UNIX System Administration Handbook - Evi Nemeth [468]
These legal cases offer up a steaming smorgasbord of some of the murkiest issues in computer law, so they’re being watched with great interest by Electronic Frontier Foundation and computer law types. See the most excellent Openlaw DVD/DeCSS FAQ maintained by Rob Warren at www.cssfaq.org for more opinions and details.
CyberPatrol makes Internet filtering software that religious groups are promoting to parents, schools, and libraries to protect children from objectionable content. A Canadian and a Swede wrote a tool called cphack that enabled them to decrypt the software’s blocking list to see exactly which web sites were being blocked, how high the error rate was, and what nonobvious agendas might be present. They reported, for example, that anyone who criticized the software was blocked in all categories.
Mattel, which owns CyberPatrol, sued the authors of the tool, claiming that the CyberPatrol license forbids reverse engineering. Mattel obtained a preliminary injunction against the distribution of the software, but unfortunately the case never came to trial; it was settled just before the trial was scheduled to start. The authors of the tool sold it to Mattel for $1 and agreed to a consent decree. It seemed that the authors had caved in (lawyers’ bills aside!), but looking closely, it appears that Mattel is now attempting to assert ownership of a tool that was originally released under the GNU Public License.
Mattel hoped to use its newly acquired intellectual property rights to prevent cphack from being copied on the Internet (as if that would ever work). But because cphack ’s authors released it under the GPL, unlimited distribution of the original program is permitted even if Mattel owns the copyright. Once a piece of software is publicly released under liberal terms such as those of the GPL, it can’t be “unreleased.”
Privacy
Privacy has always been difficult to safeguard, but with the rise of the Internet it’s in more danger than ever. During a recent incident at the University of Michigan, for example, the medical records of patients in the University of Michigan health care system were inadvertently published on the Internet. The data was freely available for months until a student noticed the oversight.
Another big privacy scandal, this one intentional, has involved DoubleClick.net, an advertising agency that provides many of the banner ads shown on web pages. DoubleClick promised for years that users in their system were never tracked or identified. Recently, however, they purchased a company that does data mining and began gathering data from each user that visited a web page containing a DoubleClick ad. The furor that ensued caused DoubleClick to withdraw the project for now and to hire two high-powered lawyers into “privacy” positions to find a way for DoubleClick to legally stalk the users who are subjected to their ads.
DoubleClick is small potatoes compared to a new threat to privacy from the combination of our ISPs and a company called Predictive Networks. According to the PRIVACY Forum Digest, Predictive, with help from ISPs, plans to collect the URLs you visit, the keywords you type into search engines, and other information by watching your work on the web. From this data, they will build a digital “signature” of you and use that profile to target Internet content and ads just to you.
Predictive says that your information is “anonymous” and that you can trust everyone involved: Predictive’s employees, the ISPs’ employees, the advertisers, the content providers—everyone. You can request a copy of your digital signature, but you might have to pay for it. You can also opt out of this “service,” but your Internet connectivity through that ISP might cost more or be rescinded. As of this writing, Predictive’s web site (www.predictivenetworks.com) still has no privacy policy and not much hard information about what they really do. The PRIVACY Forum Digest article (V09, #13, www.vortex.com) includes more details