Senator Ron Wyden is quickly becoming a politician to be proud of on issues that we feel are important. We’ve already seen him single-handedly stand up to COICA (and forcefully stand behind that position after facing ridiculous lobbying pressure). He also was one of a very small number of US politicians who has publicly expressed concerns about ACTA. But it’s not just on copyright issues. Senator Wyden is now proposing a new law that would require that law enforcement get a warrant before being able to get location info from mobile devices.

While there are still some differing opinions in the courts on the legality of obtaining location info without a warrant, law enforcement has pushed hard to not need a warrant to get such info, preferring to just use a subpoena (basically just asking with no real judicial review). Wyden believes this is wrong, and a violation of basic privacy principles:

“If you asked most Americans, I think they would tell you that surreptitiously turning somebody’s cell phone into a modern-day tracking device … and using it to monitor their movements, 24/7, is a pretty serious intrusion into their privacy, pretty much comparable to searching their house or tapping their phone calls.”

It’s so rare to see a politician say things we agree with that it seems worth highlighting. Who knows if this will actually get anywhere (chances are it won’t), but Wyden still deserves kudos.

Permalink | Comments | Email This Story





&partnerID=167&key=segment”/> .8626,cat.TechBiz
.rss”/>

Techdirt Mike Masnick

Ah, the hypocrisy of politicians. We’ve pointed out in the past how often politicians seem to push for data retention laws and privacy laws at the same time, without realizing the two are in fundamental conflict. It looks like the Obama administration is going through a bit of that as well. The FTC has been threatening to force browser makers to include a do not track feature, that would let people surf without having their data retained. And yet… at the same time, the Justice Department is pushing for extensive data retention laws, with the help of the supposed “small government” Congressional reps who don’t even seem to realize what they’re supporting. Even worse, Congress seems so eager to push for a data retention law that some Congressional Reps are apparently annoyed that the Justice Department hasn’t just handed them a bill to approve.

The problem, of course, is that these politicians don’t actually fully understand what the issues are involved here. They’re viewing the issues on a very narrow basis. On the “do not track” issue, they think “privacy is important, of course we support privacy — do not track is important.” On the “data retention” issue, they think “well, law enforcement needs to have access to data to solve crimes, and without requiring internet companies to retain data, then it’ll make law enforcement harder, so of course we need to have data retention.” What they don’t recognize is that these two things are in fundamental conflict with each other. Requiring data retention means less privacy. Period. But these politicians never actually think that far.

Permalink | Comments | Email This Story





&partnerID=167&key=segment”/> .8626,cat.TechBiz
.rss”/>

Techdirt Mike Masnick

The purpose of this blog is to hopefully inform and educate people about legal issues in technology, intellectual property, the Internet, and other areas of the law.  So I therefore try to avoid being political, but sometimes it’s hard to do.  And it’s really hard to do when the Republican brand—and isn’t it really all about branding these days?—has drifted so far from its roots that I would be remiss in not mentioning it.

There was a time, before September 11th at least, that Republicans—and the newly minted Tea Party—were for the concept of small and less intrusive government.  I’m all for that for reasons too numerous to mention here.  But I’m especially for it in areas of privacy, particularly on the Internet where personal data about people flows like water.  But alas, so much has changed in the world that up is down, small is big, and privacy now means data retention.

So to say I was disappointed when I read that the Republicans’ first major technology initiative in the House of Representatives was to introduce a bill to require Internet companies to keep track and store user data, would be an understatement.  The new bill, if it becomes law, would require ISPs and other Internet companies to store the Internet Protocol (“IP”) addresses and other records of users’ online activities for 2 years.  This goes far beyond what the Electronic Communication Transactional Records Act (“ECTRA”) passed in 1996 requires, which is for ISPs to retain any “record” for up to 180 days (in two 90 day increments) upon request by a “governmental entity.”  So where’s the smaller and less intrusive government we were promised?

The biggest backers of the bill are—no surprise here—law enforcement and prosecutors.  Of course they want the ability to fully investigate crimes on the Internet.  Who could realistically be against going after pedophiles, identity thieves, and scam artists?  But the potential for abuse by law enforcement remains a real one and a 2 year retention requirement (as opposed to companies who voluntarily save user data for a set period of time) strikes me as excessive.  Just ask these folks in Chicago who are being victimized by the police and prosecutors over the state’s absurd wiretap law.  So overreaching by law enforcement occurs in many different contexts.

As a practical common sense matter, do records on EVERYONE really need to be retained for at least 2 years?  Perhaps ECTRA has the more reasoned approach (dare I say) which requires preservation pursuant to a court order issued “only if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation.”  18 U.S.C. § 2703(d). 

But to retain records on everyone so that the police and law enforcement can cull through them at a later time and at their leisure seems particularly ripe for all sorts of abuse.  Hopefully, the Democrat-controlled Senate will be far more thoughtful in the consideration of such sweeping legislation (assuming it gets that far).  And if they’re not, then I’ll criticize the Democrats too, who are supposed to be more concerned about the “common man.”  Well, the common man needs his privacy too.  Rumor has it that he’s got the Internet now.

Okay, maybe I’m being a bit sarcastic with the title.  But according to a recent article and study (i.e., the Sophos Security Threat Report), spam, phishing, and malware attacks on social networking sites doubled from 2009 to 2010.  Not surprisingly, identity theft and third party use of personal information were primary goals of cybercriminals.

This is hardly shocking and it wouldn’t be surprising if these numbers doubled again from 2010 to 2011 given the increasing importance of social media—for better or worse—in our personal and business lives.  But what do people really expect?  Criminals go where the people are and when Facebook has 600 million users, that’s a big crowd to fleece.  And criminals can do so in the comfort of their own homes and in foreign countries knowing full well that their chances of getting nabbed are about as likely as Apple stopping production of the iPhone.  What do they really have to lose?

Not surprisingly according to the article, users want sites like Facebook to take stronger security measures.  And while sites can certainly do so in some instances voluntarily, it may take a court ruling (as it often does) to force a company to implement more substantive protections. But first you have to get past those nasty contractual disclaimers that we lawyers put into practically all user agreements about not holding the site liable for almost anything that happens on it:  “Identity theft be damned—so sorry, but it’s just not our problem!” 

Remember when you clicked “I AGREE” on that user agreement?  You can be sure Facebook does, because that’s an enforceable contract in most instances.  (No need to thank us, by the way—the public’s opinion of lawyers is thanks enough!)  Very tough to challenge, but not impossible if the right facts present themselves.  Combined with the right judge, of course.  Sometimes the lottery’s easier to win though.

The fact is that while social media sites have to do more, especially those that operate on the massive scale Facebook does, we have ourselves to blame also.  How much personal information do we really need to disclose about ourselves?  I’ve always believed that less is usually more, but perhaps because I’m over 40 (which is 95 in cyberyears), many young ’uns believe that more is more.  And that even more is still not enough.  I forget:  Does TMI stand for “Too Much Information” or “Too Many Idiots” when we  ”overshare?”  Because cybercriminals count on both meanings to do their dirty work.

Do we really need to tell everyone when we won’t be home, thereby inadvertently notifying criminals when the best time to rob us is?  Or are we so egotistical that we have to “friend” a ton of people so we can brag about how big our network is, only to unwittingly let in unsavory characters? Or to post a lot of personal details until the inevitable privacy breach thereby exposing all of that information to the world—and to sophisticated criminals who can then make use of it in all sorts of ways that decent law-abiding people have never thought of.

I often wonder where the proper practical balance is.  Because if you’re expecting the law to catch up to address some of these informational privacy and security issues, we’ll be on Web 5.0 at that point … and on Cybercriminal 7.0.  And do you really want to be the “test case” anyway?

It probably goes without saying that if you’re planning to sue your employer, you shouldn’t use your work email address to contact your lawyer. However, if you did do that, according to a California court, that email is not protected by attorney-client privilege. I don’t find this to be all that surprising (or really, problematic). It’s quite common that employers control the rights to your work emails, so it’s hard to see why that wouldn’t extend to emails you send your lawyer. All it really makes me wonder is why someone would use their work email for sending those types of emails.

Permalink | Comments | Email This Story





&partnerID=167&key=segment”/> .8626,cat.TechBiz
.rss”/>

Techdirt Mike Masnick

We’ve had plenty of problems with Senator Patrick Leahy on this blog, as his push is to always make intellectual property laws worse, such as with ProIP and now COICA. However, sometimes he does things that deserve kudos, such as his plan to investigate the TSA’s new scanners, calling them “invasive.” Leahy apparently wants the Senate Judiciary Committee (which he heads) to examine whether or not the machines really make sense. Of course, perhaps we should withhold any kudos until we find out what comes out of that “review…”

Permalink | Comments | Email This Story





&partnerID=167&key=segment”/> .8626,cat.TechBiz
.rss”/>

Techdirt Mike Masnick

Hopefully by now, most people who have upgraded to a smartphone (such as an iPhone, Blackberry, or Android) have realized that it’s not simply a phone, but a powerful mobile computer which just happens to be about the size of a 3″ x 5″ index card.  And just like your big heavy personal computer or laptop, it contains all sorts of personal information—perhaps too much information—about you and what you do.  If you haven’t come to that conclusion yet, the increasing police power of the state may soon force you to.  It should also force you to take steps to protect yourself from what could become an overzealous police officer should you ever find yourself in the unfortunate situation of being arrested (even for a misdemeanor).

For me, a big part of being a technology and internet lawyer is privacy law.  While privacy appears to have all but  disappeared in this 24/7 networked world where everyone posts a whole lot of information about themselves, it’s easy to forget that not everything is everyone’s business—especially the police, who may seek to use such information against you for violations of laws that you may not have realized even existed.  Think it can’t happen?  As a lawyer, I’ve seen many overzealous police officers, state agents, and prosecutors looking to establish a name for themselves.  Civil liberties be damned.  (Of course, there are many good ones too, but it’s often the other ones we hear about.)

An insightful article by Ryan Radia discusses the recent California Supreme Court decision in People v. Diaz, which held that police officers can lawfully search a mobile phone on a person they arrest without first obtaining a search warrant.  The court found that mobile phones, like cigarette packs and wallets, fall under the “search incident to arrest” exception of the Fourth Amendment.  While the Supreme Court may have the final say as to whether this is legal, many state courts have come to the same conclusion as California has.

Most significantly, Radia discusses the importance of taking measures to make your smartphone as secure as possible, such as full disk encryption of all content on the device.  He notes that password protection—which is certainly an important first step—may not be enough and is easy to bypass due not only to the rise of digital forensics, but the vulnerabilities in your smartphone’s own operating system that a forensic expert can exploit easily.  While Radia notes that no mobile encryption system at the moment is perfect or especially secure, this will hopefully change.

If you have a few minutes, the article is definitely worth a read.  Whether people realize it or not, privacy is one of the most daunting issues facing us (and lawyers) in this information age, and the law has difficulty keeping up.  And as the Diaz case shows when the law does catch up, it’s usually not in our favor, but works to the benefit of the state’s police power.  At least for now.

(U.S.S.C., Commercial Law, Intellectual Property, Patent) In a patent application seeking protection for a claimed invention explaining how commodities buyers and sellers in the energy market could protect, or hedge, against the risk of price changes, the denial of the application is affirmed where: 1) the machine-or-transformation test is not the sole test for patent eligibility under 35 U.S.C. section 101; 2) Section 101 precluded a reading of the term “process” that would categorically exclude business methods; and 3) even though petitioners’ application was not categorically outside of section 101 under the two atextual approaches the Court rejected today, that did not mean it was a “process” under section 101.

FindLaw Opinion Summaries - IP FindLaw Opinion Summaries - IP

(U.S. Fed. Cir., Insurance Law, Intellectual Property, Patent) In a suit for patent infringement, related to computerized methods for administering variable annuity plans, district court’s denial of defendants’ motion for summary judgment as a matter of law that it does not infringe the claims at issue of the ’201 patent is reversed and remanded where: 1) the district court erred in denying defendants’ motion for JMOL of noninfringement as the evidence on the record does not support jury’s verdict of infringement; and 2) because defendant did not infringe, its argument that the district court abused its discretion by refusing to grant it leave to amend its complaint to assert a claim for invalidity under 35 U.S.C. section 101 need not be addressed.

FindLaw Opinion Summaries - IP FindLaw Opinion Summaries - IP

(U.S. D.C. Cir., Administrative Law, Copyright, Entertainment Law, Intellectual Property, Media Law) In the Recording Industry Association of America’s petition for review of the Copyright Royalty Board’s decision instituting a 1.5 percent per month late fee for late royalty payments, and implementing a penny-rate royalty structure for cell phone ringtones (under which copyright owners received 24 cents for every ringtone sold using their copyrighted work), the petition is denied where: 1) the Board appropriately took market evidence into account when imposing a late fee; 2) a copyright owner’s ability to terminate a section 115 license in no way barred the imposition of a late fee; and 3) even if it were true that divided interests in a copyright made it difficult to make timely payments to each copyright owner, that fact would in no way counsel against the imposition of a late fee.

FindLaw Opinion Summaries - IP FindLaw Opinion Summaries - IP