[FYI] (Fwd) EDRI-gram - Number 2, 12 February 2003

["Axel H Horns" <horns@ipjur.com>]

------- Forwarded message follows -------
To:             	edri-news@edri.org
From:           	Bits of Freedom <info@bof.nl>
Subject:        	EDRI-gram - Number 2, 12 February 2003
Date sent:      	Wed, 12 Feb 2003 16:48:15 +0100

[ Double-click this line for list subscription options ] 


EDRI-gram
bi-weekly newsletter about digital civil rights in Europe
Number 2, 12 February 2003

------------------------------------------------------------------

CONTENTS:

1.  Internet censorship in Switzerland
2.  E-commerce directive transposition raises serious privacy and
     free speech concerns in France
3.  Critical draft EP report on safer internet action plan
4.  EUCD-implementation stalled in Finland
5.  Finnish companies oppose law to censor Internet
6.  Microsoft Passport does not comply with European privacy rules 7. 
UK parliamentary inquiry rejects data retention 8.  EDRI-gram
available in Spanish 9.  Agenda 10. About

------------------------------------------------------------------


1. INTERNET CENSORSHIP IN SWITZERLAND (contribution by Felix Rauch,
    SIUG)

In Switzerland, internet censorship is gaining ground. 2 recent events
demonstrate this development.

Last December, the examining magistrate of the canton Vaud issued a
command to many Swiss internet service providers (ISPs), to block
access to 3 websites. The websites, all hosted in the USA, contain
strong criticism of a.o. the Swiss courts and are prosecuted for
defamation. ISPs were also asked to modify their DNS-servers to
specifically block access to the domain appel-au-people.org

The 3 contested websites are:
http://www.appel-au-peuple.org/
http://de.geocities.com/justicecontrol/
http://www.swiss-corruption.com/

Even before the blocking became effective, mirrors immediately sprang
up at: http://www.c9c.net/swiss-corruption/info
http://www.freejustice.de/

In their press release about this case, the Swiss Internet User Group
(SIUG) and the Swiss Network operators Group point out that internet
blocking measures are easily bypassed and that article 16 of the Swiss
constitution guarantees to every person ‘the right to receive
information freely, to gather it from generally accessible sources and
to disseminate it.’

Most Swiss providers did not obey at first and appealed against the
command. The magistrate then ordered the directors of the companies to
appear in court in person. Guido Honegger of Swiss ISP Green refused
to bend under this pressure and is now facing a procedure for
disobedience. He plans to fight the command in court. Other ISPs like
e.g. Init Seven AG are redirecting traffic for the incriminated sites
to protest pages.

The blocking-orders coincide with a proposal from the Swiss federal
office of justice for a revision of the federal law on lotteries and
betting. In article 50 of the proposal, providers could be fined up to
one year in prison or a penalty of up to 1 Million Swiss francs
(approx. EUR 660.000) for ‘providing access to games that are not
allowed according to this law’. The Swiss Internet User Group is
concerned that this proposal is only the start of new legislation
providing for much wider censorship.

More reading:

Command by the canton Vaud (unofficial copy, French)
http://www.nrg4u.com:80/abuse/canton-de-vaud.pdf

Press release by SIUG and Swinog 13/12/02 (in German):
http://www.siug.ch/presse/Presse.20021213.txt

Press release ISP Green 30/01/03
http://www.green.ch/de/green/pressemitteilungen/pdf/green_freiheit.pdf

ISP Init7 explanation about the DNS-block (in German)
http://vaud.init7.net/

Federal Office of Justice (in 4 languages)
http://www.ofj.admin.ch/


2. E-COMMERCE DIRECTIVE IMPLEMENTATION RAISES SERIOUS PRIVACY AND
    FREE SPEECH CONCERNS IN FRANCE (Contribution by Meryem Marzouki,
    IRIS)

France has started the process of implementing the European Directive
on Electronic Commerce. The draft text of the Digital Economy Law
("Loi relative à l'économie numérique" or LEN in French) deals with
ISP liability, electronic contracts and unsolicited commercial emails,
cryptography, cybercrime, and satellite systems. Among them, the most
controversial provisions are those concerning cryptography, cybercrime
and ISP liability.

CRYPTOGRAPHY
Providers of cryptography services should provide upon request
decryption keys to authorised agents named by the Prime Minister. The
penalty for not complying with this obligation is a 2 years jail
sentence and a fine of EUR 30,000. When a crime or offence is
suspected, the public prosecutor or a judge may ask any expert to
decrypt data. If the incurred penalty exceeds a 2 years prison
sentence, military staff may be asked for help. In that case, the
decryption method and process would be kept secret, making it very
difficult for defence lawyers to question the outcome. The last
provision states that anyone having access to decryption keys should
provide them. The keys should be provided upon judicial request when
cryptography is used for commission, preparation, or facilitation of a
suspected crime or offence. The penalty is very high again: a jail
sentence of 3 years and a fine of EUR 45,000.

There are 3 major objections against these provisions. First, judicial
control is not ensured. The public prosecutor may start investigations
before any crime or offence has been committed. Secondly, they allow
for self-incrimination, and thus contradict the French law. Thirdly,
professional secrecy is no longer guaranteed for some professions, for
example for lawyers that exchange encrypted e-mails with their
clients.

ISP LIABILITY
On ISP liability, the draft is a third attempt to introduce a "notice
and take down" procedure in French legislation. Currently, a French
ISP can only be held liable for hosting illegal content if he does not
obey a judicial order to remove this content.

With the implementation of the Digital Economy Law, ISPs would not be
held liable if, after obtaining actual knowledge or becoming aware of
facts and circumstances indicating illegal activity, they act
expeditiously to remove or to disable access to the information. These
provisions reproduce the exact words of the E-Commerce Directive
(article 14). This would open the way for privatized censorship, where
the ISP has to decide what is illegal and what is not, after having
been notified by a third party on the basis of its private interests.
There is no provision for counter claims, seriously undermining
presumption of innocence and the right to a fair trial.

Moreover, the draft introduces the possibility of ordering French
providers to block access to foreign websites. This unprecedented
provision may open the door to further restrictions and censorship on
other media, and would undermine freedom of circulation on the
Internet.

On 5 February, EDRI-member IRIS launched a petition against provisions
on ISP liability and access filtering, in collaboration with 2 non
commercial ISPs, the French Human Rights League and a Federation of
Trade Unions. The still on-going petition has already been signed by
more than 40 French organizations and almost 400 French individuals.

More reading:

European Directive on Electronic Commerce (2000/31/EC)
http://europa.eu.int/cgi-bin/eur-lex/udl.pl?REQUEST=Seek-Deliver&COLLE
CTION=oj&SERVICE=eurlex&LANGUAGE=en&DOCID=2000l178p0001

Petition against ISP liability and access filtering provisions (in
French) http://www.iris.sgdg.org/actions/len/petition.html

IRIS Dossier (in French)
http://www.iris.sgdg.org/actions/len/index.html


3. CRITICAL DRAFT EP REPORT ON SAFER INTERNET ACTION PLAN

The EU Safer Internet Action Plan, than ran from 1999 to 2002, did not
deliver very impressive results, to put it mildly. Rapporteur Bill
Newton Dunn (UK Liberal Democrat) from the Parliamentary Committee on
Citizen’s Freedoms and Rights, Justice and Home Affairs (LIBE) wrote a
slashing draft report about the request to extend the plan for another
2 years. The original plan had 4 objectives: -Create a European
network of childporn hotlines -Develop European filtering and rating
systems -Encourage awareness actions -Organise an international
conference about the topic

Analysing the achievements, Newton Dunn states that nobody seems to
know the telephone numbers of the supposed network of hotlines in 10
member states. Secondly, in stead of validating existing filtering
software and carry out security tests against counter-attacks, the
express wish of the EP, the Commission financed 13 seemingly vague and
uncoordinated filtering projects. Awareness has not been promoted very
well either. ‘Projects such as the SUI project resulted in the
distribution of 60.000 copies of a brochure on safer Internet use to
teachers (...).’ Finally, no conference was organised, ‘and now, in
the rapporteur’s opinion, the money would be better spent with the
candidate countries.’

The report will be discussed in the next meeting of LIBE, on 17
February 2003. Next day LIBE will vote, followed in Plenary on 10
March.

More reading:

Revised Newton Dunn draft report (January 2003)
http://www.europarl.eu.int/meetdocs/committees/libe/20030217/481624en.
pdf


4. EUCD-IMPLEMENTATION STALLED IN FINLAND (contribution by Ville
    Oksanen, EFFI)

Last week, the Finnish parliament returned the national copyright law
proposal back to the ministry that originally drafted it. Electronic
Frontier Finland heavily criticized the anti-circumvention provisions
and other controversial issues of the proposal. After a parliamentary
hearing on the 31st of January, the chair of the hearing committee
announced it was impossible to continue with the proposal.

Mr Jyrki Katainen, member of the parliament committee and vice
chairman of the Conservative Party, confirmed to EFFI that the main
reason for this very rare dismissal was the extreme unclearness of the
law. The possibility of a 2 years jail sentence for the circumvention
of copy protection for example, would have posed a serious risk to
unwitting citizens.

Mr. Katainen was also worried the law would have harmed the Finnish
competitiveness as an information society. "The proposal was simply
overreaching", he said.

More reading:

EFFI press-release 31/01/03
http://www.effi.org/julkaisut/tiedotteet/pressrelease-2003-01-31.html

Slashdot
http://yro.slashdot.org/article.pl?sid=03/01/31/213251&mode=thread&tid
=153


5. FINNISH COMPANIES OPPOSE LAW TO CENSOR INTERNET (contribution
    by Ville Oksanen, EFFI)

A coalition of Finnish telecom and media companies has joined the
fight against proposed government legislation to make owners of
message boards liable for all content, similar to print media.
Additionally, Finnish government wants access to historical data to
trace anonymous postings. The law therefore requires publishers and
ISPs website to log practically all Internet traffic data for a period
of 3 months. In a message delivered to parliament on 5 February, the
companies say the law could have a chilling effect on commercial
communication.

Electronic Frontier Foundation has acted against the new law from the
beginning, warning it will stifle freedom of expression on the
Internet.

More reading:

Press release Finnish companies (06/02/03)
http://www.iccwbo.org/home/news_archives/2003/stories/finnish.asp

EFFI dossier about the law (Jan/Feb 2003)
http://www.effi.org/sananvapaus/index.en.html

Previous EFFI fight against mandatory data retention (25/11/02)
http://www.effi.org/julkaisut/tiedotteet/pressrelease-2002-11-25.html


6. MICROSOFT PASSPORT DOES NOT COMPLY WITH EUROPEAN PRIVACY RULES

Microsoft has agreed to change its Passport authentication system,
after the publication on 29 January of a very critical review by the
united EU privacy commissioners. Besides the Microsoft .NET Passport
system, the commissioners, united in the so-called Article 29 Working
Party, also examined the Liberty Alliance Project. The review
concludes with general guidelines for future on-line authentication
systems.

In order to comply with EU privacy rules, Microsoft agreed to
substantially modify the Passport system, "involving in particular a
radical change of the information flow".

Passport is a system that centralizes authentication and information
sharing for users on the internet. The system stores user information
such as addresses, ages, phone and credit card numbers and other
personal details in a large central database. With one click, users
can transfer their personal information to participating websites.

The most important consequence of the agreement is that users "will be
informed and empowered to decide as to which data they want to provide
and under which conditions these data will be processed by Microsoft
or by the participating websites".

Microsoft will have to enable users to decide on a site-by-site basis
whether they want to communicate their profile data or not. Some of
the changes involve giving information to users on how to open a
Passport account without using their real e-mail address. Microsoft
will have to reconfigure the user profile to allow users to fill out
the fields they choose, while leaving others blank. All changes have
to be made according to an agreed time line.

USA based privacy and consumers organisations, led by the Electronic
Privacy Information Center (EPIC), previously filed a complaint in
2001 with the United States Federal Trade Commission (FTC) regarding
Passport and other Microsoft products. The FTC ruled in 2002 that
Microsoft made false security and privacy promises about Passport.

Microsoft has made no formal statement regarding the issue but a
Microsoft spokesperson responded to the agreed changes of Passport
saying that "data protection is a dynamic process".

Simultaneously, other complaints about Microsoft are pending with EU
anti-trust regulators. A long running investigation involves the
bundling of Windows Media Player and alleged abuse of dominance in the
server market linked to Windows 2000. EU competition commissioner
Mario Monti recently announced to present conclusions in the first
half of 2003. A completely new complaint was filed this week by the
Computer & Communications Industry Association, representing a number
of large technology and media corporations, regarding the bundling of
applications with Windows XP and the misuse of a dominant market
position by Microsoft.

More reading:

Article 29 Data Protection Working Party: 'Working document on on-line
authentication services' 29/01/03
http://europa.eu.int/comm/internal_market/en/dataprot/wpdocs/wp68_en.p
df

EPIC archive on Passport
http://www.epic.org/privacy/consumer/microsoft/passport.html

Computer & Communications Industry Association (CCIA) v. Microsoft
http://www.ccianet.org/ms_eu.php3


7. UK PARLIAMENTARY INQUIRY REJECTS DATA RETENTION

In the UK, a parliamentary inquiry resulted in a firm rejection of
governmental plans for general data retention. In one piece of
proposed legislation Government expected phone companies, mobile
operators and Internet service providers to voluntarily keep logging
data for a period of up to 12 months. These data would reveal who has
been calling and e-mailing whom, which websites they had visited, and
even where people have been with their mobile phones. In their report,
the All Party Internet Group (APIG) concludes that the Government had
underestimated the costs of the scheme, that billing databases would
migrate abroad to escape regulation and that there were few incentives
for industry to help the government track technical change. To cap all
this, the scheme appeared to be in breach of Human Rights legislation
and despite a year of effort by the Home Office, no solution was in
sight.

The evidence heard by the parliamentary inquiry made it clear that the
proposed voluntary retention scheme had no hope of acceptance by
industry. The report also concludes that it would be impractical to
proceed with the fallback of mandatory data retention and strongly
recommends that the Home Office scrap their plans altogether and start
negotiations on a lower impact scheme of targeted "data preservation"
instead.

The group also examined existing pieces of legislation including the
Regulation of Investigatory Powers Act 2000 (RIPA) and recommended
that definition of communications data be improved.

More reading:

The APIG report 28/01/03
http://www.apig.org.uk/APIGreport.pdf


8. EDRI-GRAM IN SPANISH

 From now on, EDRI-gram will also be available in Spanish, usually 3
 days 
after the English edition. Translations will be provided by David
Casacuberta, secretary of the Spanish chapter of CPSR (Computer
Professionals for Social Responsibility). To receive the Spanish
EDRI-gram, please visit
http://www.edri.org/cgi-bin/mailman/listinfo/edri-grama/ or subscribe
by email: To: edri-grama-request@edri.org Subject: subscribe


9. AGENDA

17-28 February 2003 Geneva, Switzerland - Second Preparatory Meeting
on the World Summit Second preparatory meeting for the World Summit on
the Information Society to be held in Geneva from December 10-12 2003.
http://www.itu.int/wsis/preparatory/prepcom/prepcom2.html

25 February 2003 Kiev, Ukraine - Problems and prospects of Information
Society Development International conference organised by the
All-Ukrainian Foundation “Information Society of Ukraine” in close
cooperation with Ukrainian Institute of Information Society.
http://www.isu.org.ua/en/index.php

27-28 February 2003 Luxembourg, Luxembourg - 2 workshops on 'Safer
Internet' http://www.saferinternet.org/news/Events-feb2003.asp

10-12 March 2003 Malmo, Sweden - ASEM summit on Globalisation and ICT
http://www.iked.org/asem2003ict/program.html

15 March 2003 Nomination deadline for the world's most stupid security
measure. The Stupid Security Award will be presented on 3 April 2003,
during the CFP-conference.
http://www.privacyinternational.org/activities/stupidsecurity/

25 March 2003 - UK Big Brother Awards
For the 5th time, Privacy International will present awards for: Worst
Public Servant; Most Invasive Company; Most Appalling Project; Most
Heinous Government Organisation & Lifetime Menace.
http://www.privacyinternational.org/bigbrother/uk2003/

1-4 April 2003 New York, USA - CFP 2003, including international Big
Brother Award presentation.
http://www.cfp2003.org/cfp2003/program.html

22-24 April 2003 St Petersburg, Russia - Building the Information
Commonwealth International Conference on Information Technologies and
Building Prospects for the Development of Civil Society Institutions
in the CIS Countries. http://www.communities.org.ru/conference

6-7 May 2003 Padova, Italy - Information Society Visions and
Governance Colloquium in preparation for the World Summit on the
Information Society, organised by the European Institute for
Communication and Culture (EURICOM), in co-operation with the
University of Padua (Padova) Contact for information: Claudia
Padovani, Dipartimento di Studi Storici e Politici, Università di
Padova e-mail: claudia.padovani@unipd.it


10. ABOUT

EDRI-gram is a bi-weekly newsletter from European Digital Rights, an
association of privacy and civil rights organisations in Europe.
Currently EDRI has 10 members from 7 European countries. EDRI takes an
active interest in developments in the EU accession countries and
wants to share knowledge and awareness through the EDRI-grams. In
general, all contributions, suggestions for content or agenda-tips are
most welcome. Please e-mail your contributions to the editor, Sjoera
Nas, edrigram@edri.org .

Information about EDRI and its members:
http://www.edri.org/

Subscription Information

subscribe/unsubscribe web interface
http://www.edri.org/cgi-bin/mailman/listinfo/edri-news

subscribe by email
To: edri-news-request@edri.org
Subject: subscribe

You will receive an automated email asking to confirm your request.


_______________________________________________

------- End of forwarded message -------


-- 
To unsubscribe, e-mail: debate-unsubscribe@lists.fitug.de
For additional commands, e-mail: debate-help@lists.fitug.de