Blown To Bits

Archive for the ‘The role of government—laws and regulations’ Category

Does the DHS Laptop-Searching Policy Violate HIPAA?

Thursday, August 14th, 2008 by Harry Lewis
A discount asacol side effects usa person can discuss support services with their doctor or team cialis side effects of healthcare professionals, who may be able to suggest other cheapest generic estrace online helpful resources and local support groups. If a person wishes buy cheap acomplia to take Metamucil, they can consider starting at a lower buy cheap augmentin internet dosage to see how they react to it before increasing order cheap amikacin online the dosage. Additionally, male hormones, known as androgens, may reduce order cialis the likelihood of developing chronic pain disorders. This has contributed cheapest serevent to the belief that smoking may help ameliorate symptoms of zithromax internet anxiety and depression, a narrative promoted by the tobacco industry," amikacin without prescription he pointed out. Most people go home and feel fine buy cheap estradiol valerate online the same day, though a person will need a ride buy cheap clozapine home because it is unsafe to drive after being sedated. amikacin no prescription If you have questions about how much alcohol is safe buy retin-a online to drink while taking Cyltezo, talk with your doctor or estrace pharmacist. Both involve insulin and blood sugar regulation, but they are.

HIPAA is the very strong privacy policy for medical records to which all doctors and hospitals must adhere. As we blogged recently, the Department of Homeland Security has issued guidelines stating that border agents may seize and examine any laptop — even, presumably, the laptop of a doctor who happens to have carried medical data with him out of and into the U.S. (Here are the actual DHS policies. They are extraordinarily sweeping and worth reading.) ¬†A blogging doctor’s explains the inconsistency.

HIPAA (the Health Insurance Portability and Accountability Act) is the law that governs the privacy of your medical information. It is very, very detailed, and requires quite a bit from your doctor. You’ve signed a form at the office of every provider you’ve visited that notifies you of your privacy rights. I cannot discuss your care in a hospital elevator. I can’t send you an email regarding your health without making it very clear that any information in the email cannot be considered secure. I cannot disclose your health information to anyone else except under very specific and limited circumstances. HIPAA has radically changed the way we do things with health information (sometimes for the better, sometimes not).

Moving on to Homeland Security—DHS agents may, for any reason or none at all, seize my laptop and demand any security or encryption codes. My laptop not infrequently contains information covered by HIPAA (known as PHI, or Protected Health Information). Because of that, my laptop is secured via HIPAA-compliant security measures. Under the new DHS guidelines, I can be required to hand over my laptop and help officers access the information¬†without any suspicion of wrong-doing. We have a little problem here…

Unlimited government authority is always dangerous. I wonder if Chertoff plans to blow off this medical privacy fol-de-rol as a threat to national security.

“Intercepting” Email Becomes More Legal

Friday, August 8th, 2008 by Harry Lewis

One of the repeated lessons of Blown to Bits is that metaphors matter. We use them to describe digital phenomena, and then we use our intuitions based on the metaphor to decide how things should work or what should be prohibited.

Under the federal Wiretap Act, it is illegal to “intercept” an email. But what does that mean in a digital world in which messages are repeatedly stored momentarily in one computer and forwarded to another computer? Does “intercepting” just mean catching the bits in transit between computers? If you snarf a copy from an intermediary computer during the milliseconds while the bits are stored there, is that “interception” too?

Not according to a district judge in California. The case of Bunnell et al v. the Motion Picture Association of America involves a hacker named Anderson who was hired by the MPAA to obtain records from a file-sharing service that was distributing digital movies. Anderson managed to gain access to the service’s email server and have copies of emails forwarded to him, which he then passed on to the MPAA in exchange for $15,000. The company complained that this constituted an illegal theft of its corporate email. The judge ruled no, as reported by the Washington Post.¬†”Anderson did not stop or seize any of the messages that were forwarded to him. Anderson’s actions did not halt the transmission of the messages to their intended recipients. As such, under well-settled case law, as well as a reading of the statute and the ordinary meaning of the word ‘intercept,’ Anderson’s acquisitions of the e-mails did not violate the Wiretap Act.”

The case is being appealed, and the Electronic Frontier Foundation filed an amicus brief asking that the judge’s interpretation of “interception” be reversed. Were it allowed to stand, the EFF points out, the Wiretap Act would become meaningless as it applies to email in a store-and-forward network. The government could have lawful access to any email at all, without bothering with search or wiretap warrants.

Quacking Bipeds and Copyright Rationality

Monday, August 4th, 2008 by Harry Lewis

A couple of recent court decisions create some hope that the ordinary understanding of terms like “copy” and “own” may have some life in them, in spite of the best efforts of the intellectual property industry to twist these words’ meanings out of shape to the disadvantage of consumers. These examples pick up the story line of Chapter 6 of Blown to Bits.

You can TiVo a television program and watch it later. You can record it on a VCR and watch it yourself as many times as you want. You can’t legally sell it or make multiple copies, but as long as the copy is for your own use, you have no legal issue.

Cablevision offered a videorecording service where the bits would be held on your behalf at Cablevision, not on your home machine. The bits would be physically in “the cloud,” as the saying goes, but functionally Cablevision’s service would walk and quack like a home VCR. Legal or not?

The entertainment industry thought not, and sued Cablevision for copyright infringement. A lower court held Cablevision liable, but an appeals court agreed with Cablevision that it didn’t matter where the bits happened to be held, only who could do what with them. Entirely sensible, it seems to me. See the Reuters story that came out today.

The other story was in May. A Mr. Vernon bought stuff at garage sales and resold it on eBay. Among the stuff he sold were copies of AutoCAD, a computer-aided design software package used by architectural design firms. These copies of AutoCAD were used, but were in their original packaging, and included the original disks. Autodesk, the company that produces AutoCAD, cried foul — that was copyright infringement. The folks who originally acquired those copies of AutoCAD didn’t actually buy them. If they had bought them, then Vernon’s resale would be just like reselling a used book. Bun in fact all they had done was to acquire a right to use AutoCAD. The license agreement clearly stated that it was nontransferable. No one else could “buy” the used software package because it had never been “sold” in the first place.

A U.S. District Court in Washington State, in its opinion, notes that Autodesk actually referred to users “purchasing” the software, and charged a one-time fee with no continuing charges. The transaction looks and quacks like a purchase; Autodesk can’t turn it into a licensing agreement simply by stating that that’s what it is. Mr. Vernon can go back to selling the used software on eBay without Autodesk hassling him with DMCA takedown notices.

Will this decision have any impact on things like the Yahoo Music “Store,” which actually only issues revocable music licenses, as Hal has been blogging? Probably not — in that case there is nothing that looks like a used book that the consumer could wave at the judge. But these are both welcome decisions. Maybe some judges are starting to understand how this stuff works.

Protesting a Proposal for a Censored Internet

Thursday, July 24th, 2008 by Harry Lewis

Readers of Chapter 7 of Blown to Bits will know some of the story of the U.S. government’s efforts to make the Internet “safe” for children to see by banning from it many things that are legal and appropriate for adults. (We talked about part of this story yesterday, in our post about the COPA legislation.)

Now the FCC has come up with the bright idea of a child-friendly Internet, that is, an Internet where no one could ever say anything that would be “harmful” to children, down to the age of 5. (I mentioned this briefly in a posting a few weeks ago.) No medical images, presumably, of the kind that teenagers from time immemorial have sought out to satisfy their curiosity. No discussions, it would seem, of sexual matters that you would not discuss with your 5-year-old. The standard is so absurd as a weapon to put into the hands of government censors that one has to assume large parts of classical English literature and daily adult discourse would be barred.

The parallel universe the FCC imagines would be created by companies using a block of wireless spectrum. They would be allowed to bid on this block only if they agreed to use part of it to provide free public access to this parallel, child-friendly Internet universe.

The proposal is absurd, and the cyberspace it imagines could not be the Internet. There could presumably be no encryption, for example, else how could the censors be sure whether the data being sent represented a birthday card or a dirty joke in Yoruba? (In fact, how would the censors recognize unencrypted dirty jokes in Yoruba, that a Yoruba-reading child might see?) It seems likely that the FCC’s proposal, if it went into effect, would eventually be ruled unconstitutional on First Amendment grounds, just as the government couldn’t ban swearing in Yellowstone National Park on the theory that it was public property and children went there. The FCC proposal is here. The critical passage is on page 26, the stipulation that the network must have technology

That filters or blocks images and text that constitute obscenity or pornography and, in context, as measured by contemporary community standards and existing law,  any images or text that otherwise would be harmful to teens and adolescents.  For purposes of this rule, teens and adolescents are children 5 through 17 years of age

I have joined a number of other Fellows of the Berkman Center for Internet and Society to comment on the FCC proposal (pdf here). This “comment” has a calmer, more measured and nuanced explanation of the stakes than does this intemperate post. Thanks to Wendy Seltzer, Geoff Goodall, and Steve Schultze for carrying the burden of drafting it and of incorporating the hundreds of suggestions they got back.

Persephone Miel has a nice quick summary of our position here.

Child Online Protection Act Axed Again

Wednesday, July 23rd, 2008 by Harry Lewis

On pages 247-249 of Blown to Bits, we tell the saga of the Child Online Protection Act, an act criminalizing the posting to a web site “material that is harmful to minors.” The law was protested for a host of reasons, among them that it’s hard to tell how old the viewers of your web site actually are. It never took effect, and we say in the book, “in March 2007, the ax finally fell on COPA.”

We spoke too soon. The ax referred to there was the decision of a federal district court in eastern Pennsylvania that the law was unconstitutional, but the government appealed that decision. Yesterday the Third Circuit Court of Appeals affirmed the judgment of the district court (opinion here): the law goes too far in restricting speech. In particular, harmful material is better kept from minors at the destination, by use of filters in the home, rather than at the source, by criminalizing the publication.

But even now, ten years after the law was passed, it may not be dead. The government may appeal to the U.S. Supreme Court, hoping that the third time’s a charm.

The FCC’s indecency standards

Tuesday, July 22nd, 2008 by Harry Lewis

Chapter 8 of Blown to Bits tells the tale of how the federal government got into the business of determining which parts of the female anatomy may be shown on broadcast television and for how long, and whether the occasional s-word or f-word may be spoken. It’s an important story, because it’s one of the few clear-cut instances of a sweeping override of the First Amendment by a government body. And that body, the Federal Communications Commission, keeps reaching farther. For example, it has proposed to grease the rails for companies willing to provide a free-to-the-public, fully censored parallel Internet universe over the airwaves, an Internet with a mechanism

That filters or blocks images and text that constitute obscenity or pornography and, in context, as measured by contemporary community standards and existing law,  any images or text that otherwise would be harmful to teens and adolescents.  For purposes of this rule, teens and adolescents are children 5 through 17 years of age.

You read that right: nothing unsuitable for a 5-year old could be said or shown over this network.

While I have no interest in the famous Janet Jackson halftime stunt (I love the Superbowl, but never watch the halftime shows), I am delighted that the FCC fine was thrown out by a federal court as being capricious and arbitrary. The court essentially ruled that the FCC had improperly raised its standards. The Technology Liberation Front has a good explanation of the decision and a link to the decision itself.

An even more important judicial deliberation will be happening in the coming Supreme Court term, when the entire issue of the FCC’s indecency standards will be under review.

In the meantime, isn’t it odd that the FCC is working so hard to make broadcast TV safer for children than it has ever been, just at the moment when from what I can tell, the advertisers think the only people watching network TV are those who need AARP, Viagra, and motorized wheelchairs?

The full story on Dr. Brinkley

Friday, July 18th, 2008 by Harry Lewis

“Dr.” John Romulus Brinkley, the notorious medical quack, makes a cameo appearance in Blown to Bits as the plaintiff in a suit against the Federal Radio Commission. When the Supreme Court upheld the FRC’s authority to strip Brinkley of his radio license, it set the stage for all subsequent federal censorship of the airwaves. The technological part of the court’s reasoning now rests on shaky ground, as our book explains.

Pope Brock’s recently released book¬†Charlatan is the amazing tale of Brinkley and his lifelong battle with Morris Fishbein of the American Medical Association. It’s a terrific read, highly recommended. The Supreme Court case is barely mentioned, but there is a lot about Brinkley’s pioneering role in radio — he was the first to do major country music programming, and to use recorded music to time-shift the performances. When he had to move his station to Mexico and federal authorities said he couldn’t telephone his broadcast from the States, he recorded them and sent the records to Mexico to be played. A communications pioneer to be sure.

Brock has dug out lots of nice details — for example that the first time Johnny Cash heard June Carter sing was on Brinkley’s radio broadcast! Good summer reading.

Email and the Fourth Amendment: “Degradation of civil rights”?

Wednesday, July 16th, 2008 by Harry Lewis

Can the government search your email without telling you it is doing so?

The USA PATRIOT Act gives the federal government broad authority to search electronic communications crossing the US border, under the general guise of anti-terrorism and the rough analogy that the government could search your possessions as you brought them into the country. But what about purely domestic eavesdropping, not part of any terrorism investigation?

In an important 8-5 decision, the Sixth Circuit Appeals Court has ruled that such clandestine searches of email are at least sometimes not “unreasonable searches” in the sense of the Fourth Amendment. The Register (UK) has an excellent summary of the ruling is in an article aptly called “Court cheers warrantless snooping of e-mail.” The Court’s decision is here. It doesn’t actually endorse the constitutionality of the law under which the clandestine email snooping took place, saying instead that the issue was not “ripe” for a decision on constitutional grounds. The defendant, Steven Warshak, could have used other means to keep the evidence out of court.

The dissenting opinion of Judge Boyce Martin and four other judges takes a far dimmer view. I quote its last paragraph in full:

While I am saddened, I am not surprised by today’s ruling. It is but another step in the ongoing degradation of civil rights in the courts of this country. The majority makes much of the fact that facial challenges are no way to litigate the constitutional validity of certain laws. Yet our Supreme Court has no problem striking down a handgun ban enacted by a democratically elected city government on a facial basis. See Dist. of Columbia v. Heller, — U.S. —, 2008 WL 2520816 (June 26, 2008). History tells us that it is not the fact that a constitutional right is at issue that portends the outcome of a case, but rather what specific right we are talking about. If it is free speech, freedom of religion, or the right to bear arms, we are quick to strike down laws that curtail those freedoms. But if we are discussing the Fourth Amendment’s right to be free from unreasonable searches and seizures, heaven forbid that we should intrude on the government’s investigatory province and actually require it to abide by the mandates of the Bill of Rights. I can only imagine what our founding fathers would think of this decision. If I were to tell James Otis and John Adams that a citizen’s private correspondence is now potentially subject to ex parte and unannounced searches by the government without a warrant supported by probable cause, what would they say? Probably nothing, they would be left speechless.

Congress struggles with Web privacy

Tuesday, July 15th, 2008 by Harry Lewis

Apparently Congress knows it’s important, but — reasonably enough — can’t pass a law protecting it because it doesn’t know what it is. According to the Washington Post, Sen. Bill Nelson of Florida can recognize it when he sees it — and he doesn’t want his online newspaper keeping track of what he’s reading.

Too late — that’s probably happening right now.

Industry representatives, and some other members of Congress, claim no legislation is needed. Everyone knows privacy is important, so of course the industry has an incentive to safeguard it.

Well, yes; they have an incentive to be seen as guarding it, and also have an incentive to make the most profitable use of the available information. And if you’re a newspaper, for example, you probably can’t afford to throw information away that would be useful to your advertisers.

An interesting question noted in the article is that it’s not even clear what “personally identifying information” is. Is an IP address “personally identifying”? The Recording Industry surely thinks so — they use them to make charges against copyright infringers. But there is hardly a one to one correspondence of IP addresses to individuals.

And by the way, IP addresses are going to be less and less identifying, because we are running out of addresses. These are 32 bit numbers, so there are only about 4 billion of them. They are 85% gone already, and the supply will reportedly be exhausted by 2011. IPv6 with its 128-bit addresses is the solution, and a transition is occurring, but it’s unlikely to have been completed in time. There are workarounds, which will be annoying and clumsy. It would be cleaner if we could all move to IPv6 tomorrow — just as it would have been cleaner if the US had gone to the metric system. In the Internet too, the world won’t come to an end because we haven’t moved to a sensible standard all at once.

A Massachusetts privacy-in-surfing bill

Wednesday, July 9th, 2008 by Harry Lewis

A bill is before the Massachusetts legislature that would require web sites to give users the option of not having the records of their visits retained to be used to aid in targeted advertising. I am quoted briefly in the Patriot Ledger story on the bill, which seems unlikely to pass because, well, it’s July and the legislature wants to go on vacation. (See also this State House News Service story.)

I can’t speak to the details of the bill, in which many devils generally lie. It’s hard to argue against requiring an opt-out provision, which is likely not too hard to implement and won’t affect the advertising business model very much since few people ever change the default options on anything. (If you have the option of registering as an organ donor when you renew your drivers license, for example, participation rates vary hugely depending on whether the default is to be a donor or not to be a donor.)

Nonetheless, some of the sweeping statements about this issue are debatable. “It’s really your business what you visit on the internet,” said Rep. Daniel Bosley, speaking in support of the bill. Well, sort of; it’s also the web site’s business decision whether to send you a page when you ask for one. Google is not a public utility, even though it doesn’t require you to register in advance. Disclosure and transparency are good principles, but so are the laws of economics.

Randy Skoglund of the Americans for Technology Leadership, also supporting the bill, says “Most consumers aren’t aware how much info on them there is and how it’s being used. Consumers need to feel safe and protected online.” The first statement is absolutely true; people need to be more aware, and our book and the various disclosure mandates are steps toward educating the public. I am not so sure about the second. Is is the job of the government to make the public feel safe and protected online?