland is moving towards similar types of blocking - only by the stroke of a Ministerial pen and without any legislation by the Oireachtas. There are any number of reasons to oppose this Irish version of SOPA, and I'll blog about some of them later, but for the moment I want to highlight just one: that it is likely that such a law would be ultra vires the Minister and in breach of the European Convention on Human Rights.

I've previously made this case in a letter on behalf of Digital Rights Ireland in relation to the Department's draft statutory instrument:


In addition, the Irish telecoms group ALTO made similar points in their submission which we supported:
It's now six months since we made those submissions. In the meantime the European Court of Justice handed down its landmark judgment in Sabam v. Scarlet where it held that:

the protection of the fundamental right to property, which includes the rights linked to intellectual property, must be balanced against the protection of other fundamental rights...in the context of measures adopted to protect copyright holders, national authorities and courts must strike a fair balance between the protection of copyright and the protection of the fundamental rights of individuals who are affected by such measures.

Specifically, it held that filtering systems were prone to infringe the right to freedom of expression and held against one such system on the basis that it:

could potentially undermine freedom of information since that system might not distinguish adequately between unlawful content and lawful content, with the result that its introduction could lead to the blocking of lawful communications. Indeed, it is not contested that the reply to the question whether a transmission is lawful also depends on the application of statutory exceptions to copyright which vary from one Member State to another. Moreover, in some Member States certain works fall within the public domain or can be posted online free of charge by the authors concerned.

In light of this judgment the case against blocking is all the stronger, making the Department's proposed law all the shakier. The music industry appears to realise this, which may account for its crude attempt to force the Department's hand by demanding that the taxpayer compensate it for its (supposedly) lost sales. Nevertheless, it's not too late for the Irish government to see sense and abandon this proposal and if you agree then you should let your TDs know what you think of it.

More on the music industry case against Ireland

Today's Irish Times confirms that the litigation is intended to put pressure on the government in drafting a statutory instrument to allow blocking. Excerpt:

THE IRISH arm of multinational music group EMI has launched a High Court action against the State as part of its bid to stop the illegal downloading of music...

The Government recently pledged to issue an order to allow copyright holders to compel internet service providers (ISPs) to block access to websites that they consider are engaged in piracy. However, EMI Records (Ireland) remains unhappy with what it perceives to be foot-dragging on the part of the Government in tackling this issue. It is concerned that the matter could be delayed again, and that even if a statutory instrument is issued, its contents may not be satisfactory. Chief executive Willie Kavanagh is adamant that the instrument should give companies such as his the right to seek court injunctions against ISPs that allow access to music piracy websites. Mr Kavanagh said yesterday that EMI asked the Government to show them the forthcoming instrument, but it has not yet received it, “leading me to believe it’s unlikely to satisfy the music industry’s requirement for injunctive relief”.

Incidentally, the coverage is misleading in an important aspect - this is a concerted action brought by all the major music companies (including Sony, Universal, Warner and WEA) not merely EMI. It's also disappointing to see a story uncritically repeat the claims of one side to litigation without offering either a response from the other side or an independent perspective.

Previously

Music Industry v. Ireland

The long suffering Irish taxpayer will be delighted to learn that the music industry has joined the queue of those seeking a payout and yesterday issued a summons against the State in the High Court for alleged failure to implement aspects of EU copyright law.

The background to this case lies in the October 2010 judgment of Charleton J. in EMI v. UPC where he held that Irish law did not permit an order to be made against an ISP requiring blocking of websites and went on to say that: "In failing to provide legislative provisions for blocking, diverting and interrupting internet [filesharing] Ireland is not yet fully in compliance with its obligations under European law." Immediately after that decision there was some sabre-rattling from the music industry which threatened to sue the State for damages caused by filesharing, on the theory that if blocking laws were in place then filesharing would go away. (Ignoring research such as that from Ofcom which has found that site blocking is easily evaded.)

Since then, however, the music industry appears to have fallen silent on this threat, presumably on the basis that it would get what it wanted through a statutory instrument which would permit blocking. This statutory instrument isn't yet in place but has been promised by mid January 2012, making the timing of this case all the more interesting - on the face of it, the music industry seems to have jumped the gun by bringing an action before that legislation is in place. Curiously, the normally vocal IRMA have nothing on their website and no press release seems to have been put out - perhaps this was intended as a shot across the bow of the State in case the statutory instrument doesn't meet music industry demands? Or perhaps the music industry feels the need to ramp up the pressure in light of the Data Protection Commissioner's ruling against Eircom's three strikes system?

As to the legal basis for the action, the music industry will presumably be relying on the well-known principle in Francovich v. Italy under which damages are possible against a state for failure to transpose a directive if three conditions are met:

first, that the result prescribed by the directive should entail the grant of rights to individuals; secondly, that it should be possible to identify the content of those rights on the basis of the provisions of the directive; and thirdly, that there should be a causal link between the breach of the State's obligation and the loss and damage suffered by the injured parties.

While I'm not aware of any other action of this sort being brought against a country for failure to implement copyright law, the third element would seem to be problematic for the music industry - establishing a causal link between Irish law and filesharing will be difficult, particularly given the evidence from elsewhere that blocking is ineffective.

Christmas and New Year privacy roundup

Blogging has been light in the run up to Christmas and the New Year but there have been a few recent developments which deserve to be noted. 

Eircom's three strikes system - down but not out?

The week before Christmas brought the significant news that the Data Protection Commissioner had found Eircom's three strikes system to be in breach of data protection law and had ordered Eircom to discontinue the system within 21 days (TheJournal | SiliconRepublic). Without sight of the ruling it's hard to comment, but I wrote about the background to the investigation previously and the statement from the DPC at that stage suggests that the system was viewed as being a disproportionate use of personal data, particularly in light of its impact on the right to access the internet.

Eircom has not accepted the DPC's decision and (according to Mark Tighe in yesterday's paywalled Sunday Times) has now appealed to the Circuit Court. It's hard to see what the troubled Eircom stands to gain from this - though it may be that failure to appeal would jeopardise their deal with the music industry to offer streaming and downloads. In any event, the appeal offers some breathing space - going by past experience, this appeal should take approximately 6 months or so to resolve, enabling Eircom to continue to operate three strikes until then. Incidentally, Mark Tighe also confirms that no Eircom customers have yet been disconnected for four "offences", though a number have had their accounts suspended for seven days.

Ireland's first prosecution for data disclosure

The same week also brought news of what seems to be the first successful prosecution in Ireland for deliberate disclosure of personal information (Irish Times | Independent | Examiner). This case centred on a corrrupt Revenue worker who disclosed information on six separate individuals to her own father (as a "favour to a business associate of his") and to her father in law - a retired garda who was working as a private investigator for Quinn Insurance.

Significantly, this came to light only due to initial fears that the victims were being targeted for criminal attacks - accounting for the garda involvement which led to this prosecution being brought. As I've already blogged, despite the existence of a "culture of snooping" within the Revenue previous cases have not been referred to police. This case isn't exceptional in involving snooping - it is exceptional only in seeing criminal consequences. Had this case not involved particularly sensitive targets (an executive of Brinks Allied security company and a former Revenue official now working against cigarette smuggling in Europe) then it is likely that no prosecution would have been brought.

All three defendants pleaded guilty to data protection offences. Unfortunately, the media coverage doesn't indicate the precise offences involved but it seems likely that each was charged with the offence of disclosing personal information obtained without authority, contrary to section 22 of the Data Protection Act 1988. This presents an interesting issue in the case of the Revenue worker, as the section 22 offence doesn't apply to "a person who is an employee or agent of the data controller or data processor concerned". Consequently, it is hard to see how this charge could have been brought against her unless as a civil servant she was regarded as not being an "employee" for the purposes of that section. [Update - I'm now informed that the charge against the Revenue worker was brought under section 21, which specifically targets employees also. However section 21 is limited to data processors rather than data controllers, which presents a further issue as to whether Revenue should properly be treated as a mere data processor.]

The case also reveals a lack of awareness amongst the Irish judiciary of the importance of data protection. In a worrying comment, the judge stated that "the breaches in this case were not unduly sinister and that they were possibly done without an appreciation of the seriousness of the actions". Remarkably, each offender was given the benefit of the Probation Act and allowed to escape conviction on condition that they donate €1,000 to charity. This can only be viewed as derisory in the context of a serious and repeated breach of trust (on the part of the Revenue worker) and a deliberate attempt to profit from wrongdoing (the private investigator) and if anything highlights the urgent need to introduce custodial sentences and not merely fines for this type of offence. As UK MPs recently noted, these trivial fines mean that "there is no deterrent because the financial gain resulting from the crime far exceeds the possible penalty".

(Yet another) Irish company spying on employees

Unfair dismissal actions have a way of exposing employers with a cavalier attitude to data protection. In November it was Dunnes Stores making secret use of CCTV. December revealed that Galen - a Northern Ireland pharmaceutical company - had covertly fitted GPS trackers to the cars of employees. According to the Employment Appeals Tribunal Galen had "breached the trust of its employees" by doing so, though it didn't address the question of whether this evidence was inadmissible as a result. Incidentally, I see from their website that Galen's motto is "Doing the right thing with the right priorities".

Revenue officials accessing your private data - yet again

Now that the Sunday Times is behind a paywall it's all too easy for important stories to get less attention than they merit. Here's one from Mark Tighe, originally published on 2 October 2011, which deserves to be highlighted. The focus of the story is on fraudulent claims and other financial abuses, but there's also evidence of continued snooping by Revenue staff on the private finances of others. Excerpt:

THREE Revenue officials have resigned and another two have been dismissed after being caught committing fraud using the tax office's computer system. The cases are among 24 in which tax officials have been disciplined for abuse of access to internal records since 2009.

Disciplinary files show three tax officials extracted €57,514 in fraudulent rebates from the Revenue before being uncovered by internal investigators. They also show Revenue had to apologise to a man after his ex-wife, a former official, organised for another staff member to change his tax status leaving him with no pay on two occasions.

In one case, a female clerical officer who organised fraudulent tax refunds totalling €32,500 for herself, her family and friends, resigned in July last year before Revenue could terminate her employment...

Another female clerical officer had her pay reduced by two increments after she removed an allowance from a man on the word of his ex-wife, a former colleague of hers in Revenue.

The man wrote a letter of complaint to Revenue saying the removal of a certain child allowance had led to him receiving two consecutive pay cheques with zero net pay. The man, who has joint custody of his children with his ex-wife, said the incident was "humiliating, embarrassing and deeply puzzling". He was forced to approach the St Vincent De Paul Society and his community welfare officer for assistance.

Revenue managers said the incident had serious implications for its reputation. They issued the complainant an "unreserved apology". Investigators found the Revenue staff member had transferred the man's allowance to his ex-wife after she said she needed the money for a holiday.

The official, who was a "close confidante" of the woman, was also found to have made alterations to her own and her family's tax profiles. A CPSU official said "everyone does it" when the alteration of her tax records was being discussed in the woman's disciplinary interview. The official complained about being "singled out", saying others did what she did.

In another case a male clerical officer had his pay reduced by four points for three years after he arranged for his exwife's tax record to be labelled "crank/prank" when she tried to register for a single person's tax credits. The woman in question said her former husband told her about the salary details of men she dated after they separated. The man admitted altering his wife's file through a colleague, and accessing other files and giving the information to his ex-wife. He said he had believed his wife was having an affair, and looked up the men's details for his own "sanity".

 This story follows a similar piece in the Irish Independent earlier this year, which revealed that:

A female official... snooped on politicians and a former Revenue chairman. The same woman improperly faxed information to a financial institution about customers who were setting up SSIAs...

Most staff caught snooping on taxpayers' details are dealt with internally and are given a one or two-year pay cut for their indiscretions, as well as being barred from promotion for the same period...

One file quotes a union official as saying there was a "culture" of snooping within the department.. And even the chairman of the Revenue Commissioners is not immune, with one low-ranking civil servant found to be snooping on former Revenue chairman Frank Daly's records in 2006 and 2007.

Notable from that Irish Independent piece is the fact that none of the snooping cases were referred to Gardaí. This reflects a significant legislative gap, which has been partially filled since s.77 of the Finance Act 2011 introduced a new offence of improper disclosure of taxpayer information. Hopefully this new offence will act as a genuine deterrent to further snooping.

Previously on this blog:

• Revenue set up VIP unit (but don't the little people deserve privacy too?)
• Finance Bill 2011 - impact on Irish data protection and computer crime law 
• Dolores McNamara update: Social Welfare and Revenue snoops receive slap on wrist

Will the ECJ stymie attempts to identify internet users?

This time last year I blogged about Bonnier Audio v. Perfect Communication, the Swedish case which questioned whether data retained under the Data Retention Directive could be used in litigation to identify users accused of infringing copyright. In that case five audiobook companies brought an action against Perfect Communication, an ISP, seeking the details of a user who was said to be sharing many popular audiobooks. The ISP, however, resisted the application and argued (in essence) that data retained under the Data Retention Directive could only be used for the purposes of that Directive and not for unrelated purposes such as civil litigation. In a preliminary reference, the Swedish court asked the ECJ the following questions:

* Whether the Data Retention Directive prevents the application of a national rule based on the EU IP Rights Enforcement Directive (2004/48/EC), which provides that an ISP in a civil case can be ordered to provide a copyright owner or a rights holder with information on which subscriber holds a specific IP address assigned by the ISP, from which address the infringement is alleged to have taken place.

* Whether the answer to the first question is affected by the fact that the state has not yet implemented the Data Retention Directive, although the deadline for implementation has passed.

As I said at the time, this has the potential to be a very important case - one in which a ruling against the copyright plaintiffs might well force a revision of the entire approach which Irish and English law takes to identifying internet users. I am surprised therefore that there hasn't yet been much reaction to the Advocate General's opinion, issued last Thursday, which comes down largely on the side of the ISP.

While there's no official English translation yet, the key part of the decision appears to be in paragraphs 60-62 which build on Promusicae to hold that (irrespective of the Data Retention Directive) the disclosure of information about internet users in civil proceedings is only permissible in accordance with the provisions of Article 15 of the e-Privacy Directive - that is, only where there are "legislative measures" in place which are "necessary, appropriate and proportionate... within a democratic society". Pending the official translation, the following is an auto-translated version, tidied up slightly by myself:

60. EU law requires that before the disclosure of personal data is possible, a retention obligation must be provided for by national legislation which sets out the categories of data to be kept, the purpose for which it may be kept, the retention period and those who can access the data. It would contradict the rules governing personal data protection principles to draw on data sets that have been collected for purposes other than those set by the legislature.

61. Therefore, for the preservation and transmission of personal data to be consistent with Article 15 of Directive 2002/58, in a situation such as that described in the main proceedings, national legislation should include, at advance and in detail, the limitations on the scope of rights and obligations under Articles 5, 6, 8, paragraphs 1 to 4, and 9 of the Directive (20). A limitation so established must be a necessary, appropriate and proportionate. However, a disclosure obligation, imposed on Internet service provider and relating to personal data kept for another purpose, is not sufficient to meet these requirements.

62. In conclusion, it should be noted that the human rights protection of personal data and privacy on the one hand, as well as protection of intellectual property on the other, shall enjoy equal protection. There is no reason to favor the owners of intellectual property rights by allowing them to use personal data that have been lawfully obtained or retained for purposes unrelated to the protection of their rights. The collection and use such data for such purposes in compliance with EU law on the protection of personal data would require the prior adoption by the national legislature, of detailed provisions, in accordance with Article 15 of Directive 2002/58. (Emphasis added.)

The Advocate General's approach, if followed by the ECJ, will undoubtedly be extremely significant on a number of fronts. From my perspective, the most significant aspect would be the requirement that identification of users requires "legislative measures". Under the existing Norwich Pharmacal jurisdiction as applied to the internet in Ireland (EMI v. Eircom) and England and Wales (Totalise v. Motley Fool) there are no such legislative measures - instead the courts are relying on an inherent equitable jurisdiction which has been developed through caselaw. This would be thrown into disarray by the Bonnier Audio reasoning. Some litigants might not be too badly affected - for example, many intellectual property litigants could fall back on their rights under the various implementations of the IPR Enforcement Directive (e.g. SI 360/2006 in Ireland) - but this result would be fatal to other cases such as online defamation claims. (One example being the current litigation against RateYourSolicitor.)

I'll be watching with interest to see whether the ECJ follows the AG's opinion - if it does, expect the cat to be put among the pigeons at national level.

Is illegally obtained CCTV footage admissible in evidence?

Every now and then media reports reveal an employer who has engaged in illegal CCTV monitoring of staff and today's example is Dunnes Stores which was shown in an unfair dismissal claim to have secretly used CCTV to view employees in a restaurant in Galway:

DUNNES STORES monitored workers on CCTV at a restaurant in one of its stores for 77 days without telling them. A security man monitored the behaviour of staff at the restaurant almost exclusively and reported his findings daily to the store manager. As a result of the monitoring, two members of staff at the Dunnes outlet in Terryland, Galway, were dismissed. Two others quit, an Employment Appeals Tribunal was told yesterday... Dunnes Stores security officer Peter Zatorski said the women at the restaurant were not told they were being monitored.

It's not clear from the media reports whether the camera was hidden, or whether staff were aware of its presence but unaware that it would be used to monitor them. Either way, however, it is clear that this use of CCTV recording would breach the fair obtaining principle in data protection law which requires (even in the case of visible cameras) that individuals should be informed of the purpose for which recordings may be used. Guidance from the Data Protection Commissioner is unequivocal on this point:

If the purpose or purposes is not  obvious, there is a duty on the data controller to make this clear.  A CCTV camera in a premises is often assumed to be used for security purposes. Use for monitoring staff performance or conduct is not an obvious purpose and staff must be informed before any data are recorded for this purpose. Similarly, if the purpose of CCTV is also for health and safety reasons, this should be clearly stated and made known.

In the Dunnes Stores case, therefore, it seems likely that the CCTV footage was obtained illegally. If so, should Dunnes be able to rely on it before the Employment Appeals Tribunal to justify the dismissal? Surprisingly, the issue doesn't seem to have been raised before the EAT but as this is a relatively common issue it might be worth considering generally.

There is a general rule in Irish law that illegally (not unconstitutionally) obtained evidence may be excluded at the discretion of the court. Yvonne Daly provides a very good summary of this rule in this article (PDF), where she points out that in practice this discretion is very seldom used to exclude evidence on the basis of mere illegality. I have been unable to find any reported decisions of the Irish courts dealing specifically with evidence obtained in breach of data protection law - however, in light of the discretionary nature of the exclusionary rule and the general tendency towards admitting illegally obtained evidence there is no guarantee that the courts will prevent this evidence from being used.

This is not, however, an end to the matter, as an employee may be able to achieve the same result indirectly by going to the Data Protection Commissioner. This happened in Case Study 10 of 2008, where employees succeeded in stopping an internal disciplinary inquiry based on improperly obtained CCTV footage:

In this case, the employer had used CCTV images to compile a log that recorded the employees’ pattern of entry and exit from their place of work.  The employer then notified a trade union representative that this log would be used at a disciplinary meeting.  It also supplied a copy of the log to the union representative.  The employer sent letters to each employee requesting that they attend a disciplinary meeting to discuss potential irregularities in their attendance.  The letters indicated that this was a very serious matter of potential gross misconduct and that it could result in disciplinary action, up to and including dismissal.

The employees immediately lodged complaints with my Office.  They stated that they had never been informed of the purpose of the CCTV cameras on the campus where they were employed.  They pointed out that there were no signs visible about the operation of CCTV.  On receipt of the complaints, my Office contacted the employer and we outlined the data protection implications of using CCTV footage without having an appropriate basis for doing so.  We informed the company that, to satisfy the fair obtaining principle of the Data Protection Acts with regard to the use of CCTV cameras, those people whose images are captured on camera must be informed about the identity of the data controller and the purpose(s) of processing the data.  This can be achieved by placing easily read signs in prominent positions.  A sign at all entrances will normally suffice.  If an employer intends to use cameras to identify disciplinary (or other) issues relating to staff, as in this instance, staff must be informed of this before the cameras are used for these purposes.

The employer accepted the views of my Office.  It informed the two employees that it was not in a position to pursue the matter of potential irregularities in attendance as it could not rely on CCTV evidence obtained in contravention of the Data Protection Acts.

That case related to an internal disciplinary matter only. Consequently an interesting question arises where a matter makes it to the Employment Appeals Tribunal or a court: would those bodies be willing to accept into evidence material which the Data Protection Commissioner had found to be illegally obtained and may have directed not to be used for disciplinary purposes? Would an employer be bound by a ruling of the Data Protection Commissioner from tendering such evidence? What would happen in the event of such a clash?

There has been one case which illustrates the type of issues that might arise - in Case Study 2 of 2007 (Baxter Healthcare) the Data Protection Commissioner found that an employer had breached the fair obtaining principle by using a medical report of an employee (obtained in the context of a personal injury action brought by the employee) to defend a later unfair dismissal claim before the Labour Relations Commission. However, in that case the data protection ruling was made only after the unfair dismissal claim was concluded, leaving the issue open as to how the Labour Relations Commission would have handled the report if the ruling was made before it heard the matter.

It is unlikely that there will be any clarity until this issue is the subject of a written decision by the High Court. In the meantime, however, it's surprising that more litigants don't appear to be relying on data protection arguments to challenge the admissibility of evidence.

For more on this topic see Clark, “Data Protection and Litigation” (2009) 16(8) Commercial Law Practitioner 167 (no free link available).

Update (23.2.12) - The High Court has recently ruled against a prison officer seeking to prevent CCTV footage from being used in disciplinary proceedings against him on the basis that it was obtained in breach of his data protection rights. However there's no written judgment in this case making it difficult to determine the precise basis of the decision.

Innovation, Information and the Internet: Modernising Copyright Law

I'm delighted to be chairing a conference on copyright reform this Friday (21st October) and would encourage anyone with an interest in the topic to attend. The event is free and you can register online at http://www.dublincopyrightconference.com/. Full details:

Innovation, Information and the Internet: Modernising Copyright Law

When: Friday 21st October 2011, 1.00pm - 5.00pm (a sandwich lunch will be served at 12.00)

Where: Presidents' Hall, Law Society of Ireland, Blackhall Place, Dublin 7, Ireland

The current review of copyright law in Ireland presents significant challenges for rightsholders, copyright users and the legal profession alike. This conference will consider areas where Irish law is in need of reform and in particular will look at the role of copyright in the digital economy, the development of fair dealing exceptions, the role which fair use plays in the United States, and the experience of reform in the United Kingdom.

Speakers will include prominent national and international experts from private practice, academia and government, including:

Prof Dr Martin Senftleben - Faculty of Law, Vrije Universiteit Amsterdam
Ms. Helen Sheehy, Commercial & Copyright Department, Sheehy Donnelly Solicitors
Prof Lionel Bently - Faculty of Law, University of Cambridge
Mr Stephen Rowan - Deputy Director, Copyright and IP Enforcement Directorate, UK Intellectual Property Office
Prof Peter Jaszi - College of Law, American University Washington
Ms. Linda Scales, Solicitor and co-founder of the Copyright Association of Ireland

It's still censorship, just friendlier and fuzzier

A block page for the Qatar internet censorship system (pdf). I'm reminded of the Chinese cartoon cyber-police.

(h/t Christopher Soghoian)

Internet blocking in schools: not such a good idea, it turns out

Despite being published in 2010, I somehow managed to miss until now these remarkably sensible research findings from Ofsted on internet blocking in schools:

Restricting pupils’ access to websites may actually impair their judgement, making them more “vulnerable” to paedophiles on-line, said Ofsted. The claims come despite an admission that teachers had problems stopping young people logging on to “inappropriate” websites at school. In a report, Ofsted said there were widespread incidents of pupils accessing social networking websites and instant chat rooms – where they can be targeted with abuse. But inspectors said "locked down" systems that barred access to websites were actually "less effective" in keeping children safe overall.

In a particularly good analogy, Ofsted also points out that:

Children who hold a parent’s hand every time they cross the road are safe. However, unless they are taught to cross the road by themselves, they might not learn to do this independently. A child whose use of the internet is closely monitored at school will not necessarily develop the level of understanding required to use new technologies responsibly in other contexts.

There's a lesson here in relation to internet blocking as applied to adults also.

Daily Telegraph story
Full text of Ofsted report

(h/t Joe McNamee, EDRI)

Data protection: subject access rights not affected by litigation

The Circuit Court recently gave a significant judgment in Dublin Bus v. Data Protection Commissioner, holding that subject access rights in Ireland are not affected by the fact that civil proceedings are contemplated or ongoing.

In this case Dublin Bus attempted to withhold CCTV footage of an accident from a subject access request, making a number of rather weak arguments which claimed alternatively that the footage was subject to legal professional privilege and/or that the access request constituted some form of interference by the DPC with pending litigation. In the Circuit Court Judge Linnane gave short shrift to these claims, holding that the footage was not privileged, the Data Protection Acts did not contain any exemption in respect of contemplated or pending legal proceedings, and (unlike UK law) the Irish legislation does not permit the court any discretion as to whether to order access.

None of these rulings are surprising (it would have been very surprising indeed if the court had found otherwise) but it is nevertheless useful to have a decision confirming these points. I've placed a copy of the full judgment on Scribd in the hope that it might prove useful for other subject access requests:Dublin Bus v. Data Protection Commissioner

Site Blocking: What the UK Government would prefer you not to see

It's well known that internet blocking is easy to circumvent. Ofcom in today's report "Site Blocking" to reduce online copyright infringement admits as much, saying that:

For all blocking methods circumvention by site operators and internet users is technically possible and would be relatively straightforward by determined users. (p.5)

Despite this, however, one branch of the UK Government still appears determined to keep its head in the sand, and according to that report:

The Department for Culture, Media and Sport has redacted some parts of this document where it refers to techniques that could be used to circumvent website blocks.

Unfortunately, the technical competence of the DCMS appears to be somewhat limited, and the redaction was (ironically?) also easily circumvented, by measures as simple as copy/paste. Needless to say, a department which is unable to censor a single PDF does not exactly inspire confidence when it proposes to introduce blocking for the entire UK internet, and it is just as well that the UK government has today announced plans to abandon the blocking provisions of the Digital Economy Act.

[Updated - 1.15pm]

The full, unredacted version now appears on Scribd. As can be seen from that document, the material which was redacted was all improperly removed. The tactics discussed to circumvent blocking are all well-known, even to a mere lawyer such as myself, and the redactions appear to be motivated more by considerations of security theatre than anything else.Ofcom Site Blocking Report With Redactions Removed

[Previously]

Here are the individual portions of the report which the DCMS attempted to quash. Text in italics was not redacted but appears for context:

pp.28-29

Robustness

Bypassing IP address blocking is technically straightforward for those who have an incentive to do so.
The blocked site operator may:
• change IP address but stay on the same network (i.e. on the same hosting provider);
• move to an entirely new network (to a previously unobserved IP address);
• offer encrypted network services which obscure the true network address/destination such as Virtual Private Networking;26,27 or
• server operators may institute a Fast Flux network (where users run software on behalf of blocked site which hides the true network address of the blocked site).

There are other methods available to site operators. When moving to a new IP address a site operator may register multiple IP addresses for a given site in order to maintain service in the event that some of those individual IP addresses are blocked. This approach has legitimate purposes also.28 Furthermore, by setting a low “Time to Live” (TTL) Domain Name System (DNS) record value, determining the length of time that the IP address for a particular domain (expressed in seconds) remains in remote name server caches, it is easier for a site operator to move IP addresses without end users losing access. Where a low TTL is expressed the ISP DNS name server resolution cache is purged quickly thereby ensuring that newly assigned site IP addresses are retrieved from the authoritative name server and site accessibility is maintained. Figure 13 below shows that the TTL value for "kickasstorrents" is one hour, demonstrating that any changes to IP address to DNS name are refreshed and propagated within ISP DNS servers in just over an hour.

Figure 13: Kickasstorrents DNS record Time to Live (1 hour) Name TTL Class Record Address
www.kickasstorrents.com. 3600 IN A 95.215.60.37
www.kickasstorrents.com. 3600 IN A 93.114.40.112
www.kickasstorrents.com. 3600 IN A 193.105.134.81
www.kickasstorrents.com. 3600 IN A 95.143.195.138
www.kickasstorrents.com. 3600 IN A 76.76.107.90

26 Ipredator - Surf anonymously with VPN and proxy https://www.ipredator.se/?lang=en
27 UK based VPN services facilitating access to copyright infringed material may be subject to site blocking injunctions. UK VPN operators may institute site blocking at the VPN egress point. NB: we are not aware of any UK based VPN service marketed or positioned for such activity. Such services are likely to be non-UK based.

pp.33-34

DNS blocking robustness

For site operators and end users with a sufficient incentive to engage in circumvention DNS blocking is technically relatively straightforward to bypass:

• the blocked site may offer services such as Virtual Private Networking, which is where encryption and other security measures are deployed to ensure that the data cannot be viewed by third parties (DNS name resolution may occur within the VPN providers network thereby bypassing the ISP based DNS site-blocking);
• the end-user can change their DNS name servers to 3rd party DNS name servers;32,33
• users may use anonymous web proxy or other anonymising services which are not reliant on the ISP DNS servers; or
• name resolution may be performed locally by adding an entry to a hosts file (IP address resolution information can be obtained from websites running a web-enabled equivalent of “nslookup” command).

32 Google Public DNS - http://code.google.com/speed/public-dns/
33 OpenDNS Store > Sign up for OpenDNS Basic: - https://store.opendns.com/get/basic/

For end users who want to bypass blocks there are several options. For instance, there are many legitimate alternative DNS providers to ISP DNS registries. Examples include OpenDNS and Google DNS. We consider the changing of DNS servers to alternative providers to require low technical skills, as the providers offer clear instructions using plain English. For instance, switching to Google DNS requires 11 steps for Windows users and only 8 for those using MAC OS.

With a modest understanding of internet technologies it is possible to access a site by entering the site IP address (if multiple websites are hosted at the same IP address the user will be displayed the default web site or page for that web server/IP address). Site operators can draw attention to online web based and alternative sources of DNS name resolution within emails to their user base or via online forums.

Other channels that site operators could use to widely distribute advice on how best to circumvent DNS blocking could include posting to online forums, Really Simple Syndication (RSS) or updates via micro blogging sites such as Twitter ®. The advice could include changing to unblocked DNS name servers, Virtual Private Networks and proxy services or other anonymising systems. Similarly, site operators may quickly mirror or make copies of a blocked site on new top level or country code domains pointing towards new IP addresses e.g. www.blockedsite.cc; www.blockedsite.ru; www.blockedsite.vn; www.blockedsite.net.

p.38

Techniques that may undermine URL blocking include:

• web site operators providing encrypted access to their web sites via Secure Sockets Layer/ Transport Layer Security i.e. https connectivity https://www.example.com/downloads/pirate.zip;
• a site operator may run a website on a network port other than port 80;
• the site operator changing the IP address and bypassing the network routing announcements;
• a site operator registering a new domain name e.g. www.example.net or www.example.org;
• the blocked site offering services such as Virtual Private Networking;
• the use of anonymous web proxy or other anonymising services;
• the site operator reorganising the site structure if the blocking is conducted against specific URLs; and
• the site operator or end user encoding URLs to bypass blocking.

p.40

Packet inspection blocking robustness

Both shallow and deep packet inspection can be bypassed by site operators using the following means:

• changing the IP address but staying on the same network;
• moving to an entirely new network (to a previously unobserved IP address);
• the site may use network encryption techniques such as Virtual Private Networking to render scrutiny of the IP packet‟s payload or real IP address destination impossible, given the technology available today; or
• the site operator may add or remove site IP addresses from a pool of IP addresses.

End users who wish to circumvent packet inspection may opt to use anonymous web proxies or other anonymsing services.

p.41

As with the deployment of any of the single primary techniques, the hybrid approach is also susceptible to circumvention by the use of anonymising tools such as The Onion Router, VPNs or anonymous proxy services.

p.44 (Column marked "Difficulty of circumvention" originally redacted)

p.45 (Column marked "Difficulty of circumvention" originally redacted)

p.52

Technical Glossary

Anonymous Web Proxy Service that allows users to place web requests via an intermediary server. The proxy server makes the connection on behalf of the user thereby hiding originating IP address and bypassing blocking network techniques.

The Onion Router (ToR) Anonymity network originally developed by the United States Navy. Used in many countries to bypass state censorship.

Judicial committee to consider internet use by juries and live tweeting of trials

According to Kieron Wood in the Sunday Business Post Mr Justice John Murray is to chair a committee to consider the contempt risks posed by jurors' use of the internet and social media, and which may also consider the issues associated with courtroom reporting via twitter or liveblogging. There doesn't seem to be anything on the Courts Service website about this yet, but hopefully the committee will follow the UK practice by holding a full public consultation and (if there is a need for urgent action) issuing interim guidance only in the meantime. Given the importance of the constitutional guarantee of open justice it would be wrong to make any final decision without giving those affected the opportunity to be heard.

Kieron Wood also writes about the wider problems the internet poses for the justice system in a longer piece in the Business of Law supplement.

Newzbin2: Did BT shoot itself in the foot - and will Irish ISPs do the same?

Yesterday's decision in Twentieth Century Fox v. BT (PDF) introduces mandatory web blocking for the first time in the UK and unsurprisingly has already received a great deal of attention (BBC|Guardian|IPKat).

Lilian Edwards has provided a comprehensive legal analysis, while Richard Clayton tackles the technical implications of the judgment, so I won't attempt to duplicate their work. But a separate blog post might be useful on one point which has received less attention - the significance of the fact that BT had already voluntarily adopted a system - Cleanfeed - to block child abuse images.

In 2004 - when BT initially adopted Cleanfeed - it was even then obvious that there was a risk of function creep and in particular that copyright holders would seek to use the system. In a briefing to LINX at the time (link now broken), however, BT appeared to believe that it was unlikely to be sued and could mitigate this risk by discontinuing the use of Cleanfeed if scope creep became a reality. According to the then Director of Internet Services for BT Retail: "if the pressure to extend the scope of Cleanfeed became too great [BT] would simply cancel the project" and "BT is unlikely to be the defendent of choice for a copyright holder or other party attempting to hold an ISP legally responsible for Internet traffic".

Yesterday's ruling has shown the limits of this reasoning. Once Cleanfeed provided a proof of concept then function creep was inevitable and the idea that BT could unilaterally turn off the blocking system unrealistic. Instead, it painted a target on its back. According to a representative for the movie industry "BT was chosen because it's the largest and already has the technology in place, through its Cleanfeed system, to block the site".

The use of Cleanfeed also prevented BT from asserting two defences that might otherwise have applied - that there was no clear legal basis for imposing a blocking system and that their obligations would be unclear. Instead, according to the High Court:

the order sought by the Studios is clear and precise; it merely requires BT to implement an existing technical solution which BT already employs for a different purpose; implementing that solution is accepted by BT to be technically feasible; the cost is not suggested by BT to be excessive. (para. 177)

In light of this, therefore, it's hard not to conclude that BT shot itself in the foot by adopting a blocking system which could easily be repurposed for the benefit of Hollywood.

"No good deed goes unpunished" - this case proves the truth of this statement, and will undermine other voluntary initiatives to block child pornography by showing how easily those initiatives can be coopted by the movie industry or music industry. There's also a lesson here for Irish ISPs who are coming under police pressure to introduce similar blocking systems. Will they now do so, knowing that these systems will make them a happy hunting ground for the content companies, defamation plaintiffs, and others who may wish to block access to the web in Ireland?

Irish mobile phone companies act on voicemail hacking - but why the delay and have they gone far enough?

Yesterday's Irish Times has a story detailing what Irish mobile providers are doing about voicemail security, in light of the UK phone-hacking scandal. There is more detail on the Data Protection Commissioner's website, which indicates that the DPC has abandoned earlier plans to make remote access to voicemail a user option. Instead, according to the DPC:

[The networks] have now all put in place or have committed to put in place in the coming days additional measures to assist their customers to protect the data on their phones. It is now important that the public follow the advice of their mobile provider and where they have not already done so take steps to either secure their voicemail and phones generally or improve upon the measures they may have already taken. At the end of this process it will no longer be possible to access a person’s voicemail using a default password.

The state of play is now as follows:

Meteor and eMobile
No default security PIN is applied and every customer is required to choose their own secure PIN when enabling voicemail. In an effort to encourage customers to take proactive steps to secure their voicemail service they have enhanced the information contained on both websites (www.eMobile.ie or www.meteor.ie) with additional details and guidance on how to secure voicemail services. Additionally, an educational SMS will be sent to all voicemail users in the coming days. Customers can strengthen their password today by dialing 171 (both Meteor and eMobile) and follow the instructions.

O2
O2 has commenced a programme of communications with customers to advise on how they can keep access to their voicemail secure at all times. The communications will include text messages to customers and a pre-recorded advisory when customers dial in to their voicemail service to retrieve messages. O2 has also updated its website with a range of security tips, available at www.o2.ie in the "Can we help you today?" section on the homepage. Customers can change their password today by dialling 173 from their handset and follow the instructions.

Three
Three is communicating to its customers the importance of securing their voice mail with a unique PIN known only to the customer. The communications will include text messages to customers with advice on setting up a voicemail PIN. There will also be an Online Help & Support update to the section on Voicemail to advise customers on the level of security they should use when setting up their PIN. Customers can change their password today by dialling 171 (in Ireland) or +353 83 333 3171 from abroad from their handset and follow the instructions.

Vodafone
From tomorrow Vodafone Ireland customers will hear information when they dial 171 on how they can change their voicemail password at any time. Voicemail and password information is also available today on Vodafone.ie. Vodafone will continue to inform its customers in the coming weeks on new enhanced security options available to its customers. Customers can change their password today by dialling 173 from their handset and follow the instructions.

At first glance this might seem like a step forward, but it leaves many questions unanswered.

First - why has it taken the Irish networks so long to act? Wrongful access to voicemail messages was well known long before now - and I blogged about it here back in 2006. There is simply no excuse for the delay that most networks have shown.

Second - will the networks continue to issue new phones with default voicemail passcodes? Credit must go to Meteor/eMobile who don't do so, but it isn't clear from the DPC's statement - "At the end of this process it will no longer be possible to access a person’s voicemail using a default password" - whether the other networks will be required to abandon their ongoing use of default passcodes. If not, however, then it's hard to see how they would not be in breach of Regulation 4 of the new ePrivacy Regulations, which provides that:

(1) With respect to network security and, in particular, the requirements of paragraph (2), an undertaking providing a publicly available electronic communications network or service shall take appropriate technical and organisational measures to safeguard the security of its services, if necessary, in conjunction with undertakings upon whose networks such services are transmitted. These measures shall ensure the level of security appropriate to the risk
presented having regard to the state of the art and the cost of their implementation.
(2) Without prejudice to the Data Protection Acts, the measures referred to in paragraph (1) shall at least—
(a) ensure that personal data can be accessed only by authorised personnel for legally authorised purposes,
(b) protect personal data stored or transmitted against accidental or unlawful destruction, accidental loss or alteration, and unauthorised or unlawful storage, processing, access or disclosure, and
(c) ensure the implementation of a security policy with respect to the processing of personal data.

(Daragh O'Brien has more on the ePrivacy Regulations and their impact on voicemail hacking.)

Third - have the Irish networks taken steps to secure against other methods of voicemail hacking such as Caller ID spoofing? This is a well known problem in the US and at least some European countries - as Brian Krebs puts it:

For years, it has been a poorly-kept secret that some of the world’s largest wireless providers rely on caller ID information to verify that a call to check voicemail is made from the account holder’s mobile phone. Unfortunately, this means that... your messages may be vulnerable to snooping by anyone who has access to caller ID "spoofing" technology. Several companies offer caller ID spoofing services, and the tools needed to start your own spoofing operation are freely available online.

The recent statement from the DPC doesn't address this particular attack, and the track record of most Irish networks doesn't fill me with confidence that they are on top of this issue either.