Reports of crime: difficulties in the UK

Whereas France has now a unique website to report cybercrimes, the UK still struggles, with no sight of relief yet.

E-crime victims uncertain where to turn (ZDnet.co.uk, 27 August 2009)

Europol's improvement

COUNCIL DECISION of 6 April 2009 establishing the European Police Office (Europol) - the decision is available at http://www.statewatch.org/news/2009/may/europol.pdf

beaware: Europol exists since 1992

Hadopi, right to access a court of first instance and piracy policy

Before it was even adopted by Parliament, the French bill that promoted the three strikes policy in its attempt to fight piracy was doomed.

The EU Parliament condemned it (See TechDirt, 6 May 2009) EU Says No To Three Strikes On Accusation Only; Requires Court Order

and even the UK TalkTalk ISP (TechDirt, June 9, 2009) director considered it was silly to forbid, "pirats will always win" UK ISP Boss: 'The Pirates Will Always Win'

Without surprise, the bill, passed by an empty Assembly, was declared unconstitutional by the Constitutional Council and thus in effect can only become a Statute if the unconstitutional provisions are withdrawn.

"French Constitutional Council Guts 'Three Strikes' As Unconstitutional" (TechDirt, 10 June 2009)

Legally, the decision is particularly enlightening when it comes to the grounds of unconstitutionality. The Council found several flaws, all in line with what I have been writing about in this blog:

- violation of freedom of speech and communication because the sanction was not decided by a court, but by an administrative agency; I keep saying that a court/ the judiciary has to decide on withdrawing illegal content as much as who committed any other illegal behaviour

• "16. Considérant que les pouvoirs de sanction institués par les dispositions critiquées habilitent la commission de protection des droits, qui n'est pas une juridiction, à restreindre ou à empêcher l'accès à internet de titulaires d'abonnement ainsi que des personnes qu'ils en font bénéficier ; que la compétence reconnue à cette autorité administrative n'est pas limitée à une catégorie particulière de personnes mais s'étend à la totalité de la population ; que ses pouvoirs peuvent conduire à restreindre l'exercice, par toute personne, de son droit de s'exprimer et de communiquer librement, notamment depuis son domicile ; que, dans ces conditions, eu égard à la nature de la liberté garantie par l'article 11 de la Déclaration de 1789, le législateur ne pouvait, quelles que soient les garanties encadrant le prononcé des sanctions, confier de tels pouvoirs à une autorité administrative dans le but de protéger les droits des titulaires du droit d'auteur et de droits voisins ;"

- violation of presumption of innocence by reversing the burden of proof to the accused; it is what I always found disturbing in those cases where the RIAA in the US bring lawsuits/charges before the Court and it is most of the time for the defendant to find proof s/he did not commit the action.

• "18. Considérant, en l'espèce, qu'il résulte des dispositions déférées que la réalisation d'un acte de contrefaçon à partir de l'adresse internet de l'abonné constitue, selon les termes du deuxième alinéa de l'article L. 331-21, " la matérialité des manquements à l'obligation définie à l'article L. 336-3 " ; que seul le titulaire du contrat d'abonnement d'accès à internet peut faire l'objet des sanctions instituées par le dispositif déféré ; que, pour s'exonérer de ces sanctions, il lui incombe, en vertu de l'article L. 331-38, de produire les éléments de nature à établir que l'atteinte portée au droit d'auteur ou aux droits voisins procède de la fraude d'un tiers ; qu'ainsi, en opérant un renversement de la charge de la preuve, l'article L. 331-38 institue, en méconnaissance des exigences résultant de l'article 9 de la Déclaration de 1789, une présomption de culpabilité à l'encontre du titulaire de l'accès à internet, pouvant conduire à prononcer contre lui des sanctions privatives ou restrictives de droit ;"

- violation of privacy if the private institutions collecting data about illegal downloading use this data for other purposes; we know by experience that it is well possible, so I wonder how the Constitutional Council thought his "reserve of interpretation" will be complied with and which mecanisms will be used to ensure compliance.

• 27. Considérant que la lutte contre les pratiques de contrefaçon sur internet répond à l'objectif de sauvegarde de la propriété intellectuelle et de la création culturelle ; que, toutefois, l'autorisation donnée à des personnes privées de collecter les données permettant indirectement d'identifier les titulaires de l'accès à des services de communication au public en ligne conduit à la mise en oeuvre, par ces personnes privées, d'un traitement de données à caractère personnel relatives à des infractions ; qu'une telle autorisation ne saurait, sans porter une atteinte disproportionnée au droit au respect de la vie privée, avoir d'autres finalités que de permettre aux titulaires du droit d'auteur et de droits voisins d'exercer les recours juridictionnels dont dispose toute personne physique ou morale s'agissant des infractions dont elle a été victime ;

Censure du Conseil constitutionnel : pas d'happy end pour l'HADOPI (Juriscom. 10 June 2009)

"French court curbs internet piracy legislation" (ZDnet.co.uk, 11 June 2009)

David El Sayegh (Snep)"Couper l'accès Internet comme on envoie les contraventions établies par les radars" (JDN, 11 June 2009)

House of COmmons' control on Government's policy and EU

The House of COmmons' European Scrutiny Committee delivered its 8th report (may 2009) and analyse, in particular, the UK Government's implementation of EU policy on cyber attacks. Pages 19 to 21, after having summarised the EU policy, the Committee analyses the Government's responses and note the lack of clarity of the Minister's reply.

http://www.publications.parliament.uk/pa/cm200809/cmselect/cmeuleg/19-xvi/19-xvi.pdf

Child porn and prosecution policy: bias charges?

The story is problematic for several reasons:

1.1) the charges, as reported below, should never have existed as the image is not even pornographic - this is purely a legal argument/point

1.2) the charges should not have been started either given the context of the case. The principal is the one who has ordered the investigation; his employee reported it and obviously the student's mother had an interest in damaging his reputation. Because he was a man, it was easy to label him (and libel). That the prosecutors refused to see the context and proceeded with the charges is contrary to any good policy of prosecution - that the policy argument/point

2) the background of the case is those children/teenagers sending photos of themselves or others nude via mobile phones. Two issues: what kind of society are we where it is viewed as trendy to be exposed nude to everybody? I am not prude, but frankly, I don't see the point; the offence of child porn is protect children against adults: can it be to protect children against themselves?

"School Administrator Accused Of Child Porn Because He Investigated Sexting At School" (TechDirt, 6 April 2009)

Skype and interception of communication (update)

A very interesting article (because of the details provided) has been written in French. The reason why Skype's communications are difficult to intercept is that they are using encryption keys that Skype, so far, has refused to communicate.
A software is available that allows for decryption: Digitask. But it costs, according to the article, 3500 euros to acquire, and more importantly, 2500 euros to use and for each interception; in other words, a fortune for police forces. This is why police officers are so keen in obtaining the keys from Skype itself.
Given that both Germany and Italy were concerned about this, not surprising the EU started to look at the issue. Hence the Judicial Co-operation Unit launched an investigation into the possibilities to tap internet conversations, on the basis that organised crime uses Skype facilities already

"Bientôt des écoutes policières sur la VoIP ?" (JDN, 25 February 2009)

"EU to investigate VoIP-tapping techniques" (ZDnet.co.uk, 20 February 2009)

Skype and interception of communications

Skype does not allow for easy wiretapping of conversations. Anyone can imagine the potential for criminals, but also, on the good side, for dissidents. However, I don't think the loophole will remain for long; somebody somewhere will invent a good wiretapping device , if it has not already be done in China for example, as the article below suggests.

"Italian Cops Complain That They Can't Listen In On Skype" (TechDirt, 18 February 2009)

Paying people to filter the internet

China seems to now pay people per porn website discovered and reported. Being cynical, I wonder to which extent this solution might be cheaper than hiring them as full-time employees for the Great Firewall. A future law and economics study?
In terms of human rights and liberties, well, using people to report websites (free of charge) is a common procedure in most countries. UK does it with Internet Watch Foundation; France does it with the Internet Gouvernance website and system, etc... None however when as far as paying them! The question is probably how the prospect of being paid could affect the "objectivity" (if any) of the person's appreciating the contents of the website. As usual, how the information reported is used by Government or non Governmental agencies is crucial as lack of transparency promotes censorship and violation of human rights.

"China Looks To Build Human Firewall With Fun, Prizes" (13 February 2009)

Localisation of e-mail senders via Google mail

Quite a scary feature for Google mail users: according to the French JDN (web journal), Google will make available to other users the geographical localisation of users when they send e-mails with city/village, region and country.
In terms of privacy, it is obviously problematic. Other forms of communications like telephone do not give that amount of details as to the whereabouts of people. Telephone numbers for example indicate a region more often than a city. Only postal communication does give away the same amount of features. However, postal communication is not instantaneous, thus the person can have moved away by the time the other person received the message. This won't be the case by e-mail.
Nevertheless, the feature is not surprising given past relationships of Google with China and handing in dissidents.
"Google teste la géolocalisation d'e-mails avec Gmail" (JDN, 11 February 2009)

Terrorist search -use of language searches

I read the post sent by Statewatch in its last newsletter. I clicked rather out of habit/curiosity than anything else, but what I read, I found deeply disturbing. Please read the whole post before reading mine - you will then understanding exactly what I mean.

Those are extracts on which my analysis is based:
"Andrej works as a sociologist on issues such as gentrification and the situation of tenants. Outside academia he is actively involved in tenants' organizations and movements that deal with gentrification and urban development. Using words such as 'gentrification', 'marxist-leninist', 'precarisation' oder 'reproduction' in their texts was enough to start complete surveillance (a linguistic analysis by the Federal Police later showed it's most unlikely they wrote these texts). "

My interpretation is as follow: the police is simply using extensive powers not to do their job.
As a researcher using the web to find documentation (perfectly respectable by the way), I use regularly keywords. I also know by experience that what I want is NEVER EVER under the keywords that I type. In other words, the most obvious range of keywords will lead me to documents I don't really have any use for. Anybody using the web extensively knows that.
I worked on an article about hatecrime in cyberspace - I wanted the UN Human rights committee decision on Faurisson - I typed Faurisson & decision and used google.com. The revisionist website of aaargh came up (it does not, by the way, if you use google.fr - the website is blocked). Now linguisticly, the website never uses any offensive language; the decision published should be questioned for its reliability because it is not the official UN website (even if it is not unreliable). Conversely, although I have not done personally conducted such research, those who look at websites from neo-nazis and the like all know that the obvious words of nazis won't bring you many websites; that the most dangerous and scary stuff appear at random under the most unlikely headings (see Roversi's book on Hatecrime).
Coming back to this post I refer to, what does it mean? that the German police simply should get a grip with technology and a tutorial on internet/google searches held by librarians could actually help them understanding the fundamental flaw of their investigation practices. They used words they associate with terrorism and terrorists to conduct their search, but no other ground work substantiated their analysis before they sought permission to wiretap!!! Which, by the way, shows also how clueless the judges are...

the rest of the investigation seems also a lot of rubbish based on assumptions rather than real facts. To suspect somebody because they don't use mobile phones sometimes or do not say things on the phone or encrypt their e-mails can have several explanations. I don't use a mobile phone; I certainly will NOT say certain things on the phone or by e-mail; and if I don't encrypt usually, I certainly could do so sometimes, for security purposes because I don't want anybody knowing. But that does not make me a terrorism.
If I were politically active, would the situation change? no, because my ideas of dissent do not make me suspect of mass murder, just because I dissent.

sex offenders and MySpace

Two interesting bits of information here: 1) that MySpace does filter its users' profile to search for sex offenders; I can understand why, but this is a permanent ban or ostracism on those offenders based on the philosophy of no rehabilitation. It looks like excommunication except no religious belief is at stake. Do we have a right as a society to reach such extreme measures? Is that an acceptable cost to protect children notably against predators?
2) the reliability of profiles on MySpace: fakes are numerous and nothing should be taken for face-value...

"Raising Some Questions About Smoking Gun Sex Offender Profiles On MySpace" (TechDirt, 28 January 2009)

Private sector collaboration with investigatory forces

Two stories about the private sector wanting to or already collaborating with police forces, at least in the UK. That the firms stop avoiding the issue is a good sign and it is sad to say that it takes a financial crisis to lead the firms to realise that cybercrime is not a minor issue.
E-crime police see UK firms pledging techies' time (ZDnet.co.uk, 20 January 2009)
UK site offers bounty for DDoS attackers (ZDNet.co.uk, 22 January 2009)

Investigations - luck or display of forces?

The main problem of cyberspace is always tracking done the authors of offences. Some crimes will never be solved, unless maybe their authors unveil later on their methods; some may be solved although the more time elapsed the more unlikely there are chances to find the offenders. “The 10 Most Mysterious Cyber Crimes” (26 September 2008)
See also “Cybercrime expert to educate MSU engineers on "Gen Next Terror" (23 September 2008)

Comp with “Second TJX hacker pleads guilty” (24 September 2008) (also under "Second alleged hacker pleads guilty in TJX case") and maybe the silliness of the Palin’s hacker: hacking a high profile person is more likely to create a surge of investigatory reactions and actions than hacking a business, even if no real damage was done. “Palin Hacker's IP Address Linked to Tennessee College Dorm” (22 September 2008)

Tracking down hackers

An interesting article from CCRC about unresolved cybercrimes. The last three are from 2008, so it may be a bit early to say the offenders have not been tracked down, although as with any type of forensics, time is of the essence. "The 10 Most Mysterious Cyber Crimes" http://www.crime-research.org/news/26.09.2008/3597/ (27 September 2008)
Overall, the article highlights the main difficulty of cybercrime: tracking down the authors.
Comp. with "Cybercrime expert to educate MSU engineers on "Gen Next Terror" "(23 September 2008)

See in comparison "Second TJX hacker pleads guilty" (24 Septembre 2008) and the track for Palin's hacker which seems quite disproportionate in comparison with more damaging cybercrimes that just this one, "FBI Closing In On Palin Hacker " (22 September 2008)
"FBI on the trail of hackers after Palin's emails made public" (The Guardian, 19 September 2008)

and for statistics by DOJ (US) in september 2008

RFID, privacy and investigation

The following article raises awareness of the RIFD revolution in Europe and the rest of the world. A technology that allows any item to be tracked down and monitored from around the world, it is highly used, according to the article, in non-European countries. By contrast, Europe is more than reluctant, for fear of privacy breaches. Fears are certainly not underestimated.
Related to crime, the technology works both ways: RFID allows for items to be tracked, so stealing could become more difficult; on the other hand, imagine investigatory forces (official or not) using the device without anybody knowing... that could lead to potential abuses and evidence gathered illegaly without warrant.
(13 March 2008)
http://www.euractiv.com/en/infosociety/eu-moves-catch-microchip-revolution/article-170942

Anonymity and fighting harassment and libel

In the US, Kentucky lawmaker filed a bill to make anonymous posting illegal. The website operator who would fail to enforce the law (i.e. let somebody posting without identifying him/herself) would pay a fine.
there are two problems here: first, free speech; anonymity is a key feature of free speech. See previously anonymous mail which can be bad or good. Secondly, criminal policy: is it the best way to fight bullying to require loss of anonymity? (10 March 2008) http://www.techdirt.com/articles/20080310/110506493.shtml

Compared with the following, it is interesting to see that readers of websites sued the website owner/operator, along similar lines as proposed by the bill above. But they did not succeed (action dropped) and are even now a target of a lawsuit for libel, for the website owner losts his job because of the damage the first legal action brought. Which raises incidentally the question of the presumption of innocence! (10 March 2008) "When Law Students Get Angry... Lawsuits Get Filed" http://www.techdirt.com/articles/20080310/014651487.shtml

And where the above idea becomes interesting is when are at stake websites ranking or rating individuals for their performance in their job. Libel is obviously a danger; but this is only part of the iceberg: harassment and personal vengeance could be coupled with anonymity and give extremely hurtful results for the people targeted. Contrary to the author of the following post, I do not think accountability can be achieved via websites of this sort. There is no control on facts, no procedure to promote fairness; whatever an individual has done, s/he cannot be deprived of fairness of procedure. Otherwise, we become like those monsters we are supposedly fighting. (10 March 2008) "Police Accountability Is A Good Thing" http://www.techdirt.com/articles/20080305/075621447.shtml
The French courts clearly took the opposite view from the author of the above article. They ordered a website ranking teachers nominally to stop publishing the teachers' names, thus taking away the whole interest of the website. The co-founder of the website Stephane Cola is obviously unhappy and considers there is a breach of freedom of speech, making a parallel with ranking institutions, but I think the issues are muddled here. It's OK to rank institutions who have no career as such and have a duty of accountability to all; but to rank an individual whose career and privacy is directly at stake with no chance to put things right reaches an other level.
Sorry the article is in French "La justice dit non aux noms des professeurs sur Note2be" (3 March 2008) http://www.01net.com/editorial/372605/la-justice-dit-non-aux-noms-des-professeurs-sur-note2be/