Britain’s graduated answer

Posted on by
Reply

UK Government just published its vision of the future of Digital Britain. As expected, a section is dedicated to copyright issues. In chapter 4, “Creative Industries in the Digital World”, the report highlights the need to fight unlawful file sharing. It describes the two stage mechanism that the Government foresees to deploy.

The first step is the typical spotting of illegal file sharers and sending notifications. It is expected that this should seriously deter the piracy. nevertheless, if it would not be sufficient then other tools such as traffic shaping, bandwidth capping or address filtering would be deployed.

Legislation to reduce unlawful peer-to-peer file-sharing

The key elements of what we are proposing to do are:
● Ofcom will be placed under a duty to take steps aimed at reducing online copyright infringement. Specifically they will be required to place obligations on ISPs to require them:
– to notify alleged infringers of rights (subject to reasonable levels of proof from rights-holders) that their conduct is unlawful; and
– to collect anonymised information on serious repeat infringers (derived from their notification activities), to be made available to rights-holders together with personal details on receipt of a court order.
Ofcom will also be given the power to specify, by Statutory Instrument, other conditions to be imposed on ISPs aimed at preventing, deterring or reducing online copyright infringement, such as:
●Blocking (Site, IP, URL);
●Protocol blocking;
●Port blocking;
●Bandwidth capping (capping the speed of a subscriber’s Internet connection and/or capping the volume of data traffic which a subscriber can access);
●Bandwidth shaping (limiting the speed of a subscriber’s access to selected protocols/services and/or capping the volume of data to selected protocols/services); and
● Content identification and filtering.
This power would be triggered if the notification process has not been successful after a year in reducing infringement by 70% of the number of people notified.

After one year of experiment, the government would check the efficiency. The objective is to reduce by 70 to 80% unlawful file sharing. If the objective would not be reached, then the Government would study new measures.

The interesting part is the attempt to limit the network use to fight piracy. Nevertheless, it may open the Pandora box. Is it the end of Net neutrality in UK?

The full report is available here.

Thanks to MJC for the pointer to the doc :Happy:

80,000$ per song

Posted on by
Reply

That is what Jammie Thomas-Rasset should pay to four major labels for copyright infringement of 24 songs. The total fine is $1,900,000!!!

Jammie Thomas was spotted by Media Sentry in February 2005 for sharing 24 songs through Kazaa. She always claimed to be innocent and refused settlement. This was an appeal. The initial decision was around $9,000 per infringing songs.

Unfortunately, for this trial, her defense collapsed. Her defense was that it was not true because the experts could not spot anything on her hard disk. She always claimed that the songs must have been on the hard drive that she had exchanged at Best Buy. Unfortunately, the exchange occurred after the infringement occurrence. Furthermore, she claimed to not even know what Kazaa was. Unfortunately, while student, she wrote an essay about Kazaa. So long…

The severity of the sentence may be explained by a popular jury who did not liked that she lied to them. The severity may also incite people to go for fast settlements rather than prosecution in accordance with current RIAA’s

Beezik: an interesting distribution model

Posted on by
Reply

The French site Beezik just opened. This interesting site proposes an alternate distribution scheme for music.

Beezik allows to legally download songs for free! Yes, you pay no dime! And it is legal. The announced size of the catalog is about 2 million songs. And they offer some of the current blockbusters. (when exploring some of my favorite performers, I often found (in the style of …)? Nevertheless I found some original interesting titles.

So where is the trick? The clearly announced one is the mandatory exposure to advertisement. Once you selected your song, you have to choose among 4 advertisers. During the download time of the song, the ad is displayed full screen. If you reduce to window size, the download of the song is interrupted. In other words, your computer is “blocked” to display an ad during the download time. The obvious thought to escape advertisement is “Ok, lets go drink a coffee or a coke, or whatever you want, I’ll come back later”. This does not work. Once the download completed, you have 6 seconds to click on the screen in order to launch the screen that saves the song on the computer, else you loose it.

Thus, it has been wisely designed to maximize the advertisement exposure. This has strong value for advertisers. Of course, your selection of ad, plus your selection of songs will allow to profile you. Thus, increasing the value of the ad. Well done.

There are a few non announced limitations:

  • The songs are protected by Windows DRM 11; So long for iPod afficionados.
  • The licenses are valid for one month. Each time you download a song, it extends all licenses for a new month. If you did not download during the month, you loose all licenses (it seems that licenses are not renewable later, you have to download again the obsolete song). Once more, this monthly obligation of download is a nice trick to increase advertisement exposure.

Two nice tricks:

  • Beezik does not sell any song. Nevertheless, it displays the value of the song. This enforces the feeling that you make a good bargain. 1 minute of ad for 0.99€
  • The more you download, the more points you gain. The points can be converted in coupons for sponsors.

Beezik explores an interesting business model. It has been well designed to offer the highest value for advertisers. Are you aware of similar sites elsewhere? If yes, please send the pointer.

Would you use such service?

P.S.: Beezik is only available for France and Monaco (at least currently)

Is French HADOPI law dead? (9)

Posted on by
1

Despite the negative ruling of the French Constitutional Council, the French government has decided to launch the HADOPI. Thus, this authority may use the first two levels of the graduated response:

  • sending mails to supposed infringers
  • sending registered letter for cease and desist in the event of second offence.

Of course, HADOPI will not be able to escalate to the last level: banishing from the Internet. For this last level, there were mainly two choices (if resuming the same repressive strategy):

  • Ask a judge to pronounce the Internet banishment. This track would have been more time and money consuming.
  • Define another penalty

The government has chosen this second strategy. It will propose new penalties for the infringers. I am not sure that it solves the second issue presented by the French constitutional Council, i.e., that HADOPI has to prove the guilt.

Until the penalties are defined (and approved by the Chambers), the French graduated riposte may not frighten many P2P sharers.

Thus, the story continues…

Is French HADOPI law dead? (8)

Posted on by
Reply

Last month, the French Chambers approved the law “Internet et Création”. This law defines the HADOPI that is the administrative authority to handle French graduated response.

About 60 deputies referred to the French Constitutional Council. Was the law constitutional? The council provided the answer today.

In short, the articles 5 and 11 are unconstitutional. There are mainly two reasons:

  • The French declaration of Human Rights requires that the citizen has free speech rights. The Council estimates that today the Internet is one of the mandatory means of free speech. Only a judge can restrain this right and not an administrative authority.
  • The French Constitution requires presumption of innocence. It means the court has to prove the guilt. The law inverted this principle. The Netsurfer had to prove his/her innocence. This is unconstitutional.

In view of these two points, the French Constitutional Council ruled that articles 5 and 11 were unconstitutional.

Thus, the story continues…

Ten laws of security

Posted on by
Reply

You may know that my team has defined ten laws of security. This is an extremely useful tool. We use it daily as heuristics. Of course, we are not the only ones to have such rules. Thus, I decided to start to collect the sets of 10 security rules.

Here is my first set.

1. Technology is not a panacea
2. If a bad guy can persuade you to run his program on your computer, it’s not your computer anymore.
3. If a bad guy can alter the operating system on your computer, it’s not your computer anymore.
4. If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.
5. If you allow abad guy to upload programs to your web site, it’s not your website anymore.
6. Weak passwords trump strong security
7. A machine is only as secure as the administrator is trustworthy
8. Encrypted data is only as secure as the decryption key
9. An out-of-date virus scanner is only marginally better than no virus scanner at all
10. Absolute anonymity is not practical in real life or on the web.

I found there in a tutorial about ethical hacking. In fact, it seems that they come from Microsoft. Thus, if somebody can provide me with a pointer to the original source, I would be glad.

These rules are clearly with a computer and IT scope. They are interesting. Some rules have similarities with ours. Their law 1 looks like our law 10 (Security is not a product but a process). Law 6 is a case of our law 7 (Security is not stronger than its weakest link). Law 7 is an example of our law 6 (You are the weakest link). Law 8 is an illustration of Kerckoff’s law.

Law 2 to 5 are true. It nicely describes the extreme context as defined in software protection. Unfortunately, it is too often the reality. This is why software protection is difficult. Law 3 and Law 4 are the basic environment of any DRM system. The possible bad guys owns and controls the host (in fact, it is his machine).

If you know other sets of 10 rules of security, please forward them to me to complete my collection.