Yes, all the attention these days about the Sony hack is on the decision to not release The Interview, but it still seems like the big story to come out of the hack is the sneaky plans of the MPAA in its bizarre infatuation with attacking the internet. We've already covered the MPAA's questionably cozy relationship with state Attorneys General (to the point of both funding an investigation into Google and writing documents for those AGs to send in their names), as well as the continued focus on site blocking, despite an admission that the MPAA and the studios still don't have the slightest clue about the technology implications of site blocking.

Last week, TorrentFreak noted the various options that were under discussion by the MPAA for blocking sites, and now The Verge has published more information, including the analysis by MPAA's favorite hatchetmen lawyers at Jenner & Block about how site blocking might work in practice [pdf] by breaking DNS.

For years, actual technology experts have explained why DNS blocking is a really bad idea , but the MPAA just can't let it go apparently. It's just, this time, it's looking for ways to do it by twisting existing laws, rather than by getting a new SOPA-like law passed.

To understand the plan, you have to first understand the DMCA section 512, which is known as the safe harbor section, but which includes a few different sections, with different rules applying to different types of services. 512(a) is about "transitory digital network communications" and basically grants very broad liability protection for a network provider who isn't storing anything -- but just providing the network. There are good reasons for this, obviously. Making a network provider liable for traffic going over the network would be a disaster for the internet on a variety of levels.

The MPAA lawyers appear to recognize this (though they make some arguments for getting around it, which we'll get to in a follow-up post), but they argue that a specific narrow attack via DMCA might be used to force ISPs to break the basic internet by disabling entries in their own DNS databases. The trick here is twisting a different part of the DMCA, 512(d), which is for "information location tools." Normally, this is what's used against search engines like Google or social media links like those found on Twitter. But the MPAA argues that since ISPs offer DNS service, that DNS service is also an "information location tool" and... ta da... that's how the MPAA can break DNS. The MPAA admits that there's an easy workaround for end-users -- using third-party DNS providers like OpenDNS or Google's DNS service -- but many users won't do that. And the MPAA would likely go after those guys as well.

At the same time, even this narrow limitation on ISPs’ immunity could have the salutary effect of requiring ISPs to respond to takedown notices by disabling DNS lookups of pirate sites through the ISPs’ own DNS servers, which is not currently a general practice. Importantly, the argument for such a requirement need not turn on the Communications Act, but can instead be based on the DMCA itself, which expressly limits ISPs’ immunity to each “separate and distinct” function that ISPs provide. See 17 U.S.C. 512(n). A reasonable argument can be made that DNS functionality is an “information location tool” as contemplated by DMCA Section 512(d) and, therefore, that ISPs are required, as a condition of the safe harbor, to cease connecting users to known infringing material through their own DNS servers. Should this argument hold – and we believe that it has a reasonable prospect of success – copyright owners could effectively require ISPs to implement a modest (albeit easily circumvented) form of DNS-based site blocking on the basis of only a takedown notice rather than litigation.

In short, since DMCA takedown notices apply to "information location tools," but not to "transitory network communications," the MPAA would like to argue that just the DNS lookup functionality is an information location tool -- and can thus be censored with just a takedown notice. This is both really slimy (though brilliant in its nefariousness) and insanely dangerous for the internet and free speech . We see so many bogus DMCA takedowns of basic content today, and here the MPAA is looking to effectively, and sneakily expand that to whole sites by misrepresenting the law (badly).

DNS is not an "information location tool" in the sense of a search engine. It's the core underpinning of how much of the internet works. At no point in the 16 years the DMCA has been around has anyone made an argument that the DNS system was covered by the "information location tools" definition. Because that's clearly not what it was written to cover. The MPAA's lawyers (in this "confidential" memo) appear to recognize that this argument doesn't fully make sense because of that, but they seem to think it's worth a go:

To be sure, the argument is not guaranteed to succeed, as unlike a “pointer” or “hyperlink text,” DNS provides a user’s browser with specific information (IP routing information) that the user has requested by other means (alphanumeric internet addresses), as opposed to providing the user with an active interface allowing the user to request information online, as they might from a clickable page of search results. But at least in the literal sense, DNS appears to fit within the list of Section 512(d) functions and a reasonable argument can be made that DNS is more like a “directory” than the provision of “routing” and should be treated accordingly under the statute as a Section 512(d) function rather than a Section 512(a) function.

Pushing this argument would raise many of the problems found with the original DNS-breaking proposal in PIPA/SOPA. It would raise even more serious questions about the First Amendment and prior restraint. Effectively, it would be moving the definition of "information location tool" down the stack, such that rather than requiring the removal of access to the specific infringing content, it would require removal of access to an entire site based on a single accusation of infringement. Someone uploaded an infringing video to YouTube? Under this interpretation, the MPAA can force Verizon to make YouTube disappear from the internet for all users relying on Verizon's DNS. The censorship implications are massive here, especially with no court proceeding at all. This wouldn't require anything in court -- just a single takedown notice, of which copyright holders send millions. Rather than sending all those notices to Google and getting them delisted from search, copyright holders could turn the firehose towards Verizon, AT&T and Comcast, and basically take down half the internet on their say so alone. Yes, sites could counternotice, but ISPs would have 10 business days in which they can keep sites off their DNS entirely.

The results would be insane.

And that doesn't even touch on the technical havoc this would wreak. As we've noted earlier, the MPAA admits it's not clear on the technical implications of this plan, but let's just point back to Paul Vixie's discussion of how SOPA/PIPA would break the internet by mucking with the core DNS functionality, no matter how it was implemented.

What this goes back to is the core purpose of DNS, which is merely to translate a URL into a numeric equivalent to connect. It's not an information location tool for helping people "find" information -- it's just the basic plumbing of how the internet works. It's how basically all pieces of the internet expect to work. If you put in a URL here, then DNS returns the proper IP addresses to follow through there. Breaking that, effectively fracturing the internet, and creating a patchwork of different DNS systems would create a huge list of problems not easily fixed.

And, yet, because the MPAA can't figure out how to adapt to the times, it appears to be willing to give it a shot. Because, hey, it's better than innovating.

Permalink | Comments | Email This Story

Last month, ATT entered an amicus brief in the US v. Quartavious Davis case, arguing that law enforcement shouldn't be allowed warrantless access to cell site location data. ATT's entry into the privacy battle comes after a lengthy silence during which it was very obliging of government requests for customers' data. The crux of its argument was this:

Nothing in those [prior court] decisions contemplated, much less required, a legal regime that forces individuals to choose between maintaining their privacy and participating in the emerging social, political, and economic world facilitated by the use of today's mobile devices or other location-based services."

That's where we are, as far as private citizens are concerned. The government, through its thorough exploitation of the Third Party Doctrine, has basically forced the public to choose between allowing warrantless access to tons of their data (and metadata) or living some sort of off-the-grid lifestyle that doesn't involve generating "business records" via cell phone, internet service, etc.

Some judges and justices have noted that today's connected world would be completely unrecognizable to the judges who made the decisions the government relies so heavily on: namely, Smith vs. Maryland (1979).

The DOJ has entered its brief [pdf link] for the Eleventh Circuit Court's en banc re-hearing of US vs. Davis (2014), and it again attacks the defendant's assertion that he has an expectation of privacy in his cell phone records. While the government does make a good point that it's difficult for Davis to claim privacy expectations in a phone he refused to admit was his, it goes on to attack the premise that anyone has any expectation of privacy in their cell phone records. (All emphasis the DOJ's.)

Davis may not make out a right to be secure in someone elses papers, see U.S. Const. amend. IV, by complaining that those papers contained his location data. Evidence lawfully in the possession of a third party is not his, even if it has to do with him. Indeed, so far as the Fourth Amendment is concerned, Davis could not have prevented MetroPCS from producing the records in question even if they were his.

Here, the government argues that the records you generate by using a cell phone are not yours, nor will they ever be. They belong solely to the company that retains them and, as such, can be obtained with a minimum of paperwork or effort. It expands a bit on this argument a little later in the brief, but the underlying assertion is clear. These records are yours in the fact that they can identify you, but they are not yours should you seek to control access to them.

Certainly Davis could not have prevented the provider from turning over the records, but that skirts some of the issues with this case. ATT argued that the information it collected was sensitive enough that it should require a warrant to obtain. The government could still obtain these records (as it argues here), but it would need to reach the slightly-higher bar of "probable cause," rather than a court order or a subpoena.

The government leans on the nearly 40-year-old Smith decision as a prelude to its longer dismissal of any additional privacy expectations.

In general, courts have held that phone customers could not have maintained an actual expectation of privacy in routing-related business records made by a phone company to document transactions to which it was a party. See Smith, 442 U.S. at 741-43, 99 S.Ct. at 2580-82; United States v. Gallo, 123 F.2d 229, 231 (2d Cir. 1941). There is no cause to take a different view as to cell tower records.

The DOJ may say that cell phone records are pretty much the same as they've always been, but the dates of the cases cited don't bear this out. One decision is 35 years old. The other is 73 years old. Phone records used to be limited to phone numbers only. Now, they carry additional data, including location -- something that definitely wasn't on the courts' radar 40-70 years ago.

The DOJ then nails the point home, indicting US citizens as complicit in the removal of privacy expectations.

At any rate, Davis is not in a good position to complain that the government improperly obtained his location data, since he himself exposed and revealed to MetroPCS the very information he now seeks to keep privatei.e., the general vicinity information circumstantially inferable from cell tower records

"Exposed" and "revealed" are pretty harsh terms for something citizens are forced to give up in order to use cell phones. Without a doubt, many would like to keep this information private, but are unable to do so because even though they generate the records, they ultimately have no control over their distribution. Not only that, but they have considerably less access to records they've generated than law enforcement agencies do. The Third Party Doctrine has managed to turn the American public into handy little data generators -- data that the government can avail itself of with nothing more than a subpoena.

The government further asserts that Davis' stated "ignorance" of the fact that cell providers collect and store location data gives him no reason to claim an expectation of privacy. And this is true. Ignorance isn't a worthwhile excuse. But many of us do know providers store this information and yet, there's nothing that can be done about it other than to forgo the use of a cell phone altogether. That's almost an impossibility in this world, but the government maintains the stance that all of this is optional -- that we willingly create a wealth of data for third parties that can be accessed by law enforcement with minimal paperwork, let alone oversight. These are records we have no control over and yet the government is willing to use these against us while pretending we somehow have a choice in the matter.

Notably, the government also leans heavily on the Stored Communications Act to bolster its arguments -- a 30-year-old law that still treats email over 180 days old as not worthy of a warrant. Again, times have changed but applicable decisions and laws haven't. As it stands now, your life -- as stored by third parties -- is an open book.

This isn't a great test case for privacy expectations in cell phone records. Davis refused to admit ownership of the phone linking him to the string of robberies, taking a lot of the wind out of his Fourth Amendment sails in the progress. Like the Dread Pirate Roberts/Silk Road case, the government has used the denial of ownership to undercut Fourth Amendment concerns (Ulbricht has denied the servers infiltrated by the FBI are his). Defendants are basically being put in the position of incriminating themselves or abandoning any privacy arguments -- an unenviable position.

But the fact remains that location data can reveal far more about a person than the government is willing to admit. It's not simply a "business record." It's a roadmap to a person's connected existence. There should be an expectation of privacy, especially when the data gathered covers a span of days or weeks. But so far, the laws and the courts back up the government's third party assertions.

Permalink | Comments | Email This Story