LibertyVoice

Our cell phones aren't just for calls anymore. They hold our address books, our calendars, our emails, and our grocery lists. They may even include things like a list of questions to ask your doctor, pictures of your girlfriend, or URLs of web sites you've visited. When can police search your phone and look at all this information?

That's the question that EFF is asking a court in California to consider. In People v. Taylor, police in Daly City, California seized a suspect's iPhone during his arrest. Hours later, investigators bypassed the password and searched through the data on the device without a search warrant. After the officers realized that the information was too extensive to write down, they finally obtained a warrant to search the phone.

EFF has urged the court to suppress evidence gathered by police from the suspect's phone during the warrantless search, including contacts, called phone numbers, emails, text messages, Internet search history, and photos. EFF has also asked the judge to quash the warrant that was eventually issued in part based on the information illegally accessed on the phone.

Of course, criminal suspects will have a lot of information on their cell phones that might be of interest to police, and when investigators have enough evidence to get a warrant, they should be able to search these devices. But if the police can search anyone's cell phone at any time, then everyone's privacy is at risk.

The court will hear the motion on February 18 at 9:00 a.m. in Redwood City, California.

Of all the crazy things I've seen on the Street View feature of Google Maps, including house fires, medieval sword fights, supposed crimes in progress, people being pulled over (including the occasional Google vehicle speeding violation), I can't say that Aaron and Christine Boring's Pennsylvanian home rates high on my list of interesting vistas.

Nonetheless, I've seen it on multiple websites recently. Actually, I can thank the Borings for my newfound interest in suburban Pennsylvanian architecture and sudden desire to go swimming. See, when the Borings discovered that street-level photographs of their home, backyard, and swimming pool were available online through Street View, they sued Google. I recall seeing the Borings' home back when the case was dismissed in February 2009. Now it's back in the news again, after the Third Circuit revived one out of the five original claims by partially reversing the dismissal.

The original complaint (available at the Smoking Gun), filed in April 2008, alleged that Google committed invasion of privacy and trespass, among a smattering of other torts, when a Street View vehicle drove onto the Boring's private driveway without permission and captured the images for Google Maps. The only claim left after the Third Circuit's decision is the trespass claim.

For a moment, imagine a person is captured on a Google Street View camera while walking on public property. If that person decides to sue Google for invasion of privacy, he or she's got a difficult case ahead because individuals generally lack a legitimate expectation of privacy in their presence in publicly visible locations. In the Borings' case, which took place on private property, the invasion of privacy claim failed at both the district and appellate court levels for two reasons: (1) there were no people visible in the images, and (2) a photograph of the outside of a residential structure wouldn't, in the courts' view, upset a person of ordinary sensibilities, even if it was taken from private property.

In the February 2009 dismissal, the district court treated the invasion of privacy claim as two separate claims—intrusion on seclusion and publication of private facts. Like other states, in Pennsylvania, both of these torts can be a difficult to establish because, among other things, a plaintiff needs to show she suffered "mental suffering, shame, or humiliation" that a person of ordinary sensibilities would have suffered in the same instance. Even assuming the facts were exactly as the Borings alleged, the district court found both invasion of privacy claims factually insufficient, noting in particular:

While it is easy to imagine that many whose property appears on Google's virtual maps resent the privacy implications, it is hard to believe that any— other than the most exquisitely sensitive—would suffer shame or humiliation. The plaintiffs have not alleged facts to convince the Court otherwise.

Slip op., at 4. The Third Circuit largely agreed with the district court's analysis and affirmed that "[n]o person of ordinary sensibilities would be shamed, humiliated, or have suffered mentally as a result of a vehicle entering into his or her ungated driveway and photographing the view from there." The panel also pointed out that the Google vehicle only photographed structures and no persons were visible from inside the home, making the photography less intrusive.

On the other hand, the Third Circuit reversed dismissal of the Borings' trespass claim. The district court originally dismissed this portion of the complaint because the Borings did not "allege any facts sufficient to establish they suffered any damages by the alleged trespass." This is a bit more of a procedural goof than a bad legal claim because trespass is an intentional tort and damages are not a required element of the claim, meaning that nominal damages are available regardless of actual harm caused to the property trespassed upon. On this note, the Third Circuit quipped "it may well be that, when it comes to proving damages from the alleged trespass, the Borings are left to collect one dollar and whatever sense of vindication that may bring, but that is for another day."

The revival of the trespass claim may be a welcome result for the Borings, but it's not a serious problem for Street View. As long as Google takes footage from pubic streets, rather than entering onto private property, trespass will provide no help for future disgruntled homeowners. 

Combine a popular feature like Street View, which has a plethora of devoted websites and blog posts documenting some of the much odder things visible on camera, a seemingly quiet Pennsylvania couple's plain house, and a surname that might make an eight-year-old (like me) giggle when used in a sentence with "intrusion on seclusion," and you've got a recipe for the Streisand Effect. The Borings presumably filed this suit to stop unwanted publicity of their property; instead, I'm staring at the picture they wanted to get rid of for the fifth time this week.

Interested in an option to get that picture of you commuting to work in a shiny new tin foil hat off Street View? Ask Google. Others have had success using this less flashy method, including the Borings before the suit was filed.

(David O'Brien is an attorney and former CMLP Legal Intern. David received his J.D. from Northeastern University School of Law in 2009.)

The 2008 Summer Olympics were a huge hit online, both through legal and illegal channels. NBC streamed a record breaking 2,200 hours of live video to the delight of millions of people, but strangely enough this year the network will limit its live coverage to hockey and curling.

An NBC representative explained that the network will only cover the highlights because people “are not dying to watch lots of long-form content on a 13-inch screen.” However, at the same time NBC contradicts itself by announcing that it will do all it can to prevent people from accessing unauthorized live feeds or downloads of Olympic broadcasts.

While NBC doesn’t believe there is much demand for live coverage, it will do all it can to prevent the ‘few’ people who do from downloading or streaming the events online. “Our aim is to make access to pirated material inconvenient, low quality and hard to find,” said Rick Cotton, NBC’s Executive Vice President commenting on their Olympic mission.

Once again one of the major entertainment industry outfits has got it entirely wrong. If NBC really wants to prevent piracy they have to offer at least some sort of alternative. Cutting 2,200 hours of live web coverage back to just a few hundred is certainly not going to help in stopping piracy.

NBC reportedly has teamed up with Ustream and Justin.tv, two popular live streaming sites, to use filtering schemes in order to prevent illegal broadcasts. However, it is inevitable that they won’t be able to stop them all since there are dozens of live streaming sites. Preventing torrents from being uploaded will turn out to be even more problematic for the network.

During the Beijing Olympics two years ago, The International Olympic Committee (IOC) asked for “assistance” from the Swedish government with preventing video clips from the Olympics in Beijing being shared via The Pirate Bay. This didn’t help much and during the weeks that followed millions of people continued to download broadcasts of Olympic events.

We assume that in the coming weeks most events will again appear online, despite NBC’s efforts to prevent the Olympics from being pirated.

Article from: TorrentFreak, check out our new blog at FreakBits.

Google's ad during yesterday's Superbowl explained in less than a minute how the story of someone's life can be pieced together from their search queries. Using only the search terms and user's clicks of the search results, Google told the story of a user who seeks love while studying abroad in Paris, finds it, moves to Paris, marries and has a child.

The poignant story, along with Google's suite of search stories, masterfully illustrate how some of the most intimate information in our lives--from planning a trip to political activism--are routinely and vividly expressed in our interactions with Google, and highlights the need for that information to have strong protections.

The Superbowl ad was Google's first foray into national television advertising, and its great that Google used this opportunity to illustrate the importance of search privacy to one of the world's largest audiences. Now that Google has shown how personal its records of user interaction are, it should follow through and protect that information from involuntary disclosure by anonymizing search queries. Microsoft's Bing is anonymizing this information after six months by deleting the entire Internet Protocol ("IP") address associated with your search queries. Google can and should anonymize search queries in the same way after six months or less.

Philadelphia - The Electronic Frontier Foundation (EFF) will be arguing this Thursday before the U.S. Court of Appeals for the 3rd Circuit in Philadelphia, urging the court to block a government attempt to seize telephone company records detailing a cell phone user's past locations without first getting a search warrant.

EFF is serving as a friend of the court or "amicus," joined by co-amici the ACLU, the ACLU of Pennsylvania, and the Center for Democracy & Technology. Professor Susan Freiwald of the University of San Francisco, who submitted a separate amicus brief to the panel, will be joining EFF Senior Staff Attorney Kevin Bankston in arguing on Thursday that federal privacy statutes in combination with the Fourth Amendment to the U.S. Constitution protect the privacy of cell phone users and require the government to show probable cause before obtaining cell phone location information.

WHAT:
Oral argument In the Matter of the Application of the United States of America for an Order Directing a Provider of Electronic Communication Service to Disclose Records to the Government

WHEN:
Thursday, February 11th
9:30am

WHERE:
Albert Branson Maris Courtroom (19th floor)
U.S. Courthouse
601 Market St.
Philadelphia, PA 19106

For more information on attending Thursday's hearing, contact press@eff.org.

For the full EFF amicus brief to the Third Circuit:
http://www.eff.org/files/filenode/celltracking/Filed%20Cell%20Tracking%2...

For more on the issue of cell phone tracking:
http://www.eff.org/issues/cell-tracking

Contacts:

Kevin Bankston
Senior Staff Attorney
Electronic Frontier Foundation
bankston@eff.org

Jennifer Stisa Granick
Civil Liberties Director
Electronic Frontier Foundation
jennifer@eff.org

Rebecca Jeschke
Media Relations Director
Electronic Frontier Foundation
press@eff.org

Imagine that you want to sue someone for what they wrote, anonymously, in a web-based online forum. To succeed, you'll first have to figure out who they really are. How hard is that task? It's a question that Harlan Yu, Ed Felten, and I have been kicking around for several months. We've come to some tentative answers that surprised us, and that may surprise you.

Until recently, I thought the picture was very grim for would-be plaintiffs, writing that it should be simple for "even a non-technical Internet user to engage in effectively untraceable speech online." I still think it's feasible for most users, if they make enough effort, to remain anonymous despite any level of scrutiny they are practically likely to face. But in recent months, as Harlan, Ed, and I have discussed this issue, we've started to see a flip side to the coin: In many situations, it may be far easier to unmask apparently anonymous online speakers than they, I, or many others in the policy community have appreciated. Today, I'll tell a story that helps explain what I mean.

Anonymous online speech is a mixed bag: it includes some high value speech such as political dissent in repressive regimes, some dreck we happily tolerate on First Amendment grounds, and some material that violates the laws of many jurisdictions, including child pornography and defamatory speech. For purposes of this discussion, let's focus on cases like the recent AutoAdmit controversy, in which a plaintiff wishes to bring a defamation suit against an anonymous or pseudonymous poster to a web based discussion forum. I'll assume, as in the AutoAdmit suit, that the plaintiff has at least a facially plausible legal claim, so that if everyone's identity were clear, it would also be clear that the plaintiff would have the legal option to bring a defamation suit. In the online context, these are usually what's called "John Doe" suits, because the plaintiff's lawyer does not know the name of the defendant in the suit, and must use "John Doe" as a stand in name for the defendant. After filing a John Doe suit, the plaintiff's lawyer can use subpoenas to force third parties to reveal information that might help identify the John Doe defendant.

In situations like these, if a plaintiff's lawyer cannot otherwise determine who the poster is, the lawyer will typically subpoena the forum web site, seeking the IP address of the anonymous poster. Many widely used web based discussion systems, including for example the popular Wordpress blogging platform, routinely log the IP addresses of commenters. If the web site is able to provide an IP address for the source of the allegedly defamatory comment, the lawyer will do a reverse lookup, a WHOIS search, or both, on that IP address, hoping to discover that the IP address belongs to a residential ISP or another organization that maintains detailed information about its individual users. If the IP address does turn out to correspond to a residential ISP -- rather than, say, to an open wifi hub at a coffee shop or library -- then the lawyer will issue a second subpoena, asking the ISP to reveal the account details of the user who was using that IP address at the time it was used to transmit the potentially defamatory comment. This is known as a "subpoena chain" because it involves two subpoenas (one to the web site, and a second one, based on the results of the first, to the ISP).

Of course, in many cases, this method won't work. The forum web site may not have logged the commenter's IP address. Or, even if an address is available, it might not be readily traceable back to an ISP account: the anonymous commenter may been using an anonymization tool like Tor to hide his address. Or he may have been coming online from a coffee shop or similarly public place (which typically will not have logged information about its transient users). Or, even if he reached the web forum directly from his own ISP, that ISP might be located in a foreign jurisdiction, beyond the reach of an American lawyer's usual legal tools.

Is this a dead end for the plaintiff's lawyer, who wants to identify John Doe? Probably not. There are a range of other parties, not yet part of our story, who might have information that could help identify John Doe. When it comes to the AutoAdmit site, one of these parties is StatCounter.com, a web traffic measurement service that AutoAdmit uses to keep track of trends in its traffic over time.

At the moment I am writing this post, anyone can verify that AutoAdmit uses StatCounter by visiting AutoAdmit.com and choosing "View Source" from the web browser menu. The first screenfull of web page code that comes up includes a block of text helpfully labeled "StatCounter Code," which in turn runs a small piece of javascript that places a personalized StatCounter cookie on the machine of every user who visits AutoAdmit, or else (if one is already present) detects and records exactly which cookie it is. That's how StatCounter can tell which visitors to AutoAdmit.com are new, which ones are returning, and which pages on the site are of greatest interest to new and returning users. StatCounter is in a position to track not only each user, but also each page, and each visit by a user to a certain page, over time. This includes not only the home page, but also the particular web page for each discussion "thread" on the site. Moreover, each post (even if anonymous) is marked with the time it was posted, down to the minute. So the plaintiff's lawyer in our story could go to StatCounter, and ask only about visits to the particular thread where the relevant message was posted. If the post went up at 6:03 p.m. on a certain date, the lawyer could ask StatCounter, "What if anything do you know about the person who visited this web page at 6:03 p.m. on this date?" Of course, if John Doe's browser is configured to refuse cookies, he wouldn't be trackable. But most web based discussion sites, including AutoAdmit, rely on cookies to let people log in to their pseudonymous accounts in order to post comments in the first place. In any case, the web is much less convenient place without cookies, and as a practical matter most users do allow them.

In fact, the lawyer may be able to do better still: The anonymous commenter will have accessed the page at least twice -- once to view the discussion as it stood before he took part, and again after clicking the button to add his own post to the mix. If StatCounter recorded both visits, as it very likely would have, then it becomes even easier to tie the anonymous commenter to his StatCounter cookie (and to whatever browsing history StatCounter has associated with that cookie).

There are a huge number of things to discuss here, and we'll tackle several in the coming days. What would a web analytics provider like StatCounter know? Likely answers include IP addresses, times, and durations for the anonymous commenter's previous visits to AutoAdmit. What about other, similar services, used by other sites? What about "beacons" that simply and silently collect data about users, and pay webmasters for the privilege? What about behavioral advertisers, whose business model involves tracking users across multiple sites and developing knowledge of their browsing habits and interests? What about content distribution networks? How would this picture change if John Doe were taking affirmative steps, such as using Tor, to obfuscate his identity?

These are some of the questions that we'll try to address in future posts.

Paul Ohm has a terrific new paper out on SSRN, Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization (forthcoming in UCLA Law Review). It discusses how statistical techniques have made it increasingly easy to re-identify anonymized data sets, and to apply that information to other identification problems (for example, taking information from one’s movie ratings on Netflix and using it to figure out someone’s Facebook friends). This change in statistical power – enhanced by readily available computer computational power – undermines the exceptions embedded in many privacy regimes (think HIPAA) for anonymized data. Paul’s piece is an easy and powerful read. I’m going to assign it in my Information Privacy class next year, and it has changed how I think about regulating privacy. Highly recommended.

Released in 2008, Max Manus is a Norwegian World War II movie based on the real-life events of resistance fighter Max Manus. Created at a cost of NOK 55,000,000 it was the most expensive Norwegian film production to date.

Shortly after the movie’s 19th December release date an illicit copy of the movie appeared on the Internet. According to producer John M. Jacobsen the recording was made in an empty theater, prompting suspicions that a projectionist was involved.

“I think this is totally reprehensible, and I wish we knew who is behind it,” Jacobsen told Norwegian media. “Anyway we will go after those who have done this quite mercilessly. There are ways to track these things down.”

An investigation was immediately launched by the Filmkameratene studio, to be handled by the Simonsen law firm with notorious pirate hunter Espen Tøndel at the helm. Technicians went to work, systematically going through every copy of the movie sent out to find a match – that meant checking 103 analog and 20 digital copies.

Their detective work paid off. Simonsen said they had not only tracked the correct copy but also identified the IP-address from where the movie was first uploaded to the Internet. They took the information to the police but were notified that the case would not be a priority for them. Simonsen responded by taking the case to the courts.

Simonsen, a law firm which since 2006 had held a license to monitor alleged pirates and collect their IP-addresses, demanded that the ISP connected with the IP-address hand over the identity of the subscriber, something it had thus far refused to do. The request had the support of the Norwegian telecoms authorities which in this case made a special exception to the country’s Privacy Act, enabling the person’s identity to be handed to a group other than the police – if the court agreed.

On May 5th 2009, Simonsen received the decision from the court but the verdict was kept a secret from the public. Espen Tøndel said this was to prevent the possibility of evidence being spoiled. This lack of transparency caused an uproar, with thousands of Internet citizens demanding to know the verdict in this important case. Many argued that if there was evidence to be spoiled, it would’ve been spoiled by now.

Today in 2010, the verdict is still a mystery to the public, but at least one of the parties is disappointed with the court’s decision.

“I can confirm that the case is being appealed to the Supreme Court, but I can not confirm which of the parties has submitted the appeal, as that may indicate what the results were in the previous hearing,” said movie industry lawyer Rune Ljøstad.

The Supreme Court will now have to decide if it’s acceptable for privately owned companies with financial interests in the outcome of a case to be given the power to obtain the identity of an Internet subscriber behind an IP-address, whether or not they committed the alleged offense.

Despite the leak, Max Manus did incredibly well in Norway, breaking all records. Its 2009 theater run yielded almost NOK 200 million across 1.16 million tickets and the DVD sold 400,000 copies in the same year. From recording a loss in 2008, movie company Filmkameratene made a profit in 2009.

“There is a dramatic change for the better for us in 2009,” said producer Sveinung Golimo. “So we are not now concerned about the future.”

Privacy campaigners will look toward the forthcoming Supreme Court decision before sharing in his optimism.

Article from: TorrentFreak, check out our new blog at FreakBits.