Er I'm sorry but do you mean joeschmoe@corp.megaupload.com type emails, or joeschmoe@hotmail.com type emails? If megaupload's corporate email was siezed to provide due diligence in such a prosecution - it would quite probably not constitute private mail On Fri, Jan 20, 2012 at 8:49 AM, Steven Bellovin <smb@cs.columbia.edu> wrote:

       The Megaupload case is unusual, said Orin S. Kerr, a law professor        at George Washington University, in that federal prosecutors obtained        the private e-mails of Megaupload’s operators in an effort to show they        were operating in bad faith.

       "The government hopes to use their private words against them," Mr. Kerr        said. "This should scare the owners and operators of similar sites."

-- Suresh Ramasubramanian (ops.lists@gmail.com)

Interesting, going to do some more digging. -----Original Message----- From: Steven Bellovin Sent: Friday, January 20, 2012 12:07 AM To: Suresh Ramasubramanian Cc: james@smithwaysecurity.com ; NANOG Subject: Re: Megaupload.com seized I don't mean either -- I've only skimmed the indictment. But from the news stories, it would *appear* that they got a search or wiretap warrant to get at employees' email. I don't see how that would make it "not private". (Btw -- "due diligence" is a civil suit concept; this is a criminal case.) The prosecution is trying to claim that the targets had actual knowledge of what was going on. I do know Orin Kerr, however. He's a former federal prosecutor and he's *very* sharp, and I've never known him to be wrong on straight-forward legal issues like this. He himself may not have all the facts himself. But here are two sample paragraphs from the indictment: On or about August 31, 2006, VAN DER KOLK sent an e-mail to an associate entitled lol. Attached to the message was a screenshot of a Megaupload.com file download page for the file Alcohol 120 1.9.5 3105complete.rar with a description of Alcohol 120, con crack!!!! By ChaOtiX!. The copyrighted software Alcohol 120 is a CD/DVD burning software program sold by www.alcohol-soft.com. and On or about June 24, 2010, members of the Mega Conspiracy were informed, pursuant to a criminal search warrant from the U.S. District Court for the Eastern District of Virginia, that thirty-nine infringing copies of copyrighted motion pictures were believed to be present on their leased servers at Carpathia Hosting in Ashburn, Virginia. On or about June 29, 2010, after receiving a copy of the criminal search warrant, ORTMANN sent an e-mail entitled Re: Search Warrant Urgent to DOTCOM and three representatives of Carpathia Hosting in the Eastern District of Virginia. In the e-mail, ORTMANN stated, The user/payment credentials supplied in the warrant identify seven Mega user accounts, and further that The 39 supplied MD5 hashes identify mostly very popular files that have been uploaded by over 2000 different users so far[.] The Mega Conspiracy has continued to store copies of at least thirty-six of the thirty-nine motion pictures on its servers after the Mega Conspiracy was informed of the infringing content. (I got the indictment from http://static2.stuff.co.nz/files/MegaUpload.pdf -- while I'd prefer to use a DoJ site cite, for some reason their web server is very slow right now...) On Jan 19, 2012, at 10:48 PM, Suresh Ramasubramanian wrote:

Er I'm sorry but do you mean joeschmoe@corp.megaupload.com type emails, or joeschmoe@hotmail.com type emails?

If megaupload's corporate email was siezed to provide due diligence in such a prosecution - it would quite probably not constitute private mail

On Fri, Jan 20, 2012 at 8:49 AM, Steven Bellovin <smb@cs.columbia.edu> wrote:

...

The Megaupload case is unusual, said Orin S. Kerr, a law professor at George Washington University, in that federal prosecutors obtained the private e-mails of Megaupload’s operators in an effort to show they were operating in bad faith.

"The government hopes to use their private words against them," Mr. Kerr said. "This should scare the owners and operators of similar sites."

-- Suresh Ramasubramanian (ops.lists@gmail.com)

--Steve Bellovin, https://www.cs.columbia.edu/~smb

I can only imagine the bloodbath this will cause.!! -----Original Message----- From: Steven Bellovin Sent: Friday, January 20, 2012 12:07 AM To: Suresh Ramasubramanian Cc: james@smithwaysecurity.com ; NANOG Subject: Re: Megaupload.com seized I don't mean either -- I've only skimmed the indictment. But from the news stories, it would *appear* that they got a search or wiretap warrant to get at employees' email. I don't see how that would make it "not private". (Btw -- "due diligence" is a civil suit concept; this is a criminal case.) The prosecution is trying to claim that the targets had actual knowledge of what was going on. I do know Orin Kerr, however. He's a former federal prosecutor and he's *very* sharp, and I've never known him to be wrong on straight-forward legal issues like this. He himself may not have all the facts himself. But here are two sample paragraphs from the indictment: On or about August 31, 2006, VAN DER KOLK sent an e-mail to an associate entitled lol. Attached to the message was a screenshot of a Megaupload.com file download page for the file Alcohol 120 1.9.5 3105complete.rar with a description of Alcohol 120, con crack!!!! By ChaOtiX!. The copyrighted software Alcohol 120 is a CD/DVD burning software program sold by www.alcohol-soft.com. and On or about June 24, 2010, members of the Mega Conspiracy were informed, pursuant to a criminal search warrant from the U.S. District Court for the Eastern District of Virginia, that thirty-nine infringing copies of copyrighted motion pictures were believed to be present on their leased servers at Carpathia Hosting in Ashburn, Virginia. On or about June 29, 2010, after receiving a copy of the criminal search warrant, ORTMANN sent an e-mail entitled Re: Search Warrant Urgent to DOTCOM and three representatives of Carpathia Hosting in the Eastern District of Virginia. In the e-mail, ORTMANN stated, The user/payment credentials supplied in the warrant identify seven Mega user accounts, and further that The 39 supplied MD5 hashes identify mostly very popular files that have been uploaded by over 2000 different users so far[.] The Mega Conspiracy has continued to store copies of at least thirty-six of the thirty-nine motion pictures on its servers after the Mega Conspiracy was informed of the infringing content. (I got the indictment from http://static2.stuff.co.nz/files/MegaUpload.pdf -- while I'd prefer to use a DoJ site cite, for some reason their web server is very slow right now...) On Jan 19, 2012, at 10:48 PM, Suresh Ramasubramanian wrote:

Er I'm sorry but do you mean joeschmoe@corp.megaupload.com type emails, or joeschmoe@hotmail.com type emails?

If megaupload's corporate email was siezed to provide due diligence in such a prosecution - it would quite probably not constitute private mail

On Fri, Jan 20, 2012 at 8:49 AM, Steven Bellovin <smb@cs.columbia.edu> wrote:

...

The Megaupload case is unusual, said Orin S. Kerr, a law professor at George Washington University, in that federal prosecutors obtained the private e-mails of Megaupload’s operators in an effort to show they were operating in bad faith.

"The government hopes to use their private words against them," Mr. Kerr said. "This should scare the owners and operators of similar sites."

-- Suresh Ramasubramanian (ops.lists@gmail.com)

--Steve Bellovin, https://www.cs.columbia.edu/~smb

In message <CABRP1o8-_eN5uCsXFHtELWRiivMrKs7-9XA5OJPsJ9F3JYSqpw@mail.gmail.com> , Rodrick Brown writes:

On Thu, Jan 19, 2012 at 11:30 PM, James Smith <james@smithwaysecurity.com>w= rote:

...

I can only imagine the bloodbath this will cause.!!

Show me a file sharing site with no illegal content! This is just insane. What's quite interesting is that Rapper/Producer Swiss BeatZ is the current CEO of megaupload how ironic.

I suspect most file sharing site don't have illegal content. Most would have some content that is there without the permission of the copyright holder. These are different things. This case is not that there is copyrighted content there without the permission of the copyright holder. It's that they, allegedly, failed to remove such content when explictly notified of it which put them outside the safe harbour provision of DMCA. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org

In article <201201201025.q0KAPdM5040190@mail.r-bonomi.com>, Robert Bonomi <bonomi@mail.r-bonomi.com> writes

...

I suspect most file sharing site don't have illegal content. Most would have some content that is there without the permission of the copyright holder. These are different things.

<nitpick> "Without the permission of the copyright holder" _is_ contrary to statute, and thus 'against the law'. As such 'illegal' is _not_ an incorrect term to apply to the situation.

It may not be a _criminal_ violation, but it is still proscribed by law.

"Illegal" and "criminal" -- _these_ are different things.

Junk faxing is illegal, Telemarketing calls to cell phones are illegal, Public distribution without the permission of the copyright owner is illegal.

Except in special cases, none of those actions are _criminal_, but they are all violations of law, and thus _illegal_.

Claiming that a thing is not 'illegal' if it is not 'criminal', is similar to asserting "it's not a crime if you don't get caught".

</nitpick>

As is common in most industries there are expressions in the world of Internet Governance that are jargon, and have agreed meanings in that context. "Illegal Material" is reserved for content which is illegal to possesses and/or distribute (even if, and possibly even more so, if you originated it). "Harmful Material" is content which is legal to possess but is nevertheless regarded by many as immoral or highly undesirable within some framework of commonly held values. "Infringing Material" is content which is held without a legitimate rightsholder's permission. -- Roland Perry

On 20 Jan 2012, at 11:00, Tei wrote:

Fileshares can organize thenselves in sites based on a forum software that is private by default (open with registration), then share some "information" file that include the url to the files hosted, and the key to unencrypt these files, and some metadata. A special desktop program* would load that information file, and start the http download.

At the risk of kicking over old ground, there are a bunch of privacy solutions like this; possibly the most complete attempt (in terms of attempted privacy and distribution) is Freenet: http://freenetproject.org/whatis.html ...but it's slow; then there's Tahoe-LAFS - a decentralised filesystem: https://tahoe-lafs.org/trac/tahoe-lafs ...but it's slow; then there are connection anonymisation tools like I2P and Tor, but - wonderful as they are - they're slow. Can you see a pattern developing that would be relevant to the downloader of 700Mb+ AVIs? :-) It would be great to speed them through wider adoption, but until then... -a

On Fri, 2012-01-20 at 11:14 +0000, Alec Muffett wrote:

On 20 Jan 2012, at 11:00, Tei wrote:

...

Fileshares can organize thenselves in sites based on a forum software that is private by default (open with registration), then share some "information" file that include the url to the files hosted, and the key to unencrypt these files, and some metadata. A special desktop program* would load that information file, and start the http download.

At the risk of kicking over old ground, there are a bunch of privacy solutions like this; possibly the most complete attempt (in terms of attempted privacy and distribution) is Freenet:

http://freenetproject.org/whatis.html

...but it's slow; then there's Tahoe-LAFS - a decentralised filesystem:

https://tahoe-lafs.org/trac/tahoe-lafs

...but it's slow; then there are connection anonymisation tools like I2P and Tor, but - wonderful as they are - they're slow.

Can you see a pattern developing that would be relevant to the downloader of 700Mb+ AVIs? :-)

It would be great to speed them through wider adoption, but until then...

-a

Tahoe-lafs can be fast. A grid I help out with is often capable of 600kilobyte/per/second downloads (or faster), and I personally have several files stored on there in excess of 500mb. Close enough to your 700mb movie example. I use this storage as a CDN of sorts, as a friend wrote an HTTP interface to the Tahoe-lafs grid. Should you wish to see it in action, the code and download links are over here --> http://cryto.net/projects/tahoe.html

On Fri, 20 Jan 2012 12:00:15 +0100, Tei said:

What sould fileshares must do, is to store files in these services in a encrypted way, and anonimized name. So these services have absolutelly no way to tell what are hosting.

http://freenetproject.org/

On Fri, Jan 20, 2012 at 5:48 AM, Carsten Bormann <cabo@tzi.org> wrote:

On Jan 20, 2012, at 11:25, Robert Bonomi wrote:

...

 Public distribution without the permission of the copyright owner is  illegal.

This is veering off the purpose of this list, but maybe it is operationally significant to be able to use the right terms when a law enforcement officer is standing in the door.

Mark Andrews was pointing out that content being file-shared is rarely illegal.  By itself.  Examples of "illegal content" might be hate speech, child pornography, lèse-majesté, blasphemy, with the meaning of these terms depending on your jurisdiction.

What you are pointing out is that distribution of content may be illegal.  That does not make the content itself illegal.  The legality of transfer under copyright is bound to many legal issues, such as fair use, right to personal copies, and of course licensing, again depending on your jurisdiction.  But all this is divorced from the content.  Content is never illegal with respect to copyright.  (It might have been copied illegally, but once it's sitting somewhere, it's not illegal by itself.  A license would suddenly make it legal.)

The point is important because a lot of idiots are running around shouting "he had all this copyrighted material on his computer!".  Of course he had!  There are very few computers that don't carry copyrighted material, starting from the BIOS.  Without examining the legal context, such as purchasing histories, supreme court decisions etc., it is sometime really hard to say whether all of it got there in a legal way, and its presence may be an indication of previous illegal activity.  But (at least wrt copyright law) it is never illegal while sitting somewhere on a computer.

So the next time somebody says "illegal content", think "hate speech" or "child pornography", "lèse-majesté" or "blasphemy", not copyrighted content.  Almost everything on a computer is copyrighted.

There is a lot of disinformation in this area, with loaded words with no legal meaning being used to make political points or engender desired reactions. I am not a lawyer, and this is certainly not legal advice, but in the US copyright infringement is not theft, the shear possession of infringing material is not illegal, nor is listening / watching / reading such material in private, and the terms "piracy" and "intellectual property" are not to be found in US copyright law. That you would not know this reading the press releases is a feature, not a bug. And, since 1976, registration is not required for copyright and almost everything written, sung, videoed, etc., including these emails, is copyrighted from the time it is created. But, indeed, this is far the purpose of this mail list. Regards Marshall

Now let's return to the impact of this heist on network utilization...

Grüße, Carsten

On Fri, 20 Jan 2012 12:46:51 CST, Robert Bonomi said:

Sorry, but the last sentence is simply _not_ true. If the making of the copy was a violation of 17 USC 106 (1) or (2), it's existance is proscribed by law.

Nice try, but reading 17 USC 503 (b) we see: "As part of a final judgment or decree, the court may order the destruction or other reasonable disposition of all copies or phonorecords found to have been made or used in violation of the copyright owner's exclusive rights, and of all plates, molds, matrices, masters, tapes, film negatives, or other articles by means of which such copies or phonorecords may be reproduced." Note - the court *may* order the destruction. It's not mandatory. And there's no implied mandatory destruction elsewhere - if there was, 503(b) wouldn't need to exist because the destruction would already be required, so a court couldn't order additional destruction.

On Fri, Jan 20, 2012 at 03:05:47AM -0800, Owen DeLong wrote:

On Jan 20, 2012, at 2:25 AM, Robert Bonomi wrote:

...

Mark Andrews <marka@isc.org> wrote:

...

I suspect most file sharing site don't have illegal content. Most would have some content that is there without the permission of the copyright holder. These are different things.

<nitpick> "Without the permission of the copyright holder" _is_ contrary to statute, and thus 'against the law'. As such 'illegal' is _not_ an incorrect term to apply to the situation.

It may not be a _criminal_ violation, but it is still proscribed by law.

"Illegal" and "criminal" -- _these_ are different things.

Junk faxing is illegal, Telemarketing calls to cell phones are illegal, Public distribution without the permission of the copyright owner is illegal.

Except in special cases, none of those actions are _criminal_, but they are all violations of law, and thus _illegal_.

Actually, they are all criminal violations. They may be infractions, or, they may not often get prosecuted, but, each is, in fact, a criminal violation.

Owen

depends on the jurisdiction me thinks. Do US laws apply in India? Nigeria? Mars? Your broad generlizations may not hold. /bill

----- Original Message -----

From: "Robert Bonomi" <bonomi@mail.r-bonomi.com>

Mark Andrews <marka@isc.org> wrote:

...

I suspect most file sharing site don't have illegal content. Most would have some content that is there without the permission of the copyright holder. These are different things.

<nitpick> "Without the permission of the copyright holder" _is_ contrary to statute, and thus 'against the law'. As such 'illegal' is _not_ an incorrect term to apply to the situation.

It may not be a _criminal_ violation, but it is still proscribed by law.

"Illegal" and "criminal" -- _these_ are different things.

<nitpick level="2"> The *act of making the copy (available)* may be contrary to law (and whether the law should make this particular category of copyright infringement a criminal offense, rather than the civil one it's been for over a century is a completely different topic :-)... but whether the *contents of the file themselves* contravene some law is, I think, the issue that Mark was talking about, and clearly we all agree, a copy of Gigli, while a crime against nature, is not inherently criminal, in the way that a Traci Lords film is. Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

Suresh Ramasubramanian wrote:

It'll be interesting to see how this pans out - especially wrt any safe harbor provisions in the DMCA for providers (which do have a provision for due diligence being exercised etc).

I quickly read through the indictment, but the gov't claims that when given a takedown notice, MU would only remove the *link* and not the file itself. They specifically mention some movies that were still on the site years after the notice, thus negating MU's eligibility for safe harbor. As you say, interesting for sure with the dotted i s and crossed t s.

On 01/20/2012 09:11 AM, Ricky Beam wrote:

On Thu, 19 Jan 2012 22:34:33 -0500, Michael Painter <tvhawaii@shaka.com> wrote:

...

I quickly read through the indictment, but the gov't claims that when given a takedown notice, MU would only remove the *link* and not the file itself.

That's actually a standard practice. It allows the uploader to file a counterclaim and have the content restored. One cannot "restore" what has already been deleted.

However, never going back and cleaning up the undisputed content is a whole other mess of dead monkeys.

From what I understand about MegaUpload's approach, they created a hash of every file that they stored. If they'd already got a copy of the file that was to be uploaded they'd just put an appropriate link in a users space, saving them storage space, and bandwidth for both parties. Fairly straight forward. Whenever they received a DMCA take-down they would remove the link, not the underlying file, so even though they knew that a file was illegally hosted, they never actually removed it. That comes up for some argument about the ways the company should be practically enforcing a DMCA take-down notice, whether each take-down should apply to just an individual user's link to a file or whether the file itself should be removed. That could be different from circumstance to circumstance. Paul

In a message written on Fri, Jan 20, 2012 at 09:37:16AM -1000, Paul Graydon wrote:

From what I understand about MegaUpload's approach, they created a hash of every file that they stored. If they'd already got a copy of the file that was to be uploaded they'd just put an appropriate link in a users space, saving them storage space, and bandwidth for both parties. Fairly straight forward. Whenever they received a DMCA take-down they would remove the link, not the underlying file, so even though they knew that a file was illegally hosted, they never actually removed it. That comes up for some argument about the ways the company should be practically enforcing a DMCA take-down notice, whether each take-down should apply to just an individual user's link to a file or whether the file itself should be removed. That could be different from circumstance to circumstance.

Note that with A DMCA take down the original uploader can issue a counter-notice to get the content put back. Most sites don't immediately delete the content but rather disable it in some way so that should the file be counter noticed it can be put back up. Also, when using a hashed file store, it's possible that some uses are infringing and some are not. I might make a movie, put it on Megaupload, and then give the links only to the 5 people who bought it from them. One of them might turn around, upload it again to Megaupload, and share it with the world, infringing on my content. I would hope that when I issue a takedown notice they take down the infringers copy (link), but leave mine in place. None of this should be taken to mean I'm behind Megaupload. I have a greater concern here wondering if law enforcement, the courts, and most importantly the law makers understand the technolgy and can craft and apply laws in a reasonable way. One major issue that already came up is that a whole lot of people used Megaupload for storing perfectly legal content. It's now offline, and there appears to be no way for them to retrieve that data. At what percentage is that reasonable? If 99% of your users are infringing? 50%? 1%? Could this be used to take down your competitors? Buy some Amazon instances and put a bunch of infringing content on them, and then watch the feds seize all of Amazon's servers? Lots of troubling questions, no good answers. -- Leo Bicknell - bicknell@ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/

On Fri, Jan 20, 2012 at 3:02 PM, Leo Bicknell <bicknell@ufp.org> wrote:

In a message written on Fri, Jan 20, 2012 at 09:37:16AM -1000, Paul Graydon wrote:

...

From what I understand about MegaUpload's approach, they created a hash of every file that they stored.  If they'd already got a copy of the file that was to be uploaded they'd just put an appropriate link in a users space, saving them storage space, and bandwidth for both parties. Fairly straight forward.  Whenever they received a DMCA take-down they would remove the link, not the underlying file, so even though they knew that a file was illegally hosted, they never actually removed it.  That comes up for some argument about the ways the company should be practically enforcing a DMCA take-down notice, whether each take-down should apply to just an individual user's link to a file or whether the file itself should be removed.  That could be different from circumstance to circumstance.

Note that with A DMCA take down the original uploader can issue a counter-notice to get the content put back.  Most sites don't immediately delete the content but rather disable it in some way so that should the file be counter noticed it can be put back up.

Also, when using a hashed file store, it's possible that some uses are infringing and some are not.  I might make a movie, put it on Megaupload, and then give the links only to the 5 people who bought it from them.  One of them might turn around, upload it again to Megaupload, and share it with the world, infringing on my content. I would hope that when I issue a takedown notice they take down the infringers copy (link), but leave mine in place.

None of this should be taken to mean I'm behind Megaupload.  I have

My take only, of course

a greater concern here wondering if law enforcement,

maybe

the courts,

probably not

and most importantly the law makers

You've got to be kidding.

understand the technolgy and can craft and apply laws in a reasonable way.

"A new scientific truth does not triumph by convincing its opponents and making them see the light, but rather because its opponents eventually die, and a new generation grows up that is familiar with it." -- Max Planck, We're in for an interesting few years.

 One major issue that already came up is that a whole lot of people used Megaupload for storing perfectly legal content.  It's now offline, and there appears to be no way for them to retrieve that data.  At what percentage is that reasonable?  If 99% of your users are infringing?  50%?  1%?  Could this be used to take down your competitors?  Buy some Amazon instances and put a bunch of infringing content on them, and then watch the feds seize all of Amazon's servers?

Maybe. It would help if you had a budget to lobby Congress sufficiently. Regards Marshall

Lots of troubling questions, no good answers.

--       Leo Bicknell - bicknell@ufp.org - CCIE 3440        PGP keys at http://www.ufp.org/~bicknell/

On Fri, 20 Jan 2012 14:37:16 -0500, Paul Graydon <paul@paulgraydon.co.uk> wrote:

... Whenever they received a DMCA take-down they would remove the link, not the underlying file, so even though they knew that a file was illegally hosted, they never actually removed it.

And that's where their safe harbour evaporated. Upon receiving notice a file is infinging, they know that *file* is illegal, and must now remove all the links to it, not just the one that was reported. Mega is in a possition to know all the links, where as the copyright holder is not. They thought they had a gaping loophole. Well, the DOJ is about to teach them how wrong they are.

Technical nuances notwithsatnding, isn't the guts of the case that the megaupload team wilfully engaged in harbouring infringing files as evidenced by the email snooping, eg boasting to each other about having feature movies available prior to release etc. Similar evidence brought grokster down, and was confirmed by the US Supreme Court. j -- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast WWWhatsup NYC - http://wwwhatsup.com http://pinstand.com - http://punkcast.com VP (Admin) - ISOC-NY - http://isoc-ny.org -------------------------------------------------------------- -

On Fri, Jan 20, 2012 at 03:06:04PM -0500, Ricky Beam wrote:

Upon receiving notice a file is infinging, they know that *file* is illegal, and must now remove all the links to it, not just the one that was reported.

But what -- *exactly* -- is an "illegal file"? As Leo Bicknell astutely pointed out in this thread: "Also, when using a hashed file store, it's possible that some uses are infringing and some are not." His example goes on to explain how this is so. (And I'll point out that his example applies, for example, to Amazon. There are coprighted files there -- e.g., books, music -- which may be used legally by those who have purchased them. Do they become infringing if someone finds a way to access them without authorization/payment because Amazon's programmers made an error and left a backdoor open that allow them to be retrieved via static links? No, they don't. Should Amazon delete them in this instance? No. Amazon should fix the backdoors, i.e., remove the spurious links.) Suppose that Joe and Jane are photographers. Joe has produced image X (to which he holds copyright) and Jane has produced image Y (similarly). Digital images X and Y are used as inputs to program P which produces output Z that is visually unrecognizable -- that is, anyone who looks at it sees what appears to be random noise. Does Z infringe on Joe or Jane's copyrights? How? Why? How does this change (or does it change) if program P' which can reverse the actions of P exists? Let me give another example, this time using content that is intrinsically illegal -- and to avoid triggering hot-button responses, I'm going to posit a hypothetical: marshmallow peep dioramas. Let's suppose that these are illegal in every country on the planet, that those responsible for them are universally reviled, that it's a crime to photograph them, possess photographs of them, etc. We thus conclude that a file consisting of a picture of one of these is always illegal: that is, it's illegal no matter where it's found. Now what happens if that picture is decomposed into individual files, each consisting of one row of pixels from the original? None of those files contain anything recognizable as a marshmallow peep diorama. The original cannot be reconstructed from any one of them. Is any one of them illegal? Further: reassembling these will require something: an index, an algorithm, some construct that allows the individual files to be recombined. (This construct contains no content of any kind, marshmallow peep or otherwise. It's merely a recipe for putting together files.) Is that construct illegal? If those individual files are spread across a multitude of hosts, are any of those hosts holding an illegal file? How would they know? (If you're going to argue that those individual rows of pixels are illegal because the original is illegal, then replace the above with "individual pixels". I trust nobody will argue that a single pixel is illegal. Ever.) One more scenario: a photo of a marshmalllow peep diorama is encrypted and uploaded onto server A. Does server A hold an illegal file? How would the operators of server A know? How would anyone (other than the uploader) know? Now suppose that the uploader, the only person on the planet with the decryption key for that file, dies; therefore, the file is reduced to -- for all practical purposes -- a random collection of bits. Is that file still illegal? Why? How? Who will be able to determine this? (Schrodinger's cat paradox in 1...2...) I posit these thought experiments (and I'll stop here, although many others suggest themselves) to highlight some serious problems with terminology, and with the law: it's an attempt to apply the principles of the physical world to the digital one, and it's a total failure. The putative sharp dividing line between "legal file" and "illegal file" doesn't really exist -- although many people would like it to exist, hope it exists, etc., because it serves their agendas or would make things easier for them. That doesn't make it so. Sometimes the world changes, and sometimes when it does, it's time to discard outdated philosophy that no longer applies to current reality -- because stubborn attempts to hang onto it at all costs, especially by warping it into something completely unrecognizable from the original framework, really DO cost, often dearly. (It's 2012, and there are still inferior people living on this planet who assign more credibility to astrology and ghosts than to evolution or anthropocentric global warming. This isn't funny or quaint any more. It's stupid and dangerous.) Schneier famously said "Trying to make bits uncopyable is like trying to make water not wet". What we are witnessing is precisely an attempt to do that, via a combination of anti-security technology (e.g., DRM) and purchased legislation, orchestrated by failing, legacy companies run by insatiably greedy people. These people simply don't care how much damage they do, how many lives they destroy, how much they hold back civilization, how much they twist the law, -- as long as they get paid. They are *exactly* like one of their own famous characters: "It can't be bargained with. It can't be reasoned with. It doesn't feel pity, or remorse, or fear. And it absolutely will not stop, ever, until you are dead." See, for example: http://www.techdirt.com/articles/20120120/16442117496/clay-shirky-why-sopas-... which points to an excellent exposition by Clay Shirky on this very point. So: {Internet, Hollywood}: choose one. ---rsk

...

that was reported.

But what -- *exactly* -- is an "illegal file"?

As Leo Bicknell astutely pointed out in this thread:

"Also, when using a hashed file store, it's possible that some uses are infringing and some are not."

The problem is going to be the thousands of people who have now lost their legitimate files, research data, personal recordings, etc. that they were using Megaupload to share. http://torrentfreak.com/feds-please-return-my-personal-files-megaupload-1201...

Not that I would not be a bit miffed if personal files disappeared, but that's one of the risks associated with using a cloud service for file storage. It could have been a fire, a virus erasing file, bankruptcy, malicious insider damage... Doesn't matter, you lost access to legit content in the crossfire.

There is always a risk of losing access to cloud resources. And for years, we always joked in my computer buddy circles, computers know when you don't have a backup.

It's your fault(not theirs) if that was your only copy.

Lyle Giese LCR Computer Services, Inc.

Entire governments in the US are using "cloud storage" for their documentation these days. It is my understanding (which is hearsay) that Google has an entire service aimed at small governments (county and municipal mostly) in Google Docs for just this purpose and I know of at least one city on California that is using Google for their document repository and their city email. In case of an emergency where Google is unreachable, they are in a world of hurt and won't even be able to send email from one department to another in city hall because all their mail and documents are now "in the cloud" which would then be inaccessible to them rather than on a server in their local data center. So ... and Earthquake in Santa Clara county might take out city governments in Monterey or Santa Cruz counties which might otherwise be perfectly able to conduct their business. Point is, MANY people are using "the cloud" as their primary storage because it is marketed as being safe and secure (backed up and with better access security than they could manage themselves).

Sure, but balance that with podunk.usa's possibly incompetent IT staff? It costs a lot of money to run a state of the art shop, but only incrementally more as you add more and more instances of essentially identical shops. I guess I have more trust that Google is going to get the redundancy, etc right than your average IT operation.

Now whether you should *trust* Google with all of that information from a security standpoint is another kettle of fish.

Mike

I agree, Mike. Problem is that the communications infrastructure that enables these sorts of options is generally so reliable people don't think about what will happen if something happens between them and their data that takes out their access to those services. Imagine a situation where several municipal governments in, say, Santa Cruz County, California are using such services and there is a repeat of the Loma Prieta quake. Their data survives in Santa Clara county, their city offices survive but there is considerable damage to infrastructure and structures in their jurisdiction. But the communications is cut off between them and their data and time to repair is unknown. The city is now without email service. Employees in one department can't communicate with other departments. Access to their files is gone. They can't get the maps that show where those gas lines are. The local file server that had all that information was retired after the documents were transferred to "the cloud" and the same happened to the local mail server. At this point they are "flying blind" or relying on people's memories or maybe a scattering of documents people had printed out or saved local copies of. It's going to be a mess. The point is that "the cloud" seems like a great option but it relies on being able to reach that "cloud". Your data may be safe and sound and your office may have survived without much wear, but if something happens in between, you might be sunk. And out in "Podunk", there aren't often multiple paths. You are stuck with what you get. Or your cloud provider might announce they are going out of that business next week.

On 21/01/12 12:19 PM, George Bonser wrote:

Imagine a situation where several municipal governments in, say, Santa Cruz County, California are using such services and there is a repeat of the Loma Prieta quake. Their data survives in Santa Clara county, their city offices survive but there is considerable damage to infrastructure and structures in their jurisdiction. But the communications is cut off between them and their data and time to repair is unknown. The city is now without email service. Employees in one department can't communicate with other departments. Access to their files is gone. They can't get the maps that show where those gas lines are. The local file server that had all that information was retired after the documents were transferred to "the cloud" and the same happened to the local mail server. At this point they are "flying blind" or relying on people's memories or maybe a scattering of documents people had printed out or saved local copies of. It's going to be a mess.

This is what disaster simulations are for, to suss out these problems before a disaster and put in systems to avoid the mess. In the real world, while a city might keep the digital documents "in the cloud" they would also (always) have paper copies, because in a big emergency their computers (local mail/file servers or internet access to the cloud) are likely to be unavailable, power or internet access is likely to be disrupted. In a true emergency such as Loma Prieta, they are going to reach for the paper maps that were printed and saved for just this eventuality, and part of the emergency preparedness is to have a regular process to print and save updated maps (every year or 6 months or month or whenever there's a major change - each department will undoubtedly have their own metrics depending on how critical their maps are). If you haven't participated in your city/county CERT training and disaster simulation exercises, I highly suggest you get involved. CERT is a great program and will really help open your eyes to many types of emergency planning you probably haven't thought about. Plus, the more involved you are with CERT the more you are "known" to your local disaster management teams, and the better access you will have to them in the event of a major disaster. jc

On 21/01/12 11:20 PM, George Bonser wrote:

...

This is what disaster simulations are for, to suss out these problems before a disaster and put in systems to avoid the mess.

In the real world, while a city might keep the digital documents "in the cloud" they would also (always) have paper copies, because in a big emergency their computers (local mail/file servers or internet access to the cloud) are likely to be unavailable, power or internet access is likely to be disrupted. Nope, no paper copies.

I personally know Lynn Brown, OES (Office of Emergency Services) Coordinator for the City of Mountain View, CA[1]. I asked Lynn about the status of the maps the MV EOC (Emergency Operations Center) uses. Here is the reply:

While we rely on electronic and digital information a lot more these days, the City of Mountain View still has printed maps on hand. I just updated the master map in our EOC, in fact.

The computerized maps are great but we also plan for the worst case scenario with no access to them.

I don't think paper will ever go away completely.

Lynn Brown OES Coordinator Mountain View Fire Department 650-903-6825 lynn(dot)brown(at)mountainview(dot)gov

If you believe that this is not the norm for EOCs across the country, I suggest you personally ask the OES Coordinator for whatever city you think is putting everything in the computer and no longer keeping any paper copies. You may be surprised to learn how well they have indeed thought this thru, and that they do maintain paper maps in the EOC, just as Mountain View does. jc [1] Given that Google has wired MV with free public WiFi, if there were ever a city that would be in a good position to use and rely on Google's cloud services for data storage, Mountain View would be it.

Well I have a question which is off the top of megaupload.com But it's regarding governments around the world using cloud services. Do we have others Canadians on this list who can confirm, what branches of the Canada Government are actively using public cloud services like google cloud services. or are in the process are currently setting it up. -----Original Message----- From: Matthew Kaufman Sent: Sunday, January 22, 2012 12:49 AM To: George Bonser Cc: nanog@nanog.org Subject: Re: Megaupload.com seized On 1/21/2012 12:19 PM, George Bonser wrote:

I agree, Mike. Problem is that the communications infrastructure that enables these sorts of options is generally so reliable people don't think about what will happen if something happens between them and their data that takes out their access to those services. Imagine a situation where several municipal governments in, say, Santa Cruz County, California are using such services and there is a repeat of the Loma Prieta quake. Their data survives in Santa Clara county, their city offices survive but there is considerable damage to infrastructure and structures in their jurisdiction. But the communications is cut off between them and their data and time to repair is unknown. The city is now without email service....

But fortunately the data is also replicated in another data center nowhere near the quake, so once they pull out the mobile emergency operations center and aim the VSAT dish, they're back online with everything as it was moments before the quake hit... far superior to what formerly happened when the power or phone lines were down at their own facility, never mind what would have happened if their own facility with its infrequent backups to unreliable tape were destroyed. Matthew Kaufman

On 01/21/2012 12:19 PM, George Bonser wrote:

...

Sure, but balance that with podunk.usa's possibly incompetent IT staff? It costs a lot of money to run a state of the art shop, but only incrementally more as you add more and more instances of essentially identical shops. I guess I have more trust that Google is going to get the redundancy, etc right than your average IT operation.

Now whether you should *trust* Google with all of that information from a security standpoint is another kettle of fish.

Mike I agree, Mike. Problem is that the communications infrastructure that enables these sorts of options is generally so reliable people don't think about what will happen if something happens between them and their data that takes out their access to those services. Imagine a situation where several municipal governments in, say, Santa Cruz County, California are using such services and there is a repeat of the Loma Prieta quake. Their data survives in Santa Clara county, their city offices survive but there is considerable damage to infrastructure and structures in their jurisdiction. But the communications is cut off between them and their data and time to repair is unknown. The city is now without email service. Employees in one department can't communicate with other departments. Access to their files is gone. They can't get the maps that show where those gas lines are. The local file server that had all that information was retired after the documents were transferred to "the cloud" and the same happened to the local mail server. At this point they are "flying blind" or relying on people's memories or maybe a scattering of documents people had printed out or saved local copies of. It's going to be a mess.

The point is that "the cloud" seems like a great option but it relies on being able to reach that "cloud". Your data may be safe and sound and your office may have survived without much wear, but if something happens in between, you might be sunk. And out in "Podunk", there aren't often multiple paths. You are stuck with what you get.

Or your cloud provider might announce they are going out of that business next week.

The problem is that the local infrastructure might just as easily get taken out too. Here in SF, I'm sure that the entirety of the data center capabilities aren't, say, housed in city hall itself, so we're just as vulnerable to partition whether they run their own infrastructure as we would be if we hosted in the "cloud" too. The larger issue here is diversity and resilience. The internet is guaranteed to fail us at the worst possible time, full stop. We need to make certain that we keep at least _some_ terribly inefficient and thoroughly antiquated means of doing the same thing viable for critical tasks. When I was at Cisco, there was a push to getting emergency responders to coordinate their communication infrastructure both for cross coordination as well as of course cost down. Makes perfect sense... so long as the unthinkable doesn't happen (ie the internet failing us). That's why our new IP monoculture sort of gives me the creeps. Mike

On 01/21/2012 03:28 PM, Joel jaeggli wrote:

...

Entire governments in the US are using "cloud storage" for their documentation these days. It is my understanding (which is hearsay) that Google has an entire service aimed at small governments (county and municipal mostly) in Google Docs for just this purpose and I know of at least one city on California that is using Google for their document repository and their city email. In case of an emergency where Google is unreachable, they are in a world of hurt and won't even be able to send email from one department to another in city hall because all their mail and documents are now "in the cloud" which would then be inaccessible to them rather than on a server in their local data center. So ... and Earthquake in Santa Clara county might take out city governments in Monterey or Santa Cruz counties which might otherwise be perfectly able to conduct their business.

Point is, MANY people are using "the cloud" as their primary storage because it is marketed as being safe and secure (backed up and with better access security than they could manage themselves). It may also be the case that your cloud service may be uncoupled from

On 1/21/12 11:38 , George Bonser wrote: the fate of your geography which may will allow it to survive a regional failure that might otherwise render you inoperable.

All eggs in one basket is to my mind a bigger problem than who's basket they're in.

If your network is wiped out it may not matter where the data is from an availability perspective unless alternatives are in place.

I think that the larger issue here is resilience. If you're completely dependent on IP, then when IP fails you're hosed. We have a situation where that is becoming more and more true, however. When the last vestiges of TDM are rooted out of the telephony network, we will be less resilient than before. When paper record trails are replaced by the cloud, we are less resilient. It's sort of scarey in some ways how much of an information monoculture we're building: it's a huge strength and a glaring vulnerability. Mike

On Jan 21, 2012, at 8:00 PM, Jay Ashworth wrote:

----- Original Message -----

...

From: "Lyle Giese" <lyle@lcrcomputer.net>

...

Not that I would not be a bit miffed if personal files disappeared, but that's one of the risks associated with using a cloud service for file storage. It could have been a fire, a virus erasing file, bankruptcy, malicious insider damage... Doesn't matter, you lost access to legit content in the crossfire.

I'm not sure this is actually true. The Law generally recognizes 'accident' as a means for relieving people of responsibility for criminal acts -- it can't *be* a criminal act without scienter on the part of the doer.

Actually, that's often not true in recent laws. There was an article in the Wall Street Journal a month or so ago that gave some glaring examples of not just laws but actual convictions.

In this case, the doer was negligent, rather than purposefully malicious, but we have solutions for that as well.

I'm not sure what you mean by "doer" here. http://opinion.latimes.com/opinionla/2012/01/copyrights-feds-push-novel-theo... has an interesting analysis. It presents a number of factual statements that are capable of multiple interpretations. This in turn means that much of the case is likely to turn on scienter, which in turn means heavy reliance on the seized emails. This will be an interesting case to watch. --Steve Bellovin, https://www.cs.columbia.edu/~smb

I just made the brain melting mistake of trying to read the DMCA. The text which jumps out at me is: `(2) EXCEPTION- Paragraph (1) shall not apply with respect to material residing at the direction of a subscriber of the service provider on a system or network controlled or operated by or for the service provider that is removed, or to which access is disabled by the service provider, pursuant to a notice provided under subsection (c)(1)(C), unless the service provider-- `(A) takes reasonable steps promptly to notify the subscriber that it has removed or disabled access to the material; `(B) upon receipt of a counter notification described in paragraph (3), promptly provides the person who provided the notification under subsection (c)(1)(C) with a copy of the counter notification, and informs that person that it will replace the removed material or cease disabling access to it in 10 business days; and `(C) replaces the removed material and ceases disabling access to it not less than 10, nor more than 14, business days following receipt of the counter notice, unless its designated agent first receives notice from the person who submitted the notification under subsection (c)(1)(C) that such person has filed an action seeking a court order to restrain the subscriber from engaging in infringing activity relating to the material on the service provider's system or network. I'm about 90% sure that in a fair court, it would be concluded that disabling the reported URL qualifies as disabling access to the material. The court might then issue an injunction to, in the future, disable *all* *possible* access to the material, but that's not the current text of the law. YMMV Nick B On Sun, Jan 22, 2012 at 11:58 AM, Roland Perry < lists@internetpolicyagency.com> wrote:

In article <596B74B410EE6B4CA8A30C3AF1A15**5EA09C8CDBA@RWC-MBX1.corp.** seven.com<596B74B410EE6B4CA8A30C3AF1A155EA09C8CDBA@RWC-MBX1.corp.seven.com>>, George Bonser <gbonser@seven.com> writes

The problem is going to be the thousands of people who have now lost

...

their legitimate files, research data, personal recordings, etc. that they were using Megaupload to share.

But that's an operational risk of using any commercial entity as a filestore. Thousands of people lost[1] a lot of work when fotopic.netcollapsed: http://en.wikipedia.org/wiki/**Fotopic.net<http://en.wikipedia.org/wiki/Fotopic.net>

[1] As it's getting on for a year since an apparent rescue attempt, and nothing has emerged, this seems a reasonable assumption. -- Roland Perry

Nick B <nick@pelagiris.org> wrote:

I'm about 90% sure that in a fair court, it would be concluded that disabling the reported URL qualifies as disabling access to the material. The court might then issue an injunction to, in the future, disable *all* *possible* access to the material, but that's not the current text of the law. YMMV

The crux of the issue is whether a single DMCA take down notice refers only to the content itemized in the notice, or to _all_ content that matches the identification in the notice. It is a *significant* difference, because the former requires the _complainant_ to identify all the 'infringing' items, while the latter requires the notice _recipient_ to search out all other content that matches the notice. Obviously, each side would rather have the other guy do all the work.`

On Jan 21, 2012, at 6:11 AM, Rich Kulawiec wrote:

On Fri, Jan 20, 2012 at 03:06:04PM -0500, Ricky Beam wrote:

...

Upon receiving notice a file is infinging, they know that *file* is illegal, and must now remove all the links to it, not just the one that was reported.

But what -- *exactly* -- is an "illegal file"?

As Leo Bicknell astutely pointed out in this thread:

"Also, when using a hashed file store, it's possible that some uses are infringing and some are not."

This is a personal anecdote, and I'm not really trying to take sides in this. But I think what Megaupload's problem was that when they were told that a specific file was not authorized to be distributed at all, they claimed they couldn't stop their users from reuploading it, could only prevent distribution of the file if you were somehow able to give them a list of all their URLs that held identical copies, etc. We had a client that had some data stolen - a laptop was physically stolen, and data from it uploaded to Megaupload. She jumped through the DMCA hoops to get them to take it down, they took more than 72 hours to finally remove it, and less than an hour later the same data was uploaded again. Another 72 hour wait to get them to remove it, rinse, repeat. We finally contacted someone there directly on our client's behalf, who insisted they had no ability to block specific files/hashes/etc -OR- locate additional identical copies on their system. If they didn't have this ability, it was because they were specifically trying not to, since they admitted elsewhere they hash everything that comes in to save space/time on their side, and writing something to block based on a hash they were already making would fall under pretty trivial work. Which may have been the MPAA/RIAA/etc's issue with them as opposed to Dropbox/etc. With Megaupload it was like playing whack-a-mole trying to get something removed, they kept trying to say with a straight face they couldn't stop it from happening, and actually paid uploaders of popular files to keep doing it. I'm not defending the practices of the copyright nazis, but Megaupload was frustratingly difficult to deal with in what should have been a very simple "The owner/creator of this file has not authorized it to be distributed anywhere, don't allow it on your service again" request.

Incidentally, some traffic stats on http://gigaom.com/2012/01/20/follow-the-traffic-what-megauploads-downfall-di... MegaUpload was indeed one of the more popular sites on the web for storing

and sharing content. It ranked as .98 percent of the total web traffic in the U.S. and 11.39 of the total web traffic in Brazil. It garnered 1.95 percent of the traffic in Asia-Pac and a less substantial .86 percent in Europe.

-- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast WWWhatsup NYC - http://wwwhatsup.com http://pinstand.com - http://punkcast.com VP (Admin) - ISOC-NY - http://isoc-ny.org -------------------------------------------------------------- -

On Mon, 23 Jan 2012 13:28:49 GMT, Don Bowman said:

Given that filesonic cut off sharing, but still allows users to fetch links they themself posted, one could make the assumption from the below that there was negligible traffic due to people re-fetching their own content.

Note that the filesonic cutoff appears to have happened around 18:00 last night in whatever timezone the graph was made. There's a good chance that most of the customers don't *know* yet about the cutoff - what happens tonight once the news has spread will be indicative.