Showing posts with label computing. Show all posts
Showing posts with label computing. Show all posts

Wednesday, June 13, 2012

Optus v NRL: Copyright's Dark Clouds

The Full Bench of the Federal Court recently handed down its decision in the ongoing Optus TV Now case (National Rugby League Investments Pty Limited v Singtel Optus Pty Ltd [2012] FCAFC 59). The Full Bench overturned the findings of Rares, J in the Federal Court and their conclusions in this appeal will have serious implications for cloud computing in Australia.

In this post, I will only be examining one of the issues that were examined by the court - the issue of who "makes" a recording.

In Singtel Optus Pty Ltd v National Rugby League Investments Pty Ltd (No 2) [2012] FCA 34, Rares, J found that the subscriber to the TV Now Service was the principal who "made" the recording. This is important because it releases Optus from liability for primary infringement and brings the subscriber under the protections of s111 of the Copyright Act (1968) which allows the "Recording [of] broadcasts for replaying at more convenient time".

According to Rares,J at [63]:
"the user of the TV Now service makes each of the films in the four formats when he or she clicks on the “record” button on the TV Now electronic program guide. This is because the user is solely responsible for the creation of those films. He or she decides whether or not to make the films and only he or she has the means of being able to view them [...] The service that TV Now offers the user is substantively no different from a VCR or DVR."
At [65]:
"[...] The legislative materials do not support the rightholders’ argument that, in effect, the user could only utilise technology or equipment with which he or she had some greater connection than the “record” button on the TV Now electronic program guide"
Rares, J approached the TV Now services as an analogue for already existent non-infringing technologies and recognised that the exception in s111 was to allow for technological advances, arguing at [77] that: 
"The value of the exception created by the Parliament, that is designed to give greater flexibility to individuals so as to take advantage of technological advances, would be seriously eroded if a service provider, who has structured a service as carefully as TV Now, had to lead evidence about each user’s individual purpose on each occasion of use"
These arguments were rejected by the Full Bench and their findings, if brought to their logical conclusion, would erode the usefulness of s111 to encourage technological advances.

At [58] the Full Bench placed the emphasis on the producing of the "physical thing" (ie. the recording), rather than the actions that caused the "thing" to be made.  This, by definition placed greater emphasis on the service provider rather than the subscriber as a "maker", rejecting Rares,J's argument that the user did not need a "...greater connection than the record button..." (Singtel Optus Pty Ltd v National Rugby League Investments Pty Ltd (No 2)[2012] FCA 34 at [65].)

The Full Bench stated at [59]:
"We merely note here that a subscriber’s clicking on a button labelled “record” may trigger a sequence of actions which result in copies of a selected programme being made, but it does not necessarily follow that the subscriber alone makes that copy."
Furthermore, the Full Bench rejected the analogy with already existent technologies stating that the "TV Now" system performs the functions of the Optus-subscriber relationship (albeit automated), not just the recording function, and stated at [64] that:
"is not apparent to us why a person who designs and operates a wholly automated copying system ought as of course not be treated as a “maker” of an infringing copy where the system itself is configured designedly so as to respond to a third party command to make that copy"
If this argument is brought to its logical conclusion, it would be extremely difficult for a cloud service provider with which an individual had a contractual relationship to allow their service to be used by that individual to make a recoding of copyrighted material. If they did, the service provider is likely to be the "maker" as it was in this case.

This argument pushes many different automated subscriber cloud-based services outside of the s111 exception. This ultimately erodes the utility of the exception in s111 and ultimately ties it to physical devices over which a user has possession and control and excludes any cloud-based subscription service which enables a user to use that cloud service to make a recording of copyrighted material.

The emergence of cloud-based services that allow access to recorded digital content, such as TiVo (EDIT: although this is not strictly a cloud based service, the problem comes from the mediation of commands by TIVO from the user to the device [thanks to @neatest for pointing this out]), are now under considerable threat from copyright holders and the danger is that investment in these innovative technologies will be stalled in Australia.

As has been pointed out repeatedly, hindering access to content is a major driver of copyright infringement. However, rightsholders have been extremely reluctant to engage with technology to enable that access, preferring to hinder technological advancement by litigation (and where that fails, legislation).

Technology companies have become extremely frustrated with the content industries, stating that they may as well be "talking to a brick wall". Content industries themselves seem to be content to rely on ever more draconian copyright laws to protect their ailing business models.

While unfilled consumer demand remains and consumer behaviour continues to change in response to technology, infringement will continue. Parliament must recognise that the law must adapt to these changes in consumer behaviour and to some degree accommodate those changes (while still protecting the interests of copyright holders). As Rares, J pointed out in his FCA opinion at [74], s111 was constructed to do exactly that. 

However, the interpretation of s111 by the Full Bench has eroded its usefulness and their construction of the section is backwards-looking, legalising old technologies while ignoring the new. Unless this construction is re-examined and widened in the inevitable appeal to the High Court, parliament must expand s111 to reflect the realities of modern consumer behaviour. If it does not, investment in new legal technologies that advantage both technology and rightsholder companies will stall. The inevitable result is more infringement and that benefits no-one.

Wednesday, June 8, 2011

Constructing strong and memorable passwords

The recent Sony PlayStation Network (PSN) hack has revealed that weak passwords are still all the rage with classics such as "password", "123456" and bizarrely "Seinfeld" (considering PSN was launched in 2006, well after the final show in 1998) making up the top passwords selected for access to the PSN.

It's an age-old problem of computer security that no matter how secure the system, users will always be the weakest link - and that weakness is often expressed in password choice. Most users will excuse weak passwords or the re-use of passwords by arguing that "its impossible to remember", which is true if you expect that they'll remember a random collection of numbers and letters. The best way to construct a strong password is by the use of memes - and if you make your memes fun then people will use them to construct their own passwords.

An article in the Fairfax press suggests choosing a nursery rhyme (or other memorable phrase), taking the first letters of each word and substituting some for numbers and symbols will form the basis of a strong password which you can then customise for each service by adding a letter, such as 'F' for Facebook. Although this is a good method it still doesn't pass the memorable test because the nursery rhyme or whatever is not associated with the service. Also adding the letters to designate which service makes the password guessable if one is compromised (a fact the article acknowledges).

A method that I have suggested to people which tends to be effective is to choose a song that they can associate with the service and follow the method suggested in the article. This makes the password memorable and creates vastly different passwords for each service. A few examples that came out of this excercise were a favourite ABBA song for a NAB internet banking password (NAB sounds like ABBA apparently), Please, Mr Postman by the Beatles for a mail service and Taking it Easy by the Eagles for eBay (Taking it eBay, possibly?!). Regardless of the memes used (or their taste in music), each of these elements were memorable to the person making the password. From there it is a simple matter of constructing it along the lines outlined in the article (although I also suggest a consistent substitution scheme for example the first substitution is always a symbol).

So for example, if you chose U2's "I still haven't found what I'm looking for" for your Google services:
IsHfwILF goes to 1sHfw1LF and if your service allows symbols: !sHfw1LF, which isn't a bad password even though the attempt at irony in the song selection is terrible.