- cypherpunks-legacy - lists.cpunks.org

[Politech] Thumbprinting visitors at the Statue of Liberty
by Declan McCullagh 05 Jul '18

05 Jul '18

Previous Politech message: http://www.politechbot.com/2005/04/28/arkansas-salon-requires/ -------- Original Message -------- Subject: BB: Thumbprinting visitors at Statue of Liberty Date: Thu, 28 Apr 2005 08:37:14 -0700 From: Xeni Jardin <xeni(a)xeni.net> To: 'Declan McCullagh' <declan(a)well.com> Thumbprinting visitors at Statue of Liberty http://www.boingboing.net/2005/04/28/thumbprinting_visito.html Responding to yesterday's Boing Boing post about tanning salons and gyms that require users to sumbit to thumbprint ID, reader Matthew A. Dietzen of Chicago-Kent College of Law says: = = = = = = = = = = = = You might find these pictures of the Thumb-Scanning Lockers on Liberty Island, NYC interesting. In order to get to "Liberty" Island, you must first have your gear X-rayed by Wackenhut security goons. Then you ride to the island accompanied by Coast Guard types with German Shepherds. Once ashore, you are free to circle the island, take pictures of the statue, and buy overpriced Slurpees. However, in order to get inside the statue, you have to stow your gear in a locker... that requires you to use your fingerprint as a key!!! You can also pay with a credit card, that way if anyone hacks the machine, they can have your print AND your credit card information. This must be in place to protect us from those Al Qaeda frogmen that are clever enough to swim ashore, but are too stupid perform their dastardly deed at night where they can circumvent the locker bay by climbing the seemingly easy-to-climb wall. In all likelihood, its probably to condition us into giving up our biometric information at every turn [As if biometrics could never be hacked...] so that security companies can make even more $$$, while we become more and more sheep-like each day. In any case, I didn't go inside. However, later that day, I was falsely arrested near Ground Zero with 200 other people. I was a legal observer at the Republican National Conventions. First they said people could march, then they arrested them. They took us to Pier 57, and then the Tombs where we were laser-printed on ALL of our fingers with a SAGEM machine because we "might be terrorists." After denouncing us as anarchists and enemies of the state, the city dropped the charges [on our group anyway] a month later. The latest stories indicate that over 90% of the charges were dropped or found to be baseless. The police were also caught fabricating evidence. = = = = = = = = = = = = Matthew's snapshots: one (http://www.boingboing.net/images/Liberty-Locker-Thumbs-2.jpg) two (http://www.boingboing.net/images/Liberty-Locker-Thumbs1.jpg) Previously: Arkansas salon requires thumbprint to get a tan (http://www.boingboing.net/2005/04/27/arkansas_salon_requi.html) --------------------------------------- Xeni Jardin | www.xeni.net * co-editor, BoingBoing.net * correspondent: Wired Magazine, Wired News, NPR "Day to Day" say: /SHEH-nee zhar-DAN/ Mailing list for updates: http://groups.yahoo.com/group/xeni-net/ _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[liberationtech] was: Forbes recommends tools for journalist; is now: depressing realities
by Jacob Appelbaum 05 Jul '18

05 Jul '18

Hi, frank(a)journalistsecurity.net: > But if >> you're getting information security advice from a Forbes blog, that >> will be the least of your worries. > > Where would you suggest we get information security advice from? This is an interesting question and I admit, I feel like it leaves a bad ring in my ears... What kind of security advice? Who is following the advice? Does their context change while they follow this advice? Do they have resources of a user without more than a casual interest or are they well funded and dedicated? What are their requirements? What are their temporal tolerances? Do they understand safety plan or threat model without further explanation? What are the stakes for failure? The answer to each of those questions would shift my answers to subsequent questions around, I guess. If I were to change that question a bit to be something that many people are familiar with - I'd say - Where do we get good health advice from? When I go to a general practice doctor, they might refer me to a specialist. But where do I find that doctor? And what if I have issues that are really expensive to solve? It leads us in a similar direction - we look for common certifications, credentials, ratings, feedback, word of mouth, etc. We get a general sense of things, hopefully if we're seeing a terrible doctor, we know before they cut us up or send us home when we really need a different kind of care. It seems that some groups who do practical training are trying to be the specialist and the generalist. Sadly, because many of us are motivated by non-technical goals, say social justice, a real core background in many overlapping fields is simply missing. There isn't an advertised set of unified goals or principles stated where we try to work toward a set of solutions, nor is there a common set of agreed upon threat models that we're working with openly, and so on. The Forbes article is junk for my threat model(s) and frankly, I think it is junk for everyone else on a long enough time line. An open question is mostly if anyone will ever do anything noteworthy enough to learn that it was junk at the time. If it had been written about biology and safe sex, I'd say it was offering sheep skin condoms as a partial solution; we'd all get a pretty bad feeling about it and commonly understand the problem with such solutions, right? The technical details are so poorly understood by journalists that their ethics generally mean nothing; who cares if a journalist promises to keep a secret if they even have Skype *installed* on their laptop with confidential documents, emails or an OTR enable chat client? Their operational security is lower than the bar of the commercial market, we don't even have to begin to discuss intelligence agencies. In almost any other topic, it is simply intolerable to let a person write complete nonsense advice as an authority. Such authors get a reputation for being worth ignoring and sometimes, they're the topic of the next article. Yet in the field of journalism, we see journalists who even proudly boast of their illiteracy, without realizing the recklessness of their choices, sometimes even the choice of straight up ignorance because security is simply too hard. Or refusing to even offer anything resembling a secure way to reach them, let alone actually something they try to use regularly. I've rarely met journalists that encourage people to secure their communications - it does happen but wow, it is rare rare rare. Some journalists at least claim that they will go to jail before they'll give up sources, some won't make such claims or will even make the opposite claims. The signs of such journalists are easy to spot and still hard to confirm in any meaningful manner. When push comes to shove, even the best intentioned journalists still roll over when the might of the state crushes them under a pair of boots. At least with a proper idea of how journalism is being undermined by the Surveillance State, such a journalist might get a clue about the level of help, protection and transitive risk they pose to sources. Such an understanding is largely missing from the dialog and the Forbes piece really obviously shows that the advice is the product of an extremely lacking study of the threat landscape. What am I getting at? When journalism was two people meeting in person, the people were the main piece that mattered, when research on who to contact was ephemeral, even a failed meeting wasn't a pin pointed event to be followed up on later. The (communications, crypto, electricity, etc) systems illiteracy means that otherwise core competencies of a solid journalist are undermined. Where should 'we' get our information? From people who have a clue, I think, in whatever field where we're barely scratching the surface with our questions. When I wonder about specific cryptography issues, I don't go to Forbes, I'd take a class from Dan Boneh or Moxie. When I wonder about a pain in my chest, I go to a doctor for triage. When I want to solve those problems myself, I invest in my own education. It seems to follow that if you're building a knowledge base for journalist security, it might make sense to build a collection of threat models, a collection of unified threats (eg: calls you make will be wiretapped, your location will be recorded, your email will be intercepted) you hope to address, and so on. It might also make sense to define who receives the advice; after all, if the trainers are simply middle (hu)man, why would someone at risk want to talk to them? It seems that if the goal is simply to benefit from the surplus of the labor of others, adding something to the mix might be a useful contribution to the community. We all bring different things to the table, right? To put this a different way: I'm not a lawyer and while I doubt I'll ever be a lawyer, I accept that I do not need to have a law degree to have a clue. I also trust a number of people with law degrees to advise me but it took a lot of study, reading and frankly, rational self-interest in the self-survival department to even slightly *understand* their great advice. I've had the privilege of lawyers friends who didn't tolerate a lack of understanding while also making legal choices. My ability to make decisions was simply not up to snuff without a clue. So at least in a few of my own legal cases, I've done a lot of research to understand the core ground rules of the system that I inhabit, even if the system is made up of things I don't fully like or even really understand in an intuitive sense. While I'm *certainly* not a lawyer, I might have enough of a clue to know who to call or how badly I don't know something. So I wonder, what do journalists need to do? It seems to me that they should talk to the experts in the fields that are required for their specific operations. It also seems to me that they might want to work on not collaborating with the Surveillance State so much. As their lack of knowledge on the topic has basically made their job and their ethical commitments impossible unless they become full time security/privacy/anonymity/computer/network/telephone/etc experts. So on the one hand, I feel for journalists that don't understand technology. But on the other hand, I think without understanding the way that the world works, they're calling themselves journalists without understanding that technology is as important as having credible sources - it isn't like photography, it isn't a value add skill, it is a core and fundamental part of the job. > Many here are quick to point out what people should not rely upon. > But relatively few seem to want to assume the responsibility to > suggestt what people should use. We are gleaning material including > on concepts from the Information Security chapter written by Danny in > CPJ's Journalist Security Guide (full disclosure: I wrote the > chapters on physical safety). We are looking for guidance on tools > from Security-in-a-Box by Tactical Tech. And we are reviewing and > closely following the discussion over the new Internews guide which > covers both concepts and tools. We are also looking at relevant > guides by Small World News by Brian and others, and Mobile Active by > Katrin and Alix. > Security is a process and not simply a product that people use. I'm loathe to repeat that but that concept is worthy of deep thought. It isn't unlike asking which travel visa company we should call about entering Syria. Surely we wouldn't accept a guide that told us to simply call up the local tour company for advice. Rather, we'd want specifics, right? But to have specific, we need grounding in reality - languages help, having street smarts helps and so on. I look at all of the above guides and I think that they're interesting as an awareness and philosophy metric for the respective community that created it. Lots of unequal threat models, lots of varying capacities, lots of graphic design budgets and often very little scientific referencing for *positive* security claims. > It seems to me that the above comprise the best available sources > out there. Would you agree? Of course, if you or anyone has any > other suggestions, we are all ears. The discussion itself over the > Forbes blog and other material is all helpful. But backhanded snipes > without the benefit of positive alternative suggestions are not. No, I wouldn't agree. They're all nice efforts but frankly, all of them are lacking because they don't really explain the social stuff - the reality of the world stuff or the deep factual stuff - and are mostly about tools. There are parts that come close and are then not detailed about the technology, or they simply give up - where is the phone security guide that explains how to buy discrete SIMS for Satellite phones anonymously? Where is the IMEI changing guide for people using cell phones in Syria? Where are the threat modeling discussions that model real situations that actually exist, say for Egypt having a copy of FinFisher? I would suggest reading the (yearly) proceedings from Blackhat, DefCon, NDSS, USENIX Security, Hack-in-The-Box, and others. I would suggest trying to understand the fundamental human assumptions at play by studying behavior of people. Those guys who have generally hung out in the foreign corespondents club - they had a lot going for them but if you wanted to compromise them, how would their skills hold up in the modern world? Now do it to yourself, how would you embody that in a guide? We wouldn't do a life critical bioassay with advice from the DIY bio community, right? Why is security that is also a life line different here? I guess it isn't so simple and that is why it takes time - so I would suggest trying to find ways to encourage people to engage in intense self-study, in things that destroy apathy for the ills of the world with regard to personal liberty - so they can find resources that are otherwise seemingly unconnected on the surface that might otherwise go unnoticed. Sorry for the shameless plug here but I feel it is contextually appropriate: http://www.orbooks.com/catalog/cypherpunks/ ( I make no money from this book; you can easily find it on bittorrent - please do! ) > > Most people on this list and in conferences seem to be agreeing, at > least lately if not also before, that if people who need to use the > tools don't use them, then that becomes a security problem in and of > itself. And that the overwhelming majority of people in places like > Syria really do not understand the risks or practice best measures. > Would you agree? Getting over these obstacles requires training, and > also more transparency within this "Open Source" community about what > we should be teaching people. I think some of the best revolutionaries, journalists, activists and humans that I've ever met understand these issues quite well. That is to say - they understand emotional trauma, wiretapping, physical violence, hacked accounts, torture, legal issues and so on. Many choose to take action even when the odds are stacked against them, even or often unprotected because of say, the political gains or the tactical advantage in the moment. If I understood a point that Gene Sharp made once - trainings are ineffective without a larger framework and without specific understandings of specific words - meaning that is important is otherwise totally lost. So we need to consider the big picture as well as many different kinds of small details - to focus entirely on one area will leave us unbalanced, unprepared and well, less effective. Perhaps to the point of being worse than when people at least tried to work outside of the systems they didn't understand... I think that a long term solution for say, communications security is to normalize secure solutions and to pick some points of unity as part of the definition of secure. As an example - Free Software is a hard requirement for me in a serious situation but being FL/OSS does not mean that it is secure. Again, we need processes, models, realistic situational awareness and so on for humans - not just an International House of Check Boxes with tools, no real desire to do anything more than scrape the barrel and no actual capacity. > I am also learning not to take gratuitous snipes here personally. As > it seems to be all too common within this group. But I do think we > would serve a great many more people if we had more constructive > conversations. Isn't that what this list is for? > I don't think Steve was trying to insult you as he later clarified. That Forbes article really isn't an example of solid and cutting edge advice. Some of their stuff, such as the stuff by Andy Greenberg, is top notch. Some of it is not even a notch... I agree that constructive conversations are useful for the list. If I were to dive right in - I'd say - could you give us examples of your operational security? I'll start and I'm curious to hear your follow ups. I run almost entirely Free Software for my general computing needs. I try to use only Forward Secret cryptography for communication and I assume it only buys me time, rather than totally solves all of my problems. I use GPG with a hardware token, rather than with keys on my laptop. I encrypt all of my disks. I create honeypots to mess with people who mess with me. I use RedPhone, TextSecure, Tor, and so on - the usual suspects in the Free Software world. I assume that most things fail open. I buy most of my hardware with cash. I use different devices in different contexts. I don't believe that the Fourth Amendment actually protects the equipment I have in my home (electronically, physically,etc ). I try to understand, extend and sometimes try to break the systems that I use - I try to only use systems that people I respect have built, analyzed or use themselves. I encourage everyone that I meet or talk with to use strong cryptography, anonymity services and to consider the transitive risk of behavior. I try to write software to improve this entire field and I try to work with end users as well as trainers. And so on. An evil Maid attack would own me in a lot of cases, so I carry my computers with me to some rather annoying places. I stopped carrying a cell phone regularly when I realized that it was simply a lost cause on the privacy front. I do counter-surveillance and surveillance-detection to try to catch people who try to tamper with my hardware or worse. I give samples of likely backdoors to better reverse engineers (than me) when in doubt. I've been working hard for the last few years to show that these tactics and this kind of strategy isn't paranoia. Rather such an understanding is required for the *current* Surveillance State, let alone the coming New and Improved Surveillance State. How about you? A good friend jokingly once told me that some people raise their paranoia to meet their security situation. The joke was of course that I did the opposite: I raised the seriousness of my situation to match my paranoia and outlook. If you have to pick between the two - which side of things seems to have a possible positive outcome? All the best, Jacob > >> -------- Original Message -------- Subject: Re: [liberationtech] >> Forbes recommends tools for journalists From: Steve Weis >> <steveweis(a)gmail.com> Date: Mon, December 17, 2012 6:10 pm To: >> liberationtech <liberationtech(a)lists.stanford.edu> >> >> >> Just to go further down the tech tangent... >> >> There are SSD drives with full-disk encryption, such as the Intel >> 520 series. Here's a paper "Reliably Erasing Data From Flash-Based >> Solid State Drives" from Usenix 2011 that analyzes disk sanitation >> on several SSD drives. Their conclusion was that built in >> encryption and sanitization functions were most effective, but were >> not always implemented correctly: >> http://static.usenix.org/events/fast11/tech/full_papers/Wei.pdf >> >> Regarding storage for disk-encryption keys, PCs with TPMs can seal >> keys such that they can only be unsealed if the machine is booted >> to a verifiable state. Then you can leave the sealed key on the >> disk, which is how Bitlocker works. >> >> Keep in mind that TPMs can be compromised by physical attacks. They >> aren't going to protect you from a moderately-funded forensics >> effort. But if you're getting information security advice from a >> Forbes blog, that will be the least of your worries. >> >> On Mon, Dec 17, 2012 at 1:42 PM, Michael Rogers >> <michael(a)briarproject.org>wrote: >> >>> I'm not aware of any suitable storage on current smartphones or >>> personal computers, so we may need to ask device manufacturers to >>> add (simple, inexpensive) hardware to their devices to support >>> secure deletion. <hr>-- >> Unsubscribe, change to digest, or change password at: >> https://mailman.stanford.edu/mailman/listinfo/liberationtech > -- Unsubscribe, change to digest, or change password at: > https://mailman.stanford.edu/mailman/listinfo/liberationtech > -- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

EDRi-gram newsletter - Number 7.4, 25 February 2009
by EDRI-gram newsletter 05 Jul '18

05 Jul '18

============================================================ EDRi-gram biweekly newsletter about digital civil rights in Europe Number 7.4, 25 February 2009 ============================================================ Contents ============================================================ 1. Data protection authorities support civil society on the Telecom Package 2. The trial of The Pirate Bay in Sweden 3. Lex Nokia storms into the Finnish Parliament 4. Italy to enforce a global censorship legislation? 5. Norwegian group joins Sweden-based Justice Center against Swedish FRA law 6. European Commission disbanded data protection experts group 7. Romanian data retention law suspendend by the Government 8. HADOPI law close of creating a dangerous precedent 9. UK Government ignores the European Commission regarding Phorm 10. EDRi participates in European project on raising privacy awareness 11. ENDitorial: Privacy in the Czech Republic - nothing to celebrate 12. Recommended Action 13. Recommended Reading 14. Agenda 15. About ============================================================ 1. Data protection authorities support civil society on the Telecom Package ============================================================ The Article 29 Working Group and the European Data Protection Supervisor have issued public statement supporting some of the arguments of the civil society, including EDRi, made in the recent open letter sent to the European Parliament on 17 February 2009 and in the campaign against "voluntary data retention". The open letter underlines the signatories' concerns related to those amendments of the Telecoms Package which might affect the Internet and Internet users, by targeting the open and non-discriminatory access features. Thus the fundamental users' rights such as privacy and freedom of speech are put in jeopardy. The Article 29 adopted on 10 February Opinion 1/2009 on the proposals amending the e-Privacy Directive, acknowledging its concerns regarding the present article 6 a) that "might lend legitimacy to large scale deployment of deep packet inspection both in the network and in user equipment such as ADSL boxes, while the current legal framework already details the cases in which traffic data may be processed for security purposes." Considering that "the wording proposed by the Commission establishes beyond all doubt that the processing of traffic data falls within the scope of the Data Protection Directive", the working group decided that the Article 6(6a) is unnecessary. A similar opinion is supported by the European Data Protection Supervisor's comments on some issues in the review of the Universal Service Directive. According to the text "he is concerned about the implementation of traffic management policies that require the monitoring of Internet usage and interception without appropriate data protection safeguards," and concludes that "Article 5 of the ePrivacy Directive applies whenever traffic management policies entail interception or surveillance of Internet usage. Therefore, to avoid confusion, it seems only just and reasonable to recognise that pursuant to this article informed consent from users is necessary." In the same document, EDPS tackles the 3 strikes procedure and considers as unfortunate its possible introduction in the Telecom package and notes that "it would have been preferable if the European Parliament had not given up to pressure by laying down the foundation for a three strikes approach and if all these issues had been addressed separately in different legal instruments, after careful analysis and debate." The EDPS supports the civil society in calling upon decision makers to re-introduce Amendment 138 and Article 32a of the Universal Service Directive that would strengthen the safeguards towards ensuring the protection of individuals' rights, including the right to data protection and privacy and due process. The Article 29's Opinion also tackles other aspects regarding the e-Privacy directive. Thus the document strongly supports "an extension of personal data breach notifications to Information Society Services (...) given the ever increasing role these services play in the daily lives of European citizens." This resonates with the initial Amendments of the European Parliament or with Peter Hustinx's public comments, who explains why the position of the Commission and the Council is not enough to protect the citizens in the online world: "That restriction means European citizens would only be alerted if their internet access or telephone company suffers security breaches. If their online bank is hacked or its security systems are cracked, enabling the unauthorised access to bank account information, citizens might not be notified. So, unless the amendments proposed by the European Parliament are adopted by the Council, online banks and other e-businesses would be off the hook." The Article 29 Working Group has also re-emphasised its earlier opinion "that unless the service provider is in a position to distinguish with absolute certainty that the data correspond to users that cannot be identified, it will have to treat all IP information as personal data, to be on the safe side". Thus the WG agrees with the Commission that a substantive provision of a directive is not the most suitable way of addressing this issue, and that a reporting obligation referring to "purposes not covered by this Directive" is not appropriate. Open letter to the European Parliament - Telecom Package (17.02.2009) http://www.edri.org/edrigram/campaigns/open-letter-telecom-package EU proposal puts confidential communications data at risk (28.02.2009) http://www.edri.org/campaigns/no-voluntary-data-retention All data breaches must be made public (29.01.2009) http://resources.zdnet.co.uk/articles/comment/0,1000002985,39603777,00.htm Opinion 1/2009 on the proposals amending Directive 2002/58/EC on privacy and electronic communications (e-Privacy Directive) (10.02.2009) http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2009/wp159_en.pdf EDPS comments on some issues in the review of the Directive 2002/22/EC (Universal Service) (16.02.2009) http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consu… EDRi-gram: Data breach notification - different opinions in EU bodies ? (19.11.2008) http://www.edri.org/edri-gram/number6.22/data-breach-ec ============================================================ 2. The trial of The Pirate Bay in Sweden ============================================================ The big, long and extremely mediatized trial filed on 31 January 2008 by Swedish prosecutors against the four Pirate Bay founders for "promoting other people's infringements of copyright laws" started at Stockholm's District Court, on 16 February 2009. The first day of the trial was dedicated to the opening statements of the prosecution and the defendants, the latter denying any criminal act. Prosecutor Hekan Roswall presented the claims of the plaintiffs Warner Bros, MGM, EMI, Colombia Pictures, 20th Century Fox, Sony BMG and Universal and spent most of the morning trying to describe how the Pirate Bay works suggesting it was a commercial organization with Carl Lundstrvm as a shareholder and financier of the company. The prosecutor made a presentation of a series of movie, music and game downloads "coordinated by The Pirate Bay" before 2006. He continued trying to explain the change from a seed status to that of a peer as part of the evidence previously gathered by the plaintiffs. The civil parties represented by IFPI and MPAA expressed the intention to ask for 11 million euro damages. The second day of the trial started with a big victory for The Pirate Bay founders with the dropping out of most part of the accusations against them. The prosecutor announced the defendants would not be accused of "assisting copyright infringement" changing the accusation into "assisting making available copyright material". The prosecutor was unable to prove that the .torrent files introduced as evidence were actually using The Pirate Bay's tracker. Furthermore, he has shown to be technically unprepared and failed to explain the function of DHT which allows for so called "trackerless" torrents. This means the screenshots the prosecution provided as evidence did not necessarily belong to The Pirate Bay's tracker. Pirate Bay claimed it did not break the law because it did not host or disseminate copyright-infringing content but only links to that content and reproached the prosecution, the police and the music industry of not understanding the technology. According to Fredrik Neij, the entire accusation was based on a technical misunderstanding. On 18 February, the prosecution asked for about 11 million euro compensation and damages on the basis that the defendants should have obtained worldwide licences for the content it distributed. The defence rejected any discussion related to damages considering there had been no damage. "EU directive 2000/31/EC says that he who provides an information service is not responsible for the information that is being transferred. In order to be responsible, the service provider must initiate the transfer. But the admins of The Pirate Bay don't initiate transfers. It's the users that do and they are physically identifiable people. They call themselves names like King Kong," was defence lawyer Samuelsson's statement to the court. "According to legal procedure, the accusations must be against an individual and there must be a close tie between the perpetrators of a crime and those who are assisting. This tie has not been shown. The prosecutor must show that Carl Lundstrvm personally has interacted with the user King Kong, who may very well be found in the jungles of Cambodia," the lawyer added. The plaintiffs insited on The Pirate Bay's behaviour that refused to withdraw the .torrent links from their index, except for the cases when the content did not correspond with the one announced by the user placing the torrent file. In the prosecution's opinion, this would make The Pirate Bay more than a simple technical intermediary. The defense argued that uploading a torrent does not imply that the copyrighted files are actually 'available', as the torrent has to also be seeded and that, on the other hand, torrent files are not linked exclusively on The Pirate Bay and can be found through other search engines, including Google. Two of the defendents were heard on the fourth day, the technician Frederik Neij and the administrator Gottfrid Svartholm Warg who were both pretty much sticking to their initial position. The day did not bring very much change. Neij proved that it was possible to create a torrent file and host it somewhere else, like on TorrentSpy using the trackers opened by The Pirate Bay to distribute the files, in which case The Pirate Bay cannot know what is exchanged. In his opinion, the prosecusion had not succeeded in proving that the incriminated files had been actually downloaded on The Pirate Bay. The lawyer of the movie industry tried to show that The Pirate Bay had an active role in the choice of the content presented by its users and asked Gottfrid Svartholm Warg whether the site had withdrawn content related to child pornography. The administrator replied that they had notified the police on such torrent files and they had retired them at the request of the police. "We can't do investigations of our own. And if the police say we should remove a torrent, we will," he said. Peter Sunde was interrogated on Friday morning. The strategy of the prosecusion seemed to be clearer than during the first days being focused on trying to prove that The Pirate Bay had been created with the purpose of gaining money from "pirating". The prosecutor tried to show that The Pirate Bay was actually managed by a hierarchical organization with a commercial purpose. However no material evidence was brought to support this idea. When asked what the purpose of The Pirate Bay was Sunde answered: "It is to enable users to share their material with others." "Even though it is copyrighted?" questioned Danowsky. "That can sometimes be the sad consequences," Peter replied. The defendant stated to the court that in his opinion the entire trial was a political one and that the reason for which the plaintiffs brought the case against The Pirate Bay was not the fight against illegal downloading of their works but a a fight to preserve the monopoly on the distribution means. The trial started again on 24 February when the prosecutor also added to the charges that the site allowed its users to upload torrents that it further on stored. Magnus Mertensson, a lawyer for the IFPI testified during the morning but the evidence brought by him consisted only of screenshots and the witness also admitted having difficulties in answering some technical questions. Both him and policeman Magnus Nilsson of the Anti-Piracy Office who was the next witness for the prosecution were unable to bring forth any real evidence that the Pirate Bay trackers were actually used for the downloads investigated. Mertensson admited that he had no evidence of having any contact with The Pirate Bay's tracker during the downloading he was claiming to have made from the site. Nilsson was made to admit that the actual downloading of the pirated files happened outside of The Pirate Bay. The trial is supposed to last until the 4 March 2009. We will present the conclusions of the trial in our next newsletter. The Pirate Bay trial: 1st day under the sign of boredom (only in French, 16.02.2009) http://www.numerama.com/magazine/12023-Proces-de-The-Pirate-Bay-1ere-journe… Half of Pirate Bay case dropped in courtroom drama (17.02.2009) http://www.out-law.com//default.aspx?page=9803 The Pirate Bay cries victory after the dropping out of some charges ! (only in French, 17.02.2009) http://www.numerama.com/magazine/12041-The-Pirate-Bay-crie-victoire-apres-l… The Pirate Bay (day 3): "We are winning on legal principles" (only in French, 18.02.2009) http://www.numerama.com/magazine/12066-The-Pirate-Bay-jour-3-Nous-gagnerons… Day 3 - The Pirate Bay's 'King Kong' Defense (18.02.2009) http://torrentfreak.com/g-defense-090218/ The Pirate Bay (day 4): "Are you a coward, Fredrik Neij ?" (only in French, 19.02.2009) http://www.numerama.com/magazine/12087-The-Pirate-Bay-jour-4-Etes-vous-un-l… Day 4 - Pirate Bay Defense Calls Foul Over Evidence (19.02.2009) http://torrentfreak.com/day-4-pirate-bay-defense-calls-foul-over-evidence-0… The Pirate Bay (day 5): Peter Sunde counter-attacks (only in French, 20.02.2009) http://www.numerama.com/magazine/12100-The-Pirate-Bay-jour-5-Peter-Sunde-co… Pirate Bay Trial Day 5: Peter's "Political Trial" (20.02.2009) http://torrentfreak.com/pirate-bay-trial-day-5-peters-political-trial-09022… Pirate Bay Trial Day 7: Screenshots for Evidence (24.02.3009) http://torrentfreak.com/pirate-bay-trial-day-7-screenshots-for-evidence-090… EDRI-gram: Pirate Bay in legal battle with IFPI (11.02.2009) http://www.edri.org/edri-gram/number7.3/piratebay-ifpi-battle ============================================================ 3. Lex Nokia storms into the Finnish Parliament ============================================================ Government bill dubbed as Lex Nokia, also known as the snooping law, entered the Parliament for debate on 24 February 2009. The bill has been widely criticized for heavy-handed treatment of fundamental rights, granting companies more rights than the police, suspicion of undue corporate pressure and vagueness and unclarity. The proponents of the law have continued making embarrassing gaffes: Communications Minister Suvi Lindin has said in an interview in Tampere newspaper Aamulehti that an employer currently has the right to order a strip-search of an employee if there is suspicion that the employee is leaking company secrets. Furthermore, Finance Minister Jyrki Katainen, has stated that he is not familiar with the contents of the bill, but supports it firmly, regardless. Yesterday's parliamentary debate consisted mainly of opponents of the law raising various concerns regarding fundamental rights, usefulness of the bill, increasing surveillance, bad drafting process etc. The defenders of the law kept repeating how opponents of the bill are ill-informed of its actual implications and how the bill improves the status of employee rights. The Left Alliance and the Social Democrats were calling for rejecting the bill and sending it back for a complete overhaul. TV news on 24 February reported about the law, stating that it is meant to prevent three things: * leakage of trade secrets * copying of copyrighted materials * disruption of corporate networks with attachments and malware. Unless this is some kind of mistake made by the news, this sheds a new light on the purpose of the bill. Government party lines seem to be holding, only the Greens (14 seats) are split on the issue. If the lines are not broken any further, the bill will pass even if all Greens vote against it, since the National Coalition (51 seats), the Centre (51) and the Swedish People's Party (10) have a majority in the 200-member strong parliament. The Greens have proposed limiting the bill so that the email log data is allowed to be examined only in cases where a company is investigating leakage of trade secrets. The content of the law is expected to be voted upon today, 25 February. The final vote, whether to pass or reject the bill, is expected next week. Lex Nokia Debate Ignites Parliament (24.02.2009) http://yle.fi/uutiset/news/2009/02/lex_nokia_debate_ignites_parliament__569… Labour Ministry official confirms threat of Nokia leaving Finland over law on electronic communications (24.02.2009) http://www.hs.fi/english/article/Labour+Ministry+official+confirms+threat+o… Lex Nokia furore fuelled further by minister4s strip-search remark (13.02.2009) http://www.hs.fi/english/article/iLex+Nokiai+furore+fuelled+further+by+mini… EDRi-gram: Snooping law, "Lex Nokia", proceeding slowly but surely in Finland (17.12.2008) http://www.edri.org/edri-gram/number6.24/nokia-law-finland-snooping (Contribution by Leena Romppainen - EDRi-member Electronic Frontier Finland) ============================================================ 4. Italy to enforce a global censorship legislation? ============================================================ The Italian Senate approved - and the Camera dei deputati (Italian "Low Chamber") is ready to finally pass - draft law 733 named Pacchetto sicurezza - "Security Package", a series of (supposely) coordinated provisions aimed at improve, whatever that means, police bodies and public prosecutor powers. Of course, the law wouldn't have been complete without "taking care" of the Internet, and legislators didn't loose the chance. Under sect. 50 bis of this forthcoming law, a public prosecutor which is given "serious circumstantial evidence" that an online activity of inciting crime has been committed, is allowed to ask the Minister of Home Affair to order the ISP's to shut down the "concerned" network resource. ISP refusal to comply with Minister's order should be fined with a penalty up to 250 000 Euros. The provision is clearly flawed from a constitutional standpoint. The basis of every western democracy, indeed, is separation of power, thus is not legally possible to have such a cross-jurisdiction mess between the public prosecutor (the judiciary power) and a Ministership (the executive power). Further more, there would be a double trial for the same fact, one of which (the Home Affair Ministership one), done without the legal guarantee of a criminal trial (fair process, etc.). But this is only the tip of the iceberg. Crime-inciting wrongdoing is very difficult to handle, since the border between free-speech and law violation is often blurred (would a website supporting freedom rebel of a country be - per se - inciting to commit crimes?). Further more, if ISP's must prevent access to a network resource located outside their network (abroad, for instance) this would mean that the result will be achieved through deep-packet inspection, or similar, privacy threathning techniques. Thus - with the excuse of "protecting" Italian citizens - the D'Alia amendment (named after the MP that proposed it) is likely to be the first step toward a global censorship system. A Cassinelli amendment (again, from the MP name of its author) that followed the D'Alia one, tried to circumvent the above mentioned problems, but with no real changes in the substance of the matter and the political, net-phobic approach. Italy had a "sound" tradition in trying to enforce citizen's global surveillance systems through ISP's and telco operators, adopting every sort of justifications (from copyright, to child pornography, to online gambling and now to crime-inciting actions). Oddly enough, nevertheless, these "good intentions" fell always on innocent citizens' shoulders, while true criminals stay absolutely free. Or, to put it straight: to (maybe) catch a few criminals, the whole nation network usage will be subjected to "third parties" - namely, ISP's - systematic scrutiny. So long, human rights. (Contribution by Andrea Monti - EDRi-member ALCEI -Italy) ============================================================ 5. Norwegian group joins Sweden-based Justice Center against Swedish FRA law ============================================================ The Norwegian organisation of the International Commission of Jurists (ICJ) has filed a petition, known as a Third Party Intervention, in support of the case brought to the European Court of Human Rights challenging the Sweden's FRA law that authorizes the Sweden's National Defence Radio Establishment (Fvrsvarets radioanstalt - FRA) to wiretap all telephone and Internet traffic that crosses Sweden's borders. The legislative package which was passed by the Parliament of Sweden on 18 June 2008 and took effect on 1 January 2009, was fiercely criticized and opposed in Sweden by the public, opposition parties, the appeal courts for Skene and Blekinge, Sweden's Customs Agency, the Data Inspection Board and even politicians belonging to the alliance government. A case was filed in July 2008 by the Sweden-based Justice Center (Centrum fvr Rdttvisa - CFR), which argued FRA's expanded powers to monitor cross-border communications traffic violated Article 8 and Article 13 of the European Convention on Human Rights guaranteeing the citizens' right to privacy and ensuring the citizens with the possibility to hold national authorities to account for possible human rights violations. According to Lawyer Robin Lvvf of the European University Institute in Florence who reported the Swedish law to the European Commission in August 2008, the law is in clear breach of fundamental rights governing the movement of goods and services in the European Union. Clarence Crafoord, head attorney with CFR welcomed the Third Party Intervention of the Norwegian group considering the initiative "offers additional perspectives about the problems with the FRA-law and it's good that it makes clear to the European Court of Human Rights that the law affects both Swedes and citizens in other countries." The Norwegian petition cites a report issued by the Norwegian Postal and Telecoms Agency in November 2008 which showed that most electronic communications traffic into and out of Norway as well as a large part of the domestic traffic passes through Sweden, the Swedish law therefore affecting the privacy rights of Norwegian citizens. Although the Swedish government brought some changes to the law with an amendment in September 2008, in ICJ-Norway's opinion the changes apply only to Swedish citizens or people residing in Sweden. The group believes that Norwegian citizens' communications are the "explicit target for the secret monitoring by Swedish authorities". "Norwegian citizens are still left lawless under the present legislation.(...) They are faced with the constant risk that their private communications which happen to pass Sweden's borders could be subject to interception and be subsequently stored, distributed, and misused by and at the absolute discretion of the Swedish authorities," writes ICJ-Norway in its petition. ICJ-Norway points out a series a deficiencies in the formulation of the law which includes vague definitions of the targeted communications, the lack of clear regulations on information storing, the lack of independent judicial control and the lack of possibility of response for the citizens whose communications are intercepted. Norwegian group joins case against Sweden's wiretapping law (13.02.2009) http://www.thelocal.se/17578/20090213/ Swedish surveillance law 'breaks EU rules' (13.08.2008) http://www.thelocal.se/13664/20080813/ Goverment getting closer to surveillance law compromise (25.09.2008) http://www.thelocal.se/14554/20080925/ Snoop law to be tried in European court (15.07.2008) http://www.thelocal.se/13052/20080715/ EDRI-gram: ENDitorial: Wiretapping - the Swedish way (27.08.2008) http://www.edri.org/edrigram/number6.16/wiretapping-swedish-way ============================================================ 6. European Commission disbanded data protection experts group ============================================================ The European Commission has decided to dismantle a group of experts that needed to review the European Data Protection Directive. The group was formed after a tendering process and included: Peter Fleischer, global privacy counsel for Google, David Hoffman, director of security policy and global privacy officer for Intel; Henriette Tielemans a privacy lawyer from a US law firm, Christopher Kuner, a privacy lawyer with another US law firm; and Jacob Kohnstamm, chairman of the Dutch data protection authority. Alex T|rk, the French Data Protection Authority President and the Chairman of Article 29 Working Party, has complained about the biased structure of the group explaining to a French Senate committee that the group was composed "four-fifths of personalities representing American interests." The committee submitting a resolution stating it was "unacceptable" that four members of the group "are either from American companies or law firms whose principal establishment is in the U.S." The group had just one meeting at the end of the last year and even though they were gathered for a one-year mandate the Commissioner Barrot, who is also a French, decided to disband the group and to broaden the consultation on the review of the 1995 data protection directive. In fact T|rk asked Barrot to look into the matter, and the latter acknowledged that "the situation was abnormal". T|rk explained that part of the problem was that there were major conceptual differences between the EU and US data protection principles: "Europeans must note that the gap is big between the American vision and the European vision." Draft Resolution regarding the nomination by the European Commission of an expert group on data protection. (6.02.2009) http://www.senat.fr/leg/ppr08-203.html European Commission Disbands Privacy Group (17.02.2009) http://www.clickz.com/3632816 ============================================================ 7. Romanian data retention law suspendend by the Government ============================================================ In a sudden and unexpected move, the Romanian Government has decided on 25 February 2009 to suspend the application of the data retention law until the end of the year - 31 December 2009. The official reason from the press release of the Ministry of Communications and Information Society are related to the: - complications that the law brings to the penal cases, especially in the initial phases of information gathering; - the area of the crimes for which the retained data is accessible is contested (by whom? -n.a.); - not all of the communications providers may ensure the management of the retained data; - not all the providers are ready to respect the legal provisions regarding the confidentiality of the accessed data. Even though the law was in a public consultation (but dormant-type phase) for almost 9 months, it seems that the Government is realizing that they didn't get the "perfect text". The privacy concerns do not appear in the press release, but a better "information campaign" on the law and its consequences is mentioned somewhere in a work plan. It is still unclear how the "suspension" will work. It seems that the Government would like to issue a new emergency ordinance that will postpone the application of the law. It remains to be seen if the new text of the law supported by the Ministry will be better or worst than the present one. Application of the data retention law - postponed until the end of 2009 (only in Romanian, 25.02.2009) http://economie.hotnews.ro/stiri-telecom-5447913-aplicarea-legii-stocare-da… Minsitry of Communications and Information Society (only in Romanian, 25.02.2009) http://media.hotnews.ro/media_server1/document-2009-02-25-5447934-0-comunic… ============================================================ 8. HADOPI law close of creating a dangerous precedent ============================================================ On 18 February 2009, Christine Albanel, French Minister of Culture, presented to the Chamber of Deputies the controversial Criation et Internet draft law (so called Hadopi law) calling for the creation of a government agency to manage the graduated response (or three-strike) process. The law which was passed by the Senate in October 2008 was discussed by the deputies in the legal commissions with amendments to be presented during the debates starting on 4 March. As previously during the long discussions having taken place for some years now, during the debates in the legal commissions, any amendment proposed in the direction of a global license, such as the "creative contribution" proposed by the socialist Patrick Bloche was rejected. The proposed mechanism would have implied a fee paid by the Internet subscribers to their ISP for legal downloading of copyrighted material. The fees collected could be used to remunerate artists for their work. "With a universal licence, the money recuperated will not uniquely go into the pockets of the producers, which is definitely the case now. Today, artists' royalty payments are significantly less, while the (media companies') royalty payments are considerably more," said Bloche. According to Nicolas Maubert, an attorney with law firm Gide Loyrette Nouel, if voted in the present form, the law might still be challenged by France's judicial body. Blocking Internet access as a sanction might breach constitutional protections guaranteed by the French Constitutional body (Conseil Constitutionnel) said Maubert, who added that a graduated response initiative is not a necessarily a bad thing in itself: "It still seems legitimate to question whether blocking the access to the internet is indeed a 'proportionate measure.' Especially these days, just imagine yourself without access to the internet, with no e-mails, no information." In the meantime, as a positive balance, according to reports from the European Parliament, the also very controversial Medina report containing a range of measures in support of copyright enforcement, including increased liability for ISPs, secondary liability for peer-to-peer sites and graduated response, has been postponed and apparently even removed from the European Parliament's agenda. Having in view the very strong opposition reaction from citizens all over Europe, it appears the socialist group in the European Parliament blocked the report for fear of losing votes at the next elections. If the Medina report had been pushed to the plenary, it would have also created a problem for the Telecoms Package.The Parliament miight not have passed it, supporting Amendment 138 which is against graduate response. "Thousands of emails and phone calls from concerned citizens reached the parliament. The outcome proves that informed citizens can altogether become stronger than a small obscurantist industry pressure group. We must consolidate this victory by guaranteeing, through the second reading of the Telecoms Package, that Internet remains the most fantastic advance for our societies since the invention of the printing press."declared Jirimie Zimmermann, co-founder of La Quadrature du Net. Antipiracy Law: "the creative contribution" of the Socialist Party rejected (only in French, 20.02.2009) http://www.01net.com/editorial/403824/loi-antipiratage-la-contribution-crea… French Legislature Puts Finishing Touches On Ambitious File-Sharing Law (23.02.2009) http://www.ip-watch.org/weblog/2009/02/23/french-legislature-puts-finishing… Medina report indefinitely abandoned (22.02.2009) http://www.iptegrity.com/index.php?option=com_content&task=view&id=259&Item… Copyright dogmatism temporarily kicked out of European Parliament (19.02.2009) http://www.laquadrature.net/en/copyright-dogmatism-temporarily-kicked-out-e… Christine Albanel defends the antipiracy law in front of the deputies (only in French, 18.02.2009) http://www.01net.com/editorial/403753/christine-albanel-defend-la-loi-antip… EDRi-gram: One more step for France in adopting the graduated response (5.11.2008) http://www.edri.org/edrigram/number6.21/french-senate-adopts-3-strikes ============================================================ 9. UK Government ignores the European Commission regarding Phorm ============================================================ On 12 February 2009, the European Commission warned it would take formal action against the UK Government for not providing the requested information on the past trials of the Phorm ad-serving technology. The Commission has sent three letters until now requesting information on the secret trials by BT of Phorm, the latest having been sent at the end of January 2009. No satisfactory answers have been received so far, the response having focused only on future deployments without addressing the question of the past trials. The trials, conducted in 2006 and 2007, tracking the browsing behaviour of BT customers without their consent, resulted in complaints from privacy campaigners, peers, and politicians who argued that the actions were in breach of UK interception and data-protection laws. In July 2008, technology campaigner Alexander Hanff made a complaint to the police force considering the BT trials were not in compliance with RIPA and the Data Protection Act as the customers' consent had not been required. However, the City of London police informed Hanff in September 2008 that they would not continue the investigation for "lack of criminal intent". "One of the main reasons for this decision is the lack of criminal intent on behalf of BT and Phorm in relation to the tests. It is also believed that there would have been a level of implied consent from BT's customers in relation to the tests, as the aim was to enhance their products," wrote detective sergeant Barry Murray. Although UK regulators have provided rules for the future deployments of Phorm which require the company to not retain website history data, exclude sensitive search topics and obtain the customer's agreement also providing information of the respective technology, according to UK's EDRi-member Open Rights Group, it is not yet clear whether the consent of both the users and the visited websites is required. "Unless the ISPs employing Phorm's technology to intercept the communications between their customers and the owners of the websites their customers are visiting have the explicit consent of both parties, they are likely to be committing an offence under the Regulation of Investigatory Powers Act (RIPA), the legislation that governs interception of communications in the UK," stated the group. In spite of the repeated questions and investigations and disregarding the European Commission's warning, Phorm goes on. The company's CEO stated during an interview on 9 February that the system would be active in the UK by the end of 2009. The company has also signed deals with another two big UK ISPs, Carphone Warehouse and Virgin Media. EC warns gov't over Phorm foot-dragging (12.02.2009) http://news.zdnet.co.uk/security/0,1000000189,39615480,00.htm BT finishes trial, expects to use Phorm (15.12.2008) http://news.zdnet.co.uk/communications/0,1000000085,39578006,00.htm Police drop investigation into BT's Phorm trials (23.09.2008) http://news.zdnet.co.uk/security/0,1000000189,39492793,00.htm Phorm: damn the EU, full speed ahead! (11.02.2009) http://arstechnica.com/tech-policy/news/2009/02/phorm-damn-the-eu-full-spee… EU calls phoul over ad company Phorm's invasive snooping (15.08.2008) http://arstechnica.com/old/content/2008/08/eu-calls-phoul-over-ad-company-p… EDRIgram: UK: Phorm threat (28.01.2009) http://www.edri.org/edri-gram/number7.2/phorm-uk ============================================================ 10. EDRi participates in European project on raising privacy awareness ============================================================ EDRi is one of the partners in a new European project initiated by the French Human Rights League (LDH), which aims to raise awareness on the privacy aspects, especially among the young generation. The project initiated by LDH and started on 1 January 2009 comprises, besides EDRI, another European Human Rights Network - European Association for the Defense of Human Rights (EAHR) and two national members - Pangea (in Spain) and Iuridicum Remedium (in Czech Republic). The project is funded by the European Commision within the framework of the Program on fundamental rights and citizenship - transnational projects. This project aims to help a large group of young people, teenagers and young adults to become vigilant about the protection of their personal data, to sensitise them on subjects which may seem trivial. A first meeting was held on 13-14 February 2009 when all project members met for the first time to better define the main two objectives: a) The analysis and comparison of some privacy invasive technologies in the selected countries, the identification of good and worst practices, applicable legislation and its implementation, relevant awareness campaigns. b) The production of an awareness tool aimed at young adults dealing with sensitive subjects in all countries, which are not sufficiently handled or specifically aimed at this target population. In this case our objective is to influence these practices and go against the tendency which professes "I have nothing to hide therefore nothing to fear, so no problem" with an accent upon "why should they care and how to do it". Human Rights League France http://www.ldh-france.org/ European Association for the Defense of Human Rights http://www.aedh.eu/?lang=en Pangea http://www.pangea.org/ Iuridicum Remedium http://www.iure.org ============================================================ 11. ENDitorial: Privacy in the Czech Republic - nothing to celebrate ============================================================ For the third time the Council of Europe has proclaimed 28 January the European Data Protection Day. EDRi-member Iuridicum Remedium (IuRe) reminds that the safety of Czech citizens4 personal data is still seriously endangered. Some of the most pressing issues are listed below. RFID based Opencard (or Praguer4s Universal Card) is now being promoted as an electronic travel card for public transportation. However, the contactless chip card formerly used for parking payment and as a library ID is not secure. The contactless chip can be read remotely and the data stored on it can be linked with the central database containing personal data. The system thus allows for movement tracking, especially at the electronic gates which are going to be introduced in Prague metro. In relation with the Opencard4s drawbacks, IuRe initiated a petition at the beginning of September 2008, which demands the deletion of both Opencard holder data and usage data from the central database after the card4s expiration and an observance of database administrator4s duty to allow user4s data deletion upon request. "We also demand an implementation of an anonymous Opencard at the same price as an ordinary Opencard," reports Filip Pospmsil from IuRe. The petition has already been signed by almost 700 people. The Municipal authorities of Prague began to sell anonymous cards on the 17 December 2008. However, there is an extra 8 EUR charge and since only transferable season transport tickets can be purchased with such a card, the price for the annual travel becomes significantly higher. The Praguers effectively have to pay extra for their privacy protection and IuRe will stand out for an implementation of non-discriminatory anonymous card, i.e. the card allowing to use the service at the same price without unnecessary disclosure of personal data. The Municipal Council of the city of Prague received a Big Brother Award 2008 for the Opencard project in "Worst Public Agency Privacy Intruder" category. Visa Waiver The term Visa Waiver refers to a set of agreements related to the abolition of the visa requirement for Czech citizens traveling to the USA. These agreements allow the American authorities access to personal data of the Czech citizens in Czech state authorities4 databases, including biometric data. The access is given as a compensation for the abolition of visa requirements, but in fact the paper visa have been merely replaced by the virtual visa - a system of detailed electronic questionnaires based on which the applicant can still be refused entry to the USA. "In the case of the Czech Republic the agreements where not negotiated properly with Czech Data Protection Agency and their comments were not respected," points out Filip Pospmsil from IuRe. The complementary Agreement on strengthening the cooperation for the prevention and fight against serious crime was approved by the government on the 4 December 2008. However, the Government disregarded the comments of the Czech Data Protection Agency and other state authorities. At the beginning of 2009, IuRe urged the MEPs and senators to not approve the proposed agreement. IuRe has made an attempt to find out the scale of personal data which had been promised by the Czech authorities to be handed over to the American authorities as well as the conditions of the data protection. The official request for information has been submitted to the Ministry of Internal Affairs by the end of 2008. "The request was concerning another visa waiver related memorandum on establishing of the Combating Terorism Center and the Electronic System of Travelling Registration (ESTA)," specifies Filip Pospmsil from IuRe. However, the memorandum is classified as secret and thus neither IuRe nor any other ordinary citizens know which of their personal data is being handed over. Privacy and bank sector The new Police Law was negotiated and approved in 2008. IuRe together with the bank sector and the Czech Bank Association have been criticizing the new power of the Czech Police to request data about the location and time of electronic card payments from banks, and particularly, the ability to access bank information systems. "We have been submitting comments during the negotiation of this law, but while some others have been accepted, our objection against this competence was not" reports Helena Svatosova, a lawyer from IuRe. According to IuRe, the government document named "The enhancement of the communication system between financial institutions and state authorities" introduces since the fall of 2008 the intention to create a central evidence of financial institutions4 clients and their operations. The evidence would then be available to an unspecified range of public administration authorities. "In our opinion, it's very disturbing that despite the list of related agencies being rather long, there is no mention of the involvement of the Data Protection Office," interprets Helena Svatosova from IuRe who plans to keep an eye on this issue in the future. IuRe has notified both the Czech Data Protection Office and the Bank Association about the issue and asked them for their opinion. Data retention EU directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communication services has been implemented into the national legislation since the beginning of 2006. In November 2007, Minister of Industry and Trade Martin Rmman proposed an amendment which would allow the secret service and the military intelligence a direct access to those data. Although he has abandoned the idea under the pressure from the media and politicians, intelligence services gained access through the "backdoor" in the new Police Law. There is a legal proceeding submitted by Ireland (suported by Slovakia) going on against the directive at the European Court of Justice, as well as at both Hungarian and German constitutional courts. IuRe has also been preparing the trial of the "data retention" provision of a law in respect of its constitutionality and compliance with human-right obligations of the Czech Republic; the plan is to approach lawmakers with the proposal for an annulment of a part of the law, and gather enough support to submit the proposal to the Czech Constitutional Court. Video surveillance The volume of CCTVs has been on a sharp increase in recent years. However, the Czech legislation has not reflected this development in any way. In December last year the Government Council for Human Rights accepted a proposal of a Committee for Civil and Political Rights. The proposal has been initiated by IuRe and aims at introducing a conceptual regulation of CCTV4s usage in public. IuRe has emphasised the necessity of such an adjustment for several years. "Thus, the resolution of Council of Government is a significant achievement of our campaign, which leads to a more transparent usage of CCTV systems regulated by strict rules," declared Filip Pospmsil from IuRe. The proposal should allow private persons to use CCTV only in order to protect their own property and family; public authorities should be allowed to make a record only in the public interest and only for purposes defined by the law. The proposal should also prevent the excessive personal data processing and stipulate a duty of the CCTV owner to inform about the CCTV surveillance within its range. The aim of the proposal is also to strictly regulate the retention of records, as well as the duty to clearly state and document the exact purpose of each CCTV installation by the police or another security agency. IuRe has already tried to pursue the legal regulation of CCTV through the Police law approved in June 2008 with the help of MP Katerina Jacques. Minister of Interior Ivan Langer has rejected the proposal, but has promised that his ministry will, in cooperation with the MP and Czech Data Protection Office, prepare amendments of the Act on Personal Data Protection containing proposed amendments. Negotiations are still ongoing with IuRe participating. Passengers Name Records (PNR) Passengers Name Records (PNR), the database of information about airline passengers has originally been used only by the aviation companies. But after the 9/11, the American Security Authorities have started making pressure on aviation companies to provide the detailed data of their passengers. This practice did not have a legal ground in most countries and the agreement between EU and the USA was found illegal by the European Court of Justice. The provisional agreement, built on the same illegal base in summer 2007, was called back from negotiations in the Czech Parliament by Foreign Affairs Minister after IuRe had sent a letter to MPs raising concerns against the approval of the agreement. After difficult negotiations, the EU came up with a new agreement on PNR data exchange with the USA in June 2007. In the Czech Republic the proposal of the agreement has not gone through an ordinary legislative process and only the Data Protection Office expressed its opinion: the proposal brings a deterioration of personal data protection level against previous agreements, as US authorities will acquire access to personal data of people without guaranteeing basic rights.( for example the right of correcting of false statements, etc.) IuRe has also approached a number of parliamentarians expressing concerns about the agreement and this resulted in the fact that the agreement did not obtain the support of the Foreign Affairs committee of the Czech Parliament. Also the Senate Standing Commission for Privacy Protection expressed its negative position. IuRe believes that the Parliament will demonstrate its sovereign role and will not approve this agreement at the forthcoming session. This article has been written as a part of the "Reclaim Your Rights in the Digital Age" project supported by the Trust for Civil Society in Central and Eastern Europe Foundation. (contribution by EDRi-member Iuridicum Remedium- Czech Republic) ============================================================ 12. Recommended Action ============================================================ Announcement of the second Privacy Open Space Conference in Berlin, 1-3 April 2009. After the successful finish of the first year of the EU-funded project Privacy Open Space (PrivacyOS) the project starts the New Year with the announcement of the Second PrivacyOS Conference. As the first PrivacyOS Conference in October 2008 in the European Parliament in Strasbourg was co-located with the International Conference of Privacy and Data Protection Commissioners, also the second PrivacyOS Conference will be held alongside with "re:publica", a conference to establish collective interfaces with other EU projects as well as national and international networks. After the positive feedback on the first conference, the second PrivacyOS Conference will also follow the Open Space approach and therefore invites all participants to bring topics to the agenda. "It leaves room for spontaneous creation of new workshops during the conference which reflects the dynamics of the discussion among participants" says Jan Schallabvck, the project Manager of PrivacyOS. "Only a set of timeslots is predefined. The topics for each of the slots are introduced and moderated by the participants themselves." This approach ensures that all topics relevant to the participants are included and that fields of common interest can be detected and worked on, while taking into account different perspectives across Europe and beyond. The second PrivacyOS Conference will focus on "Enabling Privacy on the Web". Visitors of the "re:publica" are invited to partly join the Open Space slots and to discuss with the PrivacyOS Project Partners about privacy issues or their experiences on this field. Thereby, an opportunity to articulate and exchange best practices, challenges and solutions is given. The conference primarily addresses legal and technical IT experts, interested manufacturers of IT products or services as well as data protection authorities. All persons interested in privacy or data protection aspects are welcome to register for the event. Project website http://www.privacyos.eu/ . Invitation PrivacyOS - Berlin https://www.privacyos.eu/images/111_PrivacyOS_Invitation_Berlin.pdf ============================================================ 13. Recommended Reading ============================================================ Report: The Abolition of Freedom Act 2009 This UCL SHRP research report, edited by the Guardian's Liberty Central columnist Henry Porter, was complied for The Convention on Modern Liberty on 28 February and marks the beginning of a research project that seeks to reflect on legislation since the Human Rights Act 1998 and the unintended consequences it has had on rights and liberties in the UK. http://www.uclshrp.com/exchange/report_the_abolition_of_freedom_act_2009/ http://www.uclshrp.com/images/uploads/pdf/Abolition_of_Freedom_Act_2009.pdf The Article 29 Working Party - 69th plenary session - Search Engines (10-11.02.2009) http://ec.europa.eu/justice_home/fsj/privacy/news/docs/pr_12_02_09_en.pdf The Article 29 Working Party - 69th plenary session - Press Release (11.02.2009) http://ec.europa.eu/justice_home/fsj/privacy/news/docs/pr_11_02_09_final_en… ============================================================ 14. Agenda ============================================================ 18-20 March 2009, Prague, Czech Republic The Responsibilities of Content Providers and Users http://www.media-conference.cz 18-20 March 2009, Athens, Greece WebSci'09: Society On-Line http://www.websci09.org/ 23 March 2009, Berlin, Germany German-French Experts Meeting on Technologies for Electronic Identification http://www.e-identify-df.de/ 26-27 March 2009, London, UK 5th Communia Workshop: Accessing, Using, Reusing Public Sector Content and Data http://www.communia-project.eu/ws05 27-29 March 2009, Manchester, UK Oekonux Conference: Free Software and Beyond The World of Peer Production http://www.oekonux-conference.org/ 28 March 2009, London, UK Open Knowledge Conference (OKCon) 2009 http://www.okfn.org/okcon/ 29-31 March 2009, Edinburgh, UK Governance Of New Technologies: The Transformation Of Medicine, Information Technology And Intellectual Property - An International Interdisciplinary Conference http://www.law.ed.ac.uk/ahrc/conference09/ 1-3 April 2009, Berlin, Germany re:publica 2009 "Shift happens" http://www.re-publica.de/09/ Subconference: 2nd European Privacy Open Space http://www.privacyos.eu/ 4 April 2009, Paris, France French 2009 Big Brother Awards http://bigbrotherawards.eu.org/ 21-23 April 2009, Winchester, UK BILETA 2009 Annual Conference Call for Papers by 28 February 2009 http://www.winchester.ac.uk/?page=9871 11 May 2009, Brussels, Belgium GigaNet is organizing the 2nd international academic workshop on Global Internet Governance: An Interdisciplinary Research Field in Construction. Deadline for abstracts submissions is 20 March 2009. http://giganet.igloogroups.org/publiclibr/giganetcos/2009brusse 13-14 May 2009 Uppsala, Sweden Mashing-up Culture: The Rise of User-generated Content http://www.counter2010.org/workshop_call 24-28 May 2009, Venice, Italy ICIMP 2009, The Fourth International Conference on Internet Monitoring and Protection http://www.iaria.org/conferences2009/ICIMP09.html 1-4 June 2009, Washington, DC, USA Computers Freedom and Privacy 2009 http://www.cfp2009.org/ 5 June 2009, London, UK The Second Multidisciplinary Workshop on Identity in the Information Society (IDIS 09): "Identity and the Impact of Technology" Call for papers deadline: 13 March 2009 http://is2.lse.ac.uk/idis/2009/ 28-30 June 2009, Torino, Italy COMMUNIA Conference 2009: Global Science & Economics of Knowledge-Sharing Institutions Call for papers deadline: 1 March 2009 http://www.communia-project.eu/conf2009 2-3 July 2009, Padova, Italy 3rd FLOSS International Workshop on Free/Libre Open Source Software Paper submission by 31 March 2009 http://www.decon.unipd.it/personale/curri/manenti/floss/floss09.html 13-16 August 2009, Vierhouten, The Netherlands Hacking at Random http://www.har2009.org/ 23-27 August 2009, Milan, Italy World Library and Information Congress: 75th IFLA General Conference and Council: "Libraries create futures: Building on cultural heritage" http://www.ifla.org/IV/ifla75/index.htm 10-12 September 2009, Potsdam, Germany 5th ECPR General Conference, Potsdam Section: Protest Politics Panel: The Contentious Politics of Intellectual Property http://www.ecpr.org.uk/potsdam/default.asp 16-18 September 2009, Crete, Greece World Summit on the Knowledge Society WSKS 2009 http://www.open-knowledge-society.org/ October 2009, Istanbul, Turkey eChallenges 2009 Call for papers by 27 February 2009 http://www.echallenges.org/e2009/default.asp?page=c4p 16 October 2009, Bielefeld, Germany 10th German Big Brother Awards Deadlinea for nominations: 15 July 2009 http://www.bigbrotherawards.de/ 15-18 November 2009, Sharm El Sheikh, Egypt UN Internet Governance Forum http://www.intgovforum.org/ ============================================================ 15. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 29 members based or with offices in 18 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 3.0 License. See the full text at http://creativecommons.org/licenses/by/3.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

EDRi-gram newsletter - Number 7.4, 25 February 2009
by EDRI-gram newsletter 05 Jul '18

05 Jul '18

============================================================ EDRi-gram biweekly newsletter about digital civil rights in Europe Number 7.4, 25 February 2009 ============================================================ Contents ============================================================ 1. Data protection authorities support civil society on the Telecom Package 2. The trial of The Pirate Bay in Sweden 3. Lex Nokia storms into the Finnish Parliament 4. Italy to enforce a global censorship legislation? 5. Norwegian group joins Sweden-based Justice Center against Swedish FRA law 6. European Commission disbanded data protection experts group 7. Romanian data retention law suspendend by the Government 8. HADOPI law close of creating a dangerous precedent 9. UK Government ignores the European Commission regarding Phorm 10. EDRi participates in European project on raising privacy awareness 11. ENDitorial: Privacy in the Czech Republic - nothing to celebrate 12. Recommended Action 13. Recommended Reading 14. Agenda 15. About ============================================================ 1. Data protection authorities support civil society on the Telecom Package ============================================================ The Article 29 Working Group and the European Data Protection Supervisor have issued public statement supporting some of the arguments of the civil society, including EDRi, made in the recent open letter sent to the European Parliament on 17 February 2009 and in the campaign against "voluntary data retention". The open letter underlines the signatories' concerns related to those amendments of the Telecoms Package which might affect the Internet and Internet users, by targeting the open and non-discriminatory access features. Thus the fundamental users' rights such as privacy and freedom of speech are put in jeopardy. The Article 29 adopted on 10 February Opinion 1/2009 on the proposals amending the e-Privacy Directive, acknowledging its concerns regarding the present article 6 a) that "might lend legitimacy to large scale deployment of deep packet inspection both in the network and in user equipment such as ADSL boxes, while the current legal framework already details the cases in which traffic data may be processed for security purposes." Considering that "the wording proposed by the Commission establishes beyond all doubt that the processing of traffic data falls within the scope of the Data Protection Directive", the working group decided that the Article 6(6a) is unnecessary. A similar opinion is supported by the European Data Protection Supervisor's comments on some issues in the review of the Universal Service Directive. According to the text "he is concerned about the implementation of traffic management policies that require the monitoring of Internet usage and interception without appropriate data protection safeguards," and concludes that "Article 5 of the ePrivacy Directive applies whenever traffic management policies entail interception or surveillance of Internet usage. Therefore, to avoid confusion, it seems only just and reasonable to recognise that pursuant to this article informed consent from users is necessary." In the same document, EDPS tackles the 3 strikes procedure and considers as unfortunate its possible introduction in the Telecom package and notes that "it would have been preferable if the European Parliament had not given up to pressure by laying down the foundation for a three strikes approach and if all these issues had been addressed separately in different legal instruments, after careful analysis and debate." The EDPS supports the civil society in calling upon decision makers to re-introduce Amendment 138 and Article 32a of the Universal Service Directive that would strengthen the safeguards towards ensuring the protection of individuals' rights, including the right to data protection and privacy and due process. The Article 29's Opinion also tackles other aspects regarding the e-Privacy directive. Thus the document strongly supports "an extension of personal data breach notifications to Information Society Services (...) given the ever increasing role these services play in the daily lives of European citizens." This resonates with the initial Amendments of the European Parliament or with Peter Hustinx's public comments, who explains why the position of the Commission and the Council is not enough to protect the citizens in the online world: "That restriction means European citizens would only be alerted if their internet access or telephone company suffers security breaches. If their online bank is hacked or its security systems are cracked, enabling the unauthorised access to bank account information, citizens might not be notified. So, unless the amendments proposed by the European Parliament are adopted by the Council, online banks and other e-businesses would be off the hook." The Article 29 Working Group has also re-emphasised its earlier opinion "that unless the service provider is in a position to distinguish with absolute certainty that the data correspond to users that cannot be identified, it will have to treat all IP information as personal data, to be on the safe side". Thus the WG agrees with the Commission that a substantive provision of a directive is not the most suitable way of addressing this issue, and that a reporting obligation referring to "purposes not covered by this Directive" is not appropriate. Open letter to the European Parliament - Telecom Package (17.02.2009) http://www.edri.org/edrigram/campaigns/open-letter-telecom-package EU proposal puts confidential communications data at risk (28.02.2009) http://www.edri.org/campaigns/no-voluntary-data-retention All data breaches must be made public (29.01.2009) http://resources.zdnet.co.uk/articles/comment/0,1000002985,39603777,00.htm Opinion 1/2009 on the proposals amending Directive 2002/58/EC on privacy and electronic communications (e-Privacy Directive) (10.02.2009) http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2009/wp159_en.pdf EDPS comments on some issues in the review of the Directive 2002/22/EC (Universal Service) (16.02.2009) http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consu… EDRi-gram: Data breach notification - different opinions in EU bodies ? (19.11.2008) http://www.edri.org/edri-gram/number6.22/data-breach-ec ============================================================ 2. The trial of The Pirate Bay in Sweden ============================================================ The big, long and extremely mediatized trial filed on 31 January 2008 by Swedish prosecutors against the four Pirate Bay founders for "promoting other people's infringements of copyright laws" started at Stockholm's District Court, on 16 February 2009. The first day of the trial was dedicated to the opening statements of the prosecution and the defendants, the latter denying any criminal act. Prosecutor Hekan Roswall presented the claims of the plaintiffs Warner Bros, MGM, EMI, Colombia Pictures, 20th Century Fox, Sony BMG and Universal and spent most of the morning trying to describe how the Pirate Bay works suggesting it was a commercial organization with Carl Lundstrvm as a shareholder and financier of the company. The prosecutor made a presentation of a series of movie, music and game downloads "coordinated by The Pirate Bay" before 2006. He continued trying to explain the change from a seed status to that of a peer as part of the evidence previously gathered by the plaintiffs. The civil parties represented by IFPI and MPAA expressed the intention to ask for 11 million euro damages. The second day of the trial started with a big victory for The Pirate Bay founders with the dropping out of most part of the accusations against them. The prosecutor announced the defendants would not be accused of "assisting copyright infringement" changing the accusation into "assisting making available copyright material". The prosecutor was unable to prove that the .torrent files introduced as evidence were actually using The Pirate Bay's tracker. Furthermore, he has shown to be technically unprepared and failed to explain the function of DHT which allows for so called "trackerless" torrents. This means the screenshots the prosecution provided as evidence did not necessarily belong to The Pirate Bay's tracker. Pirate Bay claimed it did not break the law because it did not host or disseminate copyright-infringing content but only links to that content and reproached the prosecution, the police and the music industry of not understanding the technology. According to Fredrik Neij, the entire accusation was based on a technical misunderstanding. On 18 February, the prosecution asked for about 11 million euro compensation and damages on the basis that the defendants should have obtained worldwide licences for the content it distributed. The defence rejected any discussion related to damages considering there had been no damage. "EU directive 2000/31/EC says that he who provides an information service is not responsible for the information that is being transferred. In order to be responsible, the service provider must initiate the transfer. But the admins of The Pirate Bay don't initiate transfers. It's the users that do and they are physically identifiable people. They call themselves names like King Kong," was defence lawyer Samuelsson's statement to the court. "According to legal procedure, the accusations must be against an individual and there must be a close tie between the perpetrators of a crime and those who are assisting. This tie has not been shown. The prosecutor must show that Carl Lundstrvm personally has interacted with the user King Kong, who may very well be found in the jungles of Cambodia," the lawyer added. The plaintiffs insited on The Pirate Bay's behaviour that refused to withdraw the .torrent links from their index, except for the cases when the content did not correspond with the one announced by the user placing the torrent file. In the prosecution's opinion, this would make The Pirate Bay more than a simple technical intermediary. The defense argued that uploading a torrent does not imply that the copyrighted files are actually 'available', as the torrent has to also be seeded and that, on the other hand, torrent files are not linked exclusively on The Pirate Bay and can be found through other search engines, including Google. Two of the defendents were heard on the fourth day, the technician Frederik Neij and the administrator Gottfrid Svartholm Warg who were both pretty much sticking to their initial position. The day did not bring very much change. Neij proved that it was possible to create a torrent file and host it somewhere else, like on TorrentSpy using the trackers opened by The Pirate Bay to distribute the files, in which case The Pirate Bay cannot know what is exchanged. In his opinion, the prosecusion had not succeeded in proving that the incriminated files had been actually downloaded on The Pirate Bay. The lawyer of the movie industry tried to show that The Pirate Bay had an active role in the choice of the content presented by its users and asked Gottfrid Svartholm Warg whether the site had withdrawn content related to child pornography. The administrator replied that they had notified the police on such torrent files and they had retired them at the request of the police. "We can't do investigations of our own. And if the police say we should remove a torrent, we will," he said. Peter Sunde was interrogated on Friday morning. The strategy of the prosecusion seemed to be clearer than during the first days being focused on trying to prove that The Pirate Bay had been created with the purpose of gaining money from "pirating". The prosecutor tried to show that The Pirate Bay was actually managed by a hierarchical organization with a commercial purpose. However no material evidence was brought to support this idea. When asked what the purpose of The Pirate Bay was Sunde answered: "It is to enable users to share their material with others." "Even though it is copyrighted?" questioned Danowsky. "That can sometimes be the sad consequences," Peter replied. The defendant stated to the court that in his opinion the entire trial was a political one and that the reason for which the plaintiffs brought the case against The Pirate Bay was not the fight against illegal downloading of their works but a a fight to preserve the monopoly on the distribution means. The trial started again on 24 February when the prosecutor also added to the charges that the site allowed its users to upload torrents that it further on stored. Magnus Mertensson, a lawyer for the IFPI testified during the morning but the evidence brought by him consisted only of screenshots and the witness also admitted having difficulties in answering some technical questions. Both him and policeman Magnus Nilsson of the Anti-Piracy Office who was the next witness for the prosecution were unable to bring forth any real evidence that the Pirate Bay trackers were actually used for the downloads investigated. Mertensson admited that he had no evidence of having any contact with The Pirate Bay's tracker during the downloading he was claiming to have made from the site. Nilsson was made to admit that the actual downloading of the pirated files happened outside of The Pirate Bay. The trial is supposed to last until the 4 March 2009. We will present the conclusions of the trial in our next newsletter. The Pirate Bay trial: 1st day under the sign of boredom (only in French, 16.02.2009) http://www.numerama.com/magazine/12023-Proces-de-The-Pirate-Bay-1ere-journe… Half of Pirate Bay case dropped in courtroom drama (17.02.2009) http://www.out-law.com//default.aspx?page=9803 The Pirate Bay cries victory after the dropping out of some charges ! (only in French, 17.02.2009) http://www.numerama.com/magazine/12041-The-Pirate-Bay-crie-victoire-apres-l… The Pirate Bay (day 3): "We are winning on legal principles" (only in French, 18.02.2009) http://www.numerama.com/magazine/12066-The-Pirate-Bay-jour-3-Nous-gagnerons… Day 3 - The Pirate Bay's 'King Kong' Defense (18.02.2009) http://torrentfreak.com/g-defense-090218/ The Pirate Bay (day 4): "Are you a coward, Fredrik Neij ?" (only in French, 19.02.2009) http://www.numerama.com/magazine/12087-The-Pirate-Bay-jour-4-Etes-vous-un-l… Day 4 - Pirate Bay Defense Calls Foul Over Evidence (19.02.2009) http://torrentfreak.com/day-4-pirate-bay-defense-calls-foul-over-evidence-0… The Pirate Bay (day 5): Peter Sunde counter-attacks (only in French, 20.02.2009) http://www.numerama.com/magazine/12100-The-Pirate-Bay-jour-5-Peter-Sunde-co… Pirate Bay Trial Day 5: Peter's "Political Trial" (20.02.2009) http://torrentfreak.com/pirate-bay-trial-day-5-peters-political-trial-09022… Pirate Bay Trial Day 7: Screenshots for Evidence (24.02.3009) http://torrentfreak.com/pirate-bay-trial-day-7-screenshots-for-evidence-090… EDRI-gram: Pirate Bay in legal battle with IFPI (11.02.2009) http://www.edri.org/edri-gram/number7.3/piratebay-ifpi-battle ============================================================ 3. Lex Nokia storms into the Finnish Parliament ============================================================ Government bill dubbed as Lex Nokia, also known as the snooping law, entered the Parliament for debate on 24 February 2009. The bill has been widely criticized for heavy-handed treatment of fundamental rights, granting companies more rights than the police, suspicion of undue corporate pressure and vagueness and unclarity. The proponents of the law have continued making embarrassing gaffes: Communications Minister Suvi Lindin has said in an interview in Tampere newspaper Aamulehti that an employer currently has the right to order a strip-search of an employee if there is suspicion that the employee is leaking company secrets. Furthermore, Finance Minister Jyrki Katainen, has stated that he is not familiar with the contents of the bill, but supports it firmly, regardless. Yesterday's parliamentary debate consisted mainly of opponents of the law raising various concerns regarding fundamental rights, usefulness of the bill, increasing surveillance, bad drafting process etc. The defenders of the law kept repeating how opponents of the bill are ill-informed of its actual implications and how the bill improves the status of employee rights. The Left Alliance and the Social Democrats were calling for rejecting the bill and sending it back for a complete overhaul. TV news on 24 February reported about the law, stating that it is meant to prevent three things: * leakage of trade secrets * copying of copyrighted materials * disruption of corporate networks with attachments and malware. Unless this is some kind of mistake made by the news, this sheds a new light on the purpose of the bill. Government party lines seem to be holding, only the Greens (14 seats) are split on the issue. If the lines are not broken any further, the bill will pass even if all Greens vote against it, since the National Coalition (51 seats), the Centre (51) and the Swedish People's Party (10) have a majority in the 200-member strong parliament. The Greens have proposed limiting the bill so that the email log data is allowed to be examined only in cases where a company is investigating leakage of trade secrets. The content of the law is expected to be voted upon today, 25 February. The final vote, whether to pass or reject the bill, is expected next week. Lex Nokia Debate Ignites Parliament (24.02.2009) http://yle.fi/uutiset/news/2009/02/lex_nokia_debate_ignites_parliament__569… Labour Ministry official confirms threat of Nokia leaving Finland over law on electronic communications (24.02.2009) http://www.hs.fi/english/article/Labour+Ministry+official+confirms+threat+o… Lex Nokia furore fuelled further by minister4s strip-search remark (13.02.2009) http://www.hs.fi/english/article/iLex+Nokiai+furore+fuelled+further+by+mini… EDRi-gram: Snooping law, "Lex Nokia", proceeding slowly but surely in Finland (17.12.2008) http://www.edri.org/edri-gram/number6.24/nokia-law-finland-snooping (Contribution by Leena Romppainen - EDRi-member Electronic Frontier Finland) ============================================================ 4. Italy to enforce a global censorship legislation? ============================================================ The Italian Senate approved - and the Camera dei deputati (Italian "Low Chamber") is ready to finally pass - draft law 733 named Pacchetto sicurezza - "Security Package", a series of (supposely) coordinated provisions aimed at improve, whatever that means, police bodies and public prosecutor powers. Of course, the law wouldn't have been complete without "taking care" of the Internet, and legislators didn't loose the chance. Under sect. 50 bis of this forthcoming law, a public prosecutor which is given "serious circumstantial evidence" that an online activity of inciting crime has been committed, is allowed to ask the Minister of Home Affair to order the ISP's to shut down the "concerned" network resource. ISP refusal to comply with Minister's order should be fined with a penalty up to 250 000 Euros. The provision is clearly flawed from a constitutional standpoint. The basis of every western democracy, indeed, is separation of power, thus is not legally possible to have such a cross-jurisdiction mess between the public prosecutor (the judiciary power) and a Ministership (the executive power). Further more, there would be a double trial for the same fact, one of which (the Home Affair Ministership one), done without the legal guarantee of a criminal trial (fair process, etc.). But this is only the tip of the iceberg. Crime-inciting wrongdoing is very difficult to handle, since the border between free-speech and law violation is often blurred (would a website supporting freedom rebel of a country be - per se - inciting to commit crimes?). Further more, if ISP's must prevent access to a network resource located outside their network (abroad, for instance) this would mean that the result will be achieved through deep-packet inspection, or similar, privacy threathning techniques. Thus - with the excuse of "protecting" Italian citizens - the D'Alia amendment (named after the MP that proposed it) is likely to be the first step toward a global censorship system. A Cassinelli amendment (again, from the MP name of its author) that followed the D'Alia one, tried to circumvent the above mentioned problems, but with no real changes in the substance of the matter and the political, net-phobic approach. Italy had a "sound" tradition in trying to enforce citizen's global surveillance systems through ISP's and telco operators, adopting every sort of justifications (from copyright, to child pornography, to online gambling and now to crime-inciting actions). Oddly enough, nevertheless, these "good intentions" fell always on innocent citizens' shoulders, while true criminals stay absolutely free. Or, to put it straight: to (maybe) catch a few criminals, the whole nation network usage will be subjected to "third parties" - namely, ISP's - systematic scrutiny. So long, human rights. (Contribution by Andrea Monti - EDRi-member ALCEI -Italy) ============================================================ 5. Norwegian group joins Sweden-based Justice Center against Swedish FRA law ============================================================ The Norwegian organisation of the International Commission of Jurists (ICJ) has filed a petition, known as a Third Party Intervention, in support of the case brought to the European Court of Human Rights challenging the Sweden's FRA law that authorizes the Sweden's National Defence Radio Establishment (Fvrsvarets radioanstalt - FRA) to wiretap all telephone and Internet traffic that crosses Sweden's borders. The legislative package which was passed by the Parliament of Sweden on 18 June 2008 and took effect on 1 January 2009, was fiercely criticized and opposed in Sweden by the public, opposition parties, the appeal courts for Skene and Blekinge, Sweden's Customs Agency, the Data Inspection Board and even politicians belonging to the alliance government. A case was filed in July 2008 by the Sweden-based Justice Center (Centrum fvr Rdttvisa - CFR), which argued FRA's expanded powers to monitor cross-border communications traffic violated Article 8 and Article 13 of the European Convention on Human Rights guaranteeing the citizens' right to privacy and ensuring the citizens with the possibility to hold national authorities to account for possible human rights violations. According to Lawyer Robin Lvvf of the European University Institute in Florence who reported the Swedish law to the European Commission in August 2008, the law is in clear breach of fundamental rights governing the movement of goods and services in the European Union. Clarence Crafoord, head attorney with CFR welcomed the Third Party Intervention of the Norwegian group considering the initiative "offers additional perspectives about the problems with the FRA-law and it's good that it makes clear to the European Court of Human Rights that the law affects both Swedes and citizens in other countries." The Norwegian petition cites a report issued by the Norwegian Postal and Telecoms Agency in November 2008 which showed that most electronic communications traffic into and out of Norway as well as a large part of the domestic traffic passes through Sweden, the Swedish law therefore affecting the privacy rights of Norwegian citizens. Although the Swedish government brought some changes to the law with an amendment in September 2008, in ICJ-Norway's opinion the changes apply only to Swedish citizens or people residing in Sweden. The group believes that Norwegian citizens' communications are the "explicit target for the secret monitoring by Swedish authorities". "Norwegian citizens are still left lawless under the present legislation.(...) They are faced with the constant risk that their private communications which happen to pass Sweden's borders could be subject to interception and be subsequently stored, distributed, and misused by and at the absolute discretion of the Swedish authorities," writes ICJ-Norway in its petition. ICJ-Norway points out a series a deficiencies in the formulation of the law which includes vague definitions of the targeted communications, the lack of clear regulations on information storing, the lack of independent judicial control and the lack of possibility of response for the citizens whose communications are intercepted. Norwegian group joins case against Sweden's wiretapping law (13.02.2009) http://www.thelocal.se/17578/20090213/ Swedish surveillance law 'breaks EU rules' (13.08.2008) http://www.thelocal.se/13664/20080813/ Goverment getting closer to surveillance law compromise (25.09.2008) http://www.thelocal.se/14554/20080925/ Snoop law to be tried in European court (15.07.2008) http://www.thelocal.se/13052/20080715/ EDRI-gram: ENDitorial: Wiretapping - the Swedish way (27.08.2008) http://www.edri.org/edrigram/number6.16/wiretapping-swedish-way ============================================================ 6. European Commission disbanded data protection experts group ============================================================ The European Commission has decided to dismantle a group of experts that needed to review the European Data Protection Directive. The group was formed after a tendering process and included: Peter Fleischer, global privacy counsel for Google, David Hoffman, director of security policy and global privacy officer for Intel; Henriette Tielemans a privacy lawyer from a US law firm, Christopher Kuner, a privacy lawyer with another US law firm; and Jacob Kohnstamm, chairman of the Dutch data protection authority. Alex T|rk, the French Data Protection Authority President and the Chairman of Article 29 Working Party, has complained about the biased structure of the group explaining to a French Senate committee that the group was composed "four-fifths of personalities representing American interests." The committee submitting a resolution stating it was "unacceptable" that four members of the group "are either from American companies or law firms whose principal establishment is in the U.S." The group had just one meeting at the end of the last year and even though they were gathered for a one-year mandate the Commissioner Barrot, who is also a French, decided to disband the group and to broaden the consultation on the review of the 1995 data protection directive. In fact T|rk asked Barrot to look into the matter, and the latter acknowledged that "the situation was abnormal". T|rk explained that part of the problem was that there were major conceptual differences between the EU and US data protection principles: "Europeans must note that the gap is big between the American vision and the European vision." Draft Resolution regarding the nomination by the European Commission of an expert group on data protection. (6.02.2009) http://www.senat.fr/leg/ppr08-203.html European Commission Disbands Privacy Group (17.02.2009) http://www.clickz.com/3632816 ============================================================ 7. Romanian data retention law suspendend by the Government ============================================================ In a sudden and unexpected move, the Romanian Government has decided on 25 February 2009 to suspend the application of the data retention law until the end of the year - 31 December 2009. The official reason from the press release of the Ministry of Communications and Information Society are related to the: - complications that the law brings to the penal cases, especially in the initial phases of information gathering; - the area of the crimes for which the retained data is accessible is contested (by whom? -n.a.); - not all of the communications providers may ensure the management of the retained data; - not all the providers are ready to respect the legal provisions regarding the confidentiality of the accessed data. Even though the law was in a public consultation (but dormant-type phase) for almost 9 months, it seems that the Government is realizing that they didn't get the "perfect text". The privacy concerns do not appear in the press release, but a better "information campaign" on the law and its consequences is mentioned somewhere in a work plan. It is still unclear how the "suspension" will work. It seems that the Government would like to issue a new emergency ordinance that will postpone the application of the law. It remains to be seen if the new text of the law supported by the Ministry will be better or worst than the present one. Application of the data retention law - postponed until the end of 2009 (only in Romanian, 25.02.2009) http://economie.hotnews.ro/stiri-telecom-5447913-aplicarea-legii-stocare-da… Minsitry of Communications and Information Society (only in Romanian, 25.02.2009) http://media.hotnews.ro/media_server1/document-2009-02-25-5447934-0-comunic… ============================================================ 8. HADOPI law close of creating a dangerous precedent ============================================================ On 18 February 2009, Christine Albanel, French Minister of Culture, presented to the Chamber of Deputies the controversial Criation et Internet draft law (so called Hadopi law) calling for the creation of a government agency to manage the graduated response (or three-strike) process. The law which was passed by the Senate in October 2008 was discussed by the deputies in the legal commissions with amendments to be presented during the debates starting on 4 March. As previously during the long discussions having taken place for some years now, during the debates in the legal commissions, any amendment proposed in the direction of a global license, such as the "creative contribution" proposed by the socialist Patrick Bloche was rejected. The proposed mechanism would have implied a fee paid by the Internet subscribers to their ISP for legal downloading of copyrighted material. The fees collected could be used to remunerate artists for their work. "With a universal licence, the money recuperated will not uniquely go into the pockets of the producers, which is definitely the case now. Today, artists' royalty payments are significantly less, while the (media companies') royalty payments are considerably more," said Bloche. According to Nicolas Maubert, an attorney with law firm Gide Loyrette Nouel, if voted in the present form, the law might still be challenged by France's judicial body. Blocking Internet access as a sanction might breach constitutional protections guaranteed by the French Constitutional body (Conseil Constitutionnel) said Maubert, who added that a graduated response initiative is not a necessarily a bad thing in itself: "It still seems legitimate to question whether blocking the access to the internet is indeed a 'proportionate measure.' Especially these days, just imagine yourself without access to the internet, with no e-mails, no information." In the meantime, as a positive balance, according to reports from the European Parliament, the also very controversial Medina report containing a range of measures in support of copyright enforcement, including increased liability for ISPs, secondary liability for peer-to-peer sites and graduated response, has been postponed and apparently even removed from the European Parliament's agenda. Having in view the very strong opposition reaction from citizens all over Europe, it appears the socialist group in the European Parliament blocked the report for fear of losing votes at the next elections. If the Medina report had been pushed to the plenary, it would have also created a problem for the Telecoms Package.The Parliament miight not have passed it, supporting Amendment 138 which is against graduate response. "Thousands of emails and phone calls from concerned citizens reached the parliament. The outcome proves that informed citizens can altogether become stronger than a small obscurantist industry pressure group. We must consolidate this victory by guaranteeing, through the second reading of the Telecoms Package, that Internet remains the most fantastic advance for our societies since the invention of the printing press."declared Jirimie Zimmermann, co-founder of La Quadrature du Net. Antipiracy Law: "the creative contribution" of the Socialist Party rejected (only in French, 20.02.2009) http://www.01net.com/editorial/403824/loi-antipiratage-la-contribution-crea… French Legislature Puts Finishing Touches On Ambitious File-Sharing Law (23.02.2009) http://www.ip-watch.org/weblog/2009/02/23/french-legislature-puts-finishing… Medina report indefinitely abandoned (22.02.2009) http://www.iptegrity.com/index.php?option=com_content&task=view&id=259&Item… Copyright dogmatism temporarily kicked out of European Parliament (19.02.2009) http://www.laquadrature.net/en/copyright-dogmatism-temporarily-kicked-out-e… Christine Albanel defends the antipiracy law in front of the deputies (only in French, 18.02.2009) http://www.01net.com/editorial/403753/christine-albanel-defend-la-loi-antip… EDRi-gram: One more step for France in adopting the graduated response (5.11.2008) http://www.edri.org/edrigram/number6.21/french-senate-adopts-3-strikes ============================================================ 9. UK Government ignores the European Commission regarding Phorm ============================================================ On 12 February 2009, the European Commission warned it would take formal action against the UK Government for not providing the requested information on the past trials of the Phorm ad-serving technology. The Commission has sent three letters until now requesting information on the secret trials by BT of Phorm, the latest having been sent at the end of January 2009. No satisfactory answers have been received so far, the response having focused only on future deployments without addressing the question of the past trials. The trials, conducted in 2006 and 2007, tracking the browsing behaviour of BT customers without their consent, resulted in complaints from privacy campaigners, peers, and politicians who argued that the actions were in breach of UK interception and data-protection laws. In July 2008, technology campaigner Alexander Hanff made a complaint to the police force considering the BT trials were not in compliance with RIPA and the Data Protection Act as the customers' consent had not been required. However, the City of London police informed Hanff in September 2008 that they would not continue the investigation for "lack of criminal intent". "One of the main reasons for this decision is the lack of criminal intent on behalf of BT and Phorm in relation to the tests. It is also believed that there would have been a level of implied consent from BT's customers in relation to the tests, as the aim was to enhance their products," wrote detective sergeant Barry Murray. Although UK regulators have provided rules for the future deployments of Phorm which require the company to not retain website history data, exclude sensitive search topics and obtain the customer's agreement also providing information of the respective technology, according to UK's EDRi-member Open Rights Group, it is not yet clear whether the consent of both the users and the visited websites is required. "Unless the ISPs employing Phorm's technology to intercept the communications between their customers and the owners of the websites their customers are visiting have the explicit consent of both parties, they are likely to be committing an offence under the Regulation of Investigatory Powers Act (RIPA), the legislation that governs interception of communications in the UK," stated the group. In spite of the repeated questions and investigations and disregarding the European Commission's warning, Phorm goes on. The company's CEO stated during an interview on 9 February that the system would be active in the UK by the end of 2009. The company has also signed deals with another two big UK ISPs, Carphone Warehouse and Virgin Media. EC warns gov't over Phorm foot-dragging (12.02.2009) http://news.zdnet.co.uk/security/0,1000000189,39615480,00.htm BT finishes trial, expects to use Phorm (15.12.2008) http://news.zdnet.co.uk/communications/0,1000000085,39578006,00.htm Police drop investigation into BT's Phorm trials (23.09.2008) http://news.zdnet.co.uk/security/0,1000000189,39492793,00.htm Phorm: damn the EU, full speed ahead! (11.02.2009) http://arstechnica.com/tech-policy/news/2009/02/phorm-damn-the-eu-full-spee… EU calls phoul over ad company Phorm's invasive snooping (15.08.2008) http://arstechnica.com/old/content/2008/08/eu-calls-phoul-over-ad-company-p… EDRIgram: UK: Phorm threat (28.01.2009) http://www.edri.org/edri-gram/number7.2/phorm-uk ============================================================ 10. EDRi participates in European project on raising privacy awareness ============================================================ EDRi is one of the partners in a new European project initiated by the French Human Rights League (LDH), which aims to raise awareness on the privacy aspects, especially among the young generation. The project initiated by LDH and started on 1 January 2009 comprises, besides EDRI, another European Human Rights Network - European Association for the Defense of Human Rights (EAHR) and two national members - Pangea (in Spain) and Iuridicum Remedium (in Czech Republic). The project is funded by the European Commision within the framework of the Program on fundamental rights and citizenship - transnational projects. This project aims to help a large group of young people, teenagers and young adults to become vigilant about the protection of their personal data, to sensitise them on subjects which may seem trivial. A first meeting was held on 13-14 February 2009 when all project members met for the first time to better define the main two objectives: a) The analysis and comparison of some privacy invasive technologies in the selected countries, the identification of good and worst practices, applicable legislation and its implementation, relevant awareness campaigns. b) The production of an awareness tool aimed at young adults dealing with sensitive subjects in all countries, which are not sufficiently handled or specifically aimed at this target population. In this case our objective is to influence these practices and go against the tendency which professes "I have nothing to hide therefore nothing to fear, so no problem" with an accent upon "why should they care and how to do it". Human Rights League France http://www.ldh-france.org/ European Association for the Defense of Human Rights http://www.aedh.eu/?lang=en Pangea http://www.pangea.org/ Iuridicum Remedium http://www.iure.org ============================================================ 11. ENDitorial: Privacy in the Czech Republic - nothing to celebrate ============================================================ For the third time the Council of Europe has proclaimed 28 January the European Data Protection Day. EDRi-member Iuridicum Remedium (IuRe) reminds that the safety of Czech citizens4 personal data is still seriously endangered. Some of the most pressing issues are listed below. RFID based Opencard (or Praguer4s Universal Card) is now being promoted as an electronic travel card for public transportation. However, the contactless chip card formerly used for parking payment and as a library ID is not secure. The contactless chip can be read remotely and the data stored on it can be linked with the central database containing personal data. The system thus allows for movement tracking, especially at the electronic gates which are going to be introduced in Prague metro. In relation with the Opencard4s drawbacks, IuRe initiated a petition at the beginning of September 2008, which demands the deletion of both Opencard holder data and usage data from the central database after the card4s expiration and an observance of database administrator4s duty to allow user4s data deletion upon request. "We also demand an implementation of an anonymous Opencard at the same price as an ordinary Opencard," reports Filip Pospmsil from IuRe. The petition has already been signed by almost 700 people. The Municipal authorities of Prague began to sell anonymous cards on the 17 December 2008. However, there is an extra 8 EUR charge and since only transferable season transport tickets can be purchased with such a card, the price for the annual travel becomes significantly higher. The Praguers effectively have to pay extra for their privacy protection and IuRe will stand out for an implementation of non-discriminatory anonymous card, i.e. the card allowing to use the service at the same price without unnecessary disclosure of personal data. The Municipal Council of the city of Prague received a Big Brother Award 2008 for the Opencard project in "Worst Public Agency Privacy Intruder" category. Visa Waiver The term Visa Waiver refers to a set of agreements related to the abolition of the visa requirement for Czech citizens traveling to the USA. These agreements allow the American authorities access to personal data of the Czech citizens in Czech state authorities4 databases, including biometric data. The access is given as a compensation for the abolition of visa requirements, but in fact the paper visa have been merely replaced by the virtual visa - a system of detailed electronic questionnaires based on which the applicant can still be refused entry to the USA. "In the case of the Czech Republic the agreements where not negotiated properly with Czech Data Protection Agency and their comments were not respected," points out Filip Pospmsil from IuRe. The complementary Agreement on strengthening the cooperation for the prevention and fight against serious crime was approved by the government on the 4 December 2008. However, the Government disregarded the comments of the Czech Data Protection Agency and other state authorities. At the beginning of 2009, IuRe urged the MEPs and senators to not approve the proposed agreement. IuRe has made an attempt to find out the scale of personal data which had been promised by the Czech authorities to be handed over to the American authorities as well as the conditions of the data protection. The official request for information has been submitted to the Ministry of Internal Affairs by the end of 2008. "The request was concerning another visa waiver related memorandum on establishing of the Combating Terorism Center and the Electronic System of Travelling Registration (ESTA)," specifies Filip Pospmsil from IuRe. However, the memorandum is classified as secret and thus neither IuRe nor any other ordinary citizens know which of their personal data is being handed over. Privacy and bank sector The new Police Law was negotiated and approved in 2008. IuRe together with the bank sector and the Czech Bank Association have been criticizing the new power of the Czech Police to request data about the location and time of electronic card payments from banks, and particularly, the ability to access bank information systems. "We have been submitting comments during the negotiation of this law, but while some others have been accepted, our objection against this competence was not" reports Helena Svatosova, a lawyer from IuRe. According to IuRe, the government document named "The enhancement of the communication system between financial institutions and state authorities" introduces since the fall of 2008 the intention to create a central evidence of financial institutions4 clients and their operations. The evidence would then be available to an unspecified range of public administration authorities. "In our opinion, it's very disturbing that despite the list of related agencies being rather long, there is no mention of the involvement of the Data Protection Office," interprets Helena Svatosova from IuRe who plans to keep an eye on this issue in the future. IuRe has notified both the Czech Data Protection Office and the Bank Association about the issue and asked them for their opinion. Data retention EU directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communication services has been implemented into the national legislation since the beginning of 2006. In November 2007, Minister of Industry and Trade Martin Rmman proposed an amendment which would allow the secret service and the military intelligence a direct access to those data. Although he has abandoned the idea under the pressure from the media and politicians, intelligence services gained access through the "backdoor" in the new Police Law. There is a legal proceeding submitted by Ireland (suported by Slovakia) going on against the directive at the European Court of Justice, as well as at both Hungarian and German constitutional courts. IuRe has also been preparing the trial of the "data retention" provision of a law in respect of its constitutionality and compliance with human-right obligations of the Czech Republic; the plan is to approach lawmakers with the proposal for an annulment of a part of the law, and gather enough support to submit the proposal to the Czech Constitutional Court. Video surveillance The volume of CCTVs has been on a sharp increase in recent years. However, the Czech legislation has not reflected this development in any way. In December last year the Government Council for Human Rights accepted a proposal of a Committee for Civil and Political Rights. The proposal has been initiated by IuRe and aims at introducing a conceptual regulation of CCTV4s usage in public. IuRe has emphasised the necessity of such an adjustment for several years. "Thus, the resolution of Council of Government is a significant achievement of our campaign, which leads to a more transparent usage of CCTV systems regulated by strict rules," declared Filip Pospmsil from IuRe. The proposal should allow private persons to use CCTV only in order to protect their own property and family; public authorities should be allowed to make a record only in the public interest and only for purposes defined by the law. The proposal should also prevent the excessive personal data processing and stipulate a duty of the CCTV owner to inform about the CCTV surveillance within its range. The aim of the proposal is also to strictly regulate the retention of records, as well as the duty to clearly state and document the exact purpose of each CCTV installation by the police or another security agency. IuRe has already tried to pursue the legal regulation of CCTV through the Police law approved in June 2008 with the help of MP Katerina Jacques. Minister of Interior Ivan Langer has rejected the proposal, but has promised that his ministry will, in cooperation with the MP and Czech Data Protection Office, prepare amendments of the Act on Personal Data Protection containing proposed amendments. Negotiations are still ongoing with IuRe participating. Passengers Name Records (PNR) Passengers Name Records (PNR), the database of information about airline passengers has originally been used only by the aviation companies. But after the 9/11, the American Security Authorities have started making pressure on aviation companies to provide the detailed data of their passengers. This practice did not have a legal ground in most countries and the agreement between EU and the USA was found illegal by the European Court of Justice. The provisional agreement, built on the same illegal base in summer 2007, was called back from negotiations in the Czech Parliament by Foreign Affairs Minister after IuRe had sent a letter to MPs raising concerns against the approval of the agreement. After difficult negotiations, the EU came up with a new agreement on PNR data exchange with the USA in June 2007. In the Czech Republic the proposal of the agreement has not gone through an ordinary legislative process and only the Data Protection Office expressed its opinion: the proposal brings a deterioration of personal data protection level against previous agreements, as US authorities will acquire access to personal data of people without guaranteeing basic rights.( for example the right of correcting of false statements, etc.) IuRe has also approached a number of parliamentarians expressing concerns about the agreement and this resulted in the fact that the agreement did not obtain the support of the Foreign Affairs committee of the Czech Parliament. Also the Senate Standing Commission for Privacy Protection expressed its negative position. IuRe believes that the Parliament will demonstrate its sovereign role and will not approve this agreement at the forthcoming session. This article has been written as a part of the "Reclaim Your Rights in the Digital Age" project supported by the Trust for Civil Society in Central and Eastern Europe Foundation. (contribution by EDRi-member Iuridicum Remedium- Czech Republic) ============================================================ 12. Recommended Action ============================================================ Announcement of the second Privacy Open Space Conference in Berlin, 1-3 April 2009. After the successful finish of the first year of the EU-funded project Privacy Open Space (PrivacyOS) the project starts the New Year with the announcement of the Second PrivacyOS Conference. As the first PrivacyOS Conference in October 2008 in the European Parliament in Strasbourg was co-located with the International Conference of Privacy and Data Protection Commissioners, also the second PrivacyOS Conference will be held alongside with "re:publica", a conference to establish collective interfaces with other EU projects as well as national and international networks. After the positive feedback on the first conference, the second PrivacyOS Conference will also follow the Open Space approach and therefore invites all participants to bring topics to the agenda. "It leaves room for spontaneous creation of new workshops during the conference which reflects the dynamics of the discussion among participants" says Jan Schallabvck, the project Manager of PrivacyOS. "Only a set of timeslots is predefined. The topics for each of the slots are introduced and moderated by the participants themselves." This approach ensures that all topics relevant to the participants are included and that fields of common interest can be detected and worked on, while taking into account different perspectives across Europe and beyond. The second PrivacyOS Conference will focus on "Enabling Privacy on the Web". Visitors of the "re:publica" are invited to partly join the Open Space slots and to discuss with the PrivacyOS Project Partners about privacy issues or their experiences on this field. Thereby, an opportunity to articulate and exchange best practices, challenges and solutions is given. The conference primarily addresses legal and technical IT experts, interested manufacturers of IT products or services as well as data protection authorities. All persons interested in privacy or data protection aspects are welcome to register for the event. Project website http://www.privacyos.eu/ . Invitation PrivacyOS - Berlin https://www.privacyos.eu/images/111_PrivacyOS_Invitation_Berlin.pdf ============================================================ 13. Recommended Reading ============================================================ Report: The Abolition of Freedom Act 2009 This UCL SHRP research report, edited by the Guardian's Liberty Central columnist Henry Porter, was complied for The Convention on Modern Liberty on 28 February and marks the beginning of a research project that seeks to reflect on legislation since the Human Rights Act 1998 and the unintended consequences it has had on rights and liberties in the UK. http://www.uclshrp.com/exchange/report_the_abolition_of_freedom_act_2009/ http://www.uclshrp.com/images/uploads/pdf/Abolition_of_Freedom_Act_2009.pdf The Article 29 Working Party - 69th plenary session - Search Engines (10-11.02.2009) http://ec.europa.eu/justice_home/fsj/privacy/news/docs/pr_12_02_09_en.pdf The Article 29 Working Party - 69th plenary session - Press Release (11.02.2009) http://ec.europa.eu/justice_home/fsj/privacy/news/docs/pr_11_02_09_final_en… ============================================================ 14. Agenda ============================================================ 18-20 March 2009, Prague, Czech Republic The Responsibilities of Content Providers and Users http://www.media-conference.cz 18-20 March 2009, Athens, Greece WebSci'09: Society On-Line http://www.websci09.org/ 23 March 2009, Berlin, Germany German-French Experts Meeting on Technologies for Electronic Identification http://www.e-identify-df.de/ 26-27 March 2009, London, UK 5th Communia Workshop: Accessing, Using, Reusing Public Sector Content and Data http://www.communia-project.eu/ws05 27-29 March 2009, Manchester, UK Oekonux Conference: Free Software and Beyond The World of Peer Production http://www.oekonux-conference.org/ 28 March 2009, London, UK Open Knowledge Conference (OKCon) 2009 http://www.okfn.org/okcon/ 29-31 March 2009, Edinburgh, UK Governance Of New Technologies: The Transformation Of Medicine, Information Technology And Intellectual Property - An International Interdisciplinary Conference http://www.law.ed.ac.uk/ahrc/conference09/ 1-3 April 2009, Berlin, Germany re:publica 2009 "Shift happens" http://www.re-publica.de/09/ Subconference: 2nd European Privacy Open Space http://www.privacyos.eu/ 4 April 2009, Paris, France French 2009 Big Brother Awards http://bigbrotherawards.eu.org/ 21-23 April 2009, Winchester, UK BILETA 2009 Annual Conference Call for Papers by 28 February 2009 http://www.winchester.ac.uk/?page=9871 11 May 2009, Brussels, Belgium GigaNet is organizing the 2nd international academic workshop on Global Internet Governance: An Interdisciplinary Research Field in Construction. Deadline for abstracts submissions is 20 March 2009. http://giganet.igloogroups.org/publiclibr/giganetcos/2009brusse 13-14 May 2009 Uppsala, Sweden Mashing-up Culture: The Rise of User-generated Content http://www.counter2010.org/workshop_call 24-28 May 2009, Venice, Italy ICIMP 2009, The Fourth International Conference on Internet Monitoring and Protection http://www.iaria.org/conferences2009/ICIMP09.html 1-4 June 2009, Washington, DC, USA Computers Freedom and Privacy 2009 http://www.cfp2009.org/ 5 June 2009, London, UK The Second Multidisciplinary Workshop on Identity in the Information Society (IDIS 09): "Identity and the Impact of Technology" Call for papers deadline: 13 March 2009 http://is2.lse.ac.uk/idis/2009/ 28-30 June 2009, Torino, Italy COMMUNIA Conference 2009: Global Science & Economics of Knowledge-Sharing Institutions Call for papers deadline: 1 March 2009 http://www.communia-project.eu/conf2009 2-3 July 2009, Padova, Italy 3rd FLOSS International Workshop on Free/Libre Open Source Software Paper submission by 31 March 2009 http://www.decon.unipd.it/personale/curri/manenti/floss/floss09.html 13-16 August 2009, Vierhouten, The Netherlands Hacking at Random http://www.har2009.org/ 23-27 August 2009, Milan, Italy World Library and Information Congress: 75th IFLA General Conference and Council: "Libraries create futures: Building on cultural heritage" http://www.ifla.org/IV/ifla75/index.htm 10-12 September 2009, Potsdam, Germany 5th ECPR General Conference, Potsdam Section: Protest Politics Panel: The Contentious Politics of Intellectual Property http://www.ecpr.org.uk/potsdam/default.asp 16-18 September 2009, Crete, Greece World Summit on the Knowledge Society WSKS 2009 http://www.open-knowledge-society.org/ October 2009, Istanbul, Turkey eChallenges 2009 Call for papers by 27 February 2009 http://www.echallenges.org/e2009/default.asp?page=c4p 16 October 2009, Bielefeld, Germany 10th German Big Brother Awards Deadlinea for nominations: 15 July 2009 http://www.bigbrotherawards.de/ 15-18 November 2009, Sharm El Sheikh, Egypt UN Internet Governance Forum http://www.intgovforum.org/ ============================================================ 15. About ============================================================ EDRI-gram is a biweekly newsletter about digital civil rights in Europe. Currently EDRI has 29 members based or with offices in 18 different countries in Europe. European Digital Rights takes an active interest in developments in the EU accession countries and wants to share knowledge and awareness through the EDRI-grams. All contributions, suggestions for content, corrections or agenda-tips are most welcome. Errors are corrected as soon as possible and visibly on the EDRI website. Except where otherwise noted, this newsletter is licensed under the Creative Commons Attribution 3.0 License. See the full text at http://creativecommons.org/licenses/by/3.0/ Newsletter editor: Bogdan Manolea <edrigram(a)edri.org> Information about EDRI and its members: http://www.edri.org/ European Digital Rights needs your help in upholding digital rights in the EU. If you wish to help us promote digital rights, please consider making a private donation. http://www.edri.org/about/sponsoring - EDRI-gram subscription information subscribe by e-mail To: edri-news-request(a)edri.org Subject: subscribe You will receive an automated e-mail asking to confirm your request. unsubscribe by e-mail To: edri-news-request(a)edri.org Subject: unsubscribe - EDRI-gram in Macedonian EDRI-gram is also available partly in Macedonian, with delay. Translations are provided by Metamorphosis http://www.metamorphosis.org.mk/edrigram-mk.php - EDRI-gram in German EDRI-gram is also available in German, with delay. Translations are provided Andreas Krisch from the EDRI-member VIBE!AT - Austrian Association for Internet Users http://www.unwatched.org/ - Newsletter archive Back issues are available at: http://www.edri.org/edrigram - Help Please ask <edrigram(a)edri.org> if you have any problems with subscribing or unsubscribing. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[tor-talk] Freedom not Fear 2012: Great opportunity for Tor advocacy
by Fabian Keil 05 Jul '18

05 Jul '18

There's an upcoming bar camp in Brussels (2012-09-14 - 2012-09-17) that is relevant to our interests, but doesn't seem to be on the calendar yet: http://www.freedomnotfear.org/ https://wiki.vorratsdatenspeicherung.de/Freedom_Not_Fear_2012 It's likely to be attended by a fair number of non-technical people who strongly care about privacy and can reach other people that feel the same, but for various reasons aren't using Tor already, or use it but have misconceptions about what it protects against. It would be great if an official member of the Tor project could make it. People who are willing to provide the EU with a bunch of personal information additionally may be able to meet with representatives of the EU commission and the EU parliament and qualify for a travel allowance of up to 120 EUR. For details see: https://shop.foebud.org/fahrt-nach-bruessel-zu-den-aktionstagen-freedom-not… I intend to be there and feel confident talking about Tor in general, arm and Vidalia (which I only use as monitor, though), but I'm not in a good position to say more than a couple of words about e.g. Orbot, Tor cloud, TBB or Obfsproxy. Fabian _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Tor Browser Bundle 1.2.8 released
by Andrew Lewman 05 Jul '18

05 Jul '18

Tor Browser Bundle 1.2.8 is released. The big changes are the inclusion of statically linked openssl dlls to resolve a few geoip lookup and functionality issues with Vidalia, and the upgrade to the new Vidalia 0.2.2. Available at https://torproject.org/torbrowser The full list of updates and fixes: * update Torbutton to 1.2.2 * update Vidalia to 0.2.2 * compile OpenSSL 0.9.8k with Visual C to make dlls * update Pidgin to 2.6.1 Full post at https://blog.torproject.org/blog/tor-browser-bundle-128-released -- Andrew Lewman The Tor Project pgp 0x31B0974B Website: https://torproject.org/ Blog: https://blog.torproject.org/ Identi.ca: torproject ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[p2p-hackers] Re: anon-layer comparison
by Euseval＠aol.com 05 Jul '18

05 Jul '18

jetiants http://www.jetiants.tk Gnu-net http://www.ovmj.org/GNUnet/ I2p http://www.i2p.net/ Tor http://freehaven.net/tor/ These may be naive questions (I don't know GNUnet too well), but > hopefully I am about to learn something: GNUnet tries to achieve at > least three goals at the same time that are not perfectly understood > and should rather be treated individually: > > - anonymity > - censor resistance > - high-performance document distribution Performance is a secondary goal to the first 2 in GNUnet. The first 2 are related so I'm not sure how or why they need to be treated separately. > Also, don't the shortcomings of mix networks also apply to Freenet- / > GNUnet-style anonymization schemes? > I suspect that no matter what (existing) adversary > model you pick, plugging a good mix network into your design on the > transport layer gives you the highest anonymity possible. I don't know how GNUnet's architecture compares to mix networks. I *do* know that GNUnet attempts to protect against traffic analysis. If you think mix networks are better, they better have good protection against traffic analysis. Can you point us to any good URLs or papers on how mix networks protect against traffic analysis? Chris _______________________________________________ p2p-hackers mailing list p2p-hackers(a)zgp.org http://zgp.org/mailman/listinfo/p2p-hackers _______________________________________________ Here is a web page listing P2P Conferences: http://www.neurogrid.net/twiki/bin/view/Main/PeerToPeerConferences ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]

1 0

Re: SSL fro hidden services
by loki tiwaz 05 Jul '18

05 Jul '18

hi, >>>>That said, the certificate naming scheme may be way off, since there's >>>>no concept of a valid certificate (I doubt verisign will want to sign >>>>one for 786237261871621.onion :) i am considering running an onion-based CA which could be used... i simply need to make a script which allows a user to sign a certificate signing request and produce a signed server key. the server key only needs to have its onion address as content, nothing more is required, and a link to import the CA key into the browser so that it can be trusted automatically by the browser. >>>>However, assuming the user installs your self-signed cert, it *should* >>>>work the same unless there's something I'm missing.) >>>> >>>>Of course, you're really just protecting content from being sniffed >>>>between the user and the entry node (usually, the same machine, but not >>>>always), and the exit node and the hidden service (presumably, you >>>>control both). >>>> >>>>This is my understanding of it -- if someone has a better one please >>>>step on me without hesitation :) yes, this is the case, and it is a valid reason to use ssl. in my opinion, since tor already uses multi-layered encryption anyway, one more layer at the core is not going to create that much of an extra load on the server, and it means that there is no way the traffic can be sniffed at any point - for example a trojan could sniff localhost traffic. also, using onion routing defeats the one way in which SSL can be attacked, by man-in-the-middle intermediaries on the network pathway, which of course cannot be known within the tor network. Also, it should be noted that tor exit nodes could potentially be modified to become men-in-the-middle, although this would not be possible without compromising the key of the server being contacted - another aspect of the advantage of using tor. onion addresses are impossible to remember though - which brings me to another idea - of a name resolution system within the tor network so simpler names can be used. this would require a second directory system, i don't know if it is practical or not, but i thought i should put the idea out there because i2p has name resolution systems, and benig able to type in oniondomainname.onion rather than u15syoa125au.onion would be nice. it would increase the rate of take-up of hidden services, both use and hosting. onion domains could be propagated throughout the onion network, so that every tor node can translate a name into an onion hashed address. there would also need to be a system to prevent name spoofing... how to ensure there is no collisions of names would be tricky - very likely it would require a set of authoritative name servers similar to how there is authoritative onion directory servers. ah dammit, i am always ideas ideas ideas and so little action... prioritising goals is something i find difficult... i think i should make this idea a priority, however, which means joining the dev effort and, at the very least, defining a protocol, if not implementing code... well, anyway, i have put the idea out now. i think that the idea is a good one. tor is coming of age now and ideally tor should aim to provide all of the features one would expect in an internet layer, but with the guiding principle of protecting anonymity always ascendant. an onion-based CA would work much better if the name-resolution system were in place, so i think it should be the priority. loki _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[Politech] New law targets online activities designed "to annoy" others [fs]
by Declan McCullagh 05 Jul '18

05 Jul '18

The prohibition: "Whoever...utilizes any device or software that can be used to originate telecommunications or other types of communications that are transmitted, in whole or in part, by the Internet... without disclosing his identity and with intent to annoy, abuse, threaten, or harass any person...who receives the communications...shall be fined under title 18 or imprisoned not more than two years, or both." FAQ: http://news.com.com/2100-1028_3-6025396.html --- http://news.com.com/2010-1028_3-6022491.html Perspective: Create an e-annoyance, go to jail By Declan McCullagh January 9, 2006, 4:00 AM PST Annoying someone via the Internet is now a federal crime. It's no joke. Last Thursday, President Bush signed into law a prohibition on posting annoying Web messages or sending annoying e-mail messages without disclosing your true identity. In other words, it's OK to flame someone on a mailing list or in a blog as long as you do it under your real name. Thank Congress for small favors, I guess. This ridiculous prohibition, which would likely imperil much of Usenet, is buried in the so-called Violence Against Women and Department of Justice Reauthorization Act. Criminal penalties include stiff fines and two years in prison. "The use of the word 'annoy' is particularly problematic," says Marv Johnson, legislative counsel for the American Civil Liberties Union. "What's annoying to one person may not be annoying to someone else." [...remainder snipped...] _______________________________________________ Politech mailing list Archived at http://www.politechbot.com/ Moderated by Declan McCullagh (http://www.mccullagh.org/) ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Tor Browser Bundle 1.2.8 released
by Andrew Lewman 05 Jul '18

05 Jul '18

Tor Browser Bundle 1.2.8 is released. The big changes are the inclusion of statically linked openssl dlls to resolve a few geoip lookup and functionality issues with Vidalia, and the upgrade to the new Vidalia 0.2.2. Available at https://torproject.org/torbrowser The full list of updates and fixes: * update Torbutton to 1.2.2 * update Vidalia to 0.2.2 * compile OpenSSL 0.9.8k with Visual C to make dlls * update Pidgin to 2.6.1 Full post at https://blog.torproject.org/blog/tor-browser-bundle-128-released -- Andrew Lewman The Tor Project pgp 0x31B0974B Website: https://torproject.org/ Blog: https://blog.torproject.org/ Identi.ca: torproject ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0