The Copyleftist

A Closer Look at the Copyright (Infringing File Sharing) Bill

Reading through Twitter, the Facebook page and the rightfully outraged comments on blogs and news articles, you can’t help but notice a lot of panicked people wondering exactly what this bill entails. 

To understand what we’re dealing with and what the consequences will be, we first have to understand a little about the internet. When information is sent across a network, it’s broken up into tiny pieces of information called packets, which are then given an address and sent off to find it. 

Packets can be anything — web pages, emails, instant messaging, tweets, Facebook updates, and yes, pieces of copyrighted works being trafficked over peer-to-peer (P2P) networks. 

Contrary to popular misconception, P2P traffic does not exclusively involve ‘piracy’. BitTorrent technology, currently the most popular solution for large-scale file-sharing, has many legitimate uses in corporations and in distributing legitimate content. 

It’s important to realize that P2P is just a tool — what’s done with that tool may be illegal or not, depending on the information being sent across it. 

The bill itself has actually received a remarkable upgrade from earlier versions, which I’m forced to concede. In fact, some of the potential abuses have been amended. I’m still not convinced (by any means) that this bill is a good idea or at all necessary, mind, but I suppose it’s better than nothing given we have to live with it for the time being. 

I covered much of my opposition in a post yesterday. Right now, I want to look at what the bill actually says and give you an idea of what is, and is not, going to be legal under the soon-to-be law. 

Under 122A, file-sharing has been redefined:

file sharing is where—
(a) material is uploaded via, or downloaded from, the Internet using an application or network that enables the simultaneous sharing of material between multiple users; and
(b) uploading and downloading may, but need not, occur at the same time

That is far better than the original, which would have criminalized everything from email to watching a YouTube video. At least now there’s a pretense of targeting P2P applications (whether Limewire or BitTorrent).

(I would note that, with a loose definition of these terms, you could still build a case that watching a YouTube video in your browser qualifies — but here we run into issues of enforceability. You’ll see why in just a moment.)

The definition of “internet service provider” has likewise been upgraded:

IPAP, or Internet protocol address provider, means a person that operates a business that, other than as an incidental feature of its main business activities,—
(a) offers the transmission, routing, and providing of connections for digital online communications, between or among points specified by a user, of material of the user’s choosing; and
(ab) allocates IP addresses to its account holders; and
(b) charges its account holders for the services provided in paragraph (a) on a regular basis its services; and
(c) is not primarily operated to cater for transient users

This excludes wifi hotspots, like the library and Starbucks, and importantly, residential wifi routers. So far, so good. 

Section 122B gives us an overview of how the entire process works. 

“122B Overview of infringing file sharing regime
“(1) Sections 122A to 122R provide copyright rights owners with a special regime for taking enforcement action against people who infringe copyright through file sharing.
“(2) The regime provides that, at the instigation of copyright rights owners, ISPs IPAPs must issue infringement notices to alleged infringers.
“(3) The 3 kinds of infringement notices, in the order in which they are given, are a detection notice, a warning notice, and an enforcement notice.
“(4) After an enforcement notice is issued to an alleged infringer, the copyright rights owner may take enforcement action by seeking the following orders against the alleged infringer:
“(a) an order from the Tribunal for a sum of up to $15,000:
“(b) an order from a District Court requiring the IPAP to suspend the account holder’s Internet account for up to 6 months.
“(5) Time limits apply to all stages of the regime.
“(6) This section is by way of explanation only. If any provision is inconsistent with it, the other provision prevails.

For those of you wonder if you’re breaking the law by downloading a file, or watching YouTube videos, or listening to tracks on Soundcloud, or whatever else, pay attention here. This section lays out the process. 

Under subsection (2), you see that it’s up to the rights holders to take action. This means that downloading or file-sharing alone is not going to get you caught. This means that your ISP is not monitoring your traffic. You cannot get in trouble simply for downloading a file or watching a video or listening to a track.

This is why it would be effectively impossible to get caught for watching a YouTube video — short of subpoenaing Google for information on those who’ve watched a video, the rights holder would have no way to know you viewed anything under copyright. 

(Bear in mind that under the right circumstances, this could happen, as it did in the recent Sony case vs. the PS3 hacker Geohotz. Sony subpoenaed Google for the IP address of those who viewed the video tutorial, so it’s not impossible to get in trouble, just very unlikely.)

Under subsection (3), you see that all your ISP has to do is forward the infringement notices. The bill creates a legal requirement for them to do this. They emphatically are not monitoring your internet traffic or taking any steps to prevent you from downloading or accessing copyrighted materials.  

Let’s say you get a notice in the mail. What can you do?

122G gives you the option of challenging the infringement notice. You have 14 days from the date of the original notice to send a challenge back to the ISP, at which point it will be passed on to the rights holder, who may then accept the challenge or reject it and proceed. If the rights holder accepts your challenge, then that’s the end of the matter — nothing remains on your record.

If you rack up three notices and have to go to the Tribunal, that’s where things might get interesting. In past incarnations, there were considerable questions about liability and defense. Some of those have been answered, some have not.

“122MA Infringement notice as evidence of copyright infringement
“(1) In proceedings before the Tribunal, an infringement notice is conclusive evidence of the following:
“(a) that each incidence of file sharing identified in the notice constituted an infringement of the right owner’s copyright in the work identified:
“(b) that the information recorded in the infringement notice is correct:
“(c) that the infringement notice was issued in accordance with this Act.
“(2) An account holder may submit evidence, or give reasons, that show that any 1 or more of the presumptions in subsection (1) do not apply with respect to any particular infringement identified in an infringement notice.
“(3) If an account holder submits evidence or gives reasons as referred to in subsection (2), the rights owner must satisfy the Tribunal that the particular presumption or presumptions are correct.

Subsection (1) has some interesting wording. At first, it appears that the notice is presumed correct because it’s a notice, which is rather circular. But then subsection (2) says you can contest those presumptions of the notice, and (3) says that if you do, the burden of proof shifts back to the rights holder. 

The Tribunal presumes you’re guilty — unless you say you aren’t. That strikes me as odd, but it does give you a strategy: if you’re ever called to the Tribunal, you have no reason to admit guilt. Always deny and always put the burden back on the rights holder. 

There’s still no mention of what kind of evidence the Tribunal will accept or expect, mind you, so it may well be that having your IP address in a torrent swarm is enough to prove your guilt. If this is the case, then punting the burden of proof back to the accuser may not help you at all. I would prefer more explanation of this point. 

As far as the privacy issues go, the District Court must issue an order for your personal details to be released to an accusing rights holder, and only then when seeking disconnection under 122O. This won’t come into effect until (or if?) the disconnection feature is activated by Order of Council after the trial window expires.

The other issue of concern to me was the monitoring of a user’s activity over the internet. In the original wording, ISPs were require to keep logs on “the use of the internet” for up to 40 days — worded so vaguely that there was no way to know exactly what “activity” was being stored. 

“122Q Obligations of ISPs IPAPs
“(1) Every ISP IPAP must retain, for a minimum of 40 days, information on the allocation of IP addresses to each account holder. 
“(2) Every IPAP must retain, for a minimum of 12 months, the following information:
“(a) any information about infringements that is sent by rights owners to the IPAP for the purpose of matching infringements to account holders:
“(b) in relation to each of the IPAP’s account holders,— “(i) any infringement notices issued to the account holder; and “(ii) any challenges to infringement notices and any responses to them; and “(iii) which infringement notices (if any) have been cancelled or have expired; and “(iv) any orders made under section 122O suspending an account holder’s account.
“(3) No ISP IPAP may release the name or contact details of an account holder to a copyright rights owner unless—
“(a) authorised to do so by the account holder; or
“(b) required to do so by the Tribunal or a court.

This is much, much better. Subsection (1) specifies exactly what will be stored — the allocation of your IP address. There are still nasty things that can be done with this, of course, but it’s far better than logging the activity of all traffic over each user’s connection. That would impose enormous costs on ISPs, to say nothing of the privacy violations. 

That’s gone now, thankfully. 

So what are we left with?

1. You won’t get in trouble for watching YouTube, for legal downloads, or even for BitTorrenting — unless a rights holder manages to discover evidence of wrongdoing on your part. Savvy users will immediately understand how to circumvent this, of course. 

2. To stress it again, your ISP will not be monitoring traffic. It’s completely up to a rights holder to find and produce evidence of file-sharing. 

3. ISPs aren’t keeping logs of internet traffic. They’re only required to keep records of the IP address(es) assigned to your account during a 40-day window.

4. You can challenge infringement notices, and it’s up to the rights holder to push the matter further (or just drop the matter).

5. At the Tribunal, you’re presumed guilty, but you can challenge that presumption and shift the burden of proof back on to the rights holder. 

5a. Still no idea on what the Tribunal considers evidence. The standard of evidence could range from reasonable to lol wut? depending on how they do things. Given the difficulty of proving one’s innocence, I would hope the Tribunal keeps those standards high. 

6. You’re still liable for activity on your account, even if you don’t authorize it. This includes being hacked by malicious war-drivers. Depending on what the Tribunal will or will not accept as evidence, this could mean having a spoofed IP address turn up in a torrent swarm. This, unfortunately, has not changed. 

My opinion on this bill hasn’t changed a bit. It’s still unnecessary. It doesn’t protect the interests of creators in New Zealand. It’s a law created at the behest of foreign media companies. It still has potential for abuse. It’s a waste of government time and, potentially, money. It’s even a waste of paper, if the infringement notices run as they did after France’s HADOPI law passed (upwards of 50,000 per day). 

This bill sets a bad precedent, illuminating a fundamental misunderstanding about how the internet works and how creative works come into being. It was poorly thought out, poorly written, and only looks presentable now because the original was in such a shameful condition. 

NZ’s Copyright (Infringing File Sharing) Amendment: What it Means

As you’ve probably heard, the Copyright Amendment has passed its final reading in Parliament, rightly receiving much criticism for being shoved through the ‘urgency’ session intended to provide relief to victims of the Christchurch earthquake. 

If there were some textbook that dealt with anti-democratic elitism on the part of an allegedly representative body, and corporate cronyism to satisfy overseas interests, you would find the fiasco that is this bill under headings for both. 

Our new law came to New Zealand at the behest of media companies in the United States in a blatant case of policy laundering. The US uses its vast economic influence to export the laws it wants to its trading partners. Fearful of losing that status, most countries readily give in — whether the people of the host country benefit or not. 

So here we are, government readily acquiescing to the demands of international interests with a law that presents serious challenges to privacy, freedom of speech, and due process. All issues of policy exportation aside, only a minority — certainly none of our local lawmakers — have taken this law to task and asked the simple question: will it really do what it says? 

There are two separate questions that must be answered. Will this particular law actually help artists, writers, and musicians in New Zealand? Do these rights holders even need the protection of law in the first place? 

There is very little evidence to suggest that stronger intellectual property measures create incentives for creators to create. Extended copyright protections, which are now at life of the creator plus 70 years, do not benefit authors — they benefit Disney, who would lose control over their properties. This debate is not about making money. It’s about the right to keep creative works under lock and key, works that should pass into the public domain, so that rights holding corporations can maintain potential income streams. 

This is about control, not compensation to rights-holders. Our new law is meant to promote rent-seeking on behalf of corporate interests. 

Meanwhile, the public domain, that garden of intellectual works which we all draw upon to create new content, is steadily diminished. Instead of a rich culture, we’re left with infertile dust that excludes most any work produced in the last 50-100 years (depending on where you live). 

Ironic that copyright law originally came about as an incentive to creators to enrich the public domain. The original Statute of Anne, from the 16th century, was created as an incentive to authors to create books by protecting them from the monopolies of book printers and allowing works to add to the cultural gestalt. As written in the constitution of the United States, copyright exists to “promote the progress” of arts and science. 

There is nothing there about guaranteeing profits to corporate dynasties. 

Let’s look at the data. We’re told that “piracy” has massacred the music and movie industries. I find that to be most interesting given that the movie industry can’t stop patting itself on the back for another year of record box office takings in 2010 — the fifth year in a row, including three recession years. 

If that’s a massacre, I’d like a little of that slaughter. 

The music industry? Apple’s iTunes recently celebrated its one billionth (that’s billion with a b) sale. Music is flourishing. You can hardly set foot on the internet without encountering a new band — or a new success, made possible by the very tools of distribution and creation that the old guard wants to destroy. 

Facts don’t stop the cognitive dissonance, though. The MPAA lauds record income on one hand while the other can’t stop talking about how much money they’re losing. This may fool our politicians. This kind of buffoonery should not fool us, and it absolutely does not meet the burden of proof required to criminalize all internet users. 

Even if we assume that strong IP protections are necessary to protect creators, and even if we assume that “something must be done” — despite all the evidence suggesting nothing is wrong — what will this bill do?

Firstly, I want to point out that the complaints about this bill have exactly nothing to do with a content-creator’s right to get paid. The opposition to this travesty is focused on the fact that this is a poorly-written law, a law imported by overseas corporate interests, and a law with the potential for large-scale abuse. 

Simplistic rebuttals suggesting that the bill’s opponents support “theft” [sic] or don’t want creators to get paid are as ridiculous as they are intellectually bankrupt. I’m a creator myself, and I want creators to get paid. This law has no bearing on that — this law will not help you, writer, artist, or musician, make more money. 

Compensation to creators is entirely separate to criticisms of this unfortunate law, and hinging on the belief that you need strong IP protections in order to make money. You’re being sold a line of fear and given a choice between believing it or going broke — but we can save you if only you sign away a few civil rights. 

Quickly, I want to summarize what this law means to you:

1. Your ISP will not be actively monitoring your internet traffic. Under this law, rights-holders can contact your ISP with an infringement notice, which the ISP will then pass on to you. It’s up to the rights-holder to find evidence that you’re infringing on a copyrighted work.

2. If you receive three of these notices within a specified period of time, you’ll appear before the Copyright Tribunal. The way the bill is written, you’re assumed to be guilty and must produce evidence of your innocence — a stark reversal of the assumed innocence in every other court proceeding.

Your right to due process is an unfortunate casualty of the fast track process.

2a. It’s extraordinarily difficult for you to prove you didn’t infringe a file. I’m a competent user — writing this post on a Linux distribution and more than capable of handling networking technologies — and I couldn’t produce negative evidence of that caliber. 

This leads us to an interesting scenario. If “I didn’t do it” is a sufficient defense, then there’s no point to the Tribunal at all; anyone can demolish a claim by simply denying the infringement. 

But if your denial isn’t a defense, then virtually every Tribunal hearing will result in a guilty outcome. 

You either give everyone an out, thus making the Tribunal irrelevant, or you make everyone guilty and turn this into a sham. 

There is no middle ground, thanks to the limits of networking technology. 

Our new law is guilt on accusation with the rubber-stamp of court approval. A court hearing without the ability to defend yourself is equivalent to no hearing at all. 

3. Yes, this will be abused. The only barrier to filing an infringement notice is a fee. If you don’t like what your business competitor is doing, claim infringement. If you don’t like a blog post that offends you, claim infringement.

And this is only the human element. The technological factors are arguably worse — if your IP address turns up online, not only without your knowing but without your action, you’re liable. Have a look here to see how reliable these detection methods are, and ask yourself if you want to be on the hook for $15,000, or six months without internet, based on evidence that can incriminate a printer for illegal file sharing. 

Oh, and you’d better hope nobody cracks your wifi router. You’re liable for that too, despite WEP being worse than useless and even WPA2 having vulnerabilities. The bill places liability on the account holder for any actions taken on that account, forcing you to shoulder the burden of securing your router.

Given that both WEP and WPA2 can be cracked with little to modest effort, the Parliament has effectively told us to get rid of our wireless routers. There can be no guaranteed security short of turning them off. 

Bye-bye wifi. 

Our new law is a poorly-worded and blatantly ignorant attempt at conforming local policy to the desires of overseas interests, written by people with little understanding of the issues involved, disregarding the input of those who are informed, and then ramming it down our throats with lies and a dose of condescension. 

Once this law comes into effect, your best bet to avoid becoming a criminal is to invest in a Virtual Private Network (VPN) hosted outside New Zealand. For $5-$20 per month, you can encrypt your internet traffic in a secure SSH tunnel and not worry about having your IP address turn up in unsavory places. 

Of course, that won’t protect you from malicious activity, whether copyright trolls or wardriving wifi hackers. For that, your only defense is to cross your fingers and hope.

Which should work about as well as hoping Parliament stops caving in to US pressure to the detriment of Kiwis. 

Three Strikes Bill Passes NZ Parliament

I’m not surprised. I can’t even say I’m disappointed. I knew it was coming. No amount of reasoned argumentation can fight the tide of corporate money and lobbying.

http://torrentfreak.com/kiwi-3-strikes-anti-piracy-bill-receives-unanimous-support-100423

I could be shocked that every MP kowtowed to the industry, repeated their proven lies*, and pretty much managed to glorify this bill as the second coming of awesome even while it sets the citizens up to foot the bill of “piracy” enforcement.

* http://techdirt.com/articles/20100412/2346298988.shtml , http://techdirt.com/articles/20100419/1424349085.shtml

That doesn’t bother me so much. I’ve had time to come to acceptance. I don’t like it, but there’s not a lot I can do.

What does bother me is how people have come to so blindly accept this notion that personal file-sharing is equal to a criminal act. We’ve all seen the stupid ads, how “you wouldn’t steal a car”. The simple fact is that intellectual property is not a physical good and the analogy between the two is so flawed as to be unusable.

It seems to be accepted without criticism, the premise that file-sharing is a moral and ethical wrong. In reality, it’s only a legal wrong - and only that due to industry lobbying.

You wouldn’t have to go far to make the ethical argument that not buying from these companies is better than giving them money. After all, they contribute nothing themselves. We can’t forget that these companies are not creators and producers of works. They are distributors and promoters.

That alone is fine. Where they cross the line into becoming a net negative for society is in their ridiculous prosecution of this anti-piracy campaign. It’s not enough to find new and profitable ways to exploit the digital landscape; no, they have to use their considerable financial and legal resources to convince the world (or the lawmakers, at least) that they’re undertaking substantial losses all due to this new-fangled “internet” thing, allowing people to just come in and steal their property!

So we must crack down on this immoral and illegal act! Punish the file-sharers! Throw them offline! That way we can keep our centralized model of distribution in place, just how we like it.

To hell with that. You’re not owed a living just because you’ve always done it that way.

(An interesting footnote here: the music and movie industries were both founded on piracy. The music industry started up by violating patents on music recording technology, and the movie industry is currently in Hollywood due to patents on film recording technology which were in place in New York at the time. I don’t imagine they want most people to know that, though. So shhh!)

The question I have to ask is this: why is piracy among the youth such a horrible thing? Let’s look past the typical moral panic of such things. Why should I, as Joe Average, be worried about this?

Is it going to kill music? Doubt it, for two reasons. One, people will always make music. Or did music only come into existence in the mid-20th century, along with big record labels?

Two, the point the media companies have conveniently left out is that if they were to vanish tomorrow, they wouldn’t be missed. Artists, writers, musicians, all of these people could use the new internet tools to connect with their fans, to promote their works, market themselves, distribute their works, and get paid for it - all without the need for an anachronistic middle-man.

That’s why we see these laws. That’s why we see “piracy is wrong!” expressed as a normative statement, instead of a premise which can be empirically proven to be incorrect.

Which all brings me to the point. To listen to the MPs speak, you’d think that file-sharers are just pilfering money away from these companies as fast as they can. And of course, We Must Act! Certainly you can’t just allow people to go and take things!

Never you mind that the marginal cost of reproduction is zero and the original owner is not deprived of his possession, making file-sharing nothing at all like theft. You should also ignore the music industry’s own statistics showing that “pirates” are the most likely to actually purchase music.

You should certainly ignore the implicit assumption that each pirated file is one lost sale, because that’s the only way you can justify outrageous financial losses the industry claims.

If you point out that the music industry has seen its revenues grow, despite piracy and despite declines in physical CD sales, well, you’ll just be ignored. Facts have no place in this debate.

At least, that’s the message that we as citizens are given. If you point these facts out to the MPs, you get a nice dismissive letter that says, paraphrased, “we understand your concerns but unfortunately the music industry lobbyists pay more than you can afford.”

They’ll acknowledge each and every one of these issues, then talk out the other side of their mouths in support of industry desires.

I’m disappointed most of all in the interest groups that have rolled over on the matter and even celebrated this bill. Yes, it’s an improvement over the original s92A, but as I’ve said so many times, it’s the same kind of improvement as being punched in the mouth instead of being set on fire.

It’s better in relative terms. That doesn’t mean it crosses the line into “good” or “desirable” or “a net positive”.

As to the bill itself, I can summarize three main issues, in rough order of importance to me:

1. You’re creating a new cost for ISPs and wifi providers, and that cost will be passed down to the customers. And this says nothing about potential privacy issues.

The new bill requires internet providers to maintain logs of customer activity for 40 days, so that the precious media companies can have access to your internet traffic if they suspect you’re a dirty pirate.

Forty days of logs for each customer is no small order. That’s a lot of traffic to log and archive. Guess who’s going to be paying for that? Our internet bills weren’t high enough here, I suppose.

There’s still that murky area of wifi culpability as well.

Oh, and you better hope you don’t get accused, because you can expect all of your recent online activity to come under heavy scrutiny if you are. But if you’re doing nothing wrong, you have nothing to worry about citizen!

2. You’re creating a copyright tribunal to handle all of these complaints, and yet we’ve heard exactly nothing about what this will entail, regarding standards of evidence and valid defenses.

This is a tangled little knot right here, and you can tell because nobody’s discussed it.

The dilemma: I have a wifi hotspot in my home, attached to my internet account. It’s unsecured. A hacker or ne’er do well logs in to my hotspot, torrents a bunch of movies without my knowledge. Later I receive infringement notices and have to show up at the tribunal. I’m stunned, because I know nothing about it.

Is my defense of an unsecured wifi hotspot, combined with total ignorance of the matter, valid?

Change the parameters a little. My hotspot is secured by WEP, and a hacker cracks it (which is amazingly easy to do). Same scenario ensues. Is this a valid defense?

What about IP spoofing (http://dmca.cs.washington.edu)? What if someone frames me for infringement when I’ve not engaged in the activity? Is that a valid defense?

We have no answers for these questions! Why do I want to be at the risk of massive fines or losing my internet for six months with that sort of ambiguity?

The issue is more than a little troubling. If these defenses are valid, then the copyright tribunal is redundant; anyone aware of these issues has so many plausible defenses that there is no way to prove infringement.

If these defenses are not valid, then the tribunal is a sham and a rubber-stamp for industry interests, because there is no way to prove your innocence in light of accusation.

In that light, how does this even follow? It’s either pointless or a show-trial to rubber-stamp what the original s92A would have done in the first place, to give it a pretty sheen of due process while fast-tracking the industry’s wants.

Unfortunately I get the strong impression that our lawmakers are largely unaware that these are even issues.

3. You’re criminalizing a non-criminal behavior based on exactly nothing of substance, and at the behest of a private industry. 

I’m of the mindset that if you’re going to criminalize a behavior, you had best meet the burden of proof as to why that behavior is being outlawed.

Can the NZ MPs do that? If they can, they’re doing their best to hide their evidence. The industry’s own statistics have been called into question and ultimately they’ve been debunked.

So the obvious question: on what grounds are you justifying this?

And since nobody’s asking this question, I’ll ask: why is the law being written, in fact custom-tailored, to the specific needs of a private industry? Is it now the role of government to enforce the will of private businesses, to the exclusion of the majority of its own citizens? 

If any of these issues can be answered satisfactorily, I’ll change my opinion on this law. “Satisfactorily” means explaining the benefits to the average citizen (or for that matter, even to the average artist/musician/creator - file-sharing doesn’t hurt them) and how this actually meshes with democratic governance.