Want to know just how incredibly confusing and impossible copyright law has become? Just take a look at this lawsuit, filed yesterday by some music publishing companies against Microsoft, Yahoo and Real Networks, claiming that the online music stores each of them runs (the Zune store, Yahoo Music and Rhapsody) infringe their copyrights (thanks Eric Goldman for sending this over). How can that be, you ask? Surely these companies properly licensed the music they offer in their streaming/download offerings, right? Well, the lawsuit doesn't provide that much in the way of detail (and I've spoken to a few copyright lawyers -- none of whom seem to agree with each other!), it sure looks like the claim is that Microsoft, Yahoo and Real may have licensed the copyrights on the recordings, but did not license the copyright on the compositions. It sounds like (though, again, the details are fuzzy) that the record labels did licensing deals with these music services, but publishers and labels are separate entities (even if the labels own many publishers), and the rights are separate.

It's pure speculation until more details come out, but one imagines that the licensing deals with the record labels included some sort of assurances that the publishing rights were covered as well -- and for songs whose publishing rights were covered by the major record labels, that's probably the case. But for songs where the publishing rights were owned by independent companies -- such as MCS Music America, the claim appears to be that the publishing rights were never cleared -- and thus, Microsoft, Yahoo and Real were streaming/downloading music to which they only held some of the rights. Yikes.

Most of the complaint details which songs were offered without (allegedly) having secured all the rights. And, of course, the publishers are claiming that every time a song was streamed or downloaded, it counts as a separate act of infringement. If the court agrees, this could represent a massive liability for Microsoft, Yahoo and Real, given the fines we all know can be issued over a single instance of infringement.

That said, this is yet another example of the convoluted house of cards that copyright has become. The idea that you can license a recording, but then need to get a separate license from a totally different party for the rights to the "underlying composition" (and don't get us started on the need to make sure you're covered for reproduction, distribution and performance rights -- three separate issues under copyright law), and you begin to get a sense of the problem. Basically, every time some new technology or innovation comes along, the copyright holders run to Congress to slap on another right, rather than actually innovating on the business model side. And on top of it, when new technologies like the internet come along, it's not at all clear which rights really apply and who controls/owns what rights. Suddenly, you have a massive mess for a company trying to do something as simple as let people listen to music. Just for that, you get a massive lawsuit like the following: It's the sort of system only a greedy copyright lawyer could love: it's designed not to incentivize creation (copyright's stated purpose) or to facilitate the distribution of content -- but instead designed for the exact opposite: to confuse and hinder (but to keep copyright lawyers quite busy and gainfully employed).

Permalink | Comments | Email This Story

Stallman's fear is that Microsoft will use its software patents to force open source C# implementations, and applications, underground. Any move toward bringing C#, which Microsoft developed and Mono, which Microsoft supports, into the center of the Linux community must therefore be resisted.

Mozilla claims one million copies of Firefox 3.5 have been downloaded during its first day of release. During the browser team’s weekly meeting today that began at 2:00 pm EST, developers reported the crossing of the one million download mark. Firefox 3.5 was officially made available Tuesday, meeting the planned milestone that was announced last week. It [...]

Unemployment rates rose in all the largest U.S. metropolitan areas for the fifth straight month in May.

Americans whose hope for the economy had been rising since March are starting to lose faith, pushing down a widely watched ...

Prices of single-family homes declined in April from March in many areas, but the pace of the decline slowed, suggesting stability ...

I agree with this:

It's time to show most passwords in clear text as users type them. Providing feedback and visualizing the system's status have always been among the most basic usability principles. Showing undifferentiated bullets while users enter complex codes definitely fails to comply.

Most websites (and many other applications) mask passwords as users type them, and thereby theoretically prevent miscreants from looking over users' shoulders. Of course, a truly skilled criminal can simply look at the keyboard and note which keys are being pressed. So, password masking doesn't even protect fully against snoopers.

More importantly, there's usually nobody looking over your shoulder when you log in to a website. It's just you, sitting all alone in your office, suffering reduced usability to protect against a non-issue.

Shoulder surfing isn't very common, and cleartext passwords greatly reduces errors. It has long annoyed me when I can't see what I type: in Windows logins, in PGP, and so on.

It appears that Norway has decided that it's sick of passing laws designed to prop up obsolete industry business models at the expense of individual privacy. First, the country started telling ISPs to delete log files after just three weeks (making it pretty hard to identify individual filesharers), and now it's refused to renew the license given to the one law firm allowed to sniff IP addresses in trying to seek out unauthorized file sharing. Apparently there's been a bit of a debate about the license, with concerns about potential privacy violations. I have to admit that I'm not sure this makes much sense to me. I still have trouble understanding the European point of view that an IP address -- which your computer more or less needs to share publicly with other computers is somehow "private information." However, that's the way many European countries view it, and so such snooping is a potential privacy violation. Effectively, the country has decided that privacy rights are more important than the entertainment industry's old business model.

Permalink | Comments | Email This Story

San Francisco has asked a federal judge to overturn California's ban on same-sex marriage, allying the city with a lawsuit that could reach the U.S. Supreme Court. In papers filed Thursday night in U.S. District Court in San Francisco, City Attorney Dennis...

Pharmaceutical companies, like the insurance industry, strongly oppose any proposal to create a public health insurance option, fearful that private insurers would be marginalized and government price controls would limit what the industry can charge for its products. And with drug companies as the No. 1 all-time spender on lobbying, at $1.6 billion since 1998, Congress is bound to at least entertain their concerns.

Health care reform could be the insurance industry's greatest nightmare or sweetest dream, depending on the fate of some of the most sweeping proposals. And insurers are hoping that the $765.2 million* they've spent on lobbying since 1998 will pay off now.

Authorities have ordered designers to fix security breaches to software that will be used to block Web sites, indicating that it still backs its use, despite heated debate.

An employee inspects a model of an Airbus A350 airplane prior to the Paris Air Show in Le Bourget, France.

Will increased flooding in Bangladesh -- and other climate changes around the globe -- drive mass migrations of people?

Division between the left and the right on the stalled German economy strikes many outsiders as a choice between plague and cholera.

Interesting:

This part happens all the time: A construction crew putting up an office building in the heart of Tysons Corner a few years ago hit a fiber optic cable no one knew was there.

This part doesn't: Within moments, three black sport-utility vehicles drove up, a half-dozen men in suits jumped out and one said, "You just hit our line."

Whose line, you may ask? The guys in suits didn't say, recalled Aaron Georgelas, whose company, the Georgelas Group, was developing the Greensboro Corporate Center on Spring Hill Road. But Georgelas assumed that he was dealing with the federal government and that the cable in question was "black" wire -- a secure communications line used for some of the nation's most secretive intelligence-gathering operations.

Black wire is one of the looming perils of the massive construction that has come to Tysons, where miles and miles of secure lines are thought to serve such nearby agencies as the Office of the Director of National Intelligence, the National Counterterrorism Center and, a few miles away in McLean, the Central Intelligence Agency. After decades spent cutting through red tape to begin work on a Metrorail extension and the widening of the Capital Beltway, crews are now stirring up tons of dirt where the black lines are located.

"Yeah, we heard about the black SUVs," said Paul Goguen, the engineer in charge of relocating electric, gas, water, sewer, cable, telephone and other communications lines to make way for Metro through Tysons. "We were warned that if they were hit, the company responsible would show up before you even had a chance to make a phone call."

This year's overhyped IT concept is cloud computing. Also called software as a service (Saas), cloud computing is when you run software over the internet and access it via a browser. The Salesforce.com customer management software is an example of this. So is Google Docs. If you believe the hype, cloud computing is the future.

But, hype aside, cloud computing is nothing new . It's the modern version of the timesharing model from the 1960s, which was eventually killed by the rise of the personal computer. It's what Hotmail and Gmail have been doing all these years, and it's social networking sites, remote backup companies, and remote email filtering companies such as MessageLabs. Any IT outsourcing -- network infrastructure, security monitoring, remote hosting -- is a form of cloud computing.

The old timesharing model arose because computers were expensive and hard to maintain. Modern computers and networks are drastically cheaper, but they're still hard to maintain. As networks have become faster, it is again easier to have someone else do the hard work. Computing has become more of a utility; users are more concerned with results than technical details, so the tech fades into the background.

But what about security? Isn't it more dangerous to have your email on Hotmail's servers, your spreadsheets on Google's, your personal conversations on Facebook's, and your company's sales prospects on salesforce.com's? Well, yes and no.

IT security is about trust. You have to trust your CPU manufacturer, your hardware, operating system and software vendors -- and your ISP. Any one of these can undermine your security: crash your systems, corrupt data, allow an attacker to get access to systems. We've spent decades dealing with worms and rootkits that target software vulnerabilities. We've worried about infected chips. But in the end, we have no choice but to blindly trust the security of the IT providers we use.

Saas moves the trust boundary out one step further -- you now have to also trust your software service vendors -- but it doesn't fundamentally change anything. It's just another vendor we need to trust.

There is one critical difference. When a computer is within your network, you can protect it with other security systems such as firewalls and IDSs. You can build a resilient system that works even if those vendors you have to trust may not be as trustworthy as you like. With any outsourcing model, whether it be cloud computing or something else, you can't. You have to trust your outsourcer completely. You not only have to trust the outsourcer's security, but its reliability, its availability, and its business continuity.

You don't want your critical data to be on some cloud computer that abruptly disappears because its owner goes bankrupt . You don't want the company you're using to be sold to your direct competitor. You don't want the company to cut corners, without warning, because times are tight. Or raise its prices and then refuse to let you have your data back. These things can happen with software vendors, but the results aren't as drastic.

There are two different types of cloud computing customers. The first only pays a nominal fee for these services – and uses them for free in exchange for ads: eg Gmail and Facebook. These customers have no leverage with their outsourcers. its owner goes bankrupt . You don't want the company you're using to be sold to your direct competitor. You don't want the company to cut corners, without warning, because times are tight. Or raise its prices and then refuse to let you have your data back. These things can happen with software vendors, but the results aren't as drastic.

There are two different types of cloud computing customers. The first only pays a nominal fee for these services – and uses them for free in exchange for ads: eg Gmail and Facebook. These customers have no leverage with their outsourcers. You can lose everything . Companies like Google and Amazon won't spend a lot of time caring. The second type of customer pays considerably for these services: to Salesforce.com, MessageLabs, managed network companies, and so on. These customers have more leverage, providing they write their service contracts correctly. Still, nothing is guaranteed.

Trust is a concept as old as humanity, and the solutions are the same as they have always been. Be careful who you trust, be careful what you trust them with, and be careful how much you trust them. Outsourcing is the future of computing. Eventually we'll get this right, but you don't want to be a casualty along the way.

This essay originally appeared in The Guardian.

Whose idea is this?

The Boston Police Department is preparing a plan to arm as many as 200 patrol officers with semiautomatic assault rifles, a significant boost in firepower that department leaders believe is necessary to counter terrorist threats, according to law enforcement officials briefed on the plan.

The initiative calls for equipping specialized units, such as the bomb squad and harbor patrol, with the high-powered long-range M16 rifles first, the officials said. The department would then distribute the weapons to patrol officers in neighborhood precincts over the next several months, according to the two law enforcement officials, who spoke on the condition of anonymity because they did not have permission to speak publicly.

Remember, the "terrorist threats" that plague Boston include blinking signs, blinking name badges, and Linux. Would you trust the police there with automatic weapons?

And anyway, how exactly does an police force armed with automatic weapons protect against terrorism? Does it make it harder for the terrorists to plant bombs? To hijack aircraft? Sure, you can invent a movie-plot scenario involving a Mumbai-like attack and have a Bruce Willis-like armed policeman save the day, but -- realistically -- is this really the best way for us to be spending our counterterrorism dollar?

Luckily, people seem to be coming to their senses.

I am optimistic about President Obama's new cybersecurity policy and the appointment of a new "cybersecurity coordinator," though much depends on the details. What we do know is that the threats are real, from identity theft to Chinese hacking to cyberwar.

His principles were all welcome -- securing government networks, coordinating responses, working to secure the infrastructure in private hands (the power grid, the communications networks, and so on), although I think he's overly optimistic that legislation won't be required. I was especially heartened to hear his commitment to funding research. Much of the technology we currently use to secure cyberspace was developed from university research, and the more of it we finance today the more secure we'll be in a decade.

Education is also vital, although sometimes I think my parents need more cybersecurity education than my grandchildren do. I also appreciate the president's commitment to transparency and privacy, both of which are vital for security.

But the details matter. Centralizing security responsibilities has the downside of making security more brittle by instituting a single approach and a uniformity of thinking. Unless the new coordinator distributes responsibility, cybersecurity won't improve.

As the administration moves forward on the plan, two principles should apply. One, security decisions need to be made as close to the problem as possible. Protecting networks should be done by people who understand those networks, and threats needs to be assessed by people close to the threats. But distributed responsibility has more risk, so oversight is vital.

Two, security coordination needs to happen at the highest level possible, whether that's evaluating information about different threats, responding to an Internet worm or establishing guidelines for protecting personal information. The whole picture is larger than any single agency.

This essay originally appeared on The New York Times website, along with several others commenting on Obama's speech. All the essays are worth reading, although I want to specifically quote James Bamford making an important point I've repeatedly made:

The history of White House czars is not a glorious one as anyone who has followed the rise and fall of the drug czars can tell. There is a lot of hype, a White House speech, and then things go back to normal. Power, the ability to cause change, depends primarily on who controls the money and who is closest to the president's ear.

Because the new cyber czar will have neither a checkbook nor direct access to President Obama, the role will be more analogous to a traffic cop than a czar.

Gus Hosein wrote a good essay on the need for privacy:

Of course raising barriers around computer systems is certainly a good start. But when these systems are breached, our personal information is left vulnerable. Yet governments and companies are collecting more and more of our information.

The presumption should be that all data collected is vulnerable to abuse or theft. We should therefore collect only what is absolutely required.

As I said, they're all worth reading. And here are some more links.

I wrote something similar in 2002 about the creation of the Department of Homeland Security:

The human body defends itself through overlapping security systems. It has a complex immune system specifically to fight disease, but disease fighting is also distributed throughout every organ and every cell. The body has all sorts of security systems, ranging from your skin to keep harmful things out of your body, to your liver filtering harmful things from your bloodstream, to the defenses in your digestive system. These systems all do their own thing in their own way. They overlap each other, and to a certain extent one can compensate when another fails. It might seem redundant and inefficient, but it's more robust, reliable, and secure. You're alive and reading this because of it.

What do you do if you have too many background checks to do, and not enough time to do them? You fake them, of course:

Eight current and former security clearance investigators say they have been pressured to work faster and take on crushing workloads in recent years, as the government tried to eliminate a backlog that once topped 531,000 cases.

Investigators have eliminated that backlog, but they now are trying to meet congressionally mandated deadlines to speed up the security clearance process. The 2004 Intelligence Reform and Terrorism Prevention Act requires agencies to issue at least 80 percent of initial security clearances within 120 days after receiving a completed application. This December, agencies must issue at least 90 percent of their initial security clearances within 60 days.

"This job is a shredder, and agents are grist for the mill," said K.C. Smith, an OPM investigator in Austin, Texas, with 23 years of experience. "There are people who are getting sick, under a lot of stress, their family life is suffering. They are just beat down."

Investigators say it is common practice to spend nights, weekends and holidays writing up reports, and some don't report the overtime they work for fear it will be held against them in their performance evaluations.

Some say their superiors have made it clear that the priority is to close cases, and they say they have felt pressure to turn in even incomplete cases that lack crucial interviews or records if it will help them keep their numbers up. A recent Government Accountability Office report found that the Defense Department's security clearance process is plagued by such incomplete cases: 87 percent of the 3,500 initial top-secret security clearance cases Defense approved last year were missing at least one interview or important record.

It's all a matter of incentives. The investigators were rewarded for completing investigations, not for doing them well.

Research:

Hiding Information in Retransmissions

Wojciech Mazurczyk, Milosz Smolarczyk, Krzysztof Szczypiorski

The paper presents a new steganographic method called RSTEG (Retransmission Steganography), which is intended for a broad class of protocols that utilises retransmission mechanisms. The main innovation of RSTEG is to not acknowledge a successfully received packet in order to intentionally invoke retransmission. The retransmitted packet carries a steganogram instead of user data in the payload field. RSTEG is presented in the broad context of network steganography, and the utilisation of RSTEG for TCP (Transport Control Protocol) retransmission mechanisms is described in detail. Simulation results are also presented with the main aim to measure and compare the steganographic bandwidth of the proposed method for different TCP retransmission mechanisms as well as to determine the influence of RSTEG on the network retransmissions level.

I don't think these sorts of things have any large-scale applications, but they are clever.