Slashdot Mirror
Ask Jennifer Granick About Computer Crime Defense
Attorney Jennifer Granick has defended many high profile hackers, including researcher Christopher Soghoian, creator of a fake boarding pass generator (2006); Michael Lynn versus Cisco/ISS (2005); Jerome Heckenkamp; and Luke Smith and Nelson Pavlosky in Online Policy Group v. Diebold Election Systems (now Premier Election Solutions), a copyright misuse case related to electronic voting. Granick also won an exemption from the U.S. Copyright Office in 2006 allowing phone unlocking despite the anti-circumvention provisions of the Digital Millennium Copyright Act, which set the stage for renewal of the exemption and for the jailbreaking exemption in 2009. At Stanford, Granick worked with Lawrence Lessig on constitutional copyright cases and taught six years worth of law students about computers, technology and civil liberties. While Civil Liberties Director at the EFF, Granick started the Coders' Rights Project and participated in litigation against ATT and the federal government for violation of surveillance regulations. Now an attorney at ZwillGen PLLC, Granick assists individuals and companies creating new products and services. And now, she's graciously agreed to answer your questions. Please, as usual, ask as many questions as you'd like, but confine each question to a separate post.
Should the exemption granted for jailbreaking cell phones apply to game consoles like the Xbox 360 and PS3 as well?
SJW: Someone who has run out of real oppression, and has to fake it.
Couldn't your clients break in to the court computers after the trial and change the verdict to "not guilty"?
How much does it cost to defend against these sorts of lawsuits?
That's a good question. I believe that once you've bought the hardware, it should be yours and you can do what you want with it. You may void warranties, but there should not benaything stopping people from sharing information about jailbreaking a system, nor should it be illegal to do so. It should remain illegal to copy and sell games, but I'm a developer, who would like to play with some nice hardware.
10 years ago, what would've you said would be the most pressing issue regarding personal electronics/personal data use?
So I used to play an online game with some friends called Star Wars Galaxies (SWG). Which is now seemingly forever dead. And so the fans decided to work on building their own servers with the given clients. You seem to know a lot about reverse engineering so my question -- when applied more broadly -- is simply this: how come I shelled out $50 for a piece of software back in the day, now that software can no longer be used and that's completely legal? I realize I probably agreed to a ToS that forfeited my right to life, liberty and the pursuit of happiness but I thought consumer protection groups were supposed to prevent this exact sort of thing from happening. Last part of this question is simply do you ever foresee SWG becoming public domain? Of course, it's mired in Lucas' copyrights as well as Sony's but at some point in the distant future, all that copyrighted stuff (including server code and artwork) is supposed to be public domain, right? What then? Is that even going to happen? Is Sony legally required to hang on to that server source code so that I can finally once again play SWG while watching Matlock in the nursing home? Why are consumer rights non-existent when it comes to software? Will the Library of Congress open up all that source? Source control history included? I know I'll probably be dead but I'm curious.
My work here is dung.
Where do you see this all leading to? Will there be rulings in the near future that will blow more holes in the DMCA, and if so will that potentially lead to a more or less strict revision by the government?
After seeing the heartless machinations of our political and legal system up close, are you still hopeful that an individual can get a fair shake in our system? How rampant is prosecutorial abuse, such as that suffered by Kevin Mitnick (e.g. the NORAD whistle)? Is the complete lack of accountability for incompetent, corrupt, and malicious prosecutors and judges as serious of a problem as it appears from the outside?
What is your advice to someone who has absolutely no faith whatsoever in the legal system?
Give me Classic Slashdot or give me death!
Do you feel as though law is finally catching up with technology when it comes to computer security or are we pretty far off still? Do you think that current law does a bad job of protecting security researchers and if so why? Which laws make their life living hell and what is the best way to avoid confrontation with the feds?
Given the vast disconnect between society's common opinion on data piracy and the large fines and penalties being pursued in the legal system by copyright holders, do you think the 'unlocking' argument could lead towards more leniency in civil cases involving copyright violations, or will that be confined to purely criminal violations?
Is is possible to get a fair Jury trial for these highly technical cases? It seems like the prosecution would generally aim to eject any jurors remotely technical, and the general public is highly susceptible to sensationalization because of how technology and hacking is portrayed in the media.
Yes, it should. If it has voice chat, it's technically a phone.
Bringing suit or taking creative non-traditional enforcement actions against hackers, cheats, in-game spammers, RMT sellers, and others who disrupt the game experience;
I like the creative non-traditional enforcement route but I have to question why would you bring suit against this group of users? You might not agree but the way I see it is that I paid for my phone, I'll now do what I want with it. What do you care if I'm running different software on it? Similarly, I paid for this game and what do you care that I'm selling items for real money on the side? Or writing a bot to farm gold? It seems like users that derive an alternative means to enjoy something they buy outside of the intended usage get targeted and locked out when it happens. They're both cat and mouse games between user and corporation, why is one a legal right to do whatever you want with something you paid for and the other is prosecuted by your firm?
My work here is dung.
I'm a developer, who would like to play with some nice hardware.
Devil's advocate: That's what a PC is for. Even midrange graphics cards for the PC are stronger than the Radeon 9000-class Hollywood GPU in the Wii, the Radeon X1900-class Xenos GPU in the Xbox 360, and the GeForce 7800-class RSX GPU in the PS3. It's even rumored that the Wii U is just an Xbox 480. What does a console give you that a living-room PC with a comparable GPU does not, other than the assurance that your users won't try to run your game on a PC with an Intel GMA (Graphics My [Behind]), fail, and complain?
So? The console hardware is usually cheaper if you want the bundle.
They sell it at a loss? Cry me a river, how is that my problem?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Isnt the reason for copyright to grant secure profits to reward the innovator? Since the time to market and the market size has increased substantially, should not the life of copyrights and patents be reduced?
Advising clients on EULAs, Terms of Use, and related contract issues;
What do you tell your clients (who apparently include Blizzard Entertainment, Square Enix, Disney and Zynga) when that "thing" I agree to before playing their game is unreadable and painfully lengthy? Are you providing them more legalese or are you saying, "Look, no gamer is going to 1) sit down and read all of this and 2) have the background to comprehend some of these terms." Because right now, in the software world, those EULAs are a complete joke. Is your firm making any positive headway on shoring up that gap between the understandings of both company lawyer and end user? If so, how?
My work here is dung.
If I stand on the other side of the border of a country which I never actually have gone into and shoot at people in the other country, should I be subject to the other country's jursidiction?
The console hardware is usually cheaper if you want the bundle.
Cheaper, but not by much. There are three current major high-definition video game platforms: Windows, Xbox 360, and PlayStation 3. Without any family members who own a PS3, I'm not qualified to comment on that platform, so I'll comment on what I know. Windows: An Acer Aspire X1 with a quad-core AMD CPU, NVIDIA graphics, 1 GB RAM, and a 1 TB hard drive costs $400 at Walmart. Xbox 360: An Xbox 360 costs $540: $300 for the console with only a quarter TB drive and $240 for four years of Xbox Live Gold service, without which Netflix and other online apps won't work even if they have separate subscriptions. That's not including the $400 for four years for the official jailbreak called "App Hub membership".
Now that may fit under some laws and may even full under phone unlocking.
Now what psystar did was selling full systems with mac os x loaded on them but if you where to do it on your own will you be ok?
What if I want to load a office full of pc with mac os x and I buy a OS X Lion USB Thumb Drive at $70 each for each system will I be ok?
I'd think the interesting cases are the borderline ones, as those are the ones that are most likely to shape the law rather than be shaped by it. Assuming that, what area of computer law do you see being so vague and ill-defined that it's actually essential that case law be produced for it?
I'm a third year evening student at Georgetown Law School. Do you need a summer intern for 2012?
Genius is one percent inspiration and 99 percent perspiration, which is why engineers sometimes smell really bad.
Company vs. enthusiast (hacker) arguments often seem to go back to the Terms of Service that are associated with the company’s product (Sony vs. geohot). Are these Terms of Service legal contracts between the company and the user? The ones that I have read never state that you must be a legal adult to agree to the Terms of Service. I remember clicking “I Agree” on hundreds of installations before I was over the age of 18. My guess is that these contracts would not be legally binding since I was not a legal adult. It seems like I would get around the Terms of Service by having my 2 year old daughter click the “I Agree” button, or maybe I would just be illegally using their product.
and that let to NAT being a big thing
This is where the bloodthirsty license agreement is supposed to go, explaining that Interactive Easyflow is a copyrighted package licensed for use by a single person, and sternly warning you not to pirate copies of it and explaining, in detail, the gory consequences if you do.
We know that you are an honest person, and are not going to go around pirating copies of Interactive Easyflow; this is just as well with us since we worked hard to perfect it and selling copies of it is our only method of making anything out of all the hard work.
If, on the other hand, you are one of those few people who do go around pirating copies of software you probably aren't going to pay much attention to a license agreement, bloodthirsty or not. Just keep your doors locked and look out for the HavenTree attack shark.
Disclaimer: I used to work there, back in the day. Great place, with the right attitude. (And, yes, there actually was an attack shark.)
Probably true, but that's a devil's advocate for a different conversation. This isn't about whether one platform is better, or even whether it's a complete waste of time to jailbreak a console; it's about whether you should be *allowed* to do so. I'll probably never bother (don't have one now anyway), but there's no reason it shouldn't be permitted by law.
Hi Jennifer. To what extent can lack of a login "banner" (disclaimer defining usage guidelines, monitoring and prohibiting unauthorized access, etc) can be used as defense by someone who has unlawfully gained access to that system? I have heard of past cases where system "welcome" statements have been interpreted as an invitation to use a system, but does this apply inversely to lack of system "unwelcome" statement? Thanks.
Bow before me, for I am root.
There have been a few law suits over being forced to rent them but there is a other board line legal part with people who clam that all the boxes on e-bay and other places are stolen even when you have owned boxes from Canada, Boxes from smaller cable systems. There was this small college that to get tv on the dorm cable system you needed to buy a cable box. Also real board line part is the big cable systems list a unturned cable box price now if you pay that price you should now be the owner of the box right? Now under FCC law they should trun any box with a cable card but they don't want to trun on Cable boxes that you own that are the same ones they rent but they use cable cards so under law they are braking it.
Also a few cable systems rent moxi boxes and you get VOD but with a owned moxi box you don't get VOD.
Service Electric let's you buy cable cards and pay no outlet or mirroring fees.
I want your legal view on this.
Hi Jennifer, what are your thoughts on the recent Sony PSN Terms of Service revision including a class-action lawsuit waiver? Is this legal? Sure the consumer can decide not to buy their product, but what about those who already paid for their PlayStations? Furthermore - what if every other company follows suit and consumers are no longer able to seek retribution for identity theft, data loss or even physical harm caused by any product (sure they can individually sue, but who has the money to hire a lawyer to take on Sony's legal team)? This sounds like a very bad practice to go undisputed. Thanks.
Bow before me, for I am root.
What are the more interesting ways you have seen prosecutors prove that the person sitting at the defendant's chair was the person committing the cybercrime at the keyboard.
The makers of the major video game consoles don't even want there to be a public discussion "about whether you should be *allowed* to do so". They might try to preempt such discussion by arguing that there is already an open alternative to video game consoles, namely gaming PCs. The existence of such an open platform thus lessens "the impact that the prohibition on the circumvention of technological measures applied to copyrighted works has" under 17 USC 1201(a)(1)(C) and takes away the pressing need to jailbreak consoles.
Furthermore, they might argue under 1201(a)(1)(E) that the authority of the Librarian of Congress to make exemptions extends only to 1201(a)(1), and thus only Congress, not the Librarian of Congress, has the authority to grant exemptions involving circumvention devices under 1201(a)(2) and 1201(b). And Congress is already thoroughly bought by the entertainment industry, which controls the media through which candidates are promoted.
My question for Jennifer:
I've observed in work and professional life (my job is 50% nerd whisperer, 50% energy policy and political matters) that while laws that protect "the little guy" are practically worthless unless one is willing to shell out several hundred dollars for a lawyer--and perhaps even $10K+ for a litigator.
It's also scary and disheartening to hear an experienced and successful friend say that he selected a US Government-owned patent for technology his startup is implementing--if only because he hopes the Feds will come to his defense if he's sued for patent infringement.
Could you please suggest some political and/or legislative outcomes that we need to pursue to try to make access to law more egalitarian from technology and innovation standpoints?
(My apologies... posted anonymously.)
Just about every PC game out now or in development is using SteamWorks [wikipedia.org]. Square Enix's products are some of those that do.
SteamWorks makes a game DVD into a Steam game so it's no different than buying it online with no DVD. Because of this, the buyer isn't allowed to trade, lend or resell the DVD under the TOS [steampowered.com]. If they are found doing this the account and the DVD key may be terminated. Unlike MMOs this is being applied to single-player games that don't use the internet at all. This may be unprecedented.
Several questions arise from this. We're only supposed to ask one so I guess just pick the one you like best!
1) Is there any legal precedent for or against this practice? ie Does the Right of First Sale apply? (As this is a physical medium rather than digital-only, as it has been confirmed to apply to digital data on a disc (UMG v. Augusto) regardless of the copyright holder trying to restrict the sale.) If not, even though it's a maxim that "software is licensed not sold" what is the relevant actual law that says this?
2) If the EULA that enforces this is in fact legally binding (which has not been established with any regularity as there have been decisions for and against) does this mean that these discs should not legally be allowed to be sold to minor persons who can't sign contracts? (This is to be contrasted with online purchases where the buyer is presenting evidence of being age of majority by their method of payment. Someone else also asked this before I was done typing mine.)
-- Insert witty one-liner here. --
Many people use an IM add-on called Off-the-Record. On top of encryption, it also provides deniability by not proving any digital signatures for the other party to present to a court, and the procol ensures everyone can make false messages in the past. How strong do you this technical protection would be from a legal perspective if one of the two parties has a logfile with all messages?
oh no, sir. They sell it at a loss in your perception - in reality they start selling it at a profit, and then all the games are sold at a profit. The result is you get crap hardware over time, and the costs for consoles have skyrocketed.
$200 consoles 10 years ago -> $300-600 today. Blech.
You write for it, and anybody else with that platform can use it. No worries about differing performance or hardware within a defined range (you can say needs Kinect or Move, and then you know exactly what extra hardware they have).
But that matters not. It's your stuff, you do with it as you will, no need to justify it to anyone. It's not about needs, it's about wants, and wants are all that are required when it comes to freedom.
Same with free speech. Why do you think you should be able to say that? None of your damn business. Why do you want to own a gun? None of your damn business. Why won't you let the police search your house without a warrant? None of your damn business.
I would say the entire voire dire process in the US needs to be changed.
Dismiss a juror only for direct cause. Do you know the defendant and/or his close relatives/associates? Do you have any direct stake in the outcome? Have you already given an opinion on innocence or guilt? Everyone else is the luck of the draw, as it should be, a jury of your peers, not a jury of a few very carefully selected people.
Long ago a relative of mine had a DUI a few years before he was called to sit on a jury for a DUI. He voted guilty (he tells me the defendant obviously was), and the guy went to jail. These days the prosecution would kick him out on the possibility he might have sympathy for the defendant.
The government grants copyrights through the power of the Copyright Clause of the Constitution. That clause explicitly states the reason,
Then "secure ... exclusive Right" is only a means to this end, not an end in itself. Not profit, that's not guaranteed, only the exclusivity to increase the chance of profit in order to provide an incentive to create more works.
We'll never have real copyright reform until all of Congress and most of the public remember this very important distinction.
I remember hearing stories courts ordering people convicted of computer crimes to not touch a computer for 10+ years (sorry, I'm too lazy to find one right now). Are these stories true? Can courts really order someone not to own or use a computer or not to use the Internet?
If so, is the fact that this probably makes the person ineligible for a huge number of jobs (all jobs in their field for many) and is essentially taking away his livelihood taken into account?
What constitutional arguments have been made in defense of such things? Did any succeed, and at what level in the courts?
What about families? Can a judge can't impose such a penalty on an entire household just because a single member of that household has been convicted? If not, what, if any, mechanisms has law enforcement taken to enforce such a ban on a single member of a household?
To him, the prosecution had easily overcome the burden of proof in that case, so he voted guilty.
He had no desire to use jury nullification. He admits he screwed up with his own DUI and had no objection to the law.
Do you agree that, for many people who are wrongly accused, it is cheaper to settle or plea than to fight and win?
And if you do, how will you suggest to fix the system?
Overrated/Flamebait? Someone else can waste their time writing questions.
My work here is dung.
You write for it, and anybody else with that platform can use it.
Good luck distributing it to "anybody else with that platform" when the next patch will disable the jailbreak on which it relies to start running. So you'd need to make an exception not only for developers but also for users.
Devil's advocate: That's what a PC is for.
Response: If I wanted to modify a PC, I'd modify a PC, but I'm not - I'm trying to [run custom software on, improve hardware wise, etc] [insert console name here], so the point is moot.
If you believe in privacy, and believe you have "nothing to hide" at the same time, you're a goddammed idiot
What do you think about the PROTECT IP Act? Google CEO, Eric Schmidt's, opposition?
The other day there was a story about the fines associated with file sharing. Like many here on slashdot I feel that a $675,000 fine is way over the top.
So here is my question.
Is there any legal definition to the limits that the eighth amendment would seem to imply as it applies to an individual?
"For I desired mercy, and not sacrifice" -- God
Same with free speech. Why do you think you should be able to say that? None of your damn business.
The historic argument for free speech is that regulation of political speech has led to abusive governance.
I know this is a different area of the law, but what are the ramifications of the upcoming changes to US patent law, specifically the "first to file" provision. I am associated with a possible start up, and I have become concerned that as soon as we reveal anything, patent troll companies will scoop up our ideas and turn them against us. I know that provisional patents are supposed to protect me, but I also know that those with deep pockets often prevail because of litigation cost. As a start up, big legal fees could cripple the effort. My current feeling is that this change is another mechanism for entrenched special interests to squash competition and innovation.
Why is Snark Required?
Who has written the book or article that works out how American patent and copyright law can be brought back to benefiting the people?
One critic a few years ago said that we are living with a "Pre VCR Law in a digital You-Tube age."
So the question I have is, what political group or thinker has a draft of a better more citizen favourable patent and copyright law? Who understands how to get enough elected politicians all moving on patent and copyright law reform?
I think to myself, in the '80's Ralph Nader was talking about problems with American corporate power. And in this current Presidential campaign, Ron Paul simply has a broad brush attack against our law culture and he doesn't speak specifically about patent and copyright reform.
Business method patents, Java litigation, patent notices on websites, $1500 dollar per song penalties, and this sucking film of illegality about every kind of digital device re-purposing really does add up to a pattern of exploitation. All this legal brutality resembles the English trying to prohibit the export of textile and steam engine technology in the 1700's.
Quote from http://www.publicknowledge.org/node/1244
"The trouble with law is lawyers."- Clarence Darrow
It's still my favorite..
My question: Now that "3d hacking" becomes mainstream, what (L)awful restrictions should we expect?
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
the goal was about making something else do those things
Now prove to a government regulator's satisfaction that this goal is worthy enough by itself to justify making an exception to a federal law. Or, as the console makers would put it: "Our products were never intended for doing these things. People who want to make a device do those things can buy a PC in the first place instead of buying our products. Therefore, the exemption that the petitioners seek is not necessary, and we request that you deny it."