Subject: Re: [hrpc] Thoughts on Intersection of Content and Protocols

From: Robin Wilton <[email-masked]>
Date: Fri, 21 Sep 2018 16:00:50 +0000

> 
> From: Tony Rutkowski <[email-masked]>
> Subject: Re: [hrpc] Thoughts on Intersection of Content and Protocols
> Date: 21 September 2018 at 12:33:14 GMT+1
> To: [email-masked], [email-masked]
> Cc: Hrpc <[email-masked]>
> 
> It was the $25 million judgement against ISP Cox Communications in 2015,
> however, that made it plain that consequences of ignoring the Act's
> provisions are substantial.  Part of those requirements include a
> variety of actions to diminish the ISP culpability.  It is here where
> some of the new encryption protocols - especially QUIC - essentially
> become non-starters for most ISPs.  The protocol blocking code is
> already widely available for protecting their interests.
> 
> —tony

(1) As I understand it, the ruling against Cox was not because they had failed to detect subscribers illegally sharing copyright material, it was because - when formally notified that it was happening, Cox failed to implement its own policy for disconnecting persistent offenders. In other words, the copyright-holder determined that illegal sharing was taking place, and notified Cox. Presumably, the copyright holder was able to do this without having access to Cox subscribers’ Internet traffic… ...

> 
> 
> 
> From: Tony Rutkowski <[email-masked]>
> Subject: Re: [hrpc] Thoughts on Intersection of Content and Protocols
> Date: 21 September 2018 at 14:20:16 GMT+1
> To: Stephen Farrell <[email-masked]>
> Cc: Hrpc <[email-masked]>
> 
> 
> Hi Stephen,
> 
> The "non-starter" remark refers to commercial ISPs who tend to be risk
> adverse.  CEO's tend not to like 25 million dollar fines or at the
> extreme, life in an orange suit in prison.  QUIC, and to some extent,
> TLS1.3, are loaded DMCA time bombs for ISPs.  Within legal communities,
> there is considerable treatment of the concerns, and some significant
> middlebox vendors have advised blocking while offering the capabilities
> as part of their service packages.  It'll take but one high profile
> action against an ISP allowing customers using QUIC or TLS1.3 to
> illicitly distributing copyright protected works, to ramp up the
> blocking market and drive down traffic metrics.

(2) Perhaps I’m missing the point, but I don’t follow the logic here. Let’s consider two scenarios: one in which the ISP allows subscribers to establish encrypted sessions to websites, and one in whcih it does not.

- if the ISP allows subscribers to establish encrypted sessions to websites, how is the ISP to know that copyright material is being transmitted? If the ISP *cannot* know by inspecting the traffic, how can they be held liable for it? (This is why it’s relevant that Cox weren’t fined for not knowing; they were fined because they did nothing when notified by the copyright holder.) Surely, allowing encrypted sessions between subscribers and websites provides the ISP with plausible deniability, not greater liability.

- if the ISP prevents subscribers from establishing encrypted sessions to websites (and can therefore inspect the contents of subscribers’ traffic), how is it to know that copyright material is being shared illegally? (When an online retailer offers to “auto-rip” a CD I’ve just bought, how is the ISP to judge whether that transmission of copyright material is legal or not?).

Even if we assume these issues can be dealt with, we’re left with the implication that, just in order to allow ISPs to check for copyright material, there must be no such thing as end to end encryption - and that seems like a very odd position to take. It’s also one which I think is vulnerable to a reductio ad absurdam: if QUIC is the “guilty party” here, and must be banned for facilitating the unlawful distribution of copyright material, why stop there? Where in the OSI stack is there a layer that doesn’t facilitate the unlawful distribution of copyright material?

> 
> It is easy to roll out these capabilities when you don't bear the risk.
> Thusfar, the plaintiffs in these litigations have not moved up the
> "foodchain" and gone after standards bodies.  Fortunately, ISOC
> purchased considerable liability insurance for IETF parties approving
> standards.  Presumably, the new IETF LLC will take similar steps to
> mitigate the risk.
> 
> —tony

(3) Is this genuinely your risk assessment? By implication, the people who come up with the manufacturing standards for firearms and ammunition ought to be quaking in their boots at the prospect of an avalanche of lawsuits for manslaughter.

Yrs.,
Robin

> 
> 
> On 21-Sep-18 7:51 AM, Stephen Farrell wrote:
>> Tony,
>> 
>> On 21/09/18 12:33, Tony Rutkowski wrote:
>>> It is here where
>>> some of the new encryption protocols - especially QUIC - essentially
>>> become non-starters for most ISPs.
>> I don't get what you mean by "non-starter" there?
>> IIUC correctly measurements (e.g. [1] was the first
>> search result I found just now) seem to indicate
>> that QUIC is indeed a starter...
>> 
>> S.
>> 
>> [1]
>> https://blog.apnic.net/2018/05/15/how-much-of-the-internet-is-using-quic/
> 
> 
> 
> 
> 
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 21 Sep 2018 12:34:40 -0400

Hi Robin,

(1) The challenge here is that there have been multiple court decisions
at both trial and appellate levels.  The matter is further complicated
by the DMCA itself - which provides a cause of action as well as a safe
harbor defense, treatment of evidence, and basis for penalties.  4th
Circuit decision earlier this year is a 37 page complicated treatment of
all these variables.  It involves considerably more than just failing to
implements the ISP's own policies.  See at
http://www.ca4.uscourts.gov/opinions/161972.P.pdf

(2) The courts seem to reject the plausible deniability argument. 
Indeed, it arguably suggests unlawful activity might be occurring, and
analysis of the traffic flows and end point analysis might suggest that
the DMCA proscribed activity in particular is occurring.  There has been
considerable discussion of the topic in legal and public policy blogs
and articles over the past year - particularly as to the effects of the
termination of NetNeutrality.

(3) It is not only my risk assessment, but also that of most standards
body governing officials.   Indeed, the concerns go beyond just
standards activities and described as Directors and Officers Liability
Insurance.  In the case of ISOC and the IETF, it was a decision of its
Board circa 1994 as it assumed greater responsibilities for the IETF.

--tony

On 21-Sep-18 12:00 PM, Robin Wilton wrote:
>
>>
>> *From: *Tony Rutkowski <[email-masked]
>> <mailto:[email-masked]>>
>> *Subject: **Re: [hrpc] Thoughts on Intersection of Content and Protocols*
>> *Date: *21 September 2018 at 12:33:14 GMT+1
>> *To: [email-masked]
>> <mailto:[email-masked]>, [email-masked]
>> <mailto:[email-masked]>
>> *Cc: *Hrpc <[email-masked] <mailto:[email-masked]>>
>>
> (1) As I understand it, the ruling against Cox was not because they
> had failed to detect subscribers illegally sharing copyright material,
> it was because - when formally notified that it was happening, Cox
> failed to implement its own policy for disconnecting persistent
> offenders. In other words, the copyright-holder determined that
> illegal sharing was taking place, and notified Cox. Presumably, the
> copyright holder was able to do this without having access to Cox
> subscribers’ Internet traffic… ... 
>
>
>>
>>
>>
>> *From: *Tony Rutkowski <[email-masked]
>> <mailto:[email-masked]>>
>> *Subject: **Re: [hrpc] Thoughts on Intersection of Content and Protocols*
>> *Date: *21 September 2018 at 14:20:16 GMT+1
>> *To: *Stephen Farrell <[email-masked]
>> <mailto:[email-masked]>>
>> *Cc: *Hrpc <[email-masked] <mailto:[email-masked]>>
>>
>>
>> Hi Stephen,
>>
> (2) Perhaps I’m missing the point, but I don’t follow the logic here.
> Let’s consider two scenarios: one in which the ISP allows subscribers
> to establish encrypted sessions to websites, and one in whcih it does not.
>
> - if the ISP allows subscribers to establish encrypted sessions to
> websites, how is the ISP to know that copyright material is being
> transmitted? If the ISP *cannot* know by inspecting the traffic, how
> can they be held liable for it? (This is why it’s relevant that Cox
> weren’t fined for not knowing; they were fined because they did
> nothing when notified by the copyright holder.) Surely, allowing
> encrypted sessions between subscribers and websites provides the ISP
> with plausible deniability, not greater liability.
>
> - if the ISP prevents subscribers from establishing encrypted sessions
> to websites (and can therefore inspect the contents of subscribers’
> traffic), how is it to know that copyright material is being shared
> illegally? (When an online retailer offers to “auto-rip” a CD I’ve
> just bought, how is the ISP to judge whether that transmission of
> copyright material is legal or not?).  
>
> Even if we assume these issues can be dealt with, we’re left with the
> implication that, just in order to allow ISPs to check for copyright
> material, there must be no such thing as end to end encryption - and
> that seems like a very odd position to take. It’s also one which I
> think is vulnerable to a reductio ad absurdam: if QUIC is the “guilty
> party” here, and must be banned for facilitating the unlawful
> distribution of copyright material, why stop there? Where in the OSI
> stack is there a layer that doesn’t facilitate the unlawful
> distribution of copyright material? 
>
>>
> (3) Is this genuinely your risk assessment? By implication, the people
> who come up with the manufacturing standards for firearms and
> ammunition ought to be quaking in their boots at the prospect of an
> avalanche of lawsuits for manslaughter.
>
> Yrs.,
> Robin
>
>>
>>
>> [email-masked] <mailto:[email-masked]>

---

From: Robin Wilton <[email-masked]>
Date: Fri, 21 Sep 2018 17:52:53 +0000

> On 21 Sep 2018, at 17:34, Tony Rutkowski <[email-masked] <mailto:[email-masked]>> wrote:
> 

Thanks tony - brief pre-weekend coments inline below...
> Hi Robin,
> 
> (1) The challenge here is that there have been multiple court decisions at both trial and appellate levels.  The matter is further complicated by the DMCA itself - which provides a cause of action as well as a safe harbor defense, treatment of evidence, and basis for penalties.  4th Circuit decision earlier this year is a 37 page complicated treatment of all these variables.  It involves considerably more than just failing to implements the ISP's own policies.  See at http://www.ca4.uscourts.gov/opinions/161972.P.pdf <http://www.ca4.uscourts.gov/opinions/161972.P.pdf>I was basing my response on Cox, since that was the one you cited...
> (2) The courts seem to reject the plausible deniability argument.  Indeed, it arguably suggests unlawful activity might be occurring, and analysis of the traffic flows and end point analysis might suggest that the DMCA proscribed activity in particular is occurring.  There has been considerable discussion of the topic in legal and public policy blogs and articles over the past year - particularly as to the effects of the termination of NetNeutrality.
> 
I am not convinced that the presence of session-level or end-to-end encryption “arguably suggests unlawful activity might be occurring”. I think it arguably suggests either that (i) people are taking prudent steps to protect the confidentiality of their online activities - the overwhelming majority of which are not unlawful, or (ii) ISPs and other service providers are exercising due diligence to ensure that their subscribers’ information can be protected against malicious third parties. I think we also need to bear in mind that privacy is recognised as a human right, whereas copyright is mostly a civil law entitlement… if those two are to be balanced against one another, I know where I would want the emphasis to be. Otherwise we end up requiring people to live in glass houses just in case they are inclined to do something naughty.

> (3) It is not only my risk assessment, but also that of most standards body governing officials.   Indeed, the concerns go beyond just standards activities and described as Directors and Officers Liability Insurance.  In the case of ISOC and the IETF, it was a decision of its Board circa 1994 as it assumed greater responsibilities for the IETF.
> 
I defer to your historical knowledge - but remain sceptical about the risk: you say “plaintiffs have not yet gone up the food chain to the standards developers”… but surely, if that were a viable approach, it would already have been attempted in other domains, particularly where life and limb are put at risk by use of the resulting products.

All the best,
Robin

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 21 Sep 2018 14:12:35 -0400

Hi Robin,

Well articulated, but on one key point, contraire, monseigneur. :-)

See draft-rutkowski-hrpc-hraas-00, human right CESCR15.  It is also
backed up by two major treaty instruments, and dedicated international
organizations that are UN specialized agencies.  In France in
particular, the treatment is particularly well expressed as /droit
d'auteur /where is is regarded as a moral right/./

/--t
/

On 21-Sep-18 1:52 PM, Robin Wilton wrote:
> bear in mind that privacy is recognised as a human right, whereas
> copyright is mostly a civil law entitlement… if those two are to be
> balanced against one another, I know

---

From: Mark Perkins <[email-masked]>
Date: Fri, 21 Sep 2018 20:41:57 +0000 (UTC)

Tony

Copyright &/or Droit d'auteur are NOT human rights - this has been clearly stated by the Special Rapporteur & its Committee.

This is for various reasons, one of the main ones being that corporate copyright holders (the main litigants) do not have 'human rights'

Mark P.

    On Saturday, September 22, 2018, 5:12:48 AM GMT+11, Tony Rutkowski <[email-masked]> wrote:  

Hi Robin,

See draft-rutkowski-hrpc-hraas-00, human right CESCR15.  It is also backed up by two major treaty instruments, and dedicated international organizations that are UN specialized agencies.  In France in particular, the treatment is particularly well expressed as droit d'auteur where is is regarded as a moral right.
 
--t

bear in mind that privacy is recognised as a human right, whereas copyright is mostly a civil law entitlement… if those two are to be balanced against one another, I know

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 21 Sep 2018 17:19:41 -0400

Hi Mark,

It is well established in most legal systems that copyright protection
and droit d’auteur are not per se human rights, but tools which protect
the human rights of authors and publishers.  The enjoyment of human
rights fortunately are not dependent on "who the main litigants are." 
Corporations like**BMG Rights Management GmbH usually represent the
authors in managing and protecting their rights.

The specific human right is CESCR15, Art. 15 in the International
Covenant on Economic, Social and Cultural Rights, which provides "the
right of everyone...to enjoy...the protection of the moral and material
interests resulting from any scientific, literary or artistic production
of which he is the author."  See
https://www.ohchr.org/Documents/ProfessionalInterest/cescr.pdf

169 Nation States have agreed that it is a human right.  Is there some
suggestion here that hrpc is going to attempt to decide what is a human
right and who gets to enjoy them?

--t

On 21-Sep-18 4:41 PM, Mark Perkins wrote:
> Tony
>
> Copyright &/or Droit d'auteur are NOT human rights - this has been
> clearly stated by the Special Rapporteur & its Committee.
>
> This is for various reasons, one of the main ones being that corporate
> copyright holders (the main litigants) do not have 'human rights'
>
> Mark P.
>

---

From: [email-masked]
Date: Sun, 23 Sep 2018 17:37:03 -0400

A fundamental problem in copyright and other intellectual property
protection is that although they generate a huge amount of money in
sum the structure is often such that there isn't all that much money
per party nor good market mechanisms to protect those rights.

Which is perhaps why one sees so much activity from rights owners in
seeking government protections.

One could argue (and I have :-)) that Microsoft's (Bill Gates et al)
genius was not so much creating an operating system and some software,
much of that already existed and much of it was technically much
better.

It was their realization that they could assert intellectual property
rights and copy that software for 100x or more what that cost even
taking into account their development and support costs AND that
governments would spend almost bottomless amounts of their taxpayer's
money defending those rights for at worst an occasional (relatively)
inexpensive complaint by Microsoft.

The US v Microsoft anti-trust case was basically a too little, too
late recognition of this.

  https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp.

We have a similar problem with content on the internet except for one
thing -- no, or very little, analogous economic infrastructure to
drive solutions.

Hence all are left with are appeals from rights owners to governments
to expend their police and enforcement powers to control content
value, and for that matter other content. None of what I say is
limited to IPR.

So either we get a handle on creating some sort of self-motivating
economic infrastructure or, as Orwell so eloquently put it:

    If you want a vision of the future, imagine a boot stamping on a
    human face - forever.

Perhaps a bit dramatic but worth a thought. Sometimes I fear there
really is no less at stake.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]             | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*