Tomorrow afternoon, legislators from the House Committee on Oversight and Government Reform will be holding a hearing on the topic of "Public Access to Federally-Funded Research." The hearing will be a perfect opportunity for key representatives to look into supporting public access policies — various requirements that scientific research funded by the federal government be made available on the Internet to the tax-paying public. EFF wrote about the benefits of public access policies earlier this year when the Office of Science and Technology Policy asked for input.

Tomorrow, members of the committee will no doubt hear about the excellent Federal Research Public Access Act, (FRPAA) a bill that would require a great deal of research funded by government agencies to be made publicly available through a digital database no later than six months after publication. The law is modeled after the National Institute of Health's Public Access policy, which on its own has granted millions of people access to critical, up-to-date medical research since it was implemented in 2008.

Public access policies essentially "close the loop" on tail end of the cycle of research funded by the government. Now, the public pays for scientific research through taxes, but in most cases, that same taxpayer-funded innovation and discovery gets locked up in journals, accessible only through expensive per-article fees or massively expensive institutional licenses. With the FRPAA, academic journals still get a critical window of time to be the first to publish important findings, but shortly thereafter, the public gets unprecedented access to the knowledge that they paid for.

You can catch the webcast of the hearing tomorrow at 2pm EDT (11am PDT) or attend the hearing in person if you're in Washington, D.C. Stay tuned to EFF for future updates on how to support the Federal Research Public Access Act and other public access efforts!

Copyright owners, take note: If you're going to use the streamlined Digital Millennium Copyright Act ("DMCA") process to require a service provider to remove allegedly infringing content, you'd better make sure you actually comply with the DMCA notice requirements. Otherwise a court may find, as occurred this week in Perfect 10 v. Google, that your "notice" didn't actually put anyone on "notice."

A quick recap: In 2004, porn company and frequent litigator Perfect 10 sued Google for direct and secondary copyright infringement. Perfect 10 claimed that Google violated its copyrights by linking to websites that hosted infringing material, caching websites that hosted infringing photos of nude models, and hosting infringing images uploaded by Blogger users. In 2007, the Ninth Circuit Court of Appeals reversed a preliminary injunction in favor of Perfect 10 on its direct infringement claims, and sent the case back to the district court for a determination of some of the secondary infringement claims. Google moved for summary judgment, asserting that it was protected from secondary liability by the DMCA safe harbors.

This week, Judge Howard Matz of the U.S. District Court in Los Angeles mostly agreed with Google, whittling Perfect 10's remaining case down to a small subset of allegedly infringing images. Why? Mainly because Perfect 10 didn't trouble itself to provide Google with the information Google needed to figure out what to take down in a form that Google could readily use.

The DMCA requires a proper takedown notice to identify the work claimed to be infringed, identify the reference (or link) to material claimed to be infringing, and provide enough information to permit the service provider to locate that reference or link. Even though providing this information should be pretty easy, Perfect 10 fell far short.

For example, many of its "notices" consisted of a cover letter, a spreadsheet with URLs (many of which linked only to a top-level URL for a website, as opposed to a specific infringing URL) and a hard drive or DVD containing Perfect 10's electronic files of its photos. Not good enough, said the court — the information required by the DMCA must be contained in a single written communication; forcing a service provider to cobble together adequate notice from a variety of sources is just too burdensome.

P10 evidently expected Google to comb through hundreds of nested electronic folders containing over 70,000 distinct files, including raw image files such as JPEG files and screen shots of Google search results, in order to find which link was allegedly infringing. [] In many cases, the file containing the allegedly infringing image does not even include a URL, or the URL was truncated. [] The spreadsheets also do not identify the copyrighted work that was allegedly infringed. . . . P10 then expected Google to search through a separate electronic folder—attached only to the June 28, 2007 DMCA notice—containing all of the more than 15,000 images that appeared on P10's website as of June 2007, in order to identify the copyrighted work that was infringed.

The court did find that a small subset of notices complied with the DMCA; for those few notices, Google must now show that it responded to those notices "expeditiously" under the circumstances.

The ruling is not unprecedented: numerous courts, including the Ninth Circuit have found that ISPs don't have to respond to deficient DMCA notices. But the issue of how much information about infringement providers need to have (and fail to act on) before they lose the protection of the safe harbors is being hotly contested in two other proceedings. Content owners are insisting that if ISPs have general knowledge of infringement on their services, they must take over the burden of stamping it out. We might think of Judge Matz's decision as one more vote in favor of keeping the burden of identifying copyright infringement where it has traditionally belonged — on the content owners themselves.

LIGATT Security, a controversial Georgia-based computer security firm, is embroiled in an ongoing flame war with its online detractors, who question the firm's legitimacy and stock prospects. Earlier this month, LIGATT upped the ante by filing suit in a Georgia court, threatening about 25 anonymous commenters on Yahoo! Message Boards and demanding a $5 million judgment and a court order prohibiting criticism. LIGATT CEO warned that he hoped the lawsuit would "set a trend" for other OTC companies facing online critics.

We hope not. EFF is frequently called upon to help protect the rights of anonymous speakers in similar suits, and the world does not need more facially deficient lawsuits targeting online critics. As we explain below, this complaint is a prime example of a case that should be dismissed. And, if LIGATT attempts to use this complaint to subpoena Yahoo! for the identities of its critics, the subpoenas might not only fail, but LIGATT may be forced to pay its critics' attorneys' fees.

It is not surprising that LIGATT has attracted controversy and commentary. The publicly traded company is headed by Gregory Evans, a self-described "media personality" who calls himself the "World's #1 Hacker." Evans' books include "Memoirs of a Hi-Tech Hustler," an account of the exploits that landed him in federal prison, and "How to Become the World's No. 1 Hacker," an allegedly plagiarized introduction to computer security. LIGATT has published provocative online videos advertising its services. And this is not the first time LIGATT has been criticized over its litigation.

The important legal question at this point, however, is not whether LIGATT's critics are right or wrong, but whether the complaint sets forth a valid claim. It does not. LIGATT and Evans' complaint asserts three primary claims: defamation, commercial disparagement, and "tortuous interference with contractual relations," which is a way of accusing the defendants of hurting its business relationships. The company also seeks an injunction against the defendants from posting any further defamatory comments against LIGATT Security, its subsidiary SPOOFEM.COM, or its CEO Evans, and demands $5 million dollars in damages. The alleged damages are double the most recent "Estimated Market Cap" for the whole company listed on its investor relations page.

Curiously, while LIGATT's press release announcing the lawsuit and the accompanying video claim the suit was filed against "stock bashers," the complaint never once references the company's stock or alleges stock manipulation. While federal and state law prohibit certain forms of stock manipulation, criticizing a publicly traded company and its CEO is not a valid legal cause of action in and of itself.

In its complaint, LIGATT claims the defendants posted "false and defamatory statements" on the Yahoo Technology message board and a few other websites. But the purported defamatory statements are never identified in the complaint, much less set forth. There is no attempt to tie each of the defendants to particular statements. Under long-standing Georgia law, failure to clearly identify defamatory statements in a complaint is grounds for dismissing a defamation claim (with leave to amend). The allegation in this complaint is insufficient because it is just a bald conclusion that the unidentified statements are "false and untrue and defamed Plaintiffs." Under Georgia law, libel complaints are subject to a strict standard, and "allegations ... characterizing the publication as libelous and libelous per se are mere conclusions not supported by the pleaded facts" that must be dismissed.

Similarly, if the defendants were to move this case to a federal court (which may be possible if the defendants are not from Georgia), allegations of specific statements would be required and the complaint would be dismissed under the federal pleading standard that requires more than "conclusory allegations" and "legal conclusions masquerading as facts" (recently explained in two Supreme Court decisions, commonly known as Iqbal and Twombly).

LIGATT's "commercial disparagement" claim is simply a variation of the original defamation claim, and hangs on the same unidentified "false and defamatory statements" thread. The court should dismiss the claim for the same reasons. Moreover, even if the actual statements were pled, a federal court in Georgia recently noted that Georgia law does not support this type of claim, and a Georgia Supreme Court opinion both refused to recognize the similar tort of injurious falsehood and held that plaintiffs could not recover twice under two theories.

The complaint?s final substantive claim, accusing the defendants of interfering with LIGATT's business contracts, would also fail because LIGATT must identify wrongful conduct and provide facts, not legal conclusions, to support the cause of action. The complaint, however, does not identify any wrongful conduct on the part of the defendants beyond the deficient defamation claim. This claim should fall with the rest of the house of cards.

California?s anti-SLAPP law is another hurdle for LIGATT. Most of the defendants are anonymous Does, who have exercised their constitutional right to speak pseudonymously online. To the extent that LIGATT wants to issue subpoenas to Yahoo!, located in California, to uncover the identities of the posters on the message board, LIGATT would be wise to realize that California law mandates attorneys' fees for anyone who prevails in quashing or modifying such a subpoena, if the underlying action involves the person's online free speech rights and the plaintiff does not make a prima facie showing of the cause of action.

When courts, both in California and throughout the country, consider whether to allow a subpoena to unmask an anonymous speaker, they use a First Amendment test that requires the plaintiffs to show they have a real case. As explained above, the complaint fails to allege sufficient facts to do so. Moreover, since the plaintiffs would likely be considered public figures for purposes of this lawsuit, LIGATT would have to show a prima facie case for actual malice--a significant and difficult hurdle to overcome.

Through this lawsuit and its press release, LIGATT is affirmatively seeking to encourage and extend a disturbing trend of using the legal system as a weapon to intimidate online critics. Often, these deficient lawsuits are used to unmask online critics, even when those critics are engaged in constitutionally protected speech. LIGATT's complaint is rife with conclusory allegations and exemplifies the deficiencies with most of these lawsuits. LIGATT should voluntarily dismiss this lawsuit, and not refile unless and until it can state a valid claim that a critic has actually violated the law, quoting specifically the allegedly defamatory speech and alleging facts that show how the quoted speech is false, defamatory and was made with actual malice.

San Francisco - The Electronic Frontier Foundation (EFF) won three critical exemptions to the Digital Millennium Copyright Act (DMCA) anticircumvention provisions today, carving out new legal protections for consumers who modify their cell phones and artists who remix videos — people who, until now, could have been sued for their non-infringing or fair use activities.

"By granting all of EFF's applications, the Copyright Office and Librarian of Congress have taken three important steps today to mitigate some of the harms caused by the DMCA," said Jennifer Granick, EFF's Civil Liberties Director. "We are thrilled to have helped free jailbreakers, unlockers and vidders from this law's overbroad reach."

The exemptions were granted as part of a statutorily prescribed rulemaking process, conducted every three years to mitigate the danger the DMCA poses to legitimate, non-infringing uses of copyrighted materials. The DMCA prohibits "circumventing" digital rights management (DRM) and "other technical protection measures" used to control access to copyrighted works. While the DMCA still chills competition, free speech, and fair use, today's exemptions take unprecedented new strides towards protecting more consumers and artists from its extensive reach.

The first of EFF's three successful requests clarifies the legality of cell phone "jailbreaking" — software modifications that liberate iPhones and other handsets to run applications from sources other than those approved by the phone maker. More than a million iPhone owners are said to have "jailbroken" their handsets in order to change wireless providers or use applications obtained from sources other than Apple's own iTunes "App Store," and many more have expressed a desire to do so. But the threat of DMCA liability had previously endangered these customers and alternate applications stores.

In its reasoning in favor of EFF's jailbreaking exemption, the Copyright Office rejected Apple's claim that copyright law prevents people from installing unapproved programs on iPhones: "When one jailbreaks a smartphone in order to make the operating system on that phone interoperable with an independently created application that has not been approved by the maker of the smartphone or the maker of its operating system, the modifications that are made purely for the purpose of such interoperability are fair uses."

"Copyright law has long held that making programs interoperable is fair use," confirmed Corynne McSherry, EFF's Senior Staff Attorney. "It's gratifying that the Copyright Office acknowledges this right and agrees that the anticircumvention laws should not interfere with interoperability."

EFF also won a groundbreaking new protection for video remix artists currently thriving on Internet sites like YouTube. The new rule holds that amateur creators do not violate the DMCA when they use short excerpts from DVDs in order to create new, noncommercial works for purposes of criticism or comment if they believe that circumvention is necessary to fulfill that purpose. Hollywood has historically taken the view that "ripping" DVDs is always a violation of the DMCA, no matter the purpose.

"Noncommercial videos are a powerful art form online, and many use short clips from popular movies. Finally the creative people that make those videos won't have to worry that they are breaking the law in the process, even though their works are clearly fair uses. That benefits everyone — from the artists themselves to those of us who enjoy watching the amazing works they create," added McSherry.

On EFF's request, the Librarian of Congress renewed a 2006 rule exempting cell phone unlocking so handsets can be used with other telecommunications carriers. Cell phone unlockers have been successfully sued under the DMCA, even though there is no copyright infringement involved in the unlocking. Digital locks on cell phones make it harder to resell, reuse, or recycle the handset, prompting EFF to ask for renewal of this rule on behalf of our clients, The Wireless Alliance, ReCellular and Flipswap. However, the 2009 rule has been modified so that it only applies to used mobile phones, not new ones.

"The Copyright Office recognizes that the primary purpose of the locks on cell phones is to bind customers to their existing networks, rather than to protect copyrights," said Granick. "The Copyright Office agrees with EFF that the DMCA shouldn't be used as a barrier to prevent people who purchase phones from keeping those phones when they change carriers. The DMCA also shouldn't be used to interfere with recyclers who want to extend the useful life of a handset."

Along with the exemptions that EFF championed, several other DMCA exemptions were expanded, granted or narrowed including one for documentary filmmakers and college-level educators, as well as some for security researchers.

For the full rulemaking order:
https://www.eff.org/files/filenode/dmca_2009/RM-2008-8.pdf

For more on the DMCA rulemaking:
http://www.eff.org/issues/dmca-rulemaking

Contacts:

Jennifer Stisa Granick
Civil Liberties Director
Electronic Frontier Foundation
jennifer@eff.org

Corynne McSherry
Senior Staff Attorney
Electronic Frontier Foundation
corynne@eff.org

San Francisco - The Electronic Frontier Foundation (EFF) and a coalition of nonprofit groups have asked a federal appeals court to protect the "safe harbor" rules for online video service providers that encourage free expression and innovation on the Internet.

In an amicus brief filed Friday in UMG v. Veoh, EFF told the U.S. Court of Appeals for the 9th Circuit that Universal Music Group's (UMG's) effort to hold online video service Veoh responsible for infringing content uploaded by a minority of its users would thwart federal law and Congress's intent to stimulate electronic commerce and free speech.

"By creating a clear path for innovators like Veoh to limit their liability for the copyright violations of their users, the statutory safe harbors helped foster the innovation environment that has made YouTube, Flickr, eBay, Blogger, and myriad other hosting-based services possible," said EFF Senior Staff Attorney Corynne McSherry. "UMG is trying to turn back the clock and reinstate a climate of legal uncertainty that would harm new online businesses and the free expression they foster."

The safe harbors are part of the Digital Millennium Copyright Act (DMCA) and give sites immunity from monetary damages if they observe the DMCA's "notice and takedown" procedures for potentially infringing content and comply with other legal requirements. In a lawsuit first filed in 2007, UMG argued that the safe harbors don't apply to any service that "displays" or "distributes" copyrighted material, rather than simply "storing" it. Last year, a federal district court rejected that argument. UMG appealed.

"The safe harbors have proven to be a huge success in encouraging the growth of innovative platforms for free expression, hosting vibrant amateur creativity," said McSherry. "But under UMG's vision for the Internet, we'd get something a lot more like television, where nothing is seen until it's approved by an army of lawyers. That's why we're asking the appeals court to affirm the lower court's ruling."

Joining EFF in the amicus brief are the American Library Association, the Association of Research Libraries, the Association of College and Research Libraries, the Center for Democracy and Technology, the Computer and Communications Industry Association, the Internet Archive, NetCoalition, and Public Knowledge.

For the full amicus brief:
http://www.eff.org/files/filenode/umg_v_veoh/UMGvVeohAmicusBrief072310.p...

For more on this case:
http://www.eff.org/cases/umg-v-veoh

Contacts:

Corynne McSherry
Senior Staff Attorney
Electronic Frontier Foundation
corynne@eff.org

Join EFF for a plethora of appearances in Las Vegas, NV, at Black Hat USA 2010 and DEFCON 18. There is still time to register, and EFF supporters receive a 25% discount on Black Hat registration. Remember to stop by the EFF booths to get reduced-rate EFF memberships and top drawer swag! And be on the lookout for the limited edition "Things to Hack" t-shirt available only in Las Vegas.

Check out talks presented by members of our legal and technology teams throughout the week:

Wednesday, July 28
Kevin Bankston and Kurt Opsahl will play the role of the defense attorneys for an indicted hacker in the 2010 edition of Black Hat Hacker Court from 1515-1800 in Forum 25 at Caesar's Palace.

Thursday, July 29
EFF staffers will be at Vegas 2.0's 6th Annual Summit Fundraiser to thank our supporters, including the DEFCON 18 Getaway contest winners and the contest sponsors, Tenable Network Security, iSec Partners, and IOActive. As a special bonus, Summit attendees can receive a complimentary EFF Advocate Level membership and an opportunity to pick up the "Things to Hack" shirt at vastly reduced rates. Many thanks to Vegas 2.0 for their generosity in organizing this amazing benefit event.

Friday, July 30
On this big day for EFF, Marcia Hofmann will teach DEFCON attendees "How to Get Your FBI File (and Other Information You Want From the Federal Government)," from 1000-1050 in Track 3 at the Riviera Conference Center.

On Friday afternoon, Peter Eckersley will talk about the Panopticlick project on the "How Unique Is Your Browser?" panel from 1200 to 1250 in Track 2, and Jennifer Granick, Kevin, Marcia, and Kurt will teach about "The Law of Laptop Search and Seizure" in Track 3 from 1300 to 1350.

In the evening, Peter will join iSEC Partners' Jesse Burns in presenting "An Observatory for the SSLiverse" from 1700 to 1750 in Track 3. A gaggle of EFF attorneys and staff will answer your questions on the annual "Meet the EFF" panel from 1800-1850 in Track 1. From 2000 to 2050, Kevin and the ACLU's Nicole Ozer will present "Big Brother on the Big Screen: Fact/Fiction?" in Track 3.

Saturday July 31
Jennifer and Matt Zimmerman will discuss "Legal Developments in Hardware Hacking" from 1000 to 1050 in Track 1.

FULL CONFERENCE SCHEDULES:
Black Hat
DEFCON 18

Good news: another federal judge has ruled that violating a website terms of service is not a crime. But there's bad news, too — the court also found that bypassing technical or code-based barriers intended to limit access to or uses of a website may violate California's computer crime law.

The decision comes in Facebook v. Power Ventures, a case in which Facebook is suing a company that offers a tool for users to access and aggregate their personal information across social networking sites. Because Facebook's terms of service don't allow users to access their information through "automated means," Facebook claimed that Power accesses its service "without permission" in violation of California Penal Code Section 502. Facebook has also argued that Power broke the law by evading Facebook's effort to block the Power browser?s IP address, which was meant to try to keep users from accessing their Facebook accounts though the Power website.

EFF filed an amicus brief in this case, urging the court to reject Facebook's computer crime claims. We argued that turning any violation of terms of use into a crime would give websites unfettered power to decide what conduct is criminal, leaving millions of Internet users vulnerable to prosecution for everyday activities.

The court agreed with our position, relying heavily on our brief. This part of the ruling is great.

Unfortunately, the court also said that Power might be liable if it changed its IP address so that its browser could continue to interoperate with the Facebook service. In other words, it may be a crime to circumvent technological barriers imposed by a website, even if those measures are taken only to enforce the terms of service through code. There's nothing inherently wrong or unlawful about avoiding IP address blocking, and there are valid reasons why someone might choose to do so, including to sidestep anticompetitive behavior by other Internet services. As long as an end user is authorized to access a computer and the way she chooses doesn't cause harm, she should be able to access the computer any way she likes without committing a crime.

Overall, yesterday's opinion is an important precedent that aligns with United States v. Drew, a decision last year finding that a woman did not violate the federal hacking law when she created a fake MySpace profile, as well as recent Ninth Circuit cases. We welcome the court's rejection of terms of service violations as triggers for criminal liability, but will continue to work to demonstrate to courts that not all technological measures are created equal. If the measure seeks to control access to or use of data, then evasion of it is almost certainly criminal. But if the restriction merely seeks to impose owner preferences or terms of service on otherwise authorized users, bypassing it should not be a crime.

As other courts look at this issue, we hope that they will agree that code-based restrictions require a very fact-specific inquiry, and will remain open to the possibility that bypassing such measures should not necessarily be criminal.

Coauthored by Seth Schoen

The White House recently released a draft of a troubling plan titled "National Strategy for Trusted Identities in Cyberspace" (NSTIC). In previous iterations, the project was known as the "National Strategy for Secure Online Transactions" and emphasized, reasonably, the private sector's development of technologies to secure sensitive online transactions. But the recent shift to "Trusted Identities in Cyberspace" reflects a radical — and concerning — expansion of the project?s scope.

The draft NSTIC now calls for pervasive, authenticated digital IDs and makes scant mention of the unprecedented threat such a scheme would pose to privacy and free speech online. And while the draft NSTIC "does not advocate for the establishment of a national identification card" (p. 6), it?s far from clear that it won?t take us dangerously far down that road. Because the draft NSTIC is vague about many basic points, the White House must proceed with caution and avoid rushing past the risks that lay ahead. Here are some of our concerns.

Is authentication really the answer?

Probably the biggest conceptual problem is that the draft NSTIC seems to place unquestioning faith in authentication — a system of proving one's identity — as an approach to solving Internet security problems. Even leaving aside the civil liberties risks of pervasive online authentication, computer security experts question this emphasis. As prominent researcher Steven Bellovin notes:

The biggest problem [for Internet security] was and is buggy code. All the authentication in the world won't stop a bad guy who goes around the authentication system, either by finding bugs exploitable before authentication is performed, finding bugs in the authentication system itself, or by hijacking your system and abusing the authenticated connection set up by the legitimate user. All of these attacks have been known for years.

A Real ID Society?

The draft NSTIC says that, instead of a national ID card, it "seeks to establish an ecosystem of interoperable identity service providers and relying parties where individuals have the choice of different credentials or a single credential for different types of online transactions," which can be obtained "from either public or private sector identity providers." (p. 6) In other words, the governments want a lot of different companies or organizations to be able to do the task of confirming that a person on the Internet is who he or she claims to be.

Decentralized or federated ID management systems are possible, but like all ID systems, they definitely pose significant privacy issues. 1 There?s little discussion of these issues, and in particular, there?s no attention to how multiple ID's might be linked together under a single umbrella credential. A National Academies study, Who Goes There?: Authentication Through the Lens of Privacy, warned that multiple, separate, unlinkable credentials are better for both security and privacy (pp. 125-132). Yet the draft NSTIC doesn?t discuss in any depth how to prevent or minimize linkage of our online IDs, which would seem much easier online than offline, and fails to discuss or refer to academic work on unlinkable credentials (such as that of Stefan Brands, or Jan Camenisch and Anna Lysyanskaya).

Providing a uniform online ID system could pressure providers to require more ID than necessary. The video game company Blizzard, for example, recently indicated it would implement a verified ID requirement for its forums before walking back the proposal only after widespread, outspoken criticism from users.

Pervasive online ID could likewise encourage lawmakers to enact access restrictions for online services, from paying taxes to using libraries and beyond. Website operators have argued persuasively that they cannot be expected to tell exactly who is visiting their sites, but that could change with a new online ID mechanism. Massachusetts recently adopted an overly broad online obscenity law; it takes little imagination to believe states would require NSTIC implementation individuals to be able to access content somehow deemed to be "objectionable."

Anonymity

The draft NSTIC "envisions" that a blogger will use "a smart identity card from her home state" to "authenticate herself for . . . [a]nonymously posting blog entries." (p. 4) But how is her blog anonymous when it?s directly associated with a state-issued ID card?

The proposal mistakenly conflates trusting a third party to not reveal your identity with actual anonymity — where third parties don?t know your identity. When Thomas Paine anonymously published Common Sense in 1776, he didn?t secretly register with the British Crown.

Indeed, the draft NSTIC barely recognizes the value of anonymous speech, whether in public postings or private email, or anonymous browsing via systems like Tor. Nor does it address issues about re-identification, e.g. the ability to take different sets of de-identified data and link them so as to re-identify individuals.

Bellovin credits the draft NSTIC for suggesting the use of attribute credentials rather than identity credentials — that is, using credentials that could establish that you're authorized to do something without saying who you are. But, as he puts it, "We need ways to discourage collection of identity information unless identity is actually needed to deliver the requested service," and the draft NSTIC doesn't seem to address this.

Privacy, Identity Theft and Surveillance

The draft NSTIC seems to presuppose widespread use of smart ID cards. In one example, it envisions that an individual will use "a smart identity card from her home state" to "authenticate herself for a variety of online services," presumably modeled upon driver?s licenses. (p. 4)

One major concern, acknowledged briefly in the draft, is whether people's computers can really be secure enough to be used for these purposes — smart ID cards or no smart ID cards. As noted above, the vast majority of privacy and authentication vulnerabilities stem from buggy software, and when a computer is trivial to compromise, its users? credentials are easy to steal. The NSTIC proposal could, in fact, decrease user privacy and enable identity theft: once a user?s digital ID is stolen, it could be used to both pose as the user and access all the user?s accounts and data.

Consider, for example, the proposal to use a state digital ID card to access health records and online banking. What happens next time you lose your wallet?

Furthermore, by consolidating your credentials, the NSTIC plan may provide the government with a centralized means of surveilling your online accounts. And if the government issues your digital ID itself, it won?t even need to approach a third party with any kind of legal process before surveilling you.

The draft NSTIC also mentions the development of a public-key infrastructure (PKI). (pp. 15, 27) We support good, widespread encryption, which could allow people to get correct public keys reliably and possibly cut down on phishing, spam, fraud, and pretexting. But as Bruce Schneier and Carl Ellison have explained, doing PKI properly isn?t easy.2 All of their concerns apply, in some form, to the NSTIC proposal.

Another concern that?s emerged recently is whether governments could coerce certificate authorities in a PKI to issue false credentials in order to facilitate surveillance. Chris Soghoian and Sid Stamm have reported on an industry claim that governments could get "court orders" giving them access to falsified cryptographic credentials. This threat seems greater if the government itself is running the PKI.

Much more could be said. The NSTIC is only a draft, and the Department of Homeland Security and the White House sought public input online through July 19th. Because of the importance of this issue, EFF has joined with a coalition of concerned civil liberties group to ask the Administrations for a longer comment period and a way to submit more detailed comments. We hope and expect that this will be only the beginning of a public debate about ID management online.

1. 1. See, e.g., Susan Landau et al., Achieving Privacy in a Federated Identity Management System.
2. 2. See Ten Risks of PKI: What You're Not Being Told about Public Key Infrastructure

Today the Eleventh Circuit issued an unfortunate amended decision in Rehberg v. Hodges. The case arose from an egregious situation in which, among other misconduct, a prosecutor used a sham grand jury subpoena to obtain the private emails of whistleblower Charles Rehberg after he brought attention to systematic mismanagement of funds at a Georgia public hospital.

The Court held that Mr. Rehberg's privacy interest in his emails held by his ISP was not "clearly established" and therefore his claim against the prosecutors could not proceed. The Court relied on a legal doctrine called qualified immunity, which holds that lawsuits against government officials for violations of constitutional rights cannot proceed unless those rights were "clearly established" at the time. The Court declined to rule on whether individuals have a privacy interest in the content of their emails.

We're disappointed in this decision. Not only is it wrong for Mr. Rehberg, who had his emails turned over to a prosecutor based on a sham subpoena, but it's troubling for the millions of individuals in the Eleventh Circuit who have their email stored with ISPs. Our most sensitive and private thoughts, ideas and correspondence are contained in our emails. The Fourth Amendment requires judicial supervision (usually a warrant) before the government can access your personal papers in order to protect against just the sort of abuse that Mr. Rehberg suffered -- a rogue government official seeking to get your emails from your ISP with no court oversight and then turning it over to others who seek to harm you.

While the decision is very bad news for Mr. Rehberg, the Court did take the opportunity to correct some erroneous analysis in the panel's previous decision. The earlier decision had held that the Fourth Amendment did not apply at all once an email was received by your ISP. The Court had written that a "person also loses a reasonable expectation of privacy in emails, at least after the email is sent to and received by a third party" and that "Rehberg's voluntary delivery of emails to third parties constituted a voluntary relinquishment of the right to privacy in that information." This is not the law, and the incorrect statements are no longer precedent. In other words, the Court did not rule out the possibility that there is a reasonable expectation of privacy in your email. That is useful and will be important to other cases moving forward, as law professor Paul Ohm, who wrote an amicus brief in the case, has noted.

However, the Court did not rule that there was privacy protection for your emails either. Rather than embracing the obvious conclusion that our constitutional protections need to be recognized for email content, the court ducked the question, claiming that email is simply too new a technology for them to decide whether the Constitution applies. With all due respect, email is far too important to the daily lives of millions of Americans for its constitutional status to be unclear. Email content must be protected by the Fourth Amendment whether stored with an ISP or not. It's long past time that the courts recognize that the constitutional privacy protections for our "papers" still apply when they are in digital form.

Today, San Mateo Superior Court Judge Clifford Cretan granted an application by the San Mateo County D.A.'s office to withdraw the controversial warrant it obtained to search the house of Gizmodo.com journalist Jason Chen. Accordingly, "[a]ll items seized [from Chen's home] shall be returned forthwith to Gizmodo.com and Jason Chen..."

While the D.A.'s withdrawal of the April 23rd warrant is certainly a positive step, this likely isn't the end of the matter. As EFF repeatedly noted at the time, the warrant-backed search of Chen's home was illegal as it violated California Penal Code section 1524(g)'s prohibition against the issuance of warrants for "unpublished information obtained or prepared in gathering, receiving or processing of information for communication to the public." As we pointed out, the police could (for example) attempt to subpoena the same material without running afoul of section 1524(g) and still proceed with their case.