Commentary: Privacy, Piracy and Due Process in Peer-to-Peer File Swapping Suits (Findlaw)

Findlaw's commentary section contains an interesting article by Professor Ramasastry of the University of Washington School of Law about the privacy protections for alleged file-swappers in John Doe suits by the RIAA and others:

Ramasastry: Privacy, Piracy and Due Process in Peer-to-Peer File Swapping Suits:

"....Here's how the RIAA typically proceeds. It files a 'John Doe' lawsuit based on an Internet Protocol (IP) address connected to P2P trading via Kazaa, Grokster, Limewire, or another, similar system. The suit is often filed in the jurisdiction where the relevant Internet Service Provider (ISP) is located.

Once the suit is filed, the RIAA subpoenas the ISP to force it to disclose the real name of the 'John Doe' associated with the IP address. That person, however, is not necessarily the file trader - it may instead be a relative, college roommate, or landlord. And neither that person - nor the file trader, if he or she is a different person - is given prior notice and a chance to fight the subpoena.... Fortunately, however, that may change."

How to not be a law enforcement tool ...

The Electronic Frontier Foundation (EFF) has released a document entitled Best Practices for Online Service Providers. In response to Online Service Providers being continually subjected to subpoenas and warrants for log files, EFF argues that unless there is a legislated or reguatory need to archive data, OSPs should not keep any user info they don't need.

Best Practices for Online Service Providers:

"...The best way to protect against the risk of log artifacts on disk is to never create any user logs in the first place. This is the ideal and safest solution even though it is often impractical. By reconfiguring the logging preferences in server applications, one can easily change the log level to record nothing about network events. But for most OSPs, these logs are necessary for network troubleshooting and security precautions. This is also virtually impossible for large, for-profit providers that need to maintain billing and subscriber contact information. Thus, the best tactic for an OSP is to come up with a safe and sane network policy in which logs are retained for the shortest possible time..."

Under Canadian privacy laws (at least until retention requirements are imposed under lawful access guidelines), ISPs/OPSs should only be collecting for reasonable purposes and keeping it for only as long as is reasonably necessary for the purposes for which it was collected. I know of at least one ISP that keeps their log files indefinitely because they enjoy their friendly relationship with law enforcement. They still require a warrant, but the cops know that it is all kept. Some organizations want to minimise the muss and fuss of being dragged into court being asked to provide user info. If they simply don't have the info that is being sought, they say so and avoid the issue. (This issue has also come to the fore in public libraries, where privacy aware librarians have changed practices to delete the history of borrowers after books are returned undamaged.)

Thanks to the ever-informative, always useful BeSpacific for the link.

UC Researcher finds out how to uniquely identify a PC on the net

A University of California researcher has developed a technique to uniquely identify a PC anywhere on the internet, even if it is hidden behind a firewall or shares its IP address with other computers:

How to track a PC anywhere it connects to the Net: ZDNet Australia: News: Security:

"Anonymous Internet access is now a thing of the past. A doctoral student at the University of California has conclusively fingerprinted computer hardware remotely, allowing it to be tracked wherever it is on the Internet.

In a paper on his research, primary author and Ph.D. student Tadayoshi Kohno said: 'There are now a number of powerful techniques for remote operating system fingerprinting, that is, remotely determining the operating systems of devices on the Internet. We push this idea further and introduce the notion of remote physical device fingerprinting ... without the fingerprinted device's known cooperation.' "

Thanks to Privacy Digest for the pointer to this story.

How to check your customer is over 18 and still alive

Pinsent Mason's Out-Law (a great source of IT law news) is pointing to an interesting new service designed to fight credit card fraud. The service, offered by Metacharge, apparently verifies information related to credit card customers for online clients that are at a high risk of fraud. Metacharge checks whether the authorized holder of the card is a live adult and also tracks the IP address of the customer to see whether they are connected from their expected origin. If you are trying to gamble online while connected from Nigeria and Malaysia, you may be cut off. If you're dead, the consequences may be worse. See: How to check your customer is over 18 and still alive | OUT-LAW.COM.

PIPEDA Case Summary #315: Web-centred company's safeguards and handling of access request and privacy complaint questioned (August 9, 2005)

The Office of the Privacy Commissioner just released a finding related to a free e-mail provider's PIPEDA compliance, particularly with respect to access, security and challenging compliance. The complainant thought her estranged husband had been accessing her e-mail and was responsible for changing her password on a number of occasions. Trying to deal with customer service people at the e-mail provider proved fruitless and the Assistant Commissioner found that the company was not in compliance with Principle 10 of PIPEDA, which requires that any complaints be escalated to the company's privacy officer. The Assistant Commissioner also concluded that the IP address of the person who had been resetting her password might be information about a third-party, but the company could release it to the complainant becuase it could not be linked to a third-party without the assistance of the ISP involved. Finally, the Assistant Commissioner concluded that the company could not be faulted for inadequate security because the customer didn't follow the instructions to make her own password and "personal question" more secure. Read the full finding here: Commissioner's Findings - PIPEDA Case Summary #315: Web-centred company's safeguards and handling of access request and privacy complaint questioned (August 9, 2005).

Guest blogger: Mathew Englander's update on privacy and the CRIA file sharing lawsuit

Mathew Englander (http://www.mathew-englander.ca/) recently wrote to me about the latest developments in the CRIA lawsuit appeal. With his permission, I'm including his letter and I suggest taking a look at the appeal materials he refers to:

David,

A while ago you blogged about the decision by Justice von Finckenstein
of the Federal Court (2004 FC 488) not to compel several ISPs to
release information related to the identities of their subscribers
alleged to have infringed copyright by file-sharing
(pipeda.blogspot.com/2004/04/privacy-aspects-of-matter-of-bmg.html).

You may wish to run an update as the decision is under appeal to the
Federal Court of Appeal. I have been reading the factums at CIPPIC's
web site
(http://www.cippic.ca/en/projects-cases/file-sharing-lawsuits/document-archives.html).
The central issue on appeal is whether a plaintiff in a John Doe
lawsuit needs to establish a "prima facie case" or just a "bona fide
case" before an innocent third party is compelled to release
information about the identity of the defendant.

This may seem like a dry legal distinction, but it has serious
implications for privacy. The "prima facie" standard (which Justice von
Finckenstein adopted as the first criterion of five; see paras. 13-14
of his decision) is stricter. As I understand it, it means that the
plaintiff must provide some acceptable evidence on each element of the
cause of action. The "bona fide" standard appears to mean that the
plaintiff need only show that it honestly believes the defendants are
liable. Having a stricter standard is more respectful of an
individual's privacy since it requires more evidence before the court
may order the individual's personal information released.

The Canadian Recording Industry Association was coordinating the legal
action for the plaintiffs. It is interesting to look at its news
releases on the matter (http://www.cria.ca/news.htm). For example, on
March 12, after the first day of the hearing before Justice von
Finckenstein, it issued a news release saying it was "confident" its
motion would be granted.

The plaintiffs' motion was dismissed because of deficient evidence.
CRIA had hired a company called MediaSentry to investigate music
piracy. MediaSentry downloaded files from 29 users of peer-to-peer
software, and came up with an IP address for each user at the time of
download. The IP address could be linked with an ISP through whois
queries, so the plaintiffs wanted the ISPs to disclose the real name,
address for service, and other information about the holder of the
account to which the particular IP address was assigned at the
particular time.

However, there was no evidence at all as to how MediaSentry came up
with the IP address of each peer-to-peer user. In addition, the
affidavits tendered by the plaintiffs were full of hearsay with no
explanation for why they did not provide affidavits from those with
direct knowledge. It seems to me that this was a big screwup by the
lawyers who prepared the motion material.

There were five ISPs named as non-party respondents to the motion:
Shaw, Rogers, Bell Canada, Telus, and Videotron. All five are
respondents on the appeal and each filed its own memorandum of fact and
law. It is particularly interesting to read the ISPs' arguments. Only
one, Videotron, is basically supportive of the plaintiffs. Bell
Canada's position is ostensibly neutral, but its arguments are strongly
opposed to the plaintiffs' appeal. The other three expressly argue that
the appeal should be dismissed.

In my view, the decision of Justice von Finckenstein is solid and it is
surprising that CRIA is even appealing it. Since these are just
intended as test cases in any event, it might be better off going back
to square one, having MediaSentry or some other company entrap some
more alleged copyright-infringers and this time developing a stronger
evidentiary base to bring to court.

Mathew Englander

Don't keep the data that you don't need

The recent controversey over subpoenas of high-profile search engines has spurred a lot of discussion about what search engines know about you. For example, John Battelle was able to get confirmation from Google of what a lot of people have probably always suspected:

1) "Given a list of search terms, can Google produce a list of people
who searched for that term, identified by IP address and/or Google
cookie value?"

2) "Given an IP address or Google cookie value, can Google produce a
list of the terms searched by the user of that IP address or cookie
value?"

I put these to Google. To its credit, it rapidly replied that the answer in both cases is "yes." Just FYI.

What else does Google know? Given that Google operates

• one of the most widely used advertising networks,
  
• one of the most widely used webmail services,
  
• one of the most widely used mapping services,
  
• one of the most widely used website statistics services,
  
• one of the most widely used browser toolbars,
  
• one of the most widely used news aggregators,
  
• one of the most widely used online group services,
  

they know a heck of a lot. Every time you visit a site that uses adwords, your computer connects to google and tells them what you're viewing and probably what got you there. And all this can be matched by your google cookie or your IP address.

The question is, other than for personalized services, why should a company maintain information that is personally identifiable? Why keep logs that have your ip address down to the last digit when the same value can be obtained from the data by only keeping the first three units (192.168.168.* compared to 192.168.168.111)? The level of trust that consumers have for companies like Google is eroding and businesses should take heed of this. If you don't need the information in personally identifiable form, don't keep it.

It will not be long before the cost of keeping this stuff is prohibitive if you have to spend valuable personel time responding to subpoenas. I can imagine the FBI or some other three-letter-agency having a form subpoena that will seek all the records from Google, Yahoo!, DoubleClick and others about the supposed "owner" of a suspicious IP address. What did you search for? What did you read? When were you online? All this info is mantained by a small handful of companies.

UPDATE: While you're thinking about this, check out Google's data minefield by Mark Rasch (via robhyndman.com).

Technorati tags: IP address :: privacy :: tracking :: logs :: retention :: personal information
:: Google
:: Search Engines

IP addresses are personal information

Adam Fields' blog has a good post about the "big fuss" over IP addresses, which is particularly relevant in light of the fight over search logs and subpoenas from the US Department of Justice:

Adam
Fields (weblog) - What's the big fuss about IP addresses?:

Given the recent fuss
about the government asking for search terms and what qualifies as personally
identifiable information, I want to explain why IP address logging is a big
deal. This explanation is somewhat simplified to make the cases easier to
understand without going into complete detail of all of the possible
configurations, of which there are many. I think I've kept the important stuff
without dwelling on the boundary cases, and be aware that your setup may differ
somewhat. If you feel I've glossed over something important, please leave a
comment.

First, a brief discussion of what IP addresses are and how they
work. Slightly simplified, every device that is connected to the Internet has a
unique number that identifies it, and this number is called an IP address.
Whenever you send any normal network traffic to any other computer on the
network (request a web page, send an email, etc...), it is marked with your IP
address....

I don't think there can be much doubt that an IP address is "personal information" for the purposes of PIPEDA or the Personal Information Protection Acts of BC and Alberta, particularly as it appears in a server log. The information does not have to "identify" an individual, but must be "information about an identifiable individual". George Radwanski, when he was federal Privacy Commissioner held, in Case Summary #25, that a PC's NetBIOS information is "personal information" for the purposes of PIPEDA because it can lead to iformation that is traceable to an identifiable individual. Whether that interpretation would hold up in court is debateable, but any business in Canada should proceed on the assumption that a user's IP address is their personal information.

Technorati tags:
IP address ::
privacy ::
tracking ::
logs ::
retention ::
personal information