Feds Say You Don’t Have a Right to Check Out Retro Video Games Like Library Books. Want you to pirate them apparently.

Most of the world’s video games from close to 50 years of history are effectively, legally dead. A Video Games History Foundation study found you can’t buy nearly 90% of games from before 2010. Preservationists have been looking for ways to allow people to legally access gaming history, but the U.S. Copyright Office dealt them a heavy blow Friday. Feds declared that you or any researcher has no right to access old games under the Digital Millennium Copyright Act, or DMCA.

Groups like the VGHF and the Software Preservation Network have been putting their weight behind an exemption to the DMCA surrounding video game access. The law says that you can’t remotely access old, defunct games that are still under copyright without a license, even though they’re not available for purchase. Current rules in the DMCA restrict libraries and repositories of old games to one person at a time, in person.

The foundation’s proposed exemption would have allowed more than one person at a time to access the content stored in museums, archives, and libraries. This would allow players to access a piece of video game history like they would if they checked out an ebook from a library. The VGHF and SPN argued that if the museum has several copies of a game in its possession, then it should be able to allow as many people to access the game as there are copies available.

In the Copyright Office’s decision dated Oct. 18 (found on Page 30), Director Shira Perlmutter agreed with multiple industry groups, including the Entertainment Software Association. She recommended the Library of Congress keep the same restrictions. Section 1201 of the DMCA restricts “unauthorized” access to copyrighted works, including games. However, it allows the Library of Congress to allow some classes of people to circumvent those restrictions.

In a statement, the VGHF said lobbying efforts from rightsholders “continue to hold back progress.” The group pointed to comments from a representative from the ESA. An attorney for the ESA told Ars Technica, “I don’t think there is at the moment any combinations of limitations that ESA members would support to provide remote access.”

Video game preservationists said these game repositories could provide full-screen popups of copyright notices to anybody who checked out a game. They would also restrict access to a time limit or force users to access via “technological controls,” like a purpose-built distribution of streaming platforms.

Industry groups argued that those museums didn’t have “appropriate safeguards” to prevent users from distributing the games once they had them in hand. They also argued that there’s a “substantial market” for older or classic games, and a new, free library to access games would “jeopardize” this market. Perlmutter agreed with the industry groups.

“While the Register appreciates that proponents have suggested broad safeguards that could deter recreational uses of video games in some cases, she believes that such requirements are not specific enough to conclude that they would prevent market harms,” she wrote.

Do libraries that lend books hurt the literary industry? In many cases, publishers see libraries as free advertising for their products. It creates word of mouth, and since libraries only have a limited number of copies, those who want a book to read for longer are incentivized to purchase one. The video game industry is so effective at shooting itself in the foot that it doesn’t even recognize when third-party preservationists are actively about to help them for no cost on the publishers’ part.

If there is such a substantial market for classic games, why are so many still unavailable for purchase? Players will inevitably turn to piracy or emulation if there’s no easy-to-access way of playing older games.

“The game industry’s absolutist position… forces researchers to explore extra-legal methods to access the vast majority of out-of-print video games that are otherwise unavailable,” the VGHF wrote.

Source: Feds Say You Don’t Have a Right to Check Out Retro Video Games Like Library Books

Juicy Licensing Deals With AI Companies Show That Publishers Don’t Actually Care About Creators

One of the many interesting aspects of the current enthusiasm for generative AI is the way that it has electrified the formerly rather sleepy world of copyright. Where before publishers thought they had successfully locked down more or less everything digital with copyright, they now find themselves confronted with deep-pocketed companies – both established ones like Google and Microsoft, and newer ones like OpenAI – that want to overturn the previous norms of using copyright material. In particular, the latter group want to train their AI systems on huge quantities of text, images, videos and sounds.

As Walled Culture has reported, this has led to a spate of lawsuits from the copyright world, desperate to retain their control over digital material. They have framed this as an act of solidarity with the poor exploited creators. It’s a shrewd move, and one that seems to be gaining traction. Lots of writers and artists think they are being robbed of something by Big AI, even though that view is based on a misunderstanding of how generative AI works. However, in the light of stories like one in The Bookseller, they might want to reconsider their views about who exactly is being evil here:

Academic publisher Wiley has revealed it is set to make $44 million (£33 million) from Artificial Intelligence (AI) partnerships that it is not giving authors the opportunity to opt-out from.

As to whether authors would share in that bounty:

A spokesperson confirmed that Wiley authors are set to receive remuneration for the licensing of their work based on their “contractual terms”.

That might mean they get nothing, if there is no explicit clause in their contract about sharing AI licensing income. For example, here’s what is happening with the publisher Taylor & Francis:

In July, authors hit out another academic publisher, Taylor & Francis, the parent company of Routledge, over an AI deal with Microsoft worth $10 million, claiming they were not given the opportunity to opt out and are receiving no extra payment for the use of their research by the tech company. T&F later confirmed it was set to make $75 million from two AI partnership deals.

It’s not just in the world of academic publishing that deals are being struck. Back in July, Forbes reported on a “flurry of AI licensing activity”:

The most active area for individual deals right now by far—judging from publicly known deals—is news and journalism. Over the past year, organizations including Vox Media (parent of New York magazine, The Verge, and Eater), News Corp (Wall Street Journal, New York Post, The Times (London)), Dotdash Meredith (People, Entertainment Weekly, InStyle), Time, The Atlantic, Financial Times, and European giants such as Le Monde of France, Axel Springer of Germany, and Prisa Media of Spain have each made licensing deals with OpenAI.

In the absence of any public promises to pass on some of the money these licensing deals will bring, it is not unreasonable to assume that journalists won’t be seeing much if any of it, just as they aren’t seeing much from the link tax.

The increasing number of such licensing deals between publishers and AI companies shows that the former aren’t really too worried about the latter ingesting huge quantities of material for training their AI systems, provided they get paid. And the fact that there is no sign of this money being passed on in its entirety to the people who actually created that material, also confirms that publishers don’t really care about creators. In other words, it’s pretty much what was the status quo before generative AI came along. For doing nothing, the intermediaries are extracting money from the digital giants by invoking the creators and their copyrights. Those creators do all the work, but once again see little to no benefit from the deals that are being signed behind closed doors.

Source: Juicy Licensing Deals With AI Companies Show That Publishers Don’t Actually Care About Creators | Techdirt

Google changes Terms Of Service, now spies on your AI prompts

The new terms come in on November 15th.

4.3 Generative AI Safety and Abuse. Google uses automated safety tools to detect abuse of Generative AI Services. Notwithstanding the “Handling of Prompts and Generated Output” section in the Service Specific Terms, if these tools detect potential abuse or violations of Google’s AUP or Prohibited Use Policy, Google may log Customer prompts solely for the purpose of reviewing and determining whether a violation has occurred. See the Abuse Monitoring documentation page for more information about how logging prompts impacts Customer’s use of the Services.

Source: Google Cloud Platform Terms Of Service

Both uBlock Origin and Lite face browser problems

Both uBlock Origin and its smaller sibling, uBlock Origin Lite, are experiencing problems thanks to browser vendors that really ought to know better.

Developer Raymond Hill, or gorhill on GitHub, is one of the biggest unsung heroes of the modern web. He’s the man behind two of the leading browser extensions to block unwanted advertising, the classic uBlock Origin and its smaller, simpler relation, uBlock Origin Lite. They both do the same job in significantly different ways, so depending on your preferred browser, you now must make a choice.

Gorhill reports on GitHub that an automated code review by Mozilla flagged problems with uBlock Origin Lite. As a result, he has pulled the add-on from Mozilla’s extensions site. The extension’s former page now just says “Oops! We can’t find that page”. You can still install it direct from GitHub, though.

The good news is that the full-fat version, uBlock Origin, is still there, so you can choose that. Hill has a detailed explanation of why and how uBlock Origin works best on Firefox. It’s a snag, though, if like The Reg FOSS desk you habitually run both Firefox and Chrome and wanted to keep both on the same ad blocker.

That’s because, as The Register warned back in August, Google’s new Manifest V3 extensions system means the removal of Manifest V2 – upon which uBlock Origin depends. For now, it still works – this vulture is running Chrome version 130 and uBO is still functioning. It’s still available on Google’s web extensions store, with a slightly misleading warning:

This extension may soon no longer be supported because it doesn’t follow best practices for Chrome extensions.

So, if you use Chrome, or a Chrome-based browser – which is most of them – then you will soon be compelled to remove uBO and switch to uBlock Origin Lite instead.

It would surely be overly cynical of us to suggest that issues with ad blockers were a foreseeable difficulty now that Mozilla is an advertising company.

To sum up, if you have a Mozilla-family browser, uBlock Origin is the easier option. If you have a Chrome-family browser, such as Microsoft Edge, then, very soon, uBlock Origin Lite will be the only version available to you.

There are other in-browser ad-blocking options out there, of course.

Linux users may well want to consider having Privoxy running in the background as well. For example, on Ubuntu and Debian-family distros, just type sudo apt install -y privoxy and reboot. If you run your own home network, maybe look into configuring an old Raspberry Pi with Pi-hole.

uBlock Origin started out as a fork of uBlock, which is now owned by the developers of AdBlock – which means that, as The Register said in 2021, it is “made by an advertising company that brokers ‘acceptable ads.'”

If acceptable ads don’t sound so bad – and to be fair, they’re better than the full Times-Square-neon-infested experience of much of the modern web – then you can still install the free AdBlock Plus, which is in both the Mozilla’s store and in the Chrome store.

Source: Both uBlock Origin and Lite face browser problems • The Register

German court: LAION’s generative AI training dataset is legal thanks to EU copyright exceptions

The copyright world is currently trying to assert its control over the new world of generative AI through a number of lawsuits, several of which have been discussed previously on Walled Culture. We now have our first decision in this area, from the regional court in Hamburg. Andres Guadamuz has provided an excellent detailed analysis of a ruling that is important for the German judges’ discussion of how EU copyright law applies to various aspects of generative AI. The case concerns the freely-available dataset from LAION (Large-scale Artificial Intelligence Open Network), a German non-profit. As the LAION FAQ says: “LAION datasets are simply indexes to the internet, i.e. lists of URLs to the original images together with the ALT texts found linked to those images.” Guadamuz explains:

The case was brought by German photographer Robert Kneschke, who found that some of his photographs had been included in the LAION dataset. He requested the images to be removed, but LAION argued that they had no images, only links to where the images could be found online. Kneschke argued that the process of collecting the dataset had included making copies of the images to extract information, and that this amounted to copyright infringement.

LAION admitted making copies, but said that it was in compliance with the exception for text and data mining (TDM) present in German law, which is a transposition of Article 3 of the 2019 EU Copyright Directive. The German judges agreed:

The court argued that while LAION had been used by commercial organisations, the dataset itself had been released to the public free of charge, and no evidence was presented that any commercial body had control over its operations. Therefore, the dataset is non-commercial and for scientific research. So LAION’s actions are covered by section 60d of the German Copyright Act

That’s good news for LAION and its dataset, but perhaps more interesting for the general field of generative AI is the court’s discussion of how the EU Copyright Directive and its exceptions apply to AI training. It’s a key question because copyright companies claim that they don’t, and that when such training involves copyright material, permission is needed to use it. Guadamuz summarises that point of view as follows:

the argument is that the legislators didn’t intend to cover generative AI when they passed the [EU Copyright Directive], so text and data mining does not cover the training of a model, just the making of a copy to extract information from it. The argument is that making a copy to extract information to create a dataset is fine, as the court agreed here, but the making of a copy in order to extract information to make a model is not. I somehow think that this completely misses the way in which a model is trained; a dataset can have copies of a work, or in the case of LAION, links to the copies of the work. A trained model doesn’t contain copies of the works with which it was trained, and regurgitation of works in the training data in an output is another legal issue entirely.

The judgment from the Hamburg court says that while legislators may not have been aware of generative AI model training in 2019, when they drew up the EU Copyright Directive, they certainly are now. The judges use the EU’s 2024 AI Act as evidence of this, citing a paragraph that makes explicit reference to AI models complying with the text and data mining regulation in the earlier Copyright Directive.

As Guadamuz writes in his post, this is an important point, but the legal impact may be limited. The judgment is only the view of a local German court, so other jurisdictions may produce different results. Moreover, the original plaintiff Robert Kneschke may appeal and overturn the decision. Furthermore, the ruling only concerns the use of text and data mining to create a training dataset, not the actual training itself, although the judges’ thoughts on the latter indicate that it would be legal too. In other words, this local outbreak of good sense in Germany is welcome, but we are still a long way from complete legal clarity on the training of generative AI systems on copyright material.

Source: German court: LAION’s generative AI training dataset is legal thanks to EU copyright exceptions – Walled Culture

Penguin Random House is adding an AI warning to its books’ copyright pages fwiw

Penguin Random House, the trade publisher, is adding language to the copyright pages of its books to prohibit the use of those books to train AI.

The Bookseller reports that new books and reprints of older titles from the publisher will now include the statement, “No part of this book may be used or reproduced in any manner for the purpose of training artificial intelligence technologies or systems.”

While the use of copyrighted material to train AI models is currently being fought over in multiple lawsuits, Penguin Random House appears to be the first major publisher to update its copyright pages to reflect these new concerns.

The update doesn’t mean Penguin Random House is completely opposed to the use of AI in book publishing. In August, it outlined an initial approach to generative AI, saying it will “vigorously defend the intellectual property that belongs to our authors and artists” while also promising to “use generative AI tools selectively and responsibly, where we see a clear case that they can advance our goals.”

Source: Penguin Random House is adding an AI warning to its books’ copyright pages | TechCrunch

Penguin spins it in support of authors, but the whole copyright thing only really fills the pockets of the publishers (eg. Juicy licensing deals with AI companies show that publishers don’t really care about creators). This will probably not hold up in court.

If You Ever Rented From Redbox, Your Private Info Is Up for Grabs

If you’ve ever opted to rent a movie through a Redbox kiosk, your private info is out there waiting for any tinkerer to get their hands on it. One programmer who reverse-engineered a kiosk’s hard drive proved the Redbox machines can cough up transaction histories featuring customers’ names, emails, and rentals going back nearly a decade. It may even have part of your credit card number stored on-device.

[…]

a California-based programmer named Foone Turing, managed to grab an unencrypted file from the internal hard drive containing a file that showed the emails, home addresses, and the rental history for either a fraction or the whole of those who previously used the kiosk.

[…]

Turing told Lowpass that the Redbox stored some financial information on those drives, including the first six and last four digits of each credit card used and “some lower-level transaction details.” The devices did apparently connect to a secure payment system through Redbox’s servers, but the systems stored financial information on a log in a different folder than the rental records. She told us that it’s likely the system only stored the last month of transaction logs.

[…]

Source: If You Ever Rented From Redbox, Your Private Info Is Up for Grabs

Which is a great illustration why there needs to be some regulations about what happens to personal data when a company is sold or goes bust.

OpenAI’s GPT Store Has Left Some Developers in the Lurch

[…] when OpenAI CEO Sam Altman spoke at the dev day, he touched on potential earning opportunities for developers.

“Revenue sharing is important to us,” Altman said.” We’re going to pay people who build the most useful and the most-used GPTs a portion of our revenue.”

[…]

Books GPT, which churns out personalized book recommendations and was promoted by OpenAI at the Store’s launch, is his most popular.

But 10 months after its launch, it seems that revenue-sharing has been reserved for a tiny number of developers in an invite-only pilot program run by OpenAI. Villocido, despite his efforts, wasn’t included.

According to Villocido and other small developers who spoke with WIRED, OpenAI’s GPT Store has been a mixed bag. These developers say that OpenAI’s analytics tools are lacking and that they have no real sense of how their GPTs are performing. OpenAI has said that GPT creators outside of the US, like Villocido, are not eligible for revenue-sharing.

Those who are able to make money from their GPTs usually devise workarounds, like placing affiliate links or advertising within their GPTs. Other small developers have used the success of their GPTs to market themselves while raising outside funding.

[…]

Copywriter GPT, his GPT that drafts advertising copy, has had between 500,000 and 600,000 interactions. Like Villocido’s Books GPT, Lin’s has been featured on the homepage of OpenAI’s Store.

But Lin can’t say exactly how much traction his GPTs have gotten or how frequently they are used, because OpenAI only provides “rough estimations” to small developers like him. And since he’s in Singapore, he won’t receive any payouts from OpenAI for the usage of his app.

[…]

the creator of the Books GPT that was featured in the Store launch, he found he could no longer justify the $20 per month cost of the ChatGPT subscription required to build and maintain his custom GPTs.

He now collects a modest amount of revenue each month by placing ads in the GPTs he has already created, using a chatbot ad tool called Adzedek. On a good month, he can generate $200 a month in revenue. But he chooses not to funnel that back into ChatGPT.

Source: OpenAI’s GPT Store Has Left Some Developers in the Lurch | WIRED

Face matching now available on GSA’s login.gov, however it still doesn’t work in minimum 10% of the time

The US government’s General Services Administration’s (GSA) facial matching login service is now generally available to the public and other federal agencies, despite its own recent report admitting the tech is far from perfect.

The GSA announced general availability of remote identity verification (RiDV) technology through login.gov, and the service’s availability to other federal government agencies yesterday. According to the agency, the technology behind the offering is “a new independently certified” solution that complies with the National Institute of Standards and Technology’s (NIST) 800-63 identity assurance level 2 (IAL2) standard.

IAL2 identity verification involves using either remote or in-person verification of a person’s identity via biometric data along with some physical element, like an ID photograph, access to a cellphone number, for example.

“This new IAL2-compliant offering adds proven one-to-one facial matching technology that allows Login.gov to confirm that a live selfie taken by a user matches the photo on a photo ID, such as a driver’s license, provided by the user,” the GSA said.

The Administration noted that the system doesn’t use “one-to-many” face matching technology to compare users to others in its database, and doesn’t use the images for any purpose other than verifying a user’s identity.

[…]

In a report issued by the GSA’s Office of the Inspector General in early 2023, the Administration was called out for saying it implemented IAL2-level identity verification as early as 2018, but never actually supporting the requirements to meet the standard.

“GSA knowingly billed customer agencies over $10 million for services, including alleged IAL2 services that did not meet IAL2 standards,” the report claimed.

[…]

Fast forward to October of last year, and the GSA said it was embracing facial recognition tech on login.gov with plans to test it this year – a process it began in April.  Since then, however, the GSA has published pre-press findings of a study it conducted of five RiDV technologies, finding that they’re still largely unreliable.

The study anonymized the results of the five products, making it unclear which were included in the final pool or how any particular one performed. Generally, however, the report found that the best-performing product still failed 10 percent of the time, and the worst had a false negative rate of 50 percent, meaning its ability to properly match a selfie to a government ID was no better than chance.

Higher rejection rates for people with darker skin tones were also noted in one product, while another was more accurate for people of AAPI descent, but less accurate for everyone else – hardly the equitability the GSA said it wanted in an RiDV product last year.

[…]

It’s unclear what solution has been deployed for use on login.gov. The only firm we can confirm has been involved though the process is LexisNexis, which previously acknowledged to The Register that it has worked with the GSA on login.gov for some time.

That said, LexisNexis’ CEO for government risk solutions told us recently that he’s not convinced the GSA’s focus on adopting IAL2 RiDV solutions at the expense of other biometric verification methods is the best approach.

“Any time you rely on a single tool, especially in the modern era of generative AI and deep fakes … you are going to have this problem,” Haywood “Woody” Talcove told us during a phone interview last month. “I don’t think NIST has gone far enough with this workflow.”

Talcove told us that facial recognition is “pretty easy to game,” and said he wants a multi-layered approach – one that it looks like GSA has declined to pursue given how quickly it’s rolling out a solution.

“What this study shows is that there’s a level of risk being injected into government agencies completely relying on one tool,” Talcove said. “We’ve gotta go further.”

Along with asking the GSA for more details about its chosen RiDV solution, we also asked for some data about its performance. We didn’t get an answer to that question, either.

Source: Face matching now available on GSA’s login.gov • The Register

Italy is losing its mind because of copyright: it just made its awful Piracy Shield even worse

Walled Culture has been writing about Italy’s Piracy Shield system for a year now. It was clear from early on that its approach of blocking Internet addresses (IP addresses) to fight alleged copyright infringement – particularly the streaming of football matches – was flawed, and risked turning into another fiasco like France’s failed Hadopi law. The central issue with Piracy Shield is summed up in a recent post on the Disruptive Competition Blog:

The problem is that Italy’s Piracy Shield enables the blocking of content at the IP address and DNS level, which is particularly problematic in this time of shared IP addresses. It would be similar to arguing that if in a big shopping mall, in which dozens of shops share the same address, one shop owner is found to sell bootleg vinyl records with pirated music, the entire mall needs to be closed and all shops are forced to go out of business.

As that post points out, Italy’s IP blocking suffers from several underlying problems. One is overblocking, which has already happened, as Walled Culture noted back in March. Another issue is lack of transparency:

The Piracy Shield that has been implemented in Italy is fully automated, which prevents any transparency on the notified IP addresses and lacks checks and balances performed by third parties, who could verify whether the notified IP addresses are exclusively dedicated to piracy (and should be blocked) or not.

Piracy Shield isn’t working, and causes serious collateral damage, but instead of recognising this, its supporters have doubled down, and have just convinced the Italian parliament to pass amendments making it even worse, reported here by TorrentFreak:

VPN and DNS services anywhere on planet earth will be required to join Piracy Shield and start blocking pirate sites, most likely at their own expense, just like Italian ISPs are required to do already.

Moving forward, if pirate sites share an IP address with entirely innocent sites, and the innocent sites are outnumbered, ISPs, VPNs and DNS services will be legally required to block them all.

A new offence has been created that is aimed at service providers, including network access providers, who fail to report promptly illegal conduct by their users to the judicial authorities in Italy or the police there. Maximum punishment is not just a fine, but imprisonment for up to one year. Just why this is absurd is made clear by this LinkedIn comment by Diego Ciulli, Head of Government Affairs and Public Policy, Google Italy (translation by DeepL):

Under the label of ‘combating piracy’, the Senate yesterday approved a regulation obliging digital platforms to notify the judicial authorities of all copyright infringements – present, past and future – of which they become aware. Do you know how many there are in Google’s case? Currently, 9,756,931,770.

In short, the Senate is asking us to flood the judiciary with almost 10 billion URLs – and foresees jail time if we miss a single notification.

If the rule is not corrected, the risk is to do the opposite of the spirit of the law: flooding the judiciary, and taking resources away from the fight against piracy.

The new law will make running an Internet access service so risky that many will probably just give up, reducing consumer choice. Freedom of speech will be curtailed, online security weakened, and Italy’s digital infrastructure will be degraded. The end result of this law will be an overall impoverishment of Italian Internet users, Italian business, and the Italian economy. And all because of one industry’s obsession with policing copyright at all costs

Source: Italy is losing its mind because of copyright: it just made its awful Piracy Shield even worse – Walled Culture

23andMe is on the brink. What happens to all that genetic DNA data?

[…] The one-and-done nature of Wiles’ experience is indicative of a core business problem with the once high-flying biotech company that is now teetering on the brink of collapse. Wiles and many of 23andMe’s 15 million other customers never returned. They paid once for a saliva kit, then moved on.

Shares of 23andMe are now worth pennies. The company’s valuation has plummeted 99% from its $6 billion peak shortly after the company went public in 2021.

As 23andMe struggles for survival, customers like Wiles have one pressing question: What is the company’s plan for all the data it has collected since it was founded in 2006?

[…]

Andy Kill, a spokesperson for 23andMe, would not comment on what the company might do with its trove of genetic data beyond general pronouncements about its commitment to privacy.

[…]

When signing up for the service, about 80% of 23andMe’s customers have opted in to having their genetic data analyzed for medical research.

[…]

The company has an agreement with pharmaceutical giant GlaxoSmithKline, or GSK, that allows the drugmaker to tap the tech company’s customer data to develop new treatments for disease.

Anya Prince, a law professor at the University of Iowa’s College of Law who focuses on genetic privacy, said those worried about their sensitive DNA information may not realize just how few federal protections exist.

For instance, the Health Insurance Portability and Accountability Act, also known as HIPAA, does not apply to 23andMe since it is a company outside of the health care realm.

[…]

According to the company, all of its genetic data is anonymized, meaning there is no way for GSK, or any other third party, to connect the sample to a real person. That, however, could make it nearly impossible for a customer to renege on their decision to allow researchers to access their DNA data.

“I couldn’t go to GSK and say, ‘Hey, my sample was given to you — I want that taken out — if it was anonymized, right? Because they’re not going to re-identify it just to pull it out of the database,” Prince said.

[…]

the patchwork of state laws governing DNA data makes the generic data of millions potentially vulnerable to being sold off, or even mined by law enforcement.

“Having to rely on a private company’s terms of service or bottom line to protect that kind of information is troubling — particularly given the level of interest we’ve seen from government actors in accessing such information during criminal investigations,” Eidelman said.

She points to how investigators used a genealogy website to identify the man known as the Golden State Killer, and how police homed in on an Idaho murder suspect by turning to similar databases of genetic profiles.

“This has happened without people’s knowledge, much less their express consent,” Eidelman said.

[…]

Last year, the company was hit with a major data breach that it said affected 6.9 million customer accounts, including about 14,000 who had their passwords stolen.

[…]

Some analysts predict that 23andMe could go out of business by next year, barring a bankruptcy proceeding that could potentially restructure the company.

[…]

Source: What happens to all of 23andMe’s genetic DNA data? : NPR

For more fun reading about about this clusterfuck of a company and why giving away DNA data is a spectacularly bad idea:

License Plate Readers Are Creating a US-Wide Database of Cars – and political affiliation, planned parenthood and more

At 8:22 am on December 4 last year, a car traveling down a small residential road in Alabama used its license-plate-reading cameras to take photos of vehicles it passed. One image, which does not contain a vehicle or a license plate, shows a bright red “Trump” campaign sign placed in front of someone’s garage. In the background is a banner referencing Israel, a holly wreath, and a festive inflatable snowman.

Another image taken on a different day by a different vehicle shows a “Steelworkers for Harris-Walz” sign stuck in the lawn in front of someone’s home. A construction worker, with his face unblurred, is pictured near another Harris sign. Other photos show Trump and Biden (including “Fuck Biden”) bumper stickers on the back of trucks and cars across America.

[…]

These images were generated by AI-powered cameras mounted on cars and trucks, initially designed to capture license plates, but which are now photographing political lawn signs outside private homes, individuals wearing T-shirts with text, and vehicles displaying pro-abortion bumper stickers—all while recording the precise locations of these observations.

[…]

The detailed photographs all surfaced in search results produced by the systems of DRN Data, a license-plate-recognition (LPR) company owned by Motorola Solutions. The LPR system can be used by private investigators, repossession agents, and insurance companies; a related Motorola business, called Vigilant, gives cops access to the same LPR data.

[…]

those with access to the LPR system can search for common phrases or names, such as those of politicians, and be served with photographs where the search term is present, even if it is not displayed on license plates.

[…]

“I searched for the word ‘believe,’ and that is all lawn signs. There’s things just painted on planters on the side of the road, and then someone wearing a sweatshirt that says ‘Believe.’” Weist says. “I did a search for the word ‘lost,’ and it found the flyers that people put up for lost dogs and cats.”

Beyond highlighting the far-reaching nature of LPR technology, which has collected billions of images of license plates, the research also shows how people’s personal political views and their homes can be recorded into vast databases that can be queried.

[…]

Over more than a decade, DRN has amassed more than 15 billion “vehicle sightings” across the United States, and it claims in its marketing materials that it amasses more than 250 million sightings per month.

[…]

The system is partly fueled by DRN “affiliates” who install cameras in their vehicles, such as repossession trucks, and capture license plates as they drive around. Each vehicle can have up to four cameras attached to it, capturing images in all angles. These affiliates earn monthly bonuses and can also receive free cameras and search credits.

In 2022, Weist became a certified private investigator in New York State. In doing so, she unlocked the ability to access the vast array of surveillance software accessible to PIs. Weist could access DRN’s analytics system, DRNsights, as part of a package through investigations company IRBsearch. (After Weist published an op-ed detailing her work, IRBsearch conducted an audit of her account and discontinued it.

[…]

While not linked to license plate data, one law enforcement official in Ohio recently said people should “write down” the addresses of people who display yard signs supporting Vice President Kamala Harris, the 2024 Democratic presidential nominee, exemplifying how a searchable database of citizens’ political affiliations could be abused.

[…]

In 2022, WIRED revealed that hundreds of US Immigration and Customs Enforcement employees and contractors were investigated for abusing similar databases, including LPR systems. The alleged misconduct in both reports ranged from stalking and harassment to sharing information with criminals.

[…]

 

Source: License Plate Readers Are Creating a US-Wide Database of More Than Just Cars | WIRED

Insecure Robot Vacuums From Chinese Company Deebot Collect Photos and Audio to Train Their AI

Ecovacs robot vacuums, which have been found to suffer from critical cybersecurity flaws, are collecting photos, videos and voice recordings — taken inside customers’ houses — to train the company’s AI models.

The Chinese home robotics company, which sells a range of popular Deebot models in Australia, said its users are “willingly participating” in a product improvement program.

When users opt into this program through the Ecovacs smartphone app, they are not told what data will be collected, only that it will “help us strengthen the improvement of product functions and attached quality”. Users are instructed to click “above” to read the specifics, however there is no link available on that page.

Ecovacs’s privacy policy — available elsewhere in the app — allows for blanket collection of user data for research purposes, including:

– The 2D or 3D map of the user’s house generated by the device
– Voice recordings from the device’s microphone
— Photos or videos recorded by the device’s camera

“It also states that voice recordings, videos and photos that are deleted via the app may continue to be held and used by Ecovacs…”

Source: Insecure Robot Vacuums From Chinese Company Deebot Collect Photos and Audio to Train Their AI

Dutch oppose Hungary’s approach to EU child sexual abuse regulation – or total surveillance of every smart device

The Netherlands’ government and opposition are both against the latest version of the controversial EU regulation aimed at detecting online child sexual abuse material (CSAM), according to an official position and an open letter published on Tuesday (1 October).

The regulation, aimed at detecting online CSAM, has been criticised for potentially allowing the scanning of private messages on platforms such as WhatsApp or Gmail.

However, the latest compromise text, dated 9 September, limits detection to known material, among other changes. ‘Known’ material refers to content that has already been circulating and detected, in contrast to ‘new’ material that has not yet been identified.

The Hungarian presidency of the Council of the EU shared a partial general approach dated 24 September and seen by Euractiv, that mirrors the 9 September text but reduces the reevaluation period from five years to three for grooming and new CSAM.

Limiting detection to known material could hinder authorities’ ability to surveil massive amounts of communications, suggesting the change is likely an attempt to reconcile privacy concerns.

The Netherlands initially supported the proposal to limit detection to ‘known’ material but withdrew its support in early September, Euractiv reported.

On Tuesday (1 October), Amsterdam officially took a stance against the general approach, despite speculation last week suggesting the country might shift its position in favour of the regulation.

This is also despite the Dutch mostly maintaining that their primary concern lies with combating known CSAM – a focus that aligns with the scope of the latest proposal.

According to various statistics, the Netherlands hosts a significant amount of CSAM.

The Dutch had been considering supporting the proposal, or at least a “silent abstention” that might have weakened the blocking minority, signalling a shift since Friday (27 September), a source close to the matter told Euractiv.

While a change in the Netherlands’ stance could have affected the blocking minority in the EU Council, their current position now strengthens it.

If the draft law were to pass in the EU Council, the next stage would be interinstitutional negotiations, called trilogues, between the European Parliament, the Council of the EU, and the Commission to finalise the legislation.

Both the Dutch government and the opposition are against supporting the new partial general approach.

Opposition party GroenLinks-PvdA (Greens/EFA) published an open letter, also on Tuesday, backed by a coalition of national and EU-based private and non-profit organisations, urging the government to vote against the proposal.

According to the letter, the regulation will be discussed at the Justice and Home Affairs Council on 11 October, with positions coordinated among member states on 2 October.

Currently, an interim regulation allows companies to detect and report online CSAM voluntarily. Originally set to expire in 2024, this measure has been extended to 2026 to avoid a legislative gap, as the draft for a permanent law has yet to be agreed.

The Dutch Secret Service opposed the draft regulation because “introducing a scan application on every mobile phone” with infrastructure to manage the scans would be a complex and extensive system that would introduce risks to digital resilience, according to a decision note.

Source: Dutch oppose Hungary’s approach to EU child sexual abuse regulation – Euractiv

To find out more about how invasive the proposed scanning feature is, look through the articles here: https://www.linkielist.com/?s=csam

Mazda’s $10 Subscription For Remote Start Sparks Backlash After Killing Open Source Option

Mazda recently surprised customers by requiring them to sign up for a subscription in order to keep certain services. Now, notable right-to-repair advocate Louis Rossmann is calling out the brand. He points to several moves by Mazda as reasons for his anger toward them. However, it turns out that customers might still have a workaround.

Previously, the Japanese carmaker offered connected services, that included several features such as remote start, without the need for a subscription. At the time, the company informed customers that these services would eventually transition to a paid model.

More: Native Google Maps Won’t Work On New GM Cars Without $300 Subscription

It’s important to clarify that there are two very different types of remote start we’re talking about here. The first type is the one many people are familiar with where you use the key fob to start the vehicle. The second method involves using another device like a smartphone to start the car. In the latter, connected services do the heavy lifting.

Transition to paid services

What is wild is that Mazda used to offer the first option on the fob. Now, it only offers the second kind, where one starts the car via phone through its connected services for a $10 monthly subscription, which comes to $120 a year. Rossmann points out that one individual, Brandon Rorthweiler, developed a workaround in 2023 to enable remote start without Mazda’s subscription fees.

However, according to Ars Technica, Mazda filed a DMCA takedown notice to kill that open-source project. The company claimed it contained code that violated “[Mazda’s] copyright ownership” and used “certain Mazda information, including proprietary API information.” Additionally, Mazda argued that the project included code providing functionality identical to that found in its official apps available on the Apple App Store and Google Play Store.

That doesn’t mean an aftermarket remote starter kit won’t work though. In fact, with Mazda’s subscription model now in place, it’s not hard to imagine customers flocking to aftermarket solutions to avoid the extra fees. However, by not opting to pay for Mazda Connected Services, owners will also miss out on things like vehicle health reports, remote keyless entry, and vehicle status reports.

A growing trend

Bear in mind that this is just one case of an automaker trying to milk their customers with subscription-based features, which could net them millions in extra income. BMW, for example, installs adaptive suspension hardware in some vehicles but charges $27.50 per month (or $505 for a one-time purchase) to unlock the software that makes the suspension actually work.

And then there’s Ferrari’s plan to offer a battery subscription for extended warranty coverage on its hybrid models for a measly $7,500 per year!

[…]

sure, you might have paid a considerable amount of money to buy your car, and it might legally be yours, but that does not ensure that you really own all of the features it comes with, unless you’re prepared to pay extra.

Source: Mazda’s $10 Subscription For Remote Start Sparks Backlash After Killing Open Source Option | Carscoops

LG Wants to Show You Ads Even When You’re Not Watching TV

The outlet reveals (via Android Authority) that the ads start playing before the screensaver hits the screen and are usually sponsored messages from LG or its partners. The review highlighted one specific ad for the LG Channels app: LG’s free live TV service with ads. FlatpanelsHD adds that according to LG’s ad division, users will soon start seeing ads for other products and services.

The review mentions that “some of the ads” can be disabled, and there’s also an option under ‘Additional Settings’ to disable screensaver ads. But it’s almost sinful to push ads on a $2,400 device.

What makes this whole thing more bizarre is that, according to the review, LG pushes the same ads with the same frequency on its cheaper offerings. Oddly, it does nothing to differentiate the experience of purchasing a high-end model from an entry-level one. The brand’s OLED line is already pricey, but the G4 is allegedly “one of the most expensive TVs on the market,” according to FlatpanelsHD. I can only imagine how this will play out for the South Korean company. As FlatpanelsHD said, “LG must reconsider this strategy if they want to sell high-end TVs.”

Source: LG Wants to Show You Ads Even When You’re Not Watching TV

Unbelievable this

Ford wants to listen in on you in your car to serve you ads as much as possible

ford cars with human ears on their doors driving on a highway

Someday soon, if Ford has its way, drivers and passengers may be bombarded with infotainment ads tailored to their personal and vehicle data.

This sure-to-please-everyone idea comes via a patent application [PDF] filed by Ford Global Technologies late last month that proposes displaying ads to drivers based on their destination, route, who’s in the car, and various other data points able to be collected by modern vehicles.

According to the patent application, infotainment advertising could be varied depending on the situation and user feedback. In one example, Ford supposes showing a visual ad to passengers every 10 minutes while on the highway, and if someone responds positively to audio ads, the system could ramp up the frequency, playing audio ads every five minutes.

Of course, simply playing more ads might frustrate people, which Ford seems to understand because the pending patent notes it would have to account for “a user’s natural inclination to seek minimal or no ads.”

In order to assure advertisers that user preference is ultimately circumvented, Ford said its proposed infotainment system would be designed to “intelligently schedule variable durations of ads, with playing time seeking to maximize company revenue while minimizing the impact on user experience.”

The system would also be able to listen to conversations so it could serve ads during lulls in chatter, ostensibly to be less intrusive while being anything but.

Given the rush by some automakers to turning their vehicles into subscription-based cars-as-a-service, egged on by the chip world, we’re not surprised by efforts to wring more money out of motorists, this time with adverts. We assume patent filings similar to Ford’s have been made.

Trust us!

Then there’s the fact that automakers aren’t terrific on privacy and safeguarding the kinds of info that are used to tailor ads. In September last year, Mozilla published a report on the privacy policies of several automakers whose connected vehicles harvest information about owners, finding that 25 major manufacturers – Ford among them – failed to live up to the Firefox maker’s standards.

Just a couple of months later, a Washington state appeals court ruled it was perfectly legal for vehicles to harvest text and call data from connected smartphones and store it all in memory.

US senators have urged the FTC to investigate several car makers for allegedly selling customer data unlawfully, though we note Ford is not among the companies accused in that matter.

That said, the patent application makes no mention of how the automaker would protect user data used to serve in-vehicle ads. A couple of other potentially privacy-infringing Ford patents from the past year are worth mentioning, too.

The ideas within a patent application should not be viewed as an indication of our product plans

In 2023, Ford filed a patent application for an embedded vehicle system that would automate vehicle repossession if car payments weren’t made. Over the summer, another application describes a system where vehicles monitor each other’s speeds, and if one detects a nearby car speeding, it could snap photos using onboard cameras and send the images, along with speed data, directly to police or roadside monitors. Neither have privacy advocates thrilled.

Bear in mind neither of those patents may ever see the production, and this advertising one might not make it past the “let’s file this patent before the competition just in case” stage of life, either. That’s even what Ford essentially told us.

“Submitting patent applications is a normal part of any strong business as the process protects new ideas and helps us build a robust portfolio of intellectual property,” a Ford spokesperson told The Register. “The ideas described within a patent application should not be viewed as an indication of our business or product plans.”

Ford also said it always puts customers first in development of new products and services, though didn’t directly answer questions about a lack of privacy assurances in the patent application. In any case, it may not actually happen. Until it does.

Source: Who wants in-car ads tailored to your journey, passengers? • The Register

Resistance to Hungarian presidency’s new push for child sexual abuse prevention regulation – because it’s a draconian spying law asking for 100% coverage of digital comms

Resistance to the Hungarian presidency’s approach to the EU’s draft law to combat online child sexual abuse material (CSAM) was still palpable during a member states’ meeting on Wednesday (4 September).

The Hungarian presidency of the Council of the EU aims to secure consensus on the proposed law to combat online child sexual abuse material (CSAM) by October, according to an EU diplomat and earlier reports by Politico.

Hungary has prepared a compromise note on the draft law, also reported by Contexte.

The note, presented at a meeting of ambassadors on Wednesday, seeks political guidance to make progress at the technical level, the EU diplomat told Euractiv.

With the voluntary regime expiring in mid-2026, most member states agree that urgent action is needed, the diplomat continued.

But some member states are still resistant to the Hungarian’s latest approach.

The draft law to detect and remove online child sexual abuse material (CSAM) was removed from the agenda of Thursday’s (20 June) meeting of the Committee of Permanent Representatives (COREPER), who were supposed to vote on it.

Sources close to the matter told Euractiv, that Poland and Germany remain opposed to the proposal, with smaller member states also voicing concerns, potentially forming a blocking minority.

Although France and the Netherlands initially supported the proposal, the Netherlands has since withdrawn its support, and Italy has indicated that the new proposal is moving in the right direction.

As a result, no agreement was reached to move forward.

Currently, an interim regulation allows companies to voluntarily detect and report online CSAM. Originally set to expire in 2024, this measure has been extended to 2026 to avoid a legislative gap, as the draft for a permanent law has yet to be agreed.

Hungary is expected to introduce a concrete textual proposal soon. The goal is to agree on its general approach by October, the EU diplomat said, a fully agreed position among member states which serves as the basis for negotiations with the European Parliament.

Meanwhile, the European Commission is preparing to send a detailed opinion to Hungary regarding the draft law, expected by 30 September, Contexte reported on Wednesday.

[…]

In the text, the presidency also suggested extending the temporary exemption from certain provisions of the ePrivacy Directive, which governs privacy and electronic communications, for new CSAM and grooming.

[…]

Source: Resistance lingers to Hungarian presidency’s new push for child sexual abuse prevention regulation – Euractiv

See also:

The EU Commission’s Alleged CSAM Regulation ‘Experts’ giving them free reign to spy on everyone: can’t be found. OK then.

EU delays decision over continuous spying on all your devices *cough* scanning encrypted messages for kiddie porn

Signal, MEPs urge EU Council to drop law that puts a spy on everyone’s devices

European human rights court says backdooring encrypted comms is against human rights

EU Commission’s nameless experts behind its “spy on all EU citizens” *cough* “child sexual abuse” law

EU Trys to Implement Client-Side Scanning, death to encryption By Personalised Targeting of EU Residents With Misleading Ads

 

Second Circuit Says Libraries Disincentivize Authors To Write Books By Lending Them For Free

What would you think if an author told you they would have written a book, but they wouldn’t bother because it would be available to be borrowed for free from a library? You’d probably think they were delusional. Yet that argument has now carried the day in putting a knife into the back of the extremely useful Open Library from the Internet Archive.

The Second Circuit has upheld the lower court ruling and found that the Internet Archive’s Open Library is not fair use and therefore infringes on the copyright of publishers (we had filed an amicus brief in support of the Archive asking them to remember the fundamental purpose of copyright law and the First Amendment, which the Court ignored).

Even though this outcome was always a strong possibility, the final ruling is just incredibly damaging, especially in that it suggests that all libraries are bad for authors and cause them to no longer want to write. I only wish I were joking. Towards the end of the ruling (as we’ll get to below) it says that while having freely lent out books may help the public in the “short-term” the “long-term” consequences would be that “there would be little motivation to produce new works.

[…]

As you’ll recall, the Open Library is no different than a regular library. It obtains books legally (either through purchase or donation) and then lends out one-to-one copies of those books. It’s just that it lends out digital copies of them. To keep it identical to a regular library, it makes sure that only one digital copy can be lent out for every physical copy it holds. Courts have already determined that digitizing physical books is fair use, and the Open Library has been tremendously helpful to all sorts of people.

The only ones truly annoyed by this are the publishers, who have always hated libraries and have long seen the shift to digital as an open excuse to effectively harm libraries. With licensed ebooks, the publishers have jacked up the prices so that (unlike with regular books), the library can’t just buy a single copy from any supplier and lend it out. Rather, publishers have made it prohibitively expensive to get ebook licenses, which come with ridiculous restrictions on how frequently books can be lent and more.

[…]

The key part of the case is whether or not the Internet Archive’s scanning and lending of books is fair use. The Second Circuit says that it fails the fair use four factors test. On the question of transformative use, the Internet Archive argued that because it was using technology to make lending of books more convenient and efficient, it was clearly transformative. Unfortunately, the court disagrees:

We conclude that IA’s use of the Works is not transformative. IA creates digital copies of the Works and distributes those copies to its users in full, for free. Its digital copies do not provide criticism, commentary, or information about the originals. Nor do they “add[] something new, with a further purpose or different character, altering the [originals] with new expression, meaning or message.” Campbell, 510 U.S. at 579. Instead, IA’s digital books serve the same exact purpose as the originals: making authors’ works available to read. IA’s Free Digital Library is meant to―and does―substitute for the original Works

The panel is not convinced by the massive change in making physical books digitally lendable:

True, there is some “change” involved in the conversion of print books to digital copies. See Infinity Broadcast Corp. v. Kirkwood, 150 F.3d 104, 108 n.2 (2d Cir. 1998) (“[A] change in format . . . is not technically a transformation.”). But the degree of change does not “go beyond that required to qualify as derivative.” Warhol II, 598 U.S. at 529. Unlike transformative works, derivative works “ordinarily are those that re-present the protected aspects of the original work, i.e., its expressive content, converted into an altered form.” Google Books, 804 F.3d at 225. To be transformative, a use must do “something more than repackage or republish the original copyrighted work.” Authors Guild, Inc. v. HathiTrust, 755 F.3d 87, 96 (2d Cir. 2014); see also TVEyes, 883 F.3d at 177 (“[A] use of copyrighted material that merely repackages or republishes the original is unlikely to be deemed a fair use.” (internal quotation marks omitted)). Changing the medium of a work is a derivative use rather than a transformative one.

But, that’s not what a derivative work is? A derivative work is not scanning a book. Scanning a book is making a copy. A derivative work is something like making a movie out of a book. So, this analysis is just fundamentally wrong in saying that this is a derivative work, and thus the rest of the analysis is kinda wonky based on that error.

Tragically, the Court then undermines the important ruling in the Betamax/VCR case that found “time shifting” (recording stuff off your TV) to be fair use, even as it absolutely was repackaging the same content for the same purpose. The Court says that doesn’t matter because it “predated our use of the word ‘transformative’ as a term of art.” But that doesn’t wipe out the case as a binding precedent, even though the Court here acts as though it does.

Sony was decided long before modern technology made it possible for one to view virtually any content at any time. Put in context, the “time-shifting” permitted by the defendant’s tape recorders in Sony was a unique efficiency not widely available at the time, and certainly not offered by the plaintiff-television producer.

So because content is more widely available, this kind of shifting is no longer fair use? How does that make any sense at all?

Then the Court says (incorrectly — as we’ll explain shortly) that there’s really nothing new or different about what the Open Library does:

Here, by contrast, IA’s Free Digital Library offers few efficiencies beyond those already offered by Publishers’ own eBooks.

The problem, though, is that this isn’t quite true. Getting licensed ebooks out from libraries is a difficult and cumbersome practice and requires each library to have a vast ebook collection that none can possibly afford. As this lawsuit went down, more and more authors came out of the woodwork, explaining how research they had done for their books was only possible because of the Open Library and would have been impossible via a traditional library given the lending restrictions and availability restrictions.

[…]

From there, the Court explores whether or not the Internet Archive’s use here was commercial. The lower court said it was because, ridiculously, the Internet Archive had donation links on library pages. Thankfully, the panel here sees how problematic that would be for every non-profit:

We likewise reject the proposition that IA’s solicitation of donations renders its use of the Works commercial. IA does not solicit donations specifically in connection with its digital book lending services―nearly every page on IA’s website contains a link to “Donate” to IA. App’x 6091. Thus, as with its partnership with BWB, any link between the funds IA receives from donations and its use of the Works is too attenuated to render the use commercial. Swatch, 756 F.3d at 83. To hold otherwise would greatly restrain the ability of nonprofits to seek donations while making fair use of copyrighted works. See ASTM I, 896 F.3d at 449 (rejecting the argument that because free distribution of copyrighted industry standards enhanced a nonprofit organization’s fundraising appeal, the use was commercial).

It also disagrees that this use is commercial because there’s a referral link for people to go and buy a copy of the book, saying that’s “too attenuated”:

Any link between the funds IA receives from its partnership with BWB and its use of the Works is too attenuated for us to characterize the use as commercial on that basis

Even so, the lack of commerciality isn’t enough to protect the project on the first factor analysis, and it goes to the publishers.

[…]

Source: Second Circuit Says Libraries Disincentivize Authors To Write Books By Lending Them For Free | Techdirt

There is a lot more, but it’s safe to say that the courts in the US and copyright laws have run amok and are only feeding the rich to the detriment of the poor. Denying people libraries is a step beyond.

Internet Archive loses appeal – 4 greedy publishers shut down major library in insane luddite US law system

The Internet Archive’s appeal could spell further trouble for the non-profit, as it is in the middle of a another copyright lawsuit with music publishers that could cost more than $400m if it loses.

The Internet Archive has been dealt a serious blow in court, as it lost an appeal case to share scanned books without the approval of publishers.

The loss could lead to serious repercussions for the non-profit, as hundreds of thousands of digital books have been removed from its library. The Internet Archive is also in the middle of another copyright lawsuit from multiple music labels for digitising vintage records.

What is the Internet Archive?

Based in San Francisco, the Internet Archive is one of the world’s most well-known libraries for scanned copies of millions of physical books that it lends to people all over the globe for free.

The non-profit organisation claims its mission is to provide “universal access to all knowledge” and has been archiving digital content for years such as books, movies, music, software and more.

The archive claims to have more than 20m freely downloadable books and texts, along with a collection of 2.3m modern e-books that can be borrowed – similar to a library. But while supporters say the Internet Archive is a valuable source of easily accessible information, its critics claim it breaches copyright laws.

What caused the major publisher lawsuit?

The Internet Archive let users access its vast digital library for years before the lawsuit began, but a decision during the Covid-19 pandemic prompted the legal response.

Previously, only a limited number of individuals were allowed to borrow a digital book from the non-profit’s Open Library service, a principle that the archive referred to as controlled digital lending.

But this rule was relaxed during the pandemic and led to the creation of the archive’s National Emergency Library, which meant an unlimited number of people could access the same e-books. After this decision, the major publishers launched their lawsuit and the archive went back to its controlled lending practices.

The four publishers – Hachette, Penguin Random House, Wiley, and HarperCollins – said the Internet Archive was conducting copyright infringement through its practices. But the lawsuit went after both library services and had a major impact – in June 2024, the Internet Archive said more than 500,000 books had been removed from its library as a result of the lawsuit.

The non-profit’s founder Brewster Kahle previously said libraries are “under attack at an unprecedented scale”, with a mix of book bans, defunding and “overzealous lawsuits like the one brought against our library”.

From a loss to an appeal

Unfortunately for the digital library, a judge sided in favour of the publishers on 24 March 2023, agreeing with their claims that the Internet Archive’s practices constitutes “wilful digital piracy on an industrial scale” that hurts both writers and publishers.

The archive appealed this decision later that year, but the appeals court determined that it is not “fair use” for a non-profit to scan copyright-protected print books in their entirety and distribute those digital copies online. The appeals court also said there is not enough of a change from a printed copy to a digital one to constitute fair use.

“We conclude that IA’s use of the works is not transformative,” the appeals court said. “IA creates digital copies of the works and distributes those copies to its users in full, for free. Its digital copies do not provide criticism, commentary, or information about the originals.”

The appeals court did disagree with the previous court’s verdict that the Internet Archive’s use of these copyrighted materials is “commercial in nature” and said it is “undisputed that IA is a nonprofit entity and that it distributes its digital books for free”.

What does this mean for the Internet Archive?

The archive’s director of library services Chris Freeland said the non-profit is “disappointed” in the decision by the appeals court and that it is “reviewing the court’s opinion and will continue to defend the rights of libraries to own, lend and preserve books”.

Freeland also shared a link to readers where they can sign an open letter asking publishers to restore access to the 500,000 books removed from the archive’s library.

The loss also presents a bad precedent for the archive’s Great 78 Project, which is focused on the discovery and preservation of 78rpm records. The Internet Archive has been working to digitise millions of these recordings to preserve them, adding that the disks they were recorded onto are made of brittle material and can be easily broken.

“We aim to bring to light the decisions by music collectors over the decades and a digital reference collection of underrepresented artists and genres,” the Internet Archive says on the project page.

“The digitisation will make this less commonly available music accessible to researchers in a format where it can be manipulated and studied without harming the physical artefacts.”

But multiple music labels are suing the Internet Archive for this project and claims it has “wilfully reproduced” thousands of protected sound recordings without copyright authorisation. The music labels are seeking damages of up to $150,000 for each protected sound recording infringed in the lawsuit, which could lead to payments of more than $412m if the court rules against the Internet Archive.

Source: What you need to know about the Internet Archive’s appeal loss

Dutch DPA fines Clearview €30.5 million for violating the GDPR

Clearview AI is back in hot — and expensive — water, with the Dutch Data Protection Authority (DPA) fining the company €30.5 million ($33.6 million) for violating the General Data Protection Regulation (GDPR). The release explains that Clearview created “an illegal database with billions of photos of faces,” including Dutch individuals, and has failed to properly inform people that it’s using their data. In early 2023, Clearview’s CEO claimed the company had 30 billion images.

Clearview must immediately stop all violations or face up to €5.1 million ($5.6 million) in non-compliance penalties. “Facial recognition is a highly intrusive technology, that you cannot simply unleash on anyone in the world,” Dutch DPA chairman Aleid Wolfsen stated. “If there is a photo of you on the Internet — and doesn’t that apply to all of us? — then you can end up in the database of Clearview and be tracked.” He adds that facial recognition can help with safety but that “competent authorities” who are “subject to strict conditions” should handle it rather than a commercial company.

The Dutch DPA further states that since Clearview is breaking the law, using it is also illegal. Wolfsen warns that Dutch companies using Clearview could also be subject to “hefty fines.” Clearview didn’t issue an objection to the Dutch DPA’s fine, so it is unable to launch an appeal.

This fine is far from the first time an entity has stood up against Clearview. In 2020, the LAPD banned its use, and the American Civil Liberties Union (ACLU) sued Clearview, with the settlement ending sales of the biometric database to any private companies. Italy and the UK have previously fined Clearview €20 million ($22 million) and £7.55 million ($10 million), respectively, and instructed the company to delete any data of its residents. Earlier this year, the EU also barred Clearview from untargeted face scraping on the internet.

Source: Clearview faces a €30.5 million for violating the GDPR

Proposal to spy on all chat messages back on European political agenda

Europe is going to talk again about the possibility of checking all chat messages of citizens for child abuse. On September 4, a (secret) consultation will take place, says Patrick Breyer , former MEP for the Pirate Party.

A few years ago, the European Commission came up with the plan to monitor all chat messages of citizens. The European Parliament did not like the proposal of the European Commission and came up with its own proposal, which excludes monitoring of end-to-end encrypted services.

At the end of June, EU President Belgium came up with its own version of the proposal. Namely that only the uploading of photos, video and references to them would be checked. This proposal did not get enough votes.

Germany and Poland are the biggest opponents within the EU anyway. The Netherlands, Estonia, Slovenia, the Czech Republic and Austria would abstain from voting, according to Breyer.

A coalition of almost fifty civil society organisations, including the Dutch Offlimits, Bits of Freedom, Vrijschrift.org and ECNL, called on the European Commission in July to withdraw the chat control proposal and focus on measures that really protect children.

Source: Proposal to control chat messages back on European political agenda – Emerce

Guys, stop trying to be Big Brother in the EU – it changes how people behave and not for the better.

Mozilla removes telemetry service Adjust from mobile Firefox versions – it was spying on you secretly it turns out

Mozilla will soon remove its telemetry service Adjust from the Android and iOS versions of browsers Firefox and Firefox Focus. It appeared that the developer was collecting data on the effectiveness of Firefox ad campaigns without disclosing that.

Mozilla, the developers of Firefox, until recently used the telemetry service Adjust to collect data from its Firefox and Firefox Focus apps for both Android and iOS. Through this service, the company collected data on the number of installs of these specific apps following Mozilla’s ad campaigns.

[…]

The company’s actions may also result from previous complaints about the default enabling of ‘privacy-protecting ad metrics’ in Firefox. This option has been enabled by default since the July 9 release of Firefox 128.

The service collects data on how users respond to ads, which is shared aggregated with advertisers. Users can disable this option, however.

Mozilla says it regrets enabling such telemetry but defends the reason for turning it on by default. According to the browser provider, advertisers’ desire for information about the effectiveness of their campaigns is very difficult to escape.

[…]

Source: Mozilla removes telemetry service Adjust from mobile Firefox versions – Techzine Global

Oh dear. And I thought that Mozilla was the privacy friendly option. 2 strikes now.

Australian Regulators Decide To Write A Strongly Worded Letter About Clearview’s Privacy Law Violations, leave it at that

Clearview’s status as an international pariah really hasn’t changed much over the past few years. It may be generating fewer headlines, but nothing’s really changed about the way it does business.

Clearview has spent years scraping the web, compiling as much personal info as possible to couple with the billions of photos it has collected. It sells all of this to whoever wants to buy it. In the US, this means lots and lots of cop shops. Also, in the US, Clearview has mostly avoided running into a lot of legal trouble, other than a couple of lawsuits stemming from violations of certain states’ privacy laws.

Elsewhere in the world, it’s a different story. It has amassed millions in fines and plenty of orders to exit multiple countries immediately. These orders also mandate the removal of photos and other info gathered from accounts of these countries’ residents.

It doesn’t appear Clearview has complied with many of these orders, much less paid any of the fines. Clearview’s argument has always been that it’s a US company and, therefore, isn’t subject to rulings from foreign courts or mandates from foreign governments. It also appears Clearview might not be able to pay these fines if forced to, considering it’s now offering lawsuit plaintiffs shares in the company, rather than actual cash, to fulfill its settlement obligations.

Australia is one of several countries that claimed Clearview routinely violated privacy laws. Australia is also one of several that told Clearview to get out. Clearview’s response to the allegations and mandates delivered by Australian privacy regulators was the standard boilerplate: we don’t have offices in the Australia so we’re not going to comply with your demands.

Perhaps it’s this international stalemate that has prompted the latest bit of unfortunate news on the Clearview-Australia front. The Office of the Australian Information Commissioner (OAIC) has issued a statement that basically says it’s not going to waste any more time and money trying to get Clearview to respect Australia’s privacy laws. (h/t The Conversation)

Before giving up, the OAIC has this to say about its findings:

That determination found that Clearview AI, through its collection of facial images and biometric templates from individuals in Australia using a facial recognition technology, contravened the Privacy Act, and breached several Australian Privacy Principles (APPs) in Schedule 1 of the Act, including by collecting the sensitive information of individuals without consent in breach of APP 3.3 and failing to take reasonable steps to implement practices, procedures and systems to comply with the APPs.

Notably, the determination found that Clearview AI indiscriminately collected images of individuals’ faces from publicly available sources across the internet (including social media) to store in a database on the organisation’s servers. 

This was followed by the directive ordering Clearview to stop doing business in the country and delete any data it held pertaining to Australian residents. The statement notes Clearview’s only responses were a.) challenging the order in court in 2021 and b.) withdrawing entirely from the proceedings two years later. The OAIC notes that nothing appears to have changed in terms of how Clearview handles its collections. It also says it has no reason to believe Clearview has stopped collecting Australian persons’ data.

Despite all of that, it has decided to do absolutely nothing going forward:

Privacy Commissioner Carly Kind said, “I have given extensive consideration to the question of whether the OAIC should invest further resources in scrutinising the actions of Clearview AI, a company that has already been investigated by the OAIC and which has found itself the subject of regulatory investigations in at least three jurisdictions around the world as well as a class action in the United States. Considering all the relevant factors, I am not satisfied that further action is warranted in the particular case of Clearview AI at this time.

That’s disappointing. It makes it clear the company can avoid being held accountable for its legal violations by simply refusing to honor mandates issued by foreign countries or pay any fines levied. It can just continue to be the awful, ethically-horrendous company it has always been because, sooner or later, regulators are just going to give up and move on to softer targets.

[…]

Source: Australian Regulators Decide To Do Absolutely Nothing About Clearview’s Privacy Law Violations | Techdirt

Dutch officials fine Uber €290M for GDPR violations

Privacy authorities in the Netherlands have imposed a €290 million ($324 million) fine on ride-share giant Uber for sending driver data to servers in the United States – “a serious violation” of the EU’s General Data Protection Regulation (GDPR).

According to the Dutch Data Protection Authority (DPA), Uber spent years sending sensitive driver information from Europe to the US. Among the data that was transmitted were taxi licenses, location data, payment details, identity documents, and medical and criminal records. The data was sent abroad without the use of “transfer tools,” which the DPA said means the data wasn’t sufficiently protected.

“Businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union,” Dutch DPA chairman Aleid Wolfsen said of the decision. “Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US. That is very serious.”

The Dutch DPA said that the investigation that led to the fine began after complaints from a group of more than 170 French Uber drivers who alleged their data was being sent to the US without adequate protection. Because Uber’s European operations are based in the Netherlands, enforcement for GDPR violations fell to the Dutch DPA.

Unfortunately for Uber, it already has an extensive history with the Dutch DPA, which has fined the outfit twice before.

The first came in 2018 when the authority fined Uber €600,000 for failing to report a data breach (a slugfest that several EU countries joined in on). The latter €10 million fine came earlier this year after Dutch officials determined Uber had failed to disclose data retention practices surrounding the data of EU drivers, refusing to name which countries data was sent to, and had obstructed its drivers’ right to privacy.

[…]

The uncertainty Uber refers to stems from the EU’s striking down of the EU-US Privacy Shield agreement and the years of efforts to replace it with a new rule that defines the safe transfer of personal data between the two regions.

Uber claims it’s done its job under the GDPR to safeguard data belonging to European citizens – it didn’t even need to make any data transfer process changes to comply the latest rules.

[…]

Source: Dutch officials fine Uber €290M for GDPR violations • The Register