Slashdot Mirror
Meet the Lawyer Suing Anyone Who Uses SSL
Sparrowvsrevolution writes "Since 2008, Dallas, Texas attorney Erich Spangenberg and his company TQP have been launching suits against hundreds of firms, claiming that merely by using SSL, they've violated a patent TQP acquired in 2006. Nevermind that the patent was actually filed in 1989, long before the World Wide Web was even invented. So far Spangenberg's targets have included Apple, Google, Intel, Dell, Hewlett-Packard, every major bank and credit card company, and scores of web startups and online retailers, practically anyone who encrypts pages of a web sites to protect users' privacy. And while most of those lawsuits are ongoing, many companies have already settled with TQP rather than take the case to trial, including Apple, Amazon, Dell, and Exxon Mobil. The patent has expired now, but Spangenberg can continue to sue users of SSL for six more years and seems determined to do so as much as possible. 'When the government grants you the right to a patent, they grant you the right to exclude others from using it,' says Spangenberg. 'I don't understand why just because [SSL is] prevalent, it should be free.'"
Who's up for forming a lynch mob?
Nevermind that the patent was actually filed in 1989, long before the World Wide Web was even invented.
Now, don't get me wrong, this is patent trolling at it's absolute worst, but what exactly is this quote supposed to mean? We (rightly) complain all the freakin time how people shouldn't be granted patents just by adding "on the internet" or "on a computer", we can't have it both ways. If there is a valid patent to provide secure communications through USPS and the key steps of that patent are being performed as part of secure communications online, why shouldn't that be considered to be violating the patent?
"Your sure about that are you?"
Yes? The web was invented in '92.
Or are you saying the patent wasn't granted in '89?
All it would take is Google or one other company with adequately deep pockets to actually take this guy to court and that would be the last we'd hear of Mr. Spangenberg or his trollish little company.
It makes me wonder if the submitter (and editors) have any idea what SSL is.
As this is Slashdot, you can safely assume that neither do.
The problem here is not that the patent was filed before SSL was invented (about 1995) -- that could be fine, if SSL was using a patented technology that pre-dated its own invention.
The problem here is that the attorneys are accusing the practice of 'sending network records over a wire and encrypting them with a stream cipher', where in this case the cipher is (I believe RC4). However RC4 was invented in the 1980s and should pre-date this patent. I'm certain that somebody used it to encrypt network traffic in an almost identical manner, so there should be prior art.
Moreover, stream ciphers in general have been around for much longer than that. Someone somewhere has published/deployed this idea before. It should not be a live patent. Note that the case has never been tested by a court.
You must see the good in this man. He has set up well over 200 companies to make the point that software patents is a bad thing. He even tells this to all the companies and judges he can find. He will finally succeed and software patents will be abolished.
According to TFA, the patent apparently infringed upon has expired, however this mob can still sue people who used it in the past for the next six years.
So, if you start a new company now that uses SSL you should be in the clear.
I don't understand why the WWW was mentioned. SSL isn't tied to web technology. It makes me wonder if the submitter (and editors) have any idea what SSL is.
You can add onto it that the submitter and editors likely don't understand patents or the legal system, as well.
That's why any patent-related article on here turns into a shitstorm mere seconds away from invoking Godwin's law.
He may be on the correct side of the law as far as current patent law goes, but I'm of the opinion that, at least sometimes, the fact that it's prevalent means that it should be free. Particularly when it comes to computer software, and particularly when it comes to communications and the exchange of information. File formats should be able to be written and read without a license. You should be able to make your software communicate with others using network protocols that are unencumbered.
I don't know that I have an objection to software patents per se, but when it comes to file format standards and network communications standards, you should not have to pay in order to participate.
Marconi was sued by telegraph companies that thought they had a fifty year monopoly on morse code. The communications IP legal situation has been a sick joke since at least then.
"Your sure about that are you?"
Yes? The web was invented in '92.
Or are you saying the patent wasn't granted in '89?
And, more relevantly, HTTPS didn't appear until 1994. (Netscape originated it, as an extension to the HTTP standard -- you needed their browser, and their webserver to be able to use it.)
So, clearly this is all Netscape's fault.
'I don't understand why just because [SSL is] prevalent, it should be free.'
This statement is one of those really douchebaggy things that douchebags douche out.
All of that being said, SSL needs to be replaced with something better anyway.
a Proposed penalty is if you get convicted of being a "patent troll" and try to use a submarine patent (or purchase an otherwise inactive patent to use as a submarine patent) ALL patents held by you are rendered VOID and are now Prior Art as applies.
also to violate a patent you should have to hit each and every claim (no partial claims allowed) unless the claims form a complete set but have Common Sense branches (deploying a patent in a Fixed Mobile land Mobile Air Mobile Water manner would be one)
Any person using FTFY or editing my postings agrees to a US$50.00 charge
Now I am in danger if I activate SSL on my website?
No, because the patent has expired.
You are in danger if you enabled SSL[*] on your web site back when the patent was active. Then you can be sued now over it.
[*]: Or used any other of a wide range of symmetric encryptions facilitated by a handshake, web or no web.
Also, to clarify, this seems to not be over SSL itself, but rather over "using a shared seed value to generate pseudo-random key values at a transmitter and a receiver." RTFA on CipherLaw Blog.
Isn't CTR-mode use of a cipher block prior art? This was invented in 1979 by Dife and Hellman and in effect turns a key into a series of pseudo random values which are xored with the plain text.
Actually, patents were invented to force licensing of ideas, so that everyone can play. Somehow, in the past 200 years, we've changed that into "it's my ball and I'm going home".
Peter predicted that you would "deliberately forget" creation 2000 years ago...
When the democrats say, "you didn't build that", maybe they mean this guy?
Actually, Google has a track record of doing exactly that. They just fought (and lost) a case this last week to a patent troll company. In it, the jury awarded a 3.5% royalty of (bear with me here) the amount of demonstrated revenue increase for the previous year of infringement for U.S. revenues, plus 3.5% going forward until the patent expires. This amounts to an estimated $700-900 million over the next 4 years. http://www.reuters.com/article/2012/11/08/idUS136757+08-Nov-2012+HUG20121108
They could have settled for about half that based on the offers the patent holder made, but they went to the mattresses, and lost big time, even though the evidence was CLEARLY in favor of the patent inventor. (He was CTO at Lycos, who owned the patent before they went tits up and sold it back to the inventor, who formed the company which sued Google.)
So, even when Google KNOWS they're infringing on a valid patent, they still fight it to the end. Why would they start settling cases in which they know they are not infringing a patent?
http://en.wikipedia.org/wiki/Stream_cipher apparently somebody has patented something related to stream ciphers in 1946 , so I assume there is prior art somewhere there..
You're treating those businesses like sentient beings. Stop with that. A business does no more and no less than what the people in charge of the business want done. If you're a money-at-all costs scumbag, sure, that's how your business will operate. It's not a law of any sort that a business has to be run that way. And stop spreading the fiduciary-duty-to-shareholders bullshit, because it's tired and old and not true at all. Shareholders who invest in a business decide for themselves if their investment goals are aligned with those of the business. Nobody forces them to invest in a business that is not all about maximizing shareholder ROI.
A successful API design takes a mixture of software design and pedagogy.
At least Hitler used encryption, you Nazi.
Learn to love Alaska
This is just another in a long series of slashdot articles that have pointed out the broken nature of our patent system. What I have not seen is any serious proposals for fixing the issues beyond "throw it all out". I have to agree that making software (even software running in specific hardwire specifications) something that you cannot patent is superior to the current patenting solution. Something similar could be said about some of the pharmaceutical patenting that is going on as well (make it last "seven days" instead of "one", get to extend my patent).
What if we made patents peer reviewed by a group of high profile experts in the field in which the patent is filed. So notable software professionals would be consulted for software patents. This group would use a high bar on the "obviousness" and "prior art" test so that rewriting prior art into a different language and giving a slightly different spin would not make it past this group. The group would be paid based by on the (likely to be substantial) fees charged to the person filing the patent. This is how research articles are handled for the best scientific journals. If a patent is laughably far from being publish worthy for a reputable scientific journal, why are we letting it control millions (or billions) of dollars of commerce? Currently, we are forcing our higher courts to learn all types of arcana before they are able to kill a patent based on prior art and obviousness. Using a group of true experts (not the underpaid and overworked staff at the patent office) would do a lot to improve the situation. Patent lawyers are not a sufficient substitute.