Secret Microsoft doc leaks, DMCA notice fails to contain it

It's no secret that online service providers cooperate with law enforcement agencies and will hand over personal information of various kinds when subpoenaed, subject to court order, or compelled by search warrant. What is secret has been exactly what information these companies store about their users, and what they will hand over to the authorities when required. In recent days a series of these documents have been leaked to whistle-blowing site Cryptome. The policies of (among others) Facebook, AOL, and Skype have all been posted to the site, and several more were posted last December, including those of Verizon, Sprint, and Yahoo.

While most companies have not responded to these leaks, Yahoo, back in December, and Microsoft, whose Global Criminal Compliance Handbook was posted on Saturday, both issued DMCA takedown notices to have the documents removed. In both cases, Cryptome refused to take any action. Yahoo's demand went no further, but Microsoft decided to take things to the next stage, and told Cryptome's ISP, Network Solutions, to take the site down. Network Solutions duly complied. Microsoft now has 14 business days to begin litigation, after which the site will be reinstated.

John Young, Cryptome editor, notes that only Microsoft and Yahoo have "behaved like assholes" and taken legal action to try to get the documents removed. Though the other companies are no doubt far from thrilled to have their internal documents posted, they have not seen fit to take any action as a result. Cryptome, for its part, has moved to a temporary new host, and all the documents remain available to download.

The information that Microsoft could give to law enforcement is for the most part exactly the information one would expect. They cover the full range of Microsoft's online services; Hotmail, Windows Live ID, Windows Live Messenger, Office Live, and Xbox Live to name a few. The document describes what the services are, how long they retain data, and what data they do and don't keep. For example, Windows Live Messenger's logging records the Windows Live ID activity (sign on and sign off) and contact IDs, but does not retain any data about the actual messages. Xbox Live records indicate which gamertag was playing what game and when, but no mention is made of, say, whether the messages sent between users on the system have any accessible logs, or who is playing with who.

What's more surprising is why Microsoft should take such a hard line against the document's posting. While the company could argue that yes, technically the information contained is all proprietary and copyrighted, the fact is, it's what any half-way competent developer would expect to log. Some companies such as Cisco have even made their documents public voluntarily, for precisely this reason: there are no exciting dirty little secrets here. It's a bit surprising in places—it has to explain to readers that Microsoft can't provide access to e-mails stored on local hard drives (something that does not speak highly of the wit of the law enforcement officers who might be making such requests)—and is both quite specific in some places (explaining how to read and interpret the logs that Windows Live ID creates) and annoyingly vague in others (when discussing Office Live Small Business and Windows Live SkyDrive)—but for the most part, the thing that is striking is how mundane it is.

About the only real value in the whole document is that it makes clear that criminals should clearly conduct their business over Windows Live Messenger—unlogged—rather than e-mail. Law enforcement can't request what Microsoft doesn't keep in the first place, after all.

The decision to take action under the DMCA is also surprising because of the counterproductive result. If Redmond had done nothing, the likelihood is that few people would have even noticed that the document had been posted. Sure, it would be "out there" on the Web, but the thing is hardly compulsive reading. By having Cryptome taken offline, the Handbook has garnered far more attention—and far more redistribution around the Web—than it ever would have if the company had left the site alone. At least Yahoo's compliance guide contained pricing information—about $30-$40 to get a copy of a Yahoo user's e-mail. Microsoft's lacks anything even that juicy.

All in all, it is a strange fight for Redmond to pick. No good can come of it—the document is out there, and probably distributed more widely than ever—and the handbook tells us only what we already knew anyway. There are surely better ways to tarnish a reputation and accumulate legal costs.

Source: Arstechnica.com

World, get ready for the DMCA: ACTA's Internet chapter leaks

The oddest thing about the Anti-Counterfeiting Trade Agreement (ACTA) secrecy is that, whenever we see leaked drafts of the text, there's nothing particularly "secret" about them. That was also the case with this weekend's leak of the "Internet enforcement" section of the ACTA draft; as we've noted in the past, ACTA appears to be a measure to extend the US Digital Millennium Copyright Act (DMCA) to the rest of the world, and that's exactly what the Internet section tries to do.

IDG News saw the draft text of the Internet section last week, but the actual document has now leaked. Titled "Enforcement procedures in the digital environment," the brief document quickly hits the high points: Internet filtering (not allowed to be a requirement), "three strikes" policies (encouraged but not mandatory), takedown procedures (required), and ISP safe harbors (also required).

If the bill sounds much like existing American law, it should; the US delegation drafted the Internet section of ACTA, and the entire document is being negotiated as an executive agreement, meaning that it can be adopted without Congressional consent but may not alter US law. Thus, unsurprisingly, the leaked document takes the DMCA worldwide.

ISP immunity
In the ACTA draft, ISPs are protected from copyright lawsuits so long as they have no direct responsibility for infringement. If infringement merely happens over their networks, the infringers are responsible but the ISPs are not. This provision mirrors existing US and European law.

Two key points need to be made here, however. First, the entire ISP safe harbor is conditioned on the ISP "adopting and reasonably implementing a policy to address the unauthorized storage or transmission of materials protected by copyright." A footnote provides a single example of such a policy: "providing for termination in appropriate circumstances of subscriptions and accounts in the service provider's system or network of repeat infringers." In other words, some variation of "three strikes."

Note that this is already US law. The DMCA grants safe harbor to an ISP only if it has "a policy that provides for the termination in appropriate circumstances of subscribers and account holders of the service provider's system or network who are repeat infringers." Yet no major ISP in the US has adopted a France-like "three strikes" system en masse. One reason for this is the vagueness of the statue: what are "appropriate circumstances"? How many times must someone "repeat" before this provision applies? And can an ISP know for certain that someone is an "infringer" without a court ruling?

The ACTA draft also makes clear that governments cannot mandate Internet filtering, even in the pursuit of these "repeat infringers."

Secondly, the ISP immunity is conditioned on the existence of "takedown" process. In the US, this is the famous "DMCA takedown" dance that starts with a letter from a rightsholder. Once received, an ISP or Web storage site (think YouTube) must take down the content listed in order to maintain its immunity, but may repost it if the uploader responds with a "counter-notification" asserting that no infringement has taken place. After this, if the rightsholder wants to pursue the matter, it can take the uploader to court.

Hello, DRM
While the ACTA draft would adopt the best part of the DMCA (copyright "safe harbors"), it would also adopt the worst: making it illegal to bypass DRM locks, even when the intended use is a legal one.

ACTA would ban "the unauthorized circumvention of an effective technological measure that controls access to a protected work, performance, or phonogram." It also bans circumvention devices, even those with a "limited commercially significant purpose." Countries can set limits to the ban, but only insofar as they do not "impair the adequacy of legal protection of those measures." This is ambiguous, but allowing circumvention in cases where the use is far would appear to be outlawed.

And that's pretty much the extent of the Internet section. For Americans, there's not much new here, though that's not at all true in other countries. Canadian law professor Michael Geist notes that the current draft would mean big changes for Canada. To take one example, Canada currently has no "takedown" law. Rather than "notice-and-takedown," many ISPs rely on "notice-and-notice"—they pass notices along to the subscriber in question, but take no other action. But even this is not currently required by law.

"There is currently an informal agreement to use notice-and-notice," Geist writes, "which has proven effective (the Entertainment Software Association of Canada told the Liberal copyright roundtable earlier this month that 71 percent of subscribers who receive a notice do not repost the content within a week). ACTA would trump domestic law and the current Canadian business practice." The ban on DRM circumvention would also be new, and it goes further than existing international treaties.

In places like Europe, there's also huge concern about how these American-pushed policies would interact with existing privacy law. Just today, European Data Protection Supervisor Peter Hustinx issued an extraordinary opinion (PDF) in which he "regrets that he was not consulted by the European Commission on the content" of ACTA.

He goes on to say that Internet disconnections are "disproportionate" and "highly invasive in the individuals' private sphere. They entail the generalised monitoring of Internet users' activities, including perfectly lawful ones. They affect millions of law-abiding Internet users, including many children and adolescents. They are carried out by private parties, not by law enforcement authorities."

Given that the ACTA Internet draft—one of the most speculated-about bits of the treaty—simply reflects existing US law, what possible motivation could there be for keeping it "secret" for so long? As the responses above suggest, it may just be because forcing US law on the rest of the world isn't universally popular.

Source: Arstechnica.com