August 20, 2014

The End of a Brief Era: Recent Appellate Decisions in “Copyright Troll” Litigation

The onslaught of “copyright troll” litigation began only a few years ago, with lawsuits implicating hundreds or even thousands of “John Doe” defendants, who were identified by IP addresses with timestamps corresponding to alleged uses of BitTorrent services to share and download video content without authorization. Recently, federal appellate opinions confirmed growing consensus in district courts concerning this type of litigation.
[Read more...]

Princeton likely to rescind grade deflation policy

A Princeton faculty committee recommended yesterday that the university rescind its ten-year-old grading guideline that advises faculty to assign grades in the A range to at most 35% of students. The committee issued a report explaining its rationale. The recommendation will probably be accepted and implemented.

It’s a good report, and I agree with its recommendation. Princeton would be better off without its grading quota.
[Read more...]

Criminal Copyright Sanctions as a U.S. Export

The copyright industries’ mantra that “digital is different” has driven an aggressive, global expansion in criminal sanctions for copyright infringement over the last two decades. Historically speaking, criminal penalties for copyright infringement under U.S. law date from the turn of the 20th century, which means that for over a hundred years (from 1790 to 1897), copyright infringement was exclusively a civil cause of action. From 1897 to 1976, there were criminal penalties, but only misdemeanor ones. In 1976, felony penalties were introduced, but only for repeat offenders. Following enactment of the 1976 Copyright Act, the pace of amendments expanding criminal liability greatly accelerated—a trend that more or less coincided with the PC revolution. In 1982, felony penalties were extended to some first-time offenses, but not for all types of copyrighted works. In 1992, felony penalties were extended to all types of works. In 1997, as the commercial Internet was beginning its exponential growth, the No Electronic Theft (NET) Act eliminated a longstanding requirement of commercial motive for criminal liability, making some infringements criminally actionable even if they are undertaken without any expectation of financial gain. Under the NET Act, a willful infringer acting without any commercial motive faces up to three years in prison for reproducing or distributing as few as 10 unauthorized copies of a copyrighted work.

As criminal penalties have ballooned domestically, they have also been expanding internationally.  The international expansion in criminal copyright liability has occurred in part (and increasingly) through the vehicle of plurilateral and bilateral trade agreements. The United States uses its negotiating leverage in the trade policy arena to pressure trading partners, particularly less powerful ones, to incorporate strict IP norms into their domestic law.   [Read more...]

The hidden perils of cookie syncing

[Steven Englehardt is a first-year Ph.D. student in the computer security group at Princeton. In this post he talks about the implications of a recent study that we published in collaboration with researchers at KU Leuven, Belgium. — Arvind Narayanan]

Online tracking is becoming more sophisticated and thus increasingly difficult to block. Modern browsers expose many surfaces that enable users to be uniquely identified, including Flash cookies and browser fingerprints. In a new paper that will appear at ACM CCS, we present the first large scale study of three advanced tracking mechanisms — canvas fingerprinting, evercookies, and cookie syncing. We developed novel measurement techniques and found that these tracking mechanisms are used on a large number of sites. Our findings on canvas fingerprinting, in particular, have been in the news (Propublica, BBC, EFF).

In this blog post I’ll focus on a different part of our paper that looked at cookie syncing, the process by which two different trackers link the IDs they’ve given to the same user. The most common use of cookie syncing is to enable real-time bidding between several entities in an ad auction. It allows the bidder and the ad network to refer to the user by the same ID so that the bidder can place bids on a particular user in current and future auctions. Cookie syncing raises subtle yet serious privacy concerns, but due to the technical complexity of explaining it, didn’t receive much press coverage. In this post I’ll explain cookie syncing and why it’s worrisome — even more so than canvas fingerprinting.
[Read more...]

Why were CERT researchers attacking Tor?

Yesterday the Tor Project issued an advisory describing a large-scale identification attack on Tor hidden services. The attack started on January 30 and ended when Tor ejected the attackers on July 4. It appears that this attack was the subject of a Black Hat talk that was canceled abruptly.

These attacks raise serious questions about research ethics and institutional responsibilities.
[Read more...]

Are We Rushing to Judgment Against the Hidden Power of Algorithms?

Several recent news stories have highlighted the ways that online social platforms can subtly shape our lives. First came the news that Facebook has “manipulated” users’ emotions by tweaking the balance of happy and sad posts that it shows to some users. Then, this week, the popular online dating service OKCupid announced that it had deliberately sent its users on dates that it predicted would not go well. OKCupid asks users questions, and matches them up based on their answers (for example, “do you like horror movies?”), using the answers to compute a “match percentage” showing how likely two people are to get along.
[Read more...]

A Scanner Darkly: Protecting User Privacy from Perceptual Applications

“A Scanner Darkly”, a dystopian 1977 Philip K. Dick novel (adapted to a 2006 film), describes a society with pervasive audio and video surveillance. Our paper “A Scanner Darkly”, which appeared in last year’s IEEE Symposium on Security and Privacy (Oakland) and has just received the 2014 PET Award for Outstanding Research in Privacy Enhancing Technologies, takes a closer look at the soon-to-come world where ubiquitous surveillance is performed not by the drug police but by everyday devices with high-bandwidth sensors. [Read more...]

“Loopholes for Circumventing the Constitution”, the NSA Statement, and Our Response

CBS News and a host of other outlets have covered my new paper with Sharon Goldberg, Loopholes for Circumventing the Constitution: Warrantless Bulk Surveillance on Americans by Collecting Network Traffic Abroad. We’ll present the paper on July 18 at HotPETS [slides, pdf], right after a keynote by Bill Binney (the NSA whistleblower), and at TPRC in September. Meanwhile, the NSA has responded to our paper in a clever way that avoids addressing what our paper is actually about. [Read more...]

Fair Use, Legal Databases, and Access to Litigation Inputs  

In copyright-and-fair-use news, a significant case for the legal profession’s access to the inputs of judicial decision-making was decided last week in federal district court in New York. The case was brought against West Publishing Corp. (owner of the Westlaw database) and Reed Elsevier (owner of the LexisNexis database) by two lawyers who alleged that their copyrights in their legal briefs were infringed when West and Lexis included the briefs in their databases. The two databases have long provided paid subscribers with access to the judicial decisions that adjudicate the arguments raised by litigants. Now, Westlaw and Lexis will be able to continue providing their subscribers with access to the primary documents in which those arguments are made. In a decision that follows the lead of recent fair use decisions concerning the wholesale copying of literary works to repurpose them for search and research, the court held that West and Lexis are protected from the lawyers’ claims of infringement. A holding in favor of the plaintiffs would have made it effectively impossible for West and Lexis to continue to provide subscribers with access to copies of briefs, given the prohibitively high transaction costs associated with trying to license every brief filed by every lawyer in every case in every court in the United States.
[Read more...]

No silver bullet: De-identification still doesn’t work

Paul Ohm’s 2009 article Broken Promises of Privacy spurred a debate in legal and policy circles on the appropriate response to computer science research on re-identification techniques. In this debate, the empirical research has often been misunderstood or misrepresented. A new report by Ann Cavoukian and Daniel Castro is full of such inaccuracies, despite its claims of “setting the record straight.”

In a response to this piece, Ed Felten and I point out eight of our most serious points of disagreement with Cavoukian and Castro. The thrust of our arguments is that (i) there is no evidence that de-identification works either in theory or in practice and (ii) attempts to quantify its efficacy are unscientific and promote a false sense of security by assuming unrealistic, artificially constrained models of what an adversary might do. [Read more...]