Subject: Re: [hrpc] Thoughts on Intersection of Content and Protocols

From: <[email-masked]>
Date: Fri, 21 Sep 2018 11:02:35 +0000 (UTC)

Tony,

Thanks so much for the historical background.   As we proceed, we definitely need to consider your valuable comments and insight.

Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

--------------------------------------------
On Fri, 9/21/18, Tony Rutkowski <[email-masked]> wrote:

 Subject: Re: [hrpc] Thoughts on Intersection of Content and Protocols
 To: [email-masked], "Nalini J Elkins" <[email-masked]>
 Cc: "Hrpc" <[email-masked]>
 Date: Friday, September 21, 2018, 11:56 AM
 
 Hi Barry,
 
 It is worth noting this activity is associated
 with human right
 
     CESCR15 the right of everyone...to take part in
 cultural life...to
 >     enjoy the
 benefits of scientific progress and its
 applications...the
 >     protection of
 the moral and material interests resulting from any
 >     scientific, literary or artistic
 production of which he is the
 author...the development and the diffusion of science and
 culture 
 
 It is also the
 basis for implementing global treaty instruments in both
 UNESCO and WIPO.
 
 It is also worth noting that Bob Kahn's DOI
 content tagging platform
 largely exists for
 providing IPR related information, and has been
 significantly supported by and in use among
 multiple copyright
 communities over the past
 20 years.  It also is secure and successfully
 scaled.  Even RFC's now have DOIs for this
 purpose.  See RFC7669.  
 
 For those who enjoy the history, this is not by
 chance.  Bob - both in
 DARPA and CNRI -
 played a leading role in the instantiation of DNS. 
 Patrice Lyons, his wife, is a copyright
 attorney who once worked at
 UNESCO.  In the
 mid-1990s, CNRI created the DOI platform to facilitate
 tagging of all digital objects to allow
 discovery of IPR related
 information and
 management of the material.  Bob also played perhaps the
 most central role in facilitating the existence
 of the IETF.
 
 --tony
 
 On 20-Sep-18 10:08 PM, [email-masked]
 wrote:
 > Although not identical a closely
 related issue is copyright protection.
 > This has become a
 particularly active area since the EU adopted its
 > digital copyright rules negotiating
 position (i.e., still in early
 > stages)
 on 2018-09-12:
 http://www.europarl.europa.eu/news/en/press-room/20180906IPR12103/parliament-adopts-its-position-on-digital-copyright-rules
 > In that case my
 thought was to study how the music industry has
 > evolved copyright protection over the past
 100+ years in the US and
 > elsewhere.
 > In brief (US) they
 rely on designated third-party agencies (such as
 > BMI, ASCAP, Harry J Fox) to provide
 licensing and collect royalties
 > and
 distribute those back to copyright owners. And statutory
 fees set
 > by the US congress. Private
 agreements are also possible, and common,
 > of course.
 >
 > The music industry has developed a
 sophisticated ecosystem and rather
 > than
 rely first on threats of criminal prosecution (which is
 possible
 > in extreme cases) instead
 tries to convert as much of the problem as
 > possible into civil claims (you used my
 work, you owe me money!)
 >
 > This is in stark contrast to the EU
 directive which approaches the
 > problem
 via draconian fines etc. and seems to create none of that
 > infrastructure. One doubts any of those
 fines, which could be in the
 > billions
 of euros, will go to the content creators and owners.
 > As an internetworking
 example I could imagine creating licensing
 > agents with various types of licenses for
 sale depending on intended
 > use and
 embedding those into (https etc) SSL certificates.
 > Something analogous
 could be done for content in general.
 > For example
 identification and certification by third-party vetting
 > organizations which could be embedded into
 SSL certificates indicating
 > that a site
 adheres to certain content standards.
 > That sort of thing is
 very defensible legally (at least in the US) if
 > the third-party is identified by a
 trademark (think: Good Housekeeping
 Seal of Approval, Underwriters Laboratory.)
 > The similarities to
 managing content in general is potentially useful.
 > THE POINT:
 > This is a big, big,
 and complex problem.
 >
 > It might take "organic" thinking
 which embraces the nature of global
 networking and creates and evolves infrastructure to respond
 usefully.
 > It's
 not going to be solved by simple analysis even if that's
 useful
 > to thinking about it.
 > A problem of this
 magnitude also requires synthesis of an
 implementation ecosystem which can be much more
 difficult.
 > And
 each aspect of it SHOULDN'T evolve its own unique
 solution.

 _______________________________________________
 hrpc mailing list
 [email-masked]
 https://www.irtf.org/mailman/listinfo/hrpc

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 21 Sep 2018 07:33:14 -0400

Thanks, Nalini,

It is also worth noting that although the recent EU Directive has been
getting considerable publicity, the U.S. Digital Millennium Copyright
Act (DMCA) paved the way over the past 20 years on the West side of the
pond.  See, e.g., https://www.copyright.gov/legislation/dmca.pdf  The
potential penalties are also significant: a defendant faces a monetary
fine up to $500,000, up to five years in jail, or both a fine and jail
for a first offense, and repeat offenders may be fined up to $1,000,000,
as long as ten years in prison, or both a fine and prison.

It was the $25 million judgement against ISP Cox Communications in 2015,
however, that made it plain that consequences of ignoring the Act's
provisions are substantial.  Part of those requirements include a
variety of actions to diminish the ISP culpability.  It is here where
some of the new encryption protocols - especially QUIC - essentially
become non-starters for most ISPs.  The protocol blocking code is
already widely available for protecting their interests.

So all of this underscores the complexity of the world in which we live,
and that there are tensions among the different human rights when
analyzed against transport and service protocols.

--tony

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 21 Sep 2018 12:51:18 +0100

Tony,

On 21/09/18 12:33, Tony Rutkowski wrote:
> It is here where
> become non-starters for most ISPs. 

I don't get what you mean by "non-starter" there?
IIUC correctly measurements (e.g. [1] was the first
search result I found just now) seem to indicate
that QUIC is indeed a starter...

S.

[1]
https://blog.apnic.net/2018/05/15/how-much-of-the-internet-is-using-quic/

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 21 Sep 2018 09:20:16 -0400

Hi Stephen,

The "non-starter" remark refers to commercial ISPs who tend to be risk
adverse.  CEO's tend not to like 25 million dollar fines or at the
extreme, life in an orange suit in prison.  QUIC, and to some extent,
TLS1.3, are loaded DMCA time bombs for ISPs.  Within legal communities,
there is considerable treatment of the concerns, and some significant
middlebox vendors have advised blocking while offering the capabilities
as part of their service packages.  It'll take but one high profile
action against an ISP allowing customers using QUIC or TLS1.3 to
illicitly distributing copyright protected works, to ramp up the
blocking market and drive down traffic metrics.

It is easy to roll out these capabilities when you don't bear the risk. 
Thusfar, the plaintiffs in these litigations have not moved up the
"foodchain" and gone after standards bodies.  Fortunately, ISOC
purchased considerable liability insurance for IETF parties approving
standards.  Presumably, the new IETF LLC will take similar steps to
mitigate the risk.

--tony

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 21 Sep 2018 13:29:27 +0000

I do not understand why TLS 1.3 or QUIC are fundamentally different from TLS 1.2, etc.  If it's necessary to decrypt traffic, that's still possible -- you just have to do something more than have a copy of the long-term server key (presumably RSA). This didn't change, as PFS is still possible with 1.2.

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 21 Sep 2018 14:33:18 +0100

On 21/09/18 14:20, Tony Rutkowski wrote:
> TLS1.3, are loaded DMCA time bombs for ISPs.  

I don't follow the logic there at all. The majority of
the web is encrypted already and there's no DMCA relevant
difference between that and TLS1.2/QUIC that I can see.
Seems to me like a non-issue.

(The transition to encrypted transports does cause some
issues for network operators, but not DMCA issues afaik,
but feel free to enlighten me as to which aspect of QUIC
or TLS you see as being DMCA relevant.)

> Within legal communities,
> as part of their service packages.  

Not a surprise that vendors of kit that needs to change
or is being made OBE advise against change.

> It'll take but one high profile

FWIW, that seems more like scare-mongering to me.

S.

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 21 Sep 2018 11:07:01 -0400

The standard under the DMCA is "willful contributory copyright
infringement."  The Act also provides several means of achieving a "safe
harbor" status, although in general it must take due diligence steps in
preventing and mitigating unlawful distribution by those using their
facilities and services.  The initiating judicial complaint in BMG v.
Cox which initiated the adverse judgement and penalty against Cox
describes at some length the use of encryption capabilities - largely in
the form of BitTorrent - being at issue.  The court and a jury agreed.

So while one can certainly argue that technically, the use of encrypted
transport path protocols and services are functionally similar,  the ISP
must ask itself if it is willing to bear the risk of penalties for
willful contributory copyright infringement.  Those representing
copyright owners have substantial incentives to emulate the BMG v Cox
case - hence the "loaded DMCA time bomb" characterization.

On "scare-mongering," the adverse litigation against standards bodies
and substantial (million dollar) costs are quite real after ETSI was
found as a contributory party for its 3GPP Secretariat support by a US
Federal Court in Trueposition v. Ericsson four years ago.  Those
responsible for IETF LLC will doubtlessly want to continue the liability
insurance the ISOC began providing in 1994 and institute actions that
limit its culpability.

--t

---

From: Vittorio Bertola <[email-masked]>
Date: Fri, 21 Sep 2018 17:24:16 +0200 (CEST)

> Il 21 settembre 2018 alle 17.07 Tony Rutkowski <[email-masked]> ha scritto:
> 
> willful contributory copyright infringement. 

I have a non-rhetorical question: can not blocking encrypted transport be really considered a "willful" contribution to copyright infringement? I could see some court deciding that BitTorrent is a specialized encrypted protocol used most frequently to transmit copyrighted material in unauthorized ways, but can you say the same of any encrypted protocol in general? In other words, if unauthorized copyrighted material is just a small fraction of the overall content that is transmitted over an encrypted protocol, how can you say that allowing that protocol to pass equates to promoting copyright infringement?

I also understand that ISPs may just want to avoid to have to argue about this in court and thus stop these protocols anyway, but wouldn't that break other laws (e.g. network neutrality) and contracts?

Regards,
-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked]
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 21 Sep 2018 11:32:24 -0400

Hi Vittorio,

All good questions/arguments.  Several parties filed briefs making
similar arguments at the trial level and before the Court of Appeals for
the Fourth Circuit.  They didn't prevail.

Indeed, the ISP actions need to be weighed against other obligations. 
However, NetNeutrality is no longer a requirement in the U.S. - in part
because of competing interests like the DMCA requirements.  It is not
clear where the EU is at the moment, but probably characterized as
uncertain.  The rest of the world largely eschews the requirement.

-t