UPDATE: The Court in OpenMind Solutions v. Does 1 – 2925 heard oral argument on April 11, 2011. At the end of the hearing — during which the judge expressed some initial concerns with OpenMind's attempt to lump the defendants into a class action — the judge requested that OpenMind and EFF submit briefs on the merits of the class action lawsuit. Those briefs will be due in two weeks; we will then wait for a ruling from the Court. In the meantime (as reported below), discovery remains stayed.
As we've been reporting for some time, a series of lawsuits has been filed across the U.S. against thousands of individuals accused of having illegally uploaded and downloaded copyrighted works in violation of copyright law. One of the latest of those suits is a case called OpenMind Solutions v. Does 1 – 2925, a case in which EFF filed an amicus brief asking the judge to quash the subpoenas seeking the identities of the nearly 3,000 anonymous defendants.
We are glad to report that the judge has decided to stay discovery pending a hearing on the issues EFF raised in its brief, which means that (at least temporarily), ISPs need not comply with the subpoenas sent out by OpenMind’s attorney John Steele.
The hearing in this case is scheduled for April 11. In the meantime, if you are an ISP or an anonymous Doe defendant, you should make sure your attorney is aware of the judge’s order. For more information, or if you have further questions, consult EFF’s Subpoena Defense Resources page.
By delaying or even blocking security updates for mobile devices, mobile carriers put their users, their business, and the country’s critical infrastructure at unnecessary risk. Mobile security problems plague the entire software stack — the baseband, the kernel, the application frameworks, and the applications — and carriers continue to resist shipping regular and frequent updates.
For a specific example, consider the compromise of a Comodo certificate authority. The only “solution” for the problem of Comodo’s compromised CA is to update the browser and ship the new browser to every client computer. Without that update, browsers remain vulnerable to the hacker. While personal computer users might plausibly update their computers, mobile users have little or no control over the security status of their devices. There is unlikely to be any update they can get any time soon. Mobile devices will remain vulnerable to the fraudulent certificates for many months (or years) to come.
In fact, Ars Technica reported last week that Windows Phone 7 on AT&T is all but guaranteed to be months out of date at any given time — if it ever gets updates at all. Android and iPhone suffer from delayed updates as well.
Your cell phone company knows everywhere you go, twenty-four hours a day, every day. How concrete is this fact for you?
It's very concrete for Malte Spitz, a German politician and privacy advocate. He used German privacy law — which, like the law of many European countries, gives individuals a right to see what private companies know about them — to force his cell phone carrier to reveal what it knew about him. The result? 35,831 different facts about his cell phone use over the course of six months. As the German newspaper website Zeit Online reports:
This profile reveals when Spitz walked down the street, when he took a train, when he was in an airplane. It shows where he was in the cities he visited. It shows when he worked and when he slept, when he could be reached by phone and when was unavailable. It shows when he preferred to talk on his phone and when he preferred to send a text message. It shows which beer gardens he liked to visit in his free time. All in all, it reveals an entire life.
To show just how extensive this data is, Spitz chose to make it all available to the public; Zeit Online used it to prepare a remarkable interactive map, which animates Spitz's movements, moment by moment, over the course of half a year. It's correlated with information Spitz willingly posted on the web, and, according to him and the newspaper, is remarkably, eerily accurate. Try it out.
A report in the New York Times on Saturday described the data release, which it called "astounding", and put it in a U.S. context, quoting EFF's Kevin Bankston. The Times tried to find out whether U.S. mobile phone carriers have similar data about their subscribers, but it said "[t]he major American cellphone providers declined to explain what exactly they collect and what they use it for."
EFF has been following this issue for years and has worked extensively to limit government access to location data about individuals; government agents have increasingly sought to use this information, using questionable legal arguments to get carriers to turn it over. Still, it's remarkable to see an actual location data set about a real person. (According to the Times, German carriers have, for legal reasons, now stopped routinely storing this data. However, like all mobile phone carriers, they still have the technical ability to collect it at any time.)
Malte Spitz explains why he worked to obtain this information: to help educate the public about some of what's at stake in the German and worldwide debates about telecommunications data retention. All around the world, including the United States, proposed laws would force carriers to retain enormous quantities of personal information. As Spitz and Zeit Online have shown, these troves of information can give a detailed picture of each person's private life.
When legal issues light up the Internet, people turn to EFF for answers. Whether it’s attacks on coders' rights, overreaching copyright claims online, or governments' efforts to censor or spy on people, we are often among the first to hear about troubling events online, and we're frequently the first place people turn to for legal help.
So why are there times when EFF is involved in an important case but is silent or gives only limited information about it? Usually it’s for one of three reasons: to protect the people who have asked us for help, because of a specific court requirement or because we’re putting the strategy into place.
First, the legal protections for attorney/client communications and attorney work product allow lawyers and their prospective or existing clients to speak frankly with each other and to honestly evaluate the strengths and weaknesses of their cases. But these communications and notes must be kept strictly confidential in order to remain protected. If the confidentiality is broken, the person or a person's attorney can be required to reveal their communications, legal strategies, and evaluations to their opponents – including to prosecutors who can put them in jail or opposing civil lawyers. Breaching these privileges can hurt the people who ask us for help and undermine our chances of winning a case, so we are very careful to avoid doing so.
Other times, a court limits our ability to speak. A recent example of this is when the government demanded information from Twitter as part of its Wikileaks investigation, where we were subjected to a court sealing order. In this Twitter records case, we are representing Birgitta Jonsdottir, one of the Twitter users whose records are being sought by the U.S. government. Initially, the fact of our representation was the only thing we could acknowledge publicly. The court documents in the case were filed under seal, and we could not even discuss the hearing we were preparing for, leading to many awkward and frustrating conversations with EFF members as well as reporters. However, we asked the judge to unseal the court records, and she ultimately did unseal nearly all filed documents in the case to be released to the public, including news of the hearing. In such cases, we press as hard as we can to get the legal proceedings made public, especially for cases involving important personal privacy and free speech implications.
Finally, there are times when we are simply not finished investigating a case to determine whether to take it, or are taking the initial steps to put a strategy into place. Here’s a page outlining some of the things we consider when making those decisions. This often involves not only gathering background information, but also conducting a legal and technological analysis of the situation. We also try to help people find other lawyers for cases we can't take. While working through this process, the worst thing we could do is to talk publicly before a legal strategy is in place and before EFF has solidified our role. This is especially true when the legal situation is in flux, as when emergency legal relief is sought or when some of the people potentially involved have not yet been notified or identified. We’ve had a few of those recently – close watchers of EFF may have some guesses about specific instances where this has been the situation.
However, none of this should keep EFF members, the press, or the public from emailing us at firstname.lastname@example.org when something is happening that potentially requires EFF's involvement. EFF members and the general public are an essential part of our early warning system – a form of crowdsourcing that helps us have a much broader view of what’s going on and where the important cases are occurring. But we hope you will understand if we answer your call or email with limited detail or if we hold back from commenting extensively in the press or on our blog. We believe strongly that everyone’s rights online should be vigorously protected, and sometimes that requires us to be silent.
Further proof that the recording industry’s oft-repeated claims of the downfall of the entire music industry hold no water: a new report finding that filesharing has led directly to "reduced costs of bringing works to market and a growing role of independent labels." In other words, in the past decade, we have seen more music from independent outlets and at lower prices – something that consumers and music fans should all be happy about.
The study, by University of Minnesota economist Joel Waldfogel, proves just what we’ve been saying as recently as last week – that filesharing (unauthorized or not) has led more artists to create more music, and – just as importantly – more different music. U.S. copyright law is based on a compromise recognized in the Constitution that grants authors (or artists, or musicians) a limited monopoly designed to give those authors an incentive to make their creative works. As we’ve long known and as this study makes clear yet again, even in the face of filesharing, those incentives still exist.
UPDATE (3/26/11): HTTPS is again available for those in the countries discussed below. Microsoft denies deliberately blocking access to HTTPS, blaming the problem on a bug:
We are aware of an issue that impacted some Hotmail users trying to enable HTTPS. That issue has now been resolved. Account security is a top priority for Hotmail and our support for HTTPS is worldwide – we do not intentionally limit support by region or geography and this issue was not restricted to any specific region of the world.
Microsoft appears to have turned off the always-use-HTTPS option in Hotmail for users in more than a dozen countries, including Bahrain, Morocco, Algeria, Syria, Sudan, Iran, Lebanon, Jordan, Congo, Myanmar, Nigeria, Kazakhstan, Uzbekistan, Turkmenistan, Tajikistan, and Kyrgyzstan. Hotmail users who have set their location to any of these countries receive the following error message when they attempt to turn on the always-use-HTTPS feature in order to read their mail securely:
Your Windows Live ID can't use HTTPS automatically because this feature is not available for your account type.
Microsoft debuted the always-use-HTTPS feature for Hotmail in December of 2010, in order to give users the option of always encrypting their webmail traffic and protecting their sensitive communications from malicious hackers using tools such as Firesheep, and hostile governments eavesdropping on journalists and activists. For Microsoft to take such an enormous step backwards undermining the security of Hotmail users in countries where freedom of expression is under attack and secure communication is especially importantis deeply disturbing. We hope that this counterproductive and potentially dangerous move is merely an error that Microsoft will swiftly correct.
The good news is that the fix is very easy. Hotmail users in the affected countries can turn the always-use-HTTPS feature back on by changing the country in their profile to any of the countries in which this feature has not been disabled, such as the United States, Germany, France, Israel, or Turkey. Hotmail users who browse the web with Firefox may force the use of HTTPS by defaultwhile using any Hotmail location settingby installing the HTTPS Everywhere Firefox plug-in.
First, the London School of Economics released a paper finding that while filesharing may explain some of the decline in sales of physical copies of recorded music, the decline “should be explained by a combination of factors such as changing patterns in music consumption, decreasing disposable household incomes for leisure products and increasing sales of digital content through online platforms.” And even if the sales of recorded music are down, there is an important distinction to draw: the recording industry may be hurting, but the music industry is thriving. For example, the LSE paper points out that in the UK in 2009, the revenues from live music shows outperformed recorded music sales.
We’ve also seen more and more artists making a go of it on their own. Rebecca Black, a 13-year-old, is reportedly netting nearly $25,000 a week from digital downloads of her hit song, "Friday." The band OK Go famously made a name for itself by self-producing widely popular music videos and then leaving a big record label that failed to “recognize the basic mechanics of the Internet” by attempting to prohibit embedding of the band's video content. As the lead singer noted, "[c]urbing the viral spread of videos isn't benefiting the company’s bottom line, or the music it's there to support." Even bands with record deals are finding different ways to make money. For example, the popular band the Black Keys makes 85% of its money from live shows.
Another recent study, this one by the Social Science Research Council, delves into international aspects of "piracy," especially in emerging markets, and finds unauthorized filesharing in some developing economies has actually created opportunities for media companies to come up with innovative business models that allow legal and widespread access to media goods. For example, in India, "where large domestic film and music industries dominate the national market, [large media companies] set prices to attract mass audiences, and in some cases compete directly with pirate distribution." The impact of this cannot be understated: in many of these emerging markets, the new business models are improving legal access to music and art that was previously unaffordable for many people.
The SSRC report also points out that, despite the content industry’s dire predictions, the media business is still thriving: "Software, DVD, and box office revenues in most middle-income countries have risen in the past decade — in some cases dramatically. Sales of CDs have fallen, but the overall music business, including performance, has grown."
Despite these realities, the policy debate continues to focus on enforcement and "strengthening intellectual property," which, SSRC rightly points out, is incredibly counterproductive and comes at a high social cost. Instead of discussing ways to make sure artists get paid for their work and fans have access to media goods, time and energy is wasted debating how to continue an enforcement policy that has failed to actually curb unauthorized filesharing.
We are encouraged to see studies like these that challenge policy makers to shift the tone of the debate to a more productive conversation about how to innovate and use new technologies to benefit artists and their fans. Because the bottom line is this: those who find ways to capitalize on new technologies will be the ones to succeed going forward.
On March 15th, an HTTPS/TLS Certificate Authority (CA) was tricked into issuing fraudulent certificates that posed a dire risk to Internet security. Based on currently available information, the incident got close to — but was not quite — an Internet-wide security meltdown. As this post will explain, these events show why we urgently need to start reinforcing the system that is currently used to authenticate and identify secure websites and email systems.
There is a post up on the Tor Project's blog by Jacob Appelbaum, analyzing the revocation of a number of HTTPS certificates last week. Patches to the major web browsers blacklisted a number of TLS certificates that were issued after hackers broke into a Certificate Authority. Appelbaum and others were able to cross-reference the blacklisted certificates' serial numbers against a comprehensive collection of Certificate Revocation Lists (these CRL URLs were obtained by querying EFF's SSL Observatory databases) to learn which CA had been affected.
The answer was the UserTrust "UTN-USERFirst-Hardware" certificate owned by Comodo, one of the largest CAs on the web. Comodo has now published a statement about the improperly issued certs, which were for extremely high-value domains including google.com, login.yahoo.com and addons.mozilla.org (this last domain could be used to trojan any system that was installing a new Firefox extension, though updates to previously installed extensions have a second layer of protection from XPI signatures). One cert was for "global trustee" — not a domain name. That was probably a malicious CA certificate that could be used to flawlessly impersonate any domain on the Web.
Comodo also said that the attack came primarily from Iranian IP addresses, and that one of the fraudulent login.yahoo.com certs was briefly deployed on a webserver in Iran.1
What should we do about these attacks?
Discussing problems with the revocation mechanisms that should (but don't) protect users who don't instantly get browser updates, Appelbaum makes the following assertion:
If the CA cannot provide even a basic level of revocation, it's clearly irresponsible to ship that CA root in a browser. Browsers should give insecure CA keys an Internet Death Sentence rather than expose the users of the browsers to known problems.
Before discussing whether or not such a dramatic conclusion is at all warranted, it is worth considering what the consequences of blacklisting Comodo's UserTrust CA certificate would have been. We used the SSL Observatory datasets to determine what had been signed by that CA certificate. The answer was that, as of August 2010, 85,440 public HTTPS certificates were signed directly by UTN-USERFirst-Hardware. Indirectly, the certificate had delegated authority to a further 50 Certificate Authorities, collectively responsible for another 120,000 domains. In the event of a revocation, at least 85,000 websites would have to scramble to obtain new SSL certificates.
The situation of the 120,000 other domains is more complicated — some of these are cross-certified by other root CAs or might be able do obtain such cross-certifications. In most — but not all — cases, these domains could continue to function without updating their webserver configurations or obtaining new certs.
The short answer, however, is that the Comodo's USERFirst-Hardware certificate is too big to fail. If the private key for such a CA were hacked, by the Iranians or by anybody else, browsers would face a horrible choice: either blacklisting the CA quickly, causing outages at tens or hundreds of thousands of secure websites and email servers; or leave all of the world's HTTPS, POP and IMAP deployments vulnerable to the hackers for an extended period of time.
Fortunately, Comodo has said that the master CA private keys in its Hardware Security Modules (HSMs) were not compromised, so we did not experience that kind of Internet-wide catastrophic security failure last week. But it's time for us to start thinking about what can be done to mitigate that risk.
Cross-checking the work of CAs
Most Certificate Authorities do good work. Some make mistakes occasionally,2 but that is normal in computer security. The real problem is a structural one: there are 1,500 CA certificates controlled by around 650 organizations,3 and every time you connect to an HTTPS webserver, or exchange email (POP/IMAP/SMTP) encrypted by TLS, you implicitly trust all of those certificate authorities!
What we need is a robust way to cross-check the good work that CAs currently do, to provide defense in depth and ensure (1) that a private key-compromise failure at a major CA does not lead to an Internet-wide cryptography meltdown and (2) that our software does not need to trust all of the CAs, for everything, all of the time.
For the time being, we will make just one remark about this. Many people have been touting DNSSEC PKI as a solution to the problem. While DNSSEC could be an improvement, we do not believe it is the right solution to the TLS security problem. One reason is that the DNS hierarchy is not trustworthy. Countries like the UAE and Tunisia control certificate authorities, and have a history of compromising their citizens' computer security. But these countries also control top-level DNS domains, and could control the DNSSEC entries for those ccTLDs. And the emergence of DNS manipulation by the US government also raises many concerns about whether DNSSEC will be reliable in the future.
We don't think this is an unsolvable problem. There are ways to reinforce our existing cryptographic infrastructure. And building and deploying them may not be that hard. Look for a blog post from us shortly about how we should go about doing that.
1. This is strong circumstantial evidence that the attack was perpetrated by Iranians, though it also possible that the perpetrators used compromised systems in Iran in order to frame Iran.
3. These numbers are from the SSL Observatory. Before we performed those scans, we are unsure that anybody knew how many CAs were trusted by our browsers and operating systems, because CAs regularly delegate authority to subordinate CAs without announcing this publicly