The Future of Cybertravel: Legal Implications of the Evasion of Geolocation
This is a modal window.
The media could not be loaded, either because the server or network failed or because the format is not supported.
Formal Metadata
| Title |
| |
| Title of Series | ||
| Number of Parts | 122 | |
| Author | ||
| License | CC Attribution 3.0 Unported: You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor. | |
| Identifiers | 10.5446/40594 (DOI) | |
| Publisher | ||
| Release Date | ||
| Language |
Content Metadata
| Subject Area | ||
| Genre | ||
| Abstract |
|
DEF CON 1952 / 122
3
5
10
11
12
22
23
24
30
31
32
38
43
46
47
49
51
54
56
59
60
62
71
73
76
84
85
88
92
93
96
97
98
104
106
109
112
113
115
119
00:00
Address spaceRight anglePhysical lawCodeCybersexTerm (mathematics)Student's t-testWebsiteInternetworking
02:53
Computer clusterConnected spaceComputer networkAddress spaceExecution unitCommercial Orbital Transportation ServicesSweep line algorithmInternetworkingMaxima and minimaType theoryMultiplication signElectronic mailing listPoint (geometry)InternetworkingView (database)Degree (graph theory)CodeNeuroinformatikPhysical lawPresentation of a groupLatent heatVirtual machineLaptopAxiom of choiceContext awarenessIP addressDiscounts and allowancesOnline help
10:06
InternetworkingPhysical lawIP addressFreewareRule of inferenceQuicksortSpeech synthesisMultiplication signInternetworkingDegree (graph theory)Arithmetic meanCybersexPhysical systemState of matterService (economics)Digital photographyPoint (geometry)Copyright infringementVideo gamePattern recognitionLimit (category theory)CASE <Informatik>BitSelf-organizationExpert system
17:00
InternetworkingMereologyTerm (mathematics)Computer hardwareComputer clusterSyntaxbaumGamma functionState of matterStatisticsNetwork topologyCyclic redundancy checkFormal languagePattern recognitionLevel (video gaming)Domain nameOperator (mathematics)WebsiteRule of inferenceContent (media)Type theoryFrequencyGoodness of fitMehrplatzsystemMereologyCASE <Informatik>Game theoryOrder (biology)Multiplication signFreewareSpeech synthesisView (database)Partition (number theory)Ocean currentLatent heatService (economics)NumberComputer hardwareFlow separationRegulator geneSoftwareInternetworkingPlastikkarteReal numberException handlingPhysical lawDecision theoryCopyright infringementSinc functionOnline gameQuicksortSoftware testingMeeting/Interview
24:28
State of matterGamma functionGroup actionGame theoryAttribute grammarPersonal digital assistantType theoryInclusion mapManufacturing execution systemHand fanAvatar (2009 film)Ocean currentYouTubeService (economics)Arithmetic meanWeb 2.0Content (media)Proxy serverInternetworkingMereologyFeasibility studyType theoryCASE <Informatik>DialectPhysical lawComputer configurationWorkstation <Musikinstrument>CybersexFigurate numberComputer programmingGoodness of fitLine (geometry)Group actionIP addressExpert systemConnectivity (graph theory)Online gameUniform resource locatorAttribute grammarCode
31:56
Server (computing)Operator (mathematics)Ocean currentConvex hullSatelliteLine (geometry)Term (mathematics)JukeboxInternet service providerMaxima and minimaWebsiteIP addressServer (computing)AdditionPhysical lawArithmetic meanNumberAreaView (database)MeasurementRight angleInterpreter (computing)Copyright infringement2 (number)Bus (computing)Sound effectVideo gameQuicksortOffice suiteCybersexNeuroinformatikRevision controlCondition numberGame theoryPoint (geometry)Coma BerenicesEmailService (economics)Order (biology)Direction (geometry)Internet service providerParameter (computer programming)Uniform resource locatorAuditory maskingInternetworkingPlanningProxy serverHacker (term)Content (media)1 (number)Computer programmingWord
Transcript: English(auto-generated)
00:00
So, my name is Marketa Trimble and I teach here in Las Vegas at the William S. Boyd School of Law, which is at the University of Nevada, Las Vegas. We do have a law school here. And I teach intellectual property, copyrights, patents, and I also teach a subject matter called conflict of laws, which most law students hate, even though that's the only
00:25
thing they will really need in life. Because what it is about, it's about cross-border litigation. Not only if a plaintiff from California sues somebody who sits in Michigan, but also if somebody, let's say in the U.S., wants to sue someone in China.
00:41
So questions like where you go, which law applies, who will enforce the judgment, and so forth. So to sum up the introduction, I am not an engineer, I am not a tech person, I am just an interested lawyer. So let me say at the beginning, I am here to talk about legal issues that surround
01:02
evasion of geolocation. I will take questions after the talk, I think in the Miranda Room or wherever it is. So if you have any questions after this, please follow me there. So to begin with, I would like to take a quick poll.
01:22
How many of you show your hand if you ever encountered a website that told you that you will not be able to see some content because of where you are located? Right, okay. How many of you didn't care because you know how to get around it? Right.
01:40
How many of you actually write code to do that? Great. And now, yeah, great. So any lawyers in the audience? Any lawyers who are actually willing to admit it? Yeah, yeah, phew, phew, brave soul, so great.
02:00
So what is my talk about? Well, what I want to talk about today is what the law has or doesn't have to tell about geolocation and also about the evasion of geolocation, which I termed cyber trouble to make it more portable to people who are now thinking about tech.
02:21
Meaning evasion of geolocation in terms of making geolocation tools believe that you are actually located somewhere else than where you are physically located. So an example that I use for, as you can tell, a very low-tech audience is myexpertnetwork.co.uk, right? So we have this grandma who sits in Grand Rapids, and she really loves BBC
02:45
shows, but she wants to watch them on the Internet because BBC America doesn't show those particular shows. So she would use maybe this very low-key tool, myexpertnetwork.co.uk. She pays five pounds, British pounds per month.
03:03
And of course, it's great because suddenly she appears as if she were in London, and she can view those BBC shows. Wonderful. So does the law care? Should it care? And what does it do about it? And what you should know about where things are headed.
03:24
So disclaimer, this is not a tech talk, which I'm really sorry about. This is not going to provide you any tools to evade geolocation. After all, it doesn't seem that you are in the need of my help there. Nothing said in this presentation during the Q&A, and of course, never, ever,
03:44
whenever you meet me, whatever I tell you is not legal advice, right? And also nothing that I say you should understand as me advising you to do something, but also in the same way, I'm not trying to tell you not to do something. It's your problem. I'm just not going to give you any advice.
04:03
So why should you sit here, right? Apart from the fact that there's that 50-person discount outside. Well, so what I want to do is to maybe tell you something, maybe new that you haven't heard yet about where the law is going, and what you should be expecting from lawyers, because lawyers tend not to know much about tech on
04:25
average, and you never know what they will do. Also, this talk might help you to begin thinking about what kind of legal issues you might encounter if you actually engage in acts of evasion of geolocation tools, but also it should help you to think about how you
04:44
might want to design future tools to evade geolocation, right? So if you are working, if you are coding some great tool that should help people evade geolocation tools, thinking about legal issues might help you to do some design choices that might be actually important in the
05:03
future. Or as I like to put it, it's one of those talks that will help you to think about what you should ask your lawyer about. And finally, there are some important policy issues that are connected with this problem, and I think you are a particularly important audience to
05:22
know about these issues, because they will come up very soon, and people who will discuss them are people who know nothing about them. And they need people like you to talk. They need people like you to make them aware of the tech background of the issues and of the stuff that's important there.
05:43
So let's see what we will cover briefly. I will first tell you something about definitions so that we are on the same page, which I cannot find right now. We will also talk briefly about territoriality on the Internet. Don't worry, it won't get too into detail.
06:01
I will talk about geolocation tools and their current uses, not necessarily to tell you a laundry list of when geolocation tools are used, because you know that, and that's not the point here. The point here is to tell you something about the types of uses that are law-related. So when are geolocation tools actually used to achieve compliance with
06:25
some kind of law? I will tell you what current law thinks of geolocation, which is actually quite scary, and that's why we need to talk about this. I will talk about evasion. Again, I will skip the tech part, not to embarrass myself, and also
06:43
because you don't really need it. And then I will talk about law and the evasion of geolocation. So what does law say currently about the acts of evasion of geolocation? Can you as a user get into troubles for evading geolocation?
07:00
Or can you, as somebody who codes and provides a tool for evasion of geolocation, get into some kind of legal difficulty? And finally, I will talk briefly about what there might be at stake for us in the future, and how you all might be able to lobby for certain kind of solutions that I believe are
07:21
important. So definitions. When I talk about geolocation, I don't mean any specific type of geolocation tools. Of course, when we talk about geolocation, I think of geolocation based on IP addresses, some kind of combined methods that, based on your IP address and maybe some
07:43
ping times and so forth, can figure out approximately where you are located. But really, I mean any kind of tools that can localize a user. So whether they are based on IP addresses, GPS, whatever, that's, in my mind, geolocation. So what is the evasion of geolocation?
08:02
Again, or cyber travel, it's any kind of tools that help you evade geolocation. So any kind of tools that are able to pretend that you are located somewhere else than where you're currently physically are, whatever means you use.
08:21
What's important about evasion of geolocation, the way I think about it, is that it's an act that helps you to view the internet from the point of view of somebody who is located in another country or another jurisdiction. So if I want to see the internet as someone who sits in London, that's what I want to be able to do.
08:43
And it's very interesting because I equate it to the freedom of travel, in general, international travel, which, by the way, has a certain degree of constitutional protection in the United States under US Constitution. So with certain limitations, you should not be limited in your freedom to travel internationally.
09:03
And this is, for me, the same thing, right? I want to be able to go online and be able to view the internet as if I were in another country. So that's to cyber travel. Now, of course, there is a difficult issue here, apart
09:21
from pulling the cord from the electricity here, which is there are certain ways to access remotely your computer. And whichever way you do it, including some low tech, like go to my PC and stuff like that, you certainly can actually get online in another country if you have
09:42
your machine there and you log on to that machine and you can access internet through there. I'm not particularly interested in that because that's really a diminished problem. There are not that many people who can do that. There are not that many people who have their laptop sitting in London, right? Or who have some kind of arrangement with somebody using
10:02
their computer somewhere else. But yes, I'm aware of the fact that that exists as well. What I'm interested more in is what will become a mainstream issue, which is myexpertnetwork.co.uk, the kind of services that allow you to acquire foreign IP address
10:21
in a very easy manner, so easy that even the grandma from Grand Rapids can do it. Because as we all know, things on the internet don't become a problem until the general public gets hold of them. Another important point to make is when I talk about cyber travel or evasion of geolocation tools, I don't
10:43
equate that with anonymization. Anonymization is another extremely interesting problem, but that's not really center of my interest. Not that I don't care. Just for these purposes, for the purposes of this study, you can cyber travel and you don't have to be anonymous.
11:03
On the other hand, you can achieve a certain degree of anonymity and still be able to cyber travel, right? So you might be able to change your IP address so that nobody can really tell that it's you, but it still will be an IP address within Nevada, right?
11:22
On the other hand, you might be able to actually get cyber travel and not be anonymized, meaning maybe some kind of passport system or whatever. So let me talk briefly about territoriality and the
11:42
internet. And of course, you all know a lot about this. So let me just explain. A lot of discussion has been going on about who should rule the internet and which law should rule the internet. That's not really the issue here. The issue here is which law should apply to our lives
12:01
on the internet. So if I buy a car on eBay and the seller is in Michigan and I'm here in Nevada, which law should apply to potential liability for some kind of defect, right? Should it be the law of the seller of the state of Michigan or should it be the law of the state of Nevada?
12:20
So that's the kind of issues, right? So solutions for that on the internet, supposing there is no borders, is either to figure out how to have countries' laws apply to various acts, which is what we have today. Some people say ideal situation, one of the, maybe
12:40
the ideal situation would be to have international law apply, right? Sure, my dream. Let's get all countries together. Let's agree on defect liability rules and they will apply all over the globe. Well, I think we're all old enough to realize that really doesn't work and unfortunately won't work for a long time to come.
13:00
Maybe fortunately, who knows? And another way to deal with these issues on the internet would be to have some kind of self-regulation. So either you can have contractual arrangements, which is what we have been doing quite a bit on the internet, or you can have some kind of organization maybe that will try to regulate these legal issues for acts on the internet and so forth.
13:23
So there have been a lot of discussions among legal experts about, you know, what we should do, how we should solve this. And like always in life, right, the real life never works, never waits for the academics to make up their mind. And so the life went on and we ended up with
13:42
something that one of my colleagues from Canada calls cyber law 2.0. And what it is, is well, every country legislates and every country enforces. And every country, each country doesn't really care. So as long as the country can access your server,
14:01
your bank account, or you physically, they will enforce their laws against you. They don't care how you acted, where you said, whatever, as long as they can reach you, they will enforce their laws. Which is actually quite fine if the laws that are being enforced are the laws that you like.
14:21
So for instance, if it's free speech, as we know it, based on our first amendment, that's great, right? But if it's somebody else's sort of impression of what free speech might be, that might not be so nice. So there are a few cases, right, that document this. I will give you two examples where the US law prevailed
14:42
and we are happy about that. And I will give you one example where US laws, and you will see yourself if that's a good idea or not. So the Yahoo case, I'm sure many of you are familiar with, Yahoo offering some Nazi memorabilia in France, something we don't really care about here,
15:02
but in France that's actually illegal. So Yahoo got sued, French court decided against Yahoo, issued an injunction, but of course there was nothing to enforce it against in France. So the French plaintiff, that one, took the judgment to the US and asked for recognition and enforcement
15:22
of that French judgment. And the US court said, well, no, no way. We are not going to tell Yahoo that they should not show something on the internet because then they would have to stop showing it also in the US. They cannot limit it only to French users, the court said back then, and therefore we are not
15:41
going to do whatever French court thought was appropriate. In Viewfinder, that was a case that came out one year later and concerned fashion. Some American photographer went to France, to Paris, took some pictures at a fashion show, came back, posted them online, and you would not believe
16:03
how much money people are willing to pay to see these pictures. And you wonder, well, why? And the reason is that the guys are actually putting it online before the official release date. So if you are into fashion, that's really a great value. You are willing to pay a lot of money for that.
16:21
Of course, the designers in Paris don't appreciate that. So they sued the photographer and his company. And the French court said, well, no way. You are not going to do that. This is infringement of all sorts of things and issued a judgment against the American photographer. Well, of course, when the French plaintiffs took it to the US,
16:45
again, a court in the US said, we are not going to enforce this. French might think it was wrong, but this is a country with free speech protection. Plus, this is a journalist, so even higher protection than that. So no way we are not going to enforce it.
17:02
And finally, one example where the things worked the other way around, and that's a very recent case of Lucasfilm versus Einsforth. Mr. Einsforth is the guy who did the original molds for the Star Wars troopers' helmets. I would think some of you might be familiar with them.
17:23
And so the guy, after a few years, he figured out, well, maybe I could make some money off of this. And he started making these helmets and selling them online. Whoever orders them, he will ship it. Well, so Lucasfilm sued, because of course, Lucasfilm is making some money off of it too.
17:42
And a court in California decided in favor of Lucasfilm, and issued an injunction that said that British guys should not be offering that online, not at least in the US. Well, and the British court said, no, we don't care what the Americans actually think of this.
18:02
We don't think that California court had any kind of jurisdiction over this British guy. And we are not going to enforce it, period. You can decide whatever you want. We are not going to do that. So again, it worked great when we had free speech protection really working worldwide.
18:21
But suddenly, when we see that British should decide what should be online in the US, who knows whether that's a good idea. So territoriality and the internet. I don't know if any of you remember, but the first cases when courts had to decide whether they had jurisdiction over somebody online were really funny.
18:42
Courts looked at things such as which language was the website in. What was the top level domain name? Did you use .com or .uk? They had really low tech sort of view of the world. The peak of that approach was the famous Zippo test
19:01
that said, well, if the website is interactive enough, then we should have jurisdiction over the website. So if you had a book that people would only read, that would be fine. But if you had a website that would sell software and those people could actually call your telephone number
19:22
or they could even fill out their credit card information, that would suddenly be interactive and you would be subjected to jurisdiction. What's really interesting that recently courts realized that that might not be actually a very good approach and they are moving towards real life, real contact approach.
19:41
So they look at the website and they say, well, wait a second, how many visitors were there truly from certain country, from certain jurisdiction? How many software, CDs, downloads did you really sell to that particular jurisdiction? So courts are changing their view of that there are also various attempts
20:01
to partition the internet territorially. So the idea being, you know, it might be actually a good idea to have some kind of territorial partitioning of the internet. There are of course some scary examples, right? Like filtering by service providers, which is of course a terrible idea.
20:20
Even better one probably is filtering on user hardware. Apparently Turkey is thinking about it now. And so suddenly employing geolocation by website operators seems like a pretty reasonable way to do this. The preemptive filtering you might have heard of has a lot of critics, not even in the US,
20:40
not only in the US, but in Europe, even one of the advocate generals of the European Court of Justice issued a very strong opinion against this. So that's good news. So geolocation, leaving it up on the website operators to try to comply with specific laws
21:00
suddenly seems like a good idea. So current uses. Again, I'm sure since everybody here in the room seem to have encountered some of these geolocation problems, knows how it works. There are many ways, many reasons why people use this, copyright licenses, right? So BBC might have actually copyright license
21:22
to show certain content only to certain countries, to people connected from certain countries. Gaming regulations, right? William Hill from the UK is very careful not to show certain games to American users because they don't want to get into troubles in the US for the future when they hope to launch services here.
21:43
Certainly security. My favorite example is a Hong Kong company, megaupload.com, which uses geolocation tools to filter out every single user who connects from Hong Kong where they are incorporated.
22:00
Very smart, right? Because that means that these guys are infringing copyright in every single country of the world except for Hong Kong where their assets are located, right? So of course, yeah, for the lawyers in the room, theoretically you should be able to go to another country, even in the US, and sue them for copyright infringement. But let's face it, by the time you get back to Hong Kong
22:22
with your judgment and ask for recognition enforcement, the company will be probably bankrupt and moved and what else. So that's a great example. Current law. So those uses were to comply with law, but they were all voluntary uses, right? There William Hill voluntarily say,
22:40
okay, let's employ these geolocation tools to make sure we comply with law. But what's really scary these days is that after a few years, some lawyers finally woke up and say, oh, wait a second, this is a terrific idea. Maybe we can mandate website operators to use this. So in Italy, the National Gaming Authority
23:03
actually has this in its rules. To get a license for online gaming in Italy, you must employ geolocation tools and filter out certain content so that users connecting from Italy cannot get to certain type of content.
23:21
So it's in the rules. Another interesting example, there are several decisions by German courts from 2010 and 2011 in which the courts look at geolocation tools and decided that those were legitimate ways to comply with regional regulation.
23:43
In case of Germany, those are also cases that actually involve gaming and the partitioning there concerns parts of Germany, specific German lands. And of course, the defendants in those cases said, well, wait a second, this is not bulletproof and there are ways to evade this very easily.
24:02
And German courts said, well, we don't really care. We consider this, to quote, a viable and technically feasible method of determining website visitors' location, period. And the court goes on to say, yes, we realize that people can evade it, but that's not the problem,
24:21
that's not a problem of the defendant, period. Which unfortunately leaves the question open, okay, do they expect that it will become problem of someone else? Do they expect that law will actually deal somehow with evasion of geolocation? And that's the scary part. In the US, we have examples of when actually law enforcement
24:43
is looking into geolocation as legitimate and feasible means of partitioning the internet. So the agreement that Department of Justice reached with PokerStars, for instance, recently, does include a clause that says that PokerStars
25:01
will start using geolocation tools to try its best to filter out users from the United States. So, another interest in geolocation you probably have noticed is among legislators, right? As always, when it comes to money,
25:21
taxation of online sales, something that many people are interested in. Online gaming, right? One of the big problems with online gaming is how to tax it. And if you can figure out who connects from where, suddenly things look much more appealing for the government. So there are three important things
25:42
to take into consideration. There is the government's interest in partitioning the internet. For various reasons, including maybe national security, but even when we look away from that kind of issues, just simply for the purposes of figuring out which law applies and how to comply
26:02
with regional territorial regulation, that's something governments are interested in. The other component to this is, as you have probably noticed even here, dramatically increasing interest of government in achieving a greater attribution of acts on the internet.
26:21
And of course, we can debate forever whether it's a good idea or whether it's even feasible and whether it's feasible without implanting something into our brains. But the fact is that that's where it's headed, right? They are interested to be able to attribute acts on the internet to specific users. And finally, it's the transition to IPv6
26:41
where with statically assigned addresses, suddenly it seems like there might be interest in figuring out what to do with the evasion of geolocation. And I would argue that non-tech people and people who don't appreciate the option of cyber trial will look at all these things and say, well, why don't we just get rid of it?
27:02
Why don't we either figure out some technical means or why don't we figure out some legal means to actually prohibit cyber travel altogether? So that's what might happen. And I would argue that if you and I are interested in the evasion of geolocation today,
27:22
wait what will happen if the government actually starts mandating it, right? Suddenly it won't be only you, me and the grandma in Grand Rapids, but it will be many other everyday average users who will become interested in the evasion of geolocation and the government might have to think about what to do with it.
27:41
So again, very simple geolocation tools. The tools for evasion of geolocation are becoming extremely simple to use. There are some old-fashioned ways to do that, including a dial-up to a foreign service provider, which is incredibly expensive and slow, but theoretically you could try that.
28:02
Web proxies, other types of proxies and so forth, including the services like myexpertnetwork.co.uk that charges the incredible amount of five pounds per month for people to do that. But those are actually types of services that are very interesting because they target particular jurisdiction, right?
28:21
So it's not like, well, you just want to look like you're somewhere outside the US. No, in case of myexpertnetwork.co.uk, you actually care for looking like you are in London. So that's the example. There hasn't been done much about evasion of geolocation in law. Lawyers don't really know much about it.
28:42
There are two pretty famous experts on this, one in Australia and one in Germany, who have written about it. The German guy is, I think, the guy who is responsible for the German courts deciding that geolocation tools should be used as a means of legal compliance. But what I think is really pushing this issue forward
29:02
are place-shifting cases. And if you look at these cases, they are all from 2010 or 2011, and they all concern cases that don't really, they are not really evasion of geolocation, but they are very similar. And I would argue that they are the precursors
29:21
for their legal disputes that will concern evasion of geolocation. TV catch-up in London, in the UK, write a service. If you live in some region of England where local TV really sucks, you can actually pay something and watch programming from other regions.
29:41
The same principle with Maneki TV in Japan, apparently Tokyo Regional Television is really fun. Apparently rural television stations are not that much fun. So Maneki TV, for some amount of money, allowed you to log on their service online, and you could watch those regional TV stations from Tokyo.
30:03
Now IVI and Justin TV might be more familiar to you, similar principle, you are able to actually watch something that IVI re-transmitted to you, I think used to, I think they were shut down by an injunction. But that was the idea, right?
30:21
Justin TV is the one that works sort of on the Yahoo principle, YouTube principle, meaning you can actually broadcast, users can broadcast themselves, right? Justin TV was sued here in Las Vegas this spring, so they are involved in one legal dispute as well.
30:41
So these are services that have been attacked because they are doing the place shifting. They are allowing you to watch something, to access certain content that you should not be supposed to view because you are located in wrong place, right? So obviously, Evasion of Joe Location
31:01
will be the next one on the line. So currently, there are two problems here, right? We have two people, two actors involved in this. We have me, the user of Joe Location of Evasion, the cyber traveler, and then we have somebody here who actually wrote the code and provided it online
31:21
and allowed me to actually cyber travel. In cyber travel, we have two separate acts, right? There's the act of evasion itself, so me maybe logging in into myxpacknetwork.co.uk and getting the British IP address. And then there's a separate issue with why I do that, right?
31:42
So what is next? What kind of acts are associated with my act of cyber travel? So one of the problems that the law has with this is how to localize my activity, right? So of course, I am talking about that simple example, very simplistic, where I sit in the US
32:01
and I acquire, let's say, a German IP address to view some site that's available only in Germany. But we know that in practice, that's not how it works, right? So we know that in fact, the website I want to see is run by somebody in South Africa who might actually have servers sitting in Chile.
32:21
So then, of course, where the packets are running, right, have nothing to do with Germany or me sitting in the US. So there is a problem with that, but even if we look at it in a very simplistic way, which is what law tends to do, so what are the challenges? Well, first of all, DMCA, right?
32:41
So DMCA is not a US invention. That's actually a worldwide problem. 1996 treaties that were signed under the World Intellectual Property Organizations established these provisions about technological measures, and they have been implemented in many countries
33:03
around the world, including all European countries, and we ended up with DMCA. So as you probably all know, DMCA says, well, you should not really breach technological measures that are implemented to protect copyrighted work. Well, one problem with that is
33:21
that copyrighted work is almost everything online. Contrary to what many people believe, you don't have to go to the copyright office and register something for it to be copyrighted, right? Anything that actually fulfills the condition of copyrightability is automatically copyrighted
33:41
as soon as it's fixed in a tangible medium. So you don't really have to go to the copyright office at all anymore. So that's one problem. The other problem with DMCA is that in the rest of the world, under the WIPO treaties, countries protect technological measures
34:01
as long as those measures actually protect copyright. The problem is that in the US, at least under the interpretation of the ninth and second circuit, DMCA protects technological measures no matter for which purpose you breach them, right? So you might not have purpose
34:21
of actually infringing someone's copyright, but if the measures are there and you breach them, you will be liable, which is sort of absurd. And my God, why did it happen to us here in the US? But that's the way the law is. It was probably wrongly written.
34:41
It's probably an awful interpretation of the law, but that's what courts have been doing. So what it means is that if courts decide that geolocation tools are actually the kind of measures to be considered the proper technological measures to control access to a work,
35:01
just by evading the geolocation tools, we might be actually infringing DMCA, which is scary. Another problem is cash copies, right? So the legal status of cash copies is not pretty clear right now, but from what we see going on, what we have seen going on in England and in the US,
35:22
it seems like courts are aligning to sort of say, well, cash copies, of course, are created automatically. It's not your fault. As long as they are created during legal use of a copyrighted work, those copies are fine.
35:41
But if they are created while you actually use the work illegally, then those copies actually infringe copyright. So for instance, in England, there was a guy who ran a game of a counterfeited DVD. And the court said any copy, any cash copy that was created by that computer infringed copyright.
36:02
Because the DVD was used illegally, it was a counterfeited copy. So that's additional problem, because then if the court would say, well, yeah, in fact, by evading geolocation tools, you are not using the work in compliance with what the copyright holder said you should be doing,
36:22
then you are creating illegal cash copies and you are infringing copyright as well. So that could be an additional challenge. Of course, contractual issues, that's another area to be careful about. I have here for you as an example, a clause from an agreement with Satwan Television Station in Germany,
36:44
which clearly states, well, if you are using this website, you agree that you will not evade geolocation tools. You will not try to bypass our measures that we imposed to territorially limit the use of this website. And of course, there is some issue also within the hacking clause
37:02
that really would arise primarily if you try to evade geolocation tools to get free access to some content. And that's something to be very careful about these days, because what happens is BBC, for instance, is launching a version for its international users
37:20
that will be what we might call a paper foreign view access. So what they will do is they will say, well, if you sit in Las Vegas, you can actually watch these programs that we normally only show to people connecting from the UK, but you have to pay, right? So suddenly, if you evade the geolocation
37:41
that BBC has implemented in order to get free access to that program, then you might actually land in some serious troubles. For the evasion tool provider, and I'm not saying here that this is a particularly great idea to impose liability on somebody who provides the tool, I'm just reporting what might be an issue.
38:03
Again, there might be direct liability, right? Because if somebody said, well, evasion of geolocation, the tools that you provide are actually tools to evade technological protection measures under DMCA, there is a provision for providers.
38:20
The same applies with the anti-hacking clause. And to keep in mind, that also applies in Europe, right? So you can get into troubles even in other countries. There is some issue with retransmission, which is where the design issue comes into play. It's particularly, I think, problem for web proxies that actually could be claimed
38:41
to be retransmitting some kind of signal to the user. Other kinds of proxies, I guess, would have a better argument that that's not really their choice, that they just provide this foreign IP address, for instance, and they cannot influence what the user is doing after that. But it's very important to avoid becoming the retransmitter
39:02
in any sort of sense of the content that's being accessed. Finally, there is an issue of secondary liability, again, an interesting design issue. For instance, if you notice, the myexpertnetwork.co.uk also has a US version .com. And what they do is, if you look at that,
39:22
you would think, well, who wants a British IP address, somebody who doesn't sit in Britain, right? That would make sense. No, myexpertnetwork.co.uk is really directed at British customers, right? You pay in pounds, you have to access their .co.uk address,
39:41
you have to email them to their British email address, and so forth. So the idea is to strategically dislocate the place where you offer the service and the place where the users might engage in something that might be considered copyright infringement. So myexpertnetwork.co.uk can say, well, we were never offering anything in the US.
40:03
We were offering to British people who happened to travel. So any act that we do, we do in England, and anything that happens as direct infringement happens in individual countries outside the UK. Very questionable whether that would protect them from anything, but it's interesting to see that that's one kind of technique
40:21
that they are trying to use to limit their liability. So what will the future bring? Well, what I would argue is, we should be worried about courts, law enforcement, looking at geolocation as legitimate, working, effective means of partitioning the internet.
40:43
What I would be worried about primarily, as much as I realize that that would really make life of many people easier, is that they will immediately look at the acts of evasion and say, well, of course these things must be illegal, because my God, they defeat the whole purpose of geolocation.
41:00
What's very important there is to make sure that this problem is presented in the right way, right? It's a lot of PR work here. So for instance, you would not believe how many lawyers who know a lot about tech talk about this as about misrepresentation of one's true location. Well, it might be, but you don't want to call it that way
41:21
if you want to convince someone that that's actually a good thing, right? Don't use the word misrepresentation. Some people say, well, it really should be a right to obscure one's location. But that's tricky, because then you're really tied to the issue of anonymization. And because of law enforcement and other issues,
41:40
that might be tricky too. So what should we do in the future? Well, as long as we can, we should claim that it's a really de minimus issue, right? We will not publish that poll we took, and that only very, very few people would do that. The problem is that the number of grant masks from Grand Rapids will increase, and clearly there are more and more people interested in this.
42:04
We should, I think, make sure that people understand that this is equivalent to physical travel. And as we face all sorts of problems for the future, and as the more our lives move to the internet, the more it will be like real travel, right?
42:21
We might stop traveling one day by planes and so forth. We might spend all our lives in our bedrooms. And then really, the real travel we will take will be the cyber travel. And we should protect that. We should be able to cyber travel to another country and be able to see the internet from the point of view of those people.
42:40
And again, there is constitutional protection for the right to travel internationally. There are limits. They can ask you for your bus port and stuff like that. But courts have recognized that there is an important value in being able to travel internationally, to see other countries, see how they do things, and so forth.
43:02
So what is the big question for you is how to implement this? How to implement this? How to fight for the freedom to travel in cyberspace and make sure that it's not limited and that's not lost in these discussions about anonymization and that we are actually able to do that in the future,
43:22
you, me, and the grandma from Grand Rapids. So thank you very much for your attention. I'm glad you were here, because I think this is a very important topic. And I will be, I believe, in the Miranda Room for Q&A. Thank you very much.