Berkman’s Corinna di Gennaro posts about a proposed amendment in Italy that would require ISPs to block sites that permit postings that defend or instigate crimes. So, if there were a video on YouTube that defended a crime, Italian ISPs would be required to block all of YouTube.

Which content would be proscribed by this law? That is up to the Minister of the Interior, whose decisions cannot be appealed in a court of law. I can’t see any problems with that, can you?

So, you’d better think twice before you post to Facebook that you think that that photo of Michael Phelps and the bong is cool, kewl, or figo. You could get Facebook banned from all of Italy.

[Thanks to Marco Montemagno for the alert. And thanks to Twitter for telling me that Italian for “cool” is “figo.”]

[Tags: italy censorship free_speech digital_rights ]

1 Comment »

Charlie Leadbeater has posted a paper on why he’s unhappy with the British broadband proposal, Digital Britain. Given Charlie’s way with words, it’s not surprising that it’s a well-done piece, and it makes some essential points: First, you can’t solve problems just by throwing broadband at them, and, second, the Digital Britain proposal takes no account of the Net’s disruptive capabilities. (I’m summarizing to entice you, not to obviate reading it, people!)

[Tags: charlie_leadbeater digital_rights digital_britain broadband ]

2 Comments »

Lisa Tanzi, VP & Deputy General Counsel of Microsoft is giving a Berkman lunchtime talk called “A New Era of Computing: The Opportunities and Challenges of Cloud-Based Software and Services.” [Note: I am live-blogging, thus missing stuff, getting things wrong, writing badly, paraphrasing.] Her division at Microsoft is more on the enterprise side than the consumer side.

Microsoft is very excited about cloud computing (which I’ll abbreviate as CC)) she says. She’s going to give an overview but wants to spend time on the legal implications.

Lisa begins by putting CC into context on the history of computing timeline. Mainframes, PCs, Client/Server and WWW, and Cloud Services. During the CC era, people have multiple devices. Also, we’re seeing touch-based manipulation and other natural user interfaces. And there’s CC, defined as “providing software and computing power over the Internet.” With CC, you can pay as you go, connect all your devices, and provide wider access to “unprecedented computing power.” “But we at Microsoft don’t see it as an either/proposition.” People will want to have a mixed environment.

She goes through the benefits of CC for businesses, government, public sector, and developers. She shows a television ad.

Now she addresses some legal and policy issues. She begins with a scenario: A business launches a conferencing and email services offering. It’s HQ’ed in the US with data centers around the world. This creates jurisdictional issues — privacy, law enforcement, liability, running mixed source, data portability. But, she wants to focus on two sets of issues. First, moving data across borders: privacy, security and law enforcement. If the service provider doesn’t think it can reconcile the conflicting obligations, it may end up not launching the service. Or it might turn features on and off in different jurisdictions, although the software doesn’t always allow that, plus you lose some economies of scale.

“Governments are going to have to work together in new ways to find solutions to these issues,” Lisa says. Also, it may be that governments that figure out how to make it easier data across borders will have an advantage in attracting data centers.

Second, “How do the large bodies of traditional telecom regulations apply in this new world?” VoIP, email, IM are all affected. The laws vary quite a bit by jurisdiction, and they are usually written for different technologies. Law enforcement requirements, confidentiality obligations, emergency services (e.g., E-911) requirements, etc. How you do all this while enabling this new technology to evolve and be rolled out.

When it comes to data movement (her first point), imagine a German company that’s out-sourcing email to a CC provider that has data centers in France and Belgian. The data retention laws of Germany say that info has to be kept for 6 months, in France it’s 1 year, and in Belgium it’s 2. Whose law applies?

Some provincial laws in Canada require data in a CC system to be stored in Canada. But if a US company builds a data center in Canada, the Patriot Act may apply, and even if it doesn’t, exceptionalism is a bad way of doing business.

Q: Have you faced any specific cases where the mother country’s laws regulate or not?
A: A lot of these issues just aren’t resolved. Another real-world example: When we build a data center in another country, we go through an extensive process to make sure that we’re not in a situation of conflicting laws. Researching Japan we came across a statute that says electronic communications cannot be transferred outside of the country. It’s not very clear what that means. Can a subsidiary transfer info out of the country? Is there some new process we should be engaged in? Treaty-like solutions?

Q: Are you required to go to the highest common denominator among all the privacy and retention policies?
A: No clear answers. It looks like you can have a high water mark on privacy. And it gets yet more complicated if you have to deal with privacy based upon whether the person is, not where the data is.

Q: I use MS Word. To get it from my computer, the police have to get a warrant, etc. If I use MS Live, your CC service, the FBI needs a subpoena which means they don’t have to go before a judge and show probable cause. I’m worried that users are naively using online programs such as Google Docs and Office Live without knowing they’re online and that they’re lacking legal protection. What is MS doing to educate users?
A: We hope that it’s apparent to users that they’re storing documents online. The Terms of Use make the legality clear.
Q: No one reads Terms of Use.

Q: From the European perspective, the European Commission in2004 required MS to change its licensing policy. MS didn’t comply. In 2006, MS was fined. In 2008 there was another fine. Interoperability was the common thread. In 2008, another two cases were opened, against Office and Opera. It’s a neverending story. What’s your attitude toward interoperability?
A: We take our legal obligations seriously. We’ve announced interoperability principles. Windows Azure (MS CC) is in development. When it launches, the goal is to have it work with non-MS languages and development environments. It’s built on standard protocols. The entire industry would benefit from data portability.

Q: Users in cloud environments tend not to have much leverage. My non-profit in Zimbabwe just got kicked off its web host because Zimbabwe misunderstood US policy. The customer has no power in this scenario. I worry that for people who are very concerned human rights, data protection, etc., the early indications are that we should run like hell from CC. It’s too bad because technically CC is a much better way to do this. Unless large companies running clouds can offer assurance that they’ll fight for the rights of customers, the response from at least some class of consumers will be “Over my dead body.” Beyond harmonizing, how does this come into issues of free speech. What’s the responsibility of a company like MS to act as a defender of rights?
A: This fall we joined a global initiative to have companies protect privacy and freedom of expression. [Global Network Initiative] For enterprise customers would classify the situation differently. They want to impose obligations on the service provider: set up your physical security in a particular way, do retention in a particular way. For them those issues are being negotiated contract by contract.

Q: What are MS’s financial projections for CC?
A: We haven’t made any [well, made any public]. We’ll be making our business model clear sometime this year. Probably pay as you go.

Q: MS has pushed for a high bar for human rights when it comes to the Global Network Initiative. But CC makes it much harder. What are you going to do?
A: It’s a tough question. We’re working on it.

Q: What type of treaty might MS push for?
A: I was raising that as a discussion point. It’s sooo complex.

Q: Akamai has a similarly distributed architecture and business model. Have you looked at it and other such companies?
A: We have looked at what other companies do.

Q: Why aren’t you using SSL for the entire email session or for MS Office Live for Consumers?
A: I’ll get back to you.

Q: [jpalfrey] We at the Berkman Center pride ourselves on having great relationships and talking straight. From the perspective of users with less money than business and than other users, the value prop for CC is “free or cheap services.” When cheap services have been rolled out to the poor, there have been problems making it clear to users what their risks and rights are. So, as this CC rolls out, MS should have a “mitigation plan” in effect (e.g., signs on construction sites apologizing for the disruption). What would the mitigation plan look like?
A: I’ll take that one back to Redmond. I haven’t spent that much time on the consumer side of this. [Tags: microsoft cloud_computing digital_rights human_rights. ]

Be the first to comment »

Boston University has decided to set up an open access archive for scholarly work produced there. Yay. This seems to stop short from mandating that academics there are required to put a copy of their published work into the archive, but it’s a good step.

On the other hand, the Open Access Blog reports:

Congressional Representative John Conyers (D-MI) has re-introduced a bill (HR801) that essentially would negate the NIH policy concerning depositing research in OA repositories.

Here are the first three points in a letter posted by Jennifer McLennan:

H.R. 801 is designed to amend current copyright law and create a new category of copyrighted works (Section 201, Title 17). In effect, it would:

1. Prohibit all U.S. federal agencies from conditioning funding agreements to require that works resulting from federal support be made publicly available if those works are either: a) funded in part by sources other than a U.S. agency, or b) the result of “meaningful added value” to the work from an entity that is not party to the agreement.

2. Prohibit U.S. agencies from obtaining a license to publicly distribute, perform, or display such work by, for example, placing it on the Internet.

3. Stifle access to a broad range of federally funded works, overturning the crucially important NIH Public Access Policy and preventing other agencies from implementing similar policies.

Here’s a draft letter opposing it.

[Tags: open_access boston_university copyright copywrong john_conyers nih ]

5 Comments »

I just joined a group opposing Facebook’s decision that they own all of the content you create on their site even after you decide to close your account there. So can you.

[Tags: facebook open_access openid terms_of_service ]

4 Comments »

Jonathan Zittrain is talking at a Berkman lunch, about Herdict. [Note: I’m liveblogging, making mistakes, missing stuf, go wrong in every which way.] Herdict wants to help create “an emegent sense of what’s going on with this network” especially as network blockages and filterings are happening. Herdict tries to enlist people at large to answer the question “What’s going on with the Net?”

In the first instance, the team picked terms that it thought a regime might find objectionable, logged in as if from that country, and saw which sites are blocked. They then asked anyone on the Net to contribute sites that might be blocked, which the team then checked. In the next instance, they used open proxies. Then they teamed up with the Open Net Initiative to rigorously test filtering in about 50 countries. The result was the book Access Denied.

But to scale, they created Herdict (the verdict of the herd). As you surf, the sheep logo changes color: Green means nothing is blocked, grey means some people are blocked from the site, red means people you know have reported that it’s inaccessible. When you can’t get to a site, you can create a report

The Herdict Web site (www.herdict.org) you can see a live map of blockages. You can also filter by country. You can also go to a page internally referred to as “AmIBlockedOrNot” — officially, “The Reporter” — that will show you pages and ask if you can see them.

Herdict is collecting information not just about government filters, but wherever you expected to find info and did not. E.g., if YouTube has taken content down, Herdict wants to know about it.

Q: Can it be gamed?
A: Yes. But we can also manually inspect suspicious reports of sites.

Q: Privacy?
A: We record the IP addresses of reporters. We want to know where people are reporting from.

Q: The biggest risk is the people doing the blocking will block the sheep-server.
A: The only real countermeasure is to let people access it over SSL.
A: When the first state tries to block it — remember, it’s not a circumvention tool; it doesn’t show you anything you can’t otherwise can’t get too — I’ll take it as the first measure of success.

Q: Suppose someone uses Tor to reach Herdict to make reports …
A: We’ll see that it’s someone using Tor.

Q: [me] In the best cse, how does this information get used to make the world better?
A: We’ll “out” blockages. It might make it more difficult for regimes to block sites. It also provides data to academics and others. You can learn a lot about China from what it chooses to filter and how the filtering changes. Finally, success would be fostering a sense of participation on the Net…a sense of the Net as something that’s improved by your own contributions, you’re building a commons, you’re building a “digital nervous system,” to quote Bill Gates, for the Internet. Most blocking happens by IP address, but those change over time, which means your site may be blocked into China; this would enable a “title search” on IP addresses to see what sort of troubles it’s had.

Q: You could piggyback on Twitter…
A: Twitter might be one of the sites that get filtered early by a state worried about Web 2.0. But, you could even come up with a hash tag on Twitter. And it’d give you an independent database of reports…
A: There is already a herdict twitter account.
A: We’re excited about the possibility of including Herdict as a default add-in to existing channels.
Q: It’d be great if, when you’re blocked, you get an error msg that lets you report it directly to Herdict.

Q: Some users are very interested in blocked sites. How do you protect the privacy of those users? E.g., Someone in China coming in to your central server?
A: We’re hoping that it’s not just activists who will use it. We could have an addon that checks sites in the background, but we don’t want to ask anyone to visit a site that they haven’t given actual permission to visit. But the Chinese (or whomever) can watch who is visiting the site. But we don’t put up your IP address; it’s not visible on the site.

A: We wouldn’t be adverse to Herdict notification being offered when you register a domain name: Would you like to be alerted if your site is being blocked?

A: On the Web site, we obey your choice about Google safe sites about which sites to show you. We also heed Google’s list of malware sites.

Q: Does the color of the sheep reflect the page or the site?
A: The site.

Q: [charlie nesson] You’re describing a piece of sw that will hold up a mirror to all of the powerful entities who are filtering. Could you comment on the political dimensions? And, how are you going to launch it? And, do you have any line of defense when the blowback comes?
A: When we first came out with the studies in 2002 — first of China and then of Saudi Arabia — that made a pretty good splash. The Saudis actually had given us permission to be on their network for 2 wks. Think of things that seem inane that then become indispensible, e.g., twitter, blogs, wikipedia. The dream is that Herdict become like this. My dream is that that happens so that when the blowback comes, knowing where you can get to and you can’t and why is just part of the functioning Internet. As for the introduction, let’s talk…

Q: Maybe partner with sites where people are bored, like www.ask500people

Q: [me] The fact that you call it The Reported instead of AmIBlockedOrNot is not a good sign for PR. But how about on launch focusing on one particular region so we get good results quickly, rather than broad results>

Q: There are English-speaking communities in China…

Q: Maybe the sheep can tell me about my current ISP.
A: It’s not perfect data because we’re pulling it from a database of ISPs, but good idea.

Q: Isn’t that similar to what Google is developing?
A: Yes, but for every possible development. Google is building tools for checking Net neutrality. They’re more into the tools and details. We’re about can you get there.

Q: You should hitch up with Charlie Nesson…

Q: Maybe there’s a built-in audience for people who have desk jobs and do a lot of dilbert-esque surfing.
A: And slashdot.

Q: The more you can like it a game, the better. And it’s a great educational tool.
A: Do we want some persistence in reporting. Do you want an ID on Herdict? You could accrue points. We’ve put it on the backburner for now.

Q: Is there a function in the plugin to make it easy to ask friends whether a particular site is blocked.
A: We have a “test a website” feature. It’s our “view site report” function.
A: We’ve talked about building community
A: We have embed code so on your blog you can embed either the herdometer or the ticker.

Q: You should move as much of the infrastructure as you can onto, say, Amazon. [Tags: berkman oni censorship filtering herdict ]

We then celebrate Charlie Nesson’s 70th birthday…

Be the first to comment »

The National Journal says that Obama has picked Vivek Kundra, DC’s CTO, to fill the national post. This would be fantastic news. Vivek is all about transparency.

It’s just a rumor. But it’s a rumor that makes me happy.

[Tags: national_cto vivek_kundra obama transparency e-gov egov e-government ]

Be the first to comment »

danah boyd, John Palfrey, and Dena Sacco, three co-authors of the recent Internet Safety Technical Task Force are giving a Berkman lunch. (Laura Debonis, chair of the technical advisory board, steps in a minute late because of the snow.) (You can hear a podcast with JP and here. You can read the report here.) [Note: I’m liveblogging, whch means I’m getting things wrong, putting in typos, missing stuff, abbreviating, paraphrasing, getting meanings backwards, etc. Posted un-proofed]

JP gives the background. The ISTTF was created in Feb. 2008 by 49 state attorneys general (not Texas) and MySpace who, in a joint statement, agreed to report on the extent of unwanted contact and content (i.e., sexual predation and porn) among young folk, initially focusing on social networking sites. Thirty organizations were involved, ncluding social networking sites, Google, Microsoft, policy groups, and companies that make technology to protect kids. There was a research advisory board (chaired by danah) to make this a data-driven process. The aim of the Task Force was to assess the actual data, and then evaluate solutions. The technical advisory board advised on solutions.

dr. danah: The task force collected research. Sexual predation has been tracked over the years. “The number of online predation pale compared to the numbers for off line sexual harm.” That doesn’t negate it, but the harm is rarely stranger-related. The studies looked at studies of sexual solicitation online and of studies of cases in which someone was arrested. Most messages are not repeated, and the most common response is that the kid’s ignore it. The repeated ones are, of course, more likely to be reported. There are very few number of cases where online solicitation leads to offline contact. (This is about all Internet activity, danah says, not just SNS (social networking site/s).) Sexual solicitation has gone down over the years. It’s primarily high school age. They primarily know that they’re meeting up with someone for sexual purposes. 70% repeat the meet. “This is not the Dateline model.” The kids know what they’re doing, although “huge power issues are at play” of course. The published material says that the online chat rooms are far more likely to be connected with these cases. The SNS are much less likely. Of the kids who received sexual solicitations (one-off or repeated), what are the factors at play? The kids who are at risk are not representative of the entire population. “They’re much more likely to be at risk off line”: more likely to have been sexually abused, to have drug and alcohol issues. The online and offline behavior are closely connected.

JP: Some people disagree very strongly with what you’ve said. Some of the AGs who commissioned think our report downplays the danger and is outdated. If you create a profile page for a 14 year old girl, the AGs say you’re bombarded with sexual solicitations immediately.

danah: The research we’ve tracked goes all the way up through the Fall of 2008. Very consistent pattern. To confirm that the pattern is continuing, I called up the researchers and asked them to check their latest data sets, but they see consistent patterns.

danah: The AGs say the arrest record data is different, but they haven’t provided that data. We are publicly begging for that data. One researcher looked at all the press releases about arrests in PA, and called up PA reporting systems for sexual harm. Even in the 2008 data for PA, almost all of the cases of arrests are for when a police officer pretends to be a youngster, in a sting. Most are chat room and IM. There were three on SNS, and all fit the pattern of an older teen meeting up and thinking she’s in a relationship. WRT stings: If you go one line as a 12 yr old and put up naked photos and ask for sex, you will be solicited. But kids aren’t doing that. They’re at SNS to talk with their friends, not to the creeps. Again, you still have to worry about the exceptions. And if a 12 yr old puts up a page to attract older men, those kids desperately need our help. But if we assume that’s typical, you miss the kids who must need our help.

JP: What are the relative risks of predation and peer-to-peer (= bullying)?

danah: Almost half of sexual solicitation comes from other minors. 30-40% come from 18-24 year olds. There’s bullying wrapped up with sexual solicitation. There are various definitions of bullying, so you get radically different numbers in the research. Regardless of the definition, far more are victims of it online than are victims of sexual solicitation. There are lots of ramifications of bullying. For an average, you should be much more concerned about peer-to-peer sexual solicitation in the schools and p2p bullying. The sexual solicitation needs to involve police, social workers, etc. Parents are the best intervention point for bullying.

danah: Content solicitation hasn’t changed much. Porn numbers are relatively consistent. The primary unwanted exposures are searching for the wrong thing and email spam; SNS don’t seem to be a primary source. Violent content is well under-researched. We’re beginning to see youth-generated problematic content; a lot more work needs to be done on this. E.g., photos of self-harm (cutting, etc.), homemade porn, etc.

JP: Laura, are there technologies we should be using?

Laura: All 40 of the techs we looked at had something to recommend them, but none were 100% accurate all of the time. There were also privacy and security issues. MySpace uses Sentinel age verification. Parents use net nanny tech with reasonable degrees of success. But our mandate was to find the tech that could be used across the board, and we couldn’t find one.

JP: The SNS told us what tech they’re currently using. So now we have a sense of who’s using what. There’s promise in what’s coming out of labs.

Dena: The Task Force made a series of recommendations, for the Internet community, for parents, and where additional researches might be best spent. Overall, our recommendation was that while the tech we reviewed is promising, the AGs should not endorse any one tech or set of techs. Such an endorsement could inhibit development in this area. Also, we need more research: more resources, more data from law enforcement. Also, ISPs, AGs, academics, educators, social services, law enforcement etc., all should continue to collaborate on this problem. Also, education is important! The report includes specific recommendations.

Dena: How do you lower the risk while keeping the Net open and anonymous?

Q: [gene] The risk is context dependent. Maybe the AGs think it’s riskier because the risks are higher for those who are at risk. The damage may be higher…
A: [dana] The Internet makes access to the social world more pervasive. It’s not clear the Net has made such a strong impact, but it makes at risk kids more visible to those who can help them…more visible to educators, law enforcement, social workers. Before the Net, a lot of parents couldn’t see their kids being bullied. Now they can see some of the ramifications of it.

Q: Do you think that’s why your research is being attacked?
A: [danah] When I interviewed teenagers about predators, they’d point to Dateline. There’s consensus on these images. “On the Death of the Public Space” makes the case that we’ve begun to fear public spaces. There are also some political issues behind this.
JP: Of all the things I’ve done as a researcher, this was the meanest. So, danah, let’s say you’re right that we have burned into our minds a higher degree of risk, maybe that’s ok. Maybe we should have a higher degree of caution. What’s wrong with the fears being overblown if it keeps our kids away from harm?
danah: Looking kids away from risks does them a disservice. We need to educate them so they can make wise decisions. We also rupture trust: Kids are being hemmed in but don’t see the problems they’re parents are referring to. Also, this has been about a hierarchical dissemination, rather than parents reaching out to kids whose parents are not looking out for them. We need to work collectively, not just assume hierarchically delivered services.

[Eszter Hargittai] I too get frustrated by those who say the data must have changed. Things generally don’t change that quickly.
JP: The primary pushback from AGs is that they’ve put pup profiles and have been immediately solicited.
Eszter: How American is this? The fear? The response? How might other countries be dealing with these issues?
danah: We focused on the US but we did look out at the world. We also showed the research to researchers outside of US. The UK has similar dynamics. Europe does not. In part this is because kids’ mobility is different. The further you get out from the US and UK, the more meeting people online is acceptable and not tainted with risk. It’s assumed to be how you meed people with shared interests. And it doesn’t raise the numbers of sexual harm.
JP: There are studies in Canada and the UK and a EU Commission process. There’s great consistency across these reports.

Q: [sarah] I work with groups dealing with domestic violence. Research in that field shows that the vast majority of abuse comes from people in the home. Perhaps people object to your report because they find it more comfortable to think that abuse comes from people outside the family? Also, what contradiction between profiles and arrest records were you referring to?
A: [danah] The arrest record for online-related sex crimes shows the abuser and the victim. One scary thing we’ve seen: Family members targeting others over the Net so other family members won’t know it.

[scott macleod, via net] What do kids say they want for protection?
A: [danah] The most common thing you hear from them is what they hear from parents and teachers. So they’ll you the way to be safe is not to put up identifying info and to report other kids. Doesn’t mean they do it. Classic statement: “Just don’t be stupid.” WRT to bullying they don’t always identify it as bullying.
[dena] There’s an org that has kids present to kids.

Q: A lawyer’s question: To protect rights, isn’t it the parent’s job, not the government’s, to take care of what their kids do and see online.
A: [jp] The Communications Decency Act only affects content. In Born Digital, we say Section 230 should be amended. It provides immunity to intermediaries. It’s very important in the defamation space. It’s been interpreted as extending far beyond its intention so that “Julie Doe” was unable to sue MySpace after she was hurt by a sexual predator. MySpace probably wasn’t liable in that case, but they should have had to face the music. This is a very unpopular position. [I’ll say!] You could also mandate tech, such as age verification, and the fact that the report doesn’t say that might account for some of the resistance. Changing 230 would give sites an incentive to compete on safety.

Q: Privately funded report? And could you recommend a standard any hypothetical tech would have to meet?
JP: I wasn’t paid a penny to write this. This was on top of my job. My only incentive was to protect my children. WRT standards: I think the next best step would be for the companies to talk about standards, about data sharing. There should be ap ublished best practices for protecting kids in different environments.

In Brazil the public defense people ask the ISPs to comply with best practices. Parallel, we just changed the law to put a lot of responsibility on the ISPs, e.g., data retention. Are there emerging best practices?
A: [dena] People have said that the report says there’s no problem and we oughtn’t do anything. That’s backwards. The report says what the risks are and suggests what we ought to do. [Tags: berkman isttf sexual_predation child_safety bullying anonymity ]

3 Comments »

Yochai Benkler, who wrote the seminal book on the new collaborative economics (and of course posted it for free), and is also a Harvard Law professor and holder of the Berkman Chair at the Berkman Center (and is also one of the sweetest people ever) … I got lost in my benkleration, so let’s just start again …

Yochai Benkler has posted at Talking Points Memo his analysis of the Senate and House versions of the stimulus package for broadband. (Thanks for the link to David Isenberg, who provides his own, usual insightful analysis.)

[Tags: yochai_benkler berkman broadband stimulus net_neutrality david_isenberg ]

1 Comment »

Charlie Nesson has successfully argued that the next hearing in the countersuit against the RIAA’s prosecution of Joel Tenenbaum ought to be webcast live. Judge Nancy Gertner decided that, yes, the an Internet case about the Internet generation ought to be available on the Internet. This is highly unusual. Thank you, Judge Gertner.

David Ardia, of the Berkman Centers Citizen Media Law Project, explains it all…

1 Comment »