Slashdot Mirror
Meet the Lawyer Suing Anyone Who Uses SSL
Sparrowvsrevolution writes "Since 2008, Dallas, Texas attorney Erich Spangenberg and his company TQP have been launching suits against hundreds of firms, claiming that merely by using SSL, they've violated a patent TQP acquired in 2006. Nevermind that the patent was actually filed in 1989, long before the World Wide Web was even invented. So far Spangenberg's targets have included Apple, Google, Intel, Dell, Hewlett-Packard, every major bank and credit card company, and scores of web startups and online retailers, practically anyone who encrypts pages of a web sites to protect users' privacy. And while most of those lawsuits are ongoing, many companies have already settled with TQP rather than take the case to trial, including Apple, Amazon, Dell, and Exxon Mobil. The patent has expired now, but Spangenberg can continue to sue users of SSL for six more years and seems determined to do so as much as possible. 'When the government grants you the right to a patent, they grant you the right to exclude others from using it,' says Spangenberg. 'I don't understand why just because [SSL is] prevalent, it should be free.'"
Who's up for forming a lynch mob?
Nevermind that the patent was actually filed in 1989, long before the World Wide Web was even invented.
Now, don't get me wrong, this is patent trolling at it's absolute worst, but what exactly is this quote supposed to mean? We (rightly) complain all the freakin time how people shouldn't be granted patents just by adding "on the internet" or "on a computer", we can't have it both ways. If there is a valid patent to provide secure communications through USPS and the key steps of that patent are being performed as part of secure communications online, why shouldn't that be considered to be violating the patent?
The problem here is not that the patent was filed before SSL was invented (about 1995) -- that could be fine, if SSL was using a patented technology that pre-dated its own invention.
The problem here is that the attorneys are accusing the practice of 'sending network records over a wire and encrypting them with a stream cipher', where in this case the cipher is (I believe RC4). However RC4 was invented in the 1980s and should pre-date this patent. I'm certain that somebody used it to encrypt network traffic in an almost identical manner, so there should be prior art.
Moreover, stream ciphers in general have been around for much longer than that. Someone somewhere has published/deployed this idea before. It should not be a live patent. Note that the case has never been tested by a court.
Also, to clarify, this seems to not be over SSL itself, but rather over "using a shared seed value to generate pseudo-random key values at a transmitter and a receiver." RTFA on CipherLaw Blog.
You must see the good in this man. He has set up well over 200 companies to make the point that software patents is a bad thing. He even tells this to all the companies and judges he can find. He will finally succeed and software patents will be abolished.
According to TFA, the patent apparently infringed upon has expired, however this mob can still sue people who used it in the past for the next six years.
So, if you start a new company now that uses SSL you should be in the clear.
Marconi was sued by telegraph companies that thought they had a fifty year monopoly on morse code. The communications IP legal situation has been a sick joke since at least then.
"Your sure about that are you?"
Yes? The web was invented in '92.
Or are you saying the patent wasn't granted in '89?
And, more relevantly, HTTPS didn't appear until 1994. (Netscape originated it, as an extension to the HTTP standard -- you needed their browser, and their webserver to be able to use it.)
So, clearly this is all Netscape's fault.
Also, to clarify, this seems to not be over SSL itself, but rather over "using a shared seed value to generate pseudo-random key values at a transmitter and a receiver." RTFA on CipherLaw Blog.
Isn't CTR-mode use of a cipher block prior art? This was invented in 1979 by Dife and Hellman and in effect turns a key into a series of pseudo random values which are xored with the plain text.
When the democrats say, "you didn't build that", maybe they mean this guy?
At least Hitler used encryption, you Nazi.
Learn to love Alaska
This is just another in a long series of slashdot articles that have pointed out the broken nature of our patent system. What I have not seen is any serious proposals for fixing the issues beyond "throw it all out". I have to agree that making software (even software running in specific hardwire specifications) something that you cannot patent is superior to the current patenting solution. Something similar could be said about some of the pharmaceutical patenting that is going on as well (make it last "seven days" instead of "one", get to extend my patent).
What if we made patents peer reviewed by a group of high profile experts in the field in which the patent is filed. So notable software professionals would be consulted for software patents. This group would use a high bar on the "obviousness" and "prior art" test so that rewriting prior art into a different language and giving a slightly different spin would not make it past this group. The group would be paid based by on the (likely to be substantial) fees charged to the person filing the patent. This is how research articles are handled for the best scientific journals. If a patent is laughably far from being publish worthy for a reputable scientific journal, why are we letting it control millions (or billions) of dollars of commerce? Currently, we are forcing our higher courts to learn all types of arcana before they are able to kill a patent based on prior art and obviousness. Using a group of true experts (not the underpaid and overworked staff at the patent office) would do a lot to improve the situation. Patent lawyers are not a sufficient substitute.