Boing Boing » un

Leaked: ITU's secret Internet surveillance standard discussion draft

Cory Doctorow — Thu, 06 Dec 2012 07:54:23 +0000

Yesterday morning, I wrote about the closed-door International Telecommunications Union meeting where they were working on standardizing "deep packet inspection" -- a technology crucial to mass Internet surveillance. Other standards bodies have refused to touch DPI because of the risk to Internet users that arises from making it easier to spy on them. But not the ITU.

The ITU standardization effort has been conducted in secret, without public scrutiny. Now, Asher Wolf writes,

I publicly asked (via Twitter) if anyone could give me access to documents relating to the ITU's DPI recommendations, now endorsed by the U.N. The ITU's senior communications officer, Toby Johnson, emailed me a copy of their unpublished policy recommendations.
OOOPS!
5 hours later, they emailed, asking me not to publish it, in part or in whole, and that it was for my eyes only.
Please publish it (credit me for sending it to you.)
Also note:
1. The recommendations *NEVER* discuss the impact of DPI.
2. A FEW EXAMPLES OF POTENTIAL DPI USE CITED BY THE ITU:
"I.9.2 DPI engine use case: Simple fixed string matching for BitTorrent"
"II.3.4 Example “Forwarding copy right protected audio content”"
"II.3.6 Example “Detection of a specific transferred file from a particular user”"
"II.4.2 Example “Security check – Block SIP messages (across entire SIP traffic) with specific content types”"
"II.4.5 Example “Identify particular host by evaluating all RTCP SDES packets”"
"II.4.6 Example “Measure Spanish Jabber traffic”"
"II.4.7 Example “Blocking of dedicated games”"
"II.4.11 Example “Identify uploading BitTorrent users”"
"II.4.13 Example “Blocking Peer-to-Peer VoIP telephony
with proprietary end-to-end application control protocols”"
"II.5.1 Example “Detecting a specific Peer-to-Peer VoIP telephony with proprietary end-to-end application control protocols”"

Hit the jump for more of Asher's analysis and the download link:

3. Security threats against DPI entities is listed as:
- Destruction of DPI-related information;
- Corruption or modification of DPI-related information;
- Theft, removal or loss of DPI-related information;
- Disclosure of DPI-related information;
- Interruption of services (specifically mentions DoS.)

DRAFT NEW RECOMMENDATION ITU-T Y.2770 PROPOSED FOR APPROVAL AT THE WORLD TELECOMMUNICATION STANDARDIZATION CONFERENCE (WTSA-12) [ZIPped DOCX file]

DRAFT NEW RECOMMENDATION ITU-T Y.2770 PROPOSED FOR APPROVAL AT THE WORLD TELECOMMUNICATION STANDARDIZATION CONFERENCE (WTSA-12) [ZIPped DOCX file] CoralCache mirror

(Thanks, Asher!)

UN's International Telecommunications Union sets out to standardize bulk surveillance of Internet users by oppressive governments

Cory Doctorow — Wed, 05 Dec 2012 13:53:18 +0000

The International Telecommunications Union, a UN agency dominated by veterans of incumbent telcoms who mistrust the Internet, and representatives of repressive governments who want to control it, have quietly begun the standardization process for a kind of invasive network spying called "deep packet inspection" (DPI). Other standards bodies have shied away from standardizing surveillance technology, but the ITU just dived in with both feet, and proposed a standard that includes not only garden-variety spying, but also spying "in case of a local availability of the used encryption key(s)" -- a situation that includes the kind of spying Iran's government is suspected of engaging in, when an Iranian hacker stole signing keys from the Dutch certificate authority DigiNotar, allowing for silent interception of Facebook and Gmail traffic by Iranian dissidents.

The ITU-T DPI standard holds very little in reserve when it comes to privacy invasion. For example, the document optionally requires DPI systems to support inspection of encrypted traffic “in case of a local availability of the used encryption key(s).” It’s not entirely clear under what circumstances ISPs might have access to such keys, but in any event the very notion of decrypting the users’ traffic (quite possibly against their will) is antithetical to most norms, policies, and laws concerning privacy of communications. In discussing IPSec, an end-to-end encryption technology that obscures all traffic content, the document notes that “aspects related to application identification are for further study” – as if some future work may be dedicated to somehow breaking or circumventing IPSec.
Several global standards bodies, including the IETF and W3C, have launched initiatives to incorporate privacy considerations into their work. In fact, the IETF has long had a policy of not considering technical requirements for wiretapping in its work, taking the seemingly opposite approach to the ITU-T DPI document, as Germany pointed out in voicing its opposition to the ITU-T standard earlier this year. The ITU-T standard barely acknowledges that DPI has privacy implications, let alone does it provide a thorough analysis of how the potential privacy threats associated with the technology might be mitigated.
These aspects of the ITU-T Recommendation are troubling in light of calls from Russia and a number of Middle Eastern countries to make ITU-T Recommendations mandatory for Internet technology companies and network operators to build into their products. Mandatory standards are a bad idea even when they are well designed. Forcing the world’s technology companies to adopt standards developed in a body that fails to conduct rigorous privacy analysis could have dire global consequences for online trust and users’ rights.

Adoption of Traffic Sniffing Standard Fans WCIT Flames [CDT]

Copyright versus human rights

Cory Doctorow — Fri, 26 Oct 2012 19:42:15 +0000

On TechDirt, Leigh Beadon's taken an excellent, in-depth look at the way that UN instruments and treaties address copyright and human rights.

UN's copyright agency won't let the Pirate Party in

Cory Doctorow — Thu, 04 Oct 2012 17:00:20 +0000

International non-governmental organizations with an interest in copyright and related issues have always been admitted to the United Nations's World Intellectual Property Organization (WIPO) as observers (I was once such an accredited observer, working on behalf of the Electronic Frontier Foundation). Historically, the NGO "observers" at WIPO were industry groups, such as the motion picture lobbyists from the MPA, the record industry lobbyists from IFPI, and so on. But starting in the middle of the last decade, public interest groups like Creative Commons and EFF started to attend these meetings, adding balance and an emphasis on human rights to the treaty-making debates.

Pirate Party International satisfies every one of the criteria used to evaluate NGOs for WIPO observer status. Nevertheless, WIPO's general assembly has postponed approval of PPI's application for status. According to a report by Knowledge Ecology International founder James Love, the assembly rejected the Pirates after pressure from Switzerland, the USA, France and other EU nations:

US, Switzerland [and] France raised objections in the informal consultations, and [...] some other European countries wanted to raise objections, but found it awkward given the recent success of domestic Pirate Parties in national elections. The USA said it asked for a hold on the decision until WIPO could decide if it wanted to accept political parties as WIPO observers. One delegate said European countries were concerned that the Pirate Parties would take “political action” back home when they disagreed with positions taken by the official delegates at the WIPO meetings”

PPI blocked from becoming observer members of WIPO

WIPO's Broadcasting Treaty is back: a treaty to end the public domain, fair use and Creative Commons

Cory Doctorow — Sat, 11 Aug 2012 09:19:30 +0000

The UN's World Intellectual Property Organization's Broadcasting Treaty is back. This is the treaty that EFF and its colleagues killed five years ago, but Big Content won't let it die. Under the treaty, broadcasters would have rights over the material they transmitted, separate from copyright, meaning that if you recorded something from TV, the Internet, cable or satellite, you'd need to get permission from the creator and the broadcaster to re-use it. And unlike copyright, the "broadcast right" doesn't expire, so even video that is in the public domain can't be used without permission from the broadcaster who contributed the immense creativity inherent in, you know, pressing the "play" button. Likewise, broadcast rights will have different fair use/fair dealing rules from copyright -- nations get to choose whether their broadcast rights will have any fair dealing at all. That means that even if you want to reuse video in a way that's protected by fair use (such as parody, quotation, commentary or education), the broadcast right version of fair use might prohibit it.

Worst of all: There's no evidence that this is needed. No serious scholarship of any kind has established that creating another layer of property-like rights will add one cent to any country's GDP. Indeed, given that this would make sites like Vimeo and YouTube legally impossible, it would certainly subtract a great deal from nations' GDP -- as well as stifling untold amounts of speech and creativity, by turning broadcasters into rent-seeking gatekeepers who get to charge tax on videos they didn't create and whose copyright they don't hold.

And since the broadcast right is separate from copyright, permissive copyright licenses like Creative Commons would not apply. That means that if you made a CC-licensed video -- as tens of millions of creators have -- that the web-host, the cablecaster, the satellite company or the broadcaster that made it available to the public could essentially strip off the license you provided and go back to an all-rights-reserved model, with them in the driver's seat.

Thanks, WIPO, for showing us once again what a corrupt, anti-creator, anti-free-speech, economically backwards waste of time and space you are.

During the last hours of the meeting, the WIPO Committee pursued discussions that led to the adoption of a single text titled “Working document for a treaty on the protection of broadcasting organizations” (which has not been published as of today)3. This working document will constitute the basis of further discussions to be undertaken in November in Geneva, which WIPO hopes will conclude with a consensus document to be signed as a treaty early 2013. If WIPO convenes this conference it is because members have reached a decision and a new treaty may be born.
This procedural detail is a really important one — despite there being no international consensus, WIPO is pushing for a treaty to be signed quickly. This is actually a cruel trend in other WIPO negotiations. In the past, it has seemed like the WIPO bureaucracy has pushed for a conclusion of treaties just because they have been in negotiation for a long period of time. For example, another long-running negotiation led to the adoption of a treaty about performance rights that was opposed by many.
We urge country Members to say no to the WIPO Broadcasting treaty—as they have said in the past. We continue to believe the preferable model for addressing these issues is the narrower signal-based approach in the Brussels Satellite Convention.

Negotiations for a 2014 WIPO Broadcasting Treaty Are Back

WIPO caught secretly funneling cash to North Korea to buy patent database computers

Cory Doctorow — Fri, 06 Apr 2012 23:36:29 +0000

A trusted insider source writes, "A real blockbuster of bizarre at WIPO [ed: The World Intellectual Trade Organization, the UN body responsible for copyright and patent treaties]. It seems that [WIPO director general] Francis Gurry has personally approved payment for new computer equipment to go to North Korea to modernise their patent office, and that WIPO have tried to do it by going around the UN office in South Korea designed to ensure that UN sanctions are not broken. The only thing that stopped this transaction taking place was that the Bank of America was prevented from transferring WIPO's money to China. The bizarre bit is that WIPO is trying to argue that what they were doing is inherently legal because it is development assistance. Development assistance, in this case, designed to help a rogue state violate patent protection, is what it looks like. The US and a few other countries are objecting to this, for obvious reasons, but it seems to me this is an example of WIPO doing the opposite of what is in the interest of patent holders and really everyone else as well."

In that letter, also obtained by Fox News, Kateb declared that so far as WIPO staffers could tell, WIPO’s member states “had not been consulted and have no knowledge of this project. Thus, they were not given an opportunity to review or object to it.” The project, Kateb said, “was allegedly approved directly by the director general.”
Gurry denied at the meeting with diplomats that WIPO’s technology transfer violated any international sanctions efforts. He subsequently circulated to the attending ambassadors a WIPO legal memorandum -- written by the office of WIPO legal counsel Edward Kwakwa -- which claimed that the computer exports were “part of WIPO’s technical assistance program,” which “does not violate any U.N. Security Council sanctions.”
The memo acknowledged that payment for the computers had been blocked by U.S. sanctions laws “enacted in part to implement” the binding U.N. sanctions. But it also declared that “WIPO, as an international organization, is not bound by the U.S. national law in this matter” and was still looking for ways to pay for the shipment.

EXCLUSIVE: Cash for computers: Is the U.N. busting its own sanctions in North Korea?

FCC commissioner: don't let the Internet fall into the UN's hands

Cory Doctorow — Wed, 22 Feb 2012 02:59:50 +0000

FCC Commissioner Robert M. McDowell has a WSJ op-ed condemning a treaty proposed at the International Telecommunications Union, the UN agency that oversees global phone systems, which would transfer much of Internet governance to the UN.

Commissioner McDowell correctly asserts that transferring governance to the ITU would be bad for Internet freedom. There are few UN specialized agencies that are more ossified and more prone to being gamed by the world's totalitarian regimes than the ITU. One UN acquaintance of mine memorably referred to the ITU as the place "where superannuated telco bureaucrats go to die." And let's not forget the vital role that ITU designates filled in creating surveillance and censorship regimes established by the failing governments of Tunisia and Egypt (and the similar role they're likely playing in other regional nations in the midst of popular uprisings).

But it's pretty rich for someone from the ~~Obama administration~~ US government to go around talking about how the Internet is in danger from political interference from special interests. This is the administration that gave us SOPA and the TPP, that argues that ACTA can be put into law without an act of Congress, and that has made a habit of extrajudicially seizing .com and .net domains on the sloppy say-so of its political donors from the entertainment industry.

I agree with Commissioner McDowell that the Internet needs to be free of political interference. I agree that this won't happen at the ITU.

But that's where we part ways. McDowell describes a present-day Internet where wise American stewards neutrally steer the net's course. I see a world where political hacks and appointees from the lobbyist/regulator revolving-door are ready to destroy the Internet to maximize profits for one or another industry, and where an amok defense industry is ready to destroy whatever is left after Big Content gets through with its dirty work.

The Internet does need stewards, and the Obama administration has spectacularly demonstrated that it is unfit to carry out that stewardship.

Merely saying "no" to any changes to the current structure of Internet governance is likely to be a losing proposition. A more successful strategy would be for proponents of Internet freedom and prosperity within every nation to encourage a dialogue among all interested parties, including governments and the ITU, to broaden the multi-stakeholder umbrella with the goal of reaching consensus to address reasonable concerns. As part of this conversation, we should underscore the tremendous benefits that the Internet has yielded for the developing world through the multi-stakeholder model.
Upending this model with a new regulatory treaty is likely to partition the Internet as some countries would inevitably choose to opt out. A balkanized Internet would be devastating to global free trade and national sovereignty. It would impair Internet growth most severely in the developing world but also globally as technologists are forced to seek bureaucratic permission to innovate and invest. This would also undermine the proliferation of new cross-border technologies, such as cloud computing.

The U.N. Threat to Internet Freedom (via Reddit)

WIPO's secret, corporate-run trademark enforcement meeting

Cory Doctorow — Sat, 22 Oct 2011 11:15:24 +0000

The World Intellectual Property Organization is hosting an off-the-books meeting in the Philippines on trademark enforcement, with speakers from Louis Vuitton, Chanel, the Swiss Watch Federation. The meeting wasn't announced on WIPO's website, and it exclusively features speakers who support greater enforcement, with no one speaking for moderation and balance.

WIPO's own "Development Agenda" requires the organization to "approach intellectual property enforcement in the context of broader societal interests and especially development-oriented concerns, with a view that 'the protection and enforcement of intellectual property rights should contribute to the promotion of technological innovation and to the transfer and dissemination of technology, to the mutual advantage of producers and users of technological knowledge and in a manner conducive to social and economic welfare, and to a balance of rights and obligations.'"

It's hard to see how holding secret meetings run by major corporations who support more invasive searches, restrictions on the resale of goods, and more private enforcement rights uphold that principle.

1st PHILIPPINE ANTI-COUNTERFEITING AND PIRACY SUMMIT (PDF) [craphound.com]

WIPO's Broadcast Treaty is back: copyright nuts want to steal the public domain, kill Creative Commons, and give copyright over your videos to YouTube and other streamers

Cory Doctorow — Thu, 07 Jul 2011 04:23:27 +0000

One of the major projects I worked on at the Electronic Frontier Foundation was working to kill the World Intellectual Property Organization's "Broadcast Treaty," a treaty that would have given a new form of copyright to broadcasters. Under this proposal, the mere act of broadcasting audio or video would trigger a new right for the broadcaster to control all copies made from that broadcast. This right wouldn't be subject to the same fair use or fair dealing rules, and would cover works that were in the public domain. It would also give broadcasters the right to control copies of works where the actual creator has explicitly allowed copies to be made, such as Creative Commons works.

The treaty died just around the time I left EFF, and I like to think I had a small part in killing this treaty. As did you, if you were one of the thousands and thousands of Boing Boing and Slashdot readers who contacted your government, or wrote to WIPO in protest. There was plenty to speak out about, such as the handouts opposing the treaty being spirited away and hidden in the toilets, or the WIPO administration trying to lock public interest groups out of important related meetings.

But now, the Broadcast Treaty is back, and with a vengeance. The new WIPO Broadcast Treaty incorporates the two most controversial proposals from the original one.

First, "technology neutrality," which is WIPO-speak for "this applies to the Internet," which is to say, YouTube and Vimeo would get to control copies of all the works that they stream (as would Hulu and other streaming services), even CC-licensed works, even public domain works, even uses that would be fair use or fair dealing under copyright.

Second, "technical measures," which is WIPO-speak for DRM. This means that laws that make it illegal to break DRM that's used to restrict access to copyrighted works would be extended to DRM that's used to restrict the use of uncopyrighted, uncopyrightable, public domain works, as well as Creative Commons-licensed works (even though the CC licenses actually prohibit the use of DRM in connection with them).

EFF is on the scene, and Gwen Hinze and Richard Esguerra have written a great primer on the issues at hand. Be prepared for another long and vicious fight, gang -- and watch out, the broadcasters want to steal the public domain from you.

It's Back: WIPO Broadcasting Treaty Returns From The Grave

US, EU want to delay copyright treaty to help blind people for 3-5 years

Cory Doctorow — Tue, 19 Apr 2011 00:45:21 +0000

Jamie Love sez, "On April 15, 2011, the European Union participated in informal negotiations on the World Intellectual Property Organization treaty for the blind. The meeting was held at the US Embassy in Geneva. The EU proposed a 3 to 5 year delay in even considering a treaty. The US position is reportedly quite similar to the EU. The URL links to the text of the EU proposal, and provides additional context."

The combination of the soft recommendation and the monitoring and delay in action advocated by the European Commission and the USPTO is widely seen as a face saving way for the Obama Administration and the European Commission to kill the treaty, or at least to delay it so long its proponents can no longer maintain their advocacy efforts.
At this point, advocates of the treaty will be looking for help in changing the positions of the European Commission and the US government -- the two groups now blocking action on the treaty.
* Within the US government, the USPTO head David Kappos and the White House have dug in against the treaty.
* In Europe, the European Parliament has held two large public meetings on the treaty, sent several letters and questions to the Commission, and plans a vote on the treaty proposal.
* The US Congress has yet to show any support for the treaty.

15 April European Union proposal: 3 to 5 year delay in negotiations on a copyright treaty for blind persons

WIPO proposes punishing, extortionist-friendly trademark treaty aimed at eBay, Google, and Twitter

Cory Doctorow — Wed, 23 Mar 2011 03:31:30 +0000

The fun-loving weirdos at the World Intellectual Property Organization have a new and terrible wheeze they want to unleash upon the world: a treaty that would require "intermediaries" (web-hosts, ISPs, social networking sites, auction sites, etc) to enforce trademarks on behalf of mark-holders. Under the proposal, these companies and organizations would not only have to delete material that is alleged to infringe on a trademark, they'd also have to narc out their users, supplying IP addresses and other information to the trademark holders, without a court order.

Combine this with the current vogue to copyright trolling, where scumbag lawyers send out indiscriminate shakedown letters demanding copyright "settlements," these being sums priced below what it would cost a victim to get legal advice as to whether they should cough up, and you've got the making of a fine racket for the next generation of legal fraudsters, bottom-feeders and blackmailers.

I love that this UN agency has made its mission to provide full employment for extortionists and trademark lawyers.

English : Standing Committee on the Law of Trademarks, Industrial Designs and Geographical Indications : Twenty-Fifth Session (Thanks, Nick!)

UN approves military intervention to protect Free Benghazi

Cory Doctorow — Thu, 17 Mar 2011 17:24:39 +0000

The UN Security Council has approved air strikes against Gadaffi loyalist forces and the Gadaffi mercenary army as they advance on "Free Benghazi," the Libyan rebel stronghold. In response, Gadaffi told a Portuguese TV station, "This is craziness, madness, arrogance. If the world gets crazy with us we will get crazy too. We will respond. We will make their lives hell because they are making our lives hell. They will never have peace." The no-fly zone and intervention will be enforced with support from Arab League members who earlier passed a resolution calling on the UN to take action (the Arab League has always had a fraught relationship with Gadaffi, whose presence at League meetings has been marked by the aforementioned "crazy").

7.05pm ET: There's some very impressive singing in central Benghazi, accompanied by celebratory gunfire, right now, based on al-Jazeera's footage.
An al-Jazeera English reporter, Tony Birtley, later says: "I haven't been hugged by so many people since my daughter's birthday party."
7.11pm ET: US enforcement of a no-fly zone in Libya could begin by Sunday or Monday, according to anonymous US officials quoted by AP, and would involve "jet fighters, bombers and surveillance aircraft".
7.16pm ET: Italy announces it is opening its air force and naval bases in Sicily for operations against Libya - the obvious spot to base US and British jets.
The Berlusconi government may have had relatively warm relations with Libya, but Italy's Nato obligations gave it little choice but to allow other members to use its bases.

Libya resolution: UN security council air strikes vote - as it happened

Libya's UN mission asks world to defend Libyans from Gadaffi

Cory Doctorow — Mon, 21 Feb 2011 05:08:59 +0000

Libya's UN ambassadors have joined the ranks of Libyan diplomats around the world to denounce Gadhafi's brutal crackdown on the popular uprising across the country. The entire Libyan UN diplomatic has appealed to the Security Council to defend their countrymen from the crackdown.

Dabbashi urged the international community to impose a no-fly zone over Libya to prevent mercenaries, weapons and other supplies from reaching Gadhafi and his security forces.
Dabbashi also said he was not resigning.
The diplomat says the Libyan delegation is also urging the International Criminal Court to investigate possible crimes against humanity committed against the Libyan people during the current protests.

Libya's UN ambassadors are calling for leader Col. Moammar Gadhafi to step down.

(Image: Colonel Gadaffi is a great leader!, a Creative Commons Attribution Share-Alike (2.0) image from quinnanya's photostream)

UNESCO's bizarre World Anti-Piracy Observatory

Cory Doctorow — Thu, 06 May 2010 16:26:58 +0000

Claude sez,

UNESCO announced the launch of its World Anti-Piracy Observatory in a YouTube video on April 21, 2010, but according to French Wikipedia - an entry coyly started as "193.242.192.9" - the idea hearkens back to 2005, and reeks of it.
Particularly notable: WAPO's "collection of national copyright laws", where each country's page is linked to a "Disclaimer" in which UNESCO claims copyright on the content of the collection and restricts its use to educational, non commercial purposes - even though in most cases, they simply downloaded the copyright law from the official site, renamed the file and re-uploaded it on the UNESCO server.
There are also some gems of inaccuracy in the countries' PDFs that are linked to in the sections of WAPO that are listed in the left column - but putting copyright laws that are either in the public domain or copyrighted to the country's parliament under UNESCO's own copyright is the next-to-worst one. The worst one being, of course the use of the word "piracy" - which even WIPO has given up long ago.
As messages about these and other issues sent by several people to the address provided in WAPO's "Contact Us" page remain systematically unanswered, it would be nice if BoingBoing could write something about WAPO, because it would be more difficult for them to ignore it.

World Anti-Piracy Observatory (Thanks, Claude!)