<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>ZeroPaid.com &#187; international</title>
	<atom:link href="http://www.zeropaid.com/tag/international/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.zeropaid.com</link>
	<description></description>
	<lastBuildDate>Mon, 13 Feb 2012 17:55:07 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
<xhtml:meta xmlns:xhtml="http://www.w3.org/1999/xhtml" name="robots" content="noindex" />
		<item>
		<title>Load Gearing Up for Massive 8GB Multinational Data Dump</title>
		<link>http://www.zeropaid.com/news/94630/load-gearing-up-for-massive-8gb-multinational-data-dump/</link>
		<comments>http://www.zeropaid.com/news/94630/load-gearing-up-for-massive-8gb-multinational-data-dump/#comments</comments>
		<pubDate>Sun, 24 Jul 2011 22:27:09 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[AntiSec]]></category>
		<category><![CDATA[australia]]></category>
		<category><![CDATA[data]]></category>
		<category><![CDATA[dump]]></category>
		<category><![CDATA[Egypt]]></category>
		<category><![CDATA[eu]]></category>
		<category><![CDATA[france]]></category>
		<category><![CDATA[government]]></category>
		<category><![CDATA[hack]]></category>
		<category><![CDATA[hacker]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[india]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[load]]></category>
		<category><![CDATA[us]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=94630</guid>
		<description><![CDATA[<p><img width="200" height="150" src="http://www.zeropaid.com/wp-content/uploads/2011/07/data_leak_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="data_leak_crop" title="data_leak_crop" /></p><h3>The hacking community has taken notice to another hacker who claims to have internal documents on several governments from around the world including the US, Russia and several European countries.  To prove it, the hacker released a small set of "preview" leaks which appear to be internal documents of embassies and government minister offices.</h3>

If this particular hacker delivers in full, the data dump might send shock waves around the world.  In a posting to PasteBin, Load <a href=http://pastebin.com/r21cExeP target=_blank>claims to have obtained a total of 8GB of internal government and industry documents</a> that span numerous countries around the world.  The release is said to be exposing corruption.  Here's the statement:

<blockquote>Heynow,
This is a prerelease of a series we are going to make to reveal the biggest in history of European LE cyber operation Evidence exploitation and abuse. Thing's gonna get published and twittered all over anonymous and lulzsec community.

 Today we were granted with the Italian law enforcement Pandora box, we really think it shall be a new era of “regreaissance” to the almighty Homeland Security Cyber Operation Unit in EU. 
So we decided to leak everything they got since they were established as a full scale cyber taskforce named CNAIPIC.

 This corrupted organization gathered all the evidence from the seized property of suspected computer professional entertainers and utilized it over many years to conduct illegal operations with foreign intelligence agencies and oligarchy to facilitate their lust for power and money, they never used obtained evidence to really support ongoing investigations.

 Today we reveal a whole Load of stuff (estimated leak would be over 8Gb) from such owned institutions, just to make it clear all of this stuff was stored on CNAIPIC evidence servers for years while people are doing time in jail waiting for the trial while CNAIPIC used the evidence in the global spy game galore</blockquote>

Load provided a sample list of institutions affected by this data dump and, to say the least, there are big names included - from government to business entities:

<blockquote>Egypt: Ministry of Transport and Communication
  Australia: Ministry of Defence
  Russia: Atomstroyexport, Diaskan, Sibneft, Gazprom etc.
  Ukraine: several embassies and consulates on it’s territory
  Nepal: Ministry of Foreign Affairs
  Belarus: Ministry of Foreign Affairs, Belneftehim, Belspetzexport
  Gibraltar, Cyprus, Cayman Islands etc: Tecno Develp, Line Holdings,    Dugsberry Inc, Alpha Prime, Alpha Minerals etc.
Vietnam: PetroVietnam (PTSC), Ministry of Natural Resources (MONRE)
  USA: EXXON MOBIL, US Department of agriculture and hundreds of attorneys and DOJ accounts including: McCallion & Associates LLP, Goodkind, Labaton, Rudoff & Sucharow, LLP, and hundreds of bullshit agencies we don’t even know why we pay taxes to support all of them.</blockquote>

We've had a chance to go through the files.  One file is a file structure that doesn't even look anywhere close to being complete.  Just looking at the extensions alone, one can easily get a sense that these files are all over the map.  There's power point slides, PDF files, gif images, .doc files - really, you name it, it's probably there.

Also included in this was two preview leaks.  The first preview appears to be predominantly two languages: Italian and Russian - though some documents are in French and English among others.

Some of the files were pictures of scanned documents.  There was a set of a screenshot of some people's e-mail inbox (some in English, others, not).

One PDF appears to be an oil drilling agreement document (in English) with ExxonMobil regarding a "Master Marine Survey Agreement Order #2288701".  In fact, there were a few documents surrounding oil drilling plans that seem almost freakishly detailed.  Another PDF appears to be a flow chart regarding some alleged illegal activities (money laundering) with "Medici Enterprise's" (also in English).  One PDF appears to be from the Australian Government Department of Defence - a letter to the "Bureau de la defense".  The letter appears to be in French.

That first file is about 27MB big.

The second "preview" leak appears to be much larger - weighing in at around 60MB in size.  A large majority of these files appear to be little more than scans of passports of different people from different countries.  There were a number of files in Russian, but two files were in English.  One dealt with gas company PetroVietnam.  The other dealt with what appears to be something with India and Kabul.  It mentions someone by the name of Shri Gurpreet Singh.

There's not a whole lot more I can really read in to these documents.  It would require a different set of knowledge to drill down deeper in to the significance of these documents.  Some of this might involve someone who is more familiar with environmental sciences, geology and math to understand one document in particular.

I can say that what is leaked certainly looks impressive given the different types of content that seems to be present in this "preview" release.  Exactly how significant, I can't personally say.  It's unclear when the full release will happen or what the implications might be, but given the number of countries involved inside these documents, it looks like this could be a big international story for whenever or even if the data dump actually occurs.

[Hat tip: <a href=http://twitter.com/#!/anonymouSabu/status/95329662665887744 target=_blank>anonymouSabu</a>]

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="200" height="150" src="http://www.zeropaid.com/wp-content/uploads/2011/07/data_leak_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="data_leak_crop" title="data_leak_crop" /></p><h3>The hacking community has taken notice to another hacker who claims to have internal documents on several governments from around the world including the US, Russia and several European countries.  To prove it, the hacker released a small set of "preview" leaks which appear to be internal documents of embassies and government minister offices.</h3>

If this particular hacker delivers in full, the data dump might send shock waves around the world.  In a posting to PasteBin, Load <a href=http://pastebin.com/r21cExeP target=_blank>claims to have obtained a total of 8GB of internal government and industry documents</a> that span numerous countries around the world.  The release is said to be exposing corruption.  Here's the statement:

<blockquote>Heynow,
This is a prerelease of a series we are going to make to reveal the biggest in history of European LE cyber operation Evidence exploitation and abuse. Thing's gonna get published and twittered all over anonymous and lulzsec community.

 Today we were granted with the Italian law enforcement Pandora box, we really think it shall be a new era of “regreaissance” to the almighty Homeland Security Cyber Operation Unit in EU. 
So we decided to leak everything they got since they were established as a full scale cyber taskforce named CNAIPIC.

 This corrupted organization gathered all the evidence from the seized property of suspected computer professional entertainers and utilized it over many years to conduct illegal operations with foreign intelligence agencies and oligarchy to facilitate their lust for power and money, they never used obtained evidence to really support ongoing investigations.

 Today we reveal a whole Load of stuff (estimated leak would be over 8Gb) from such owned institutions, just to make it clear all of this stuff was stored on CNAIPIC evidence servers for years while people are doing time in jail waiting for the trial while CNAIPIC used the evidence in the global spy game galore</blockquote>

Load provided a sample list of institutions affected by this data dump and, to say the least, there are big names included - from government to business entities:

<blockquote>Egypt: Ministry of Transport and Communication
  Australia: Ministry of Defence
  Russia: Atomstroyexport, Diaskan, Sibneft, Gazprom etc.
  Ukraine: several embassies and consulates on it’s territory
  Nepal: Ministry of Foreign Affairs
  Belarus: Ministry of Foreign Affairs, Belneftehim, Belspetzexport
  Gibraltar, Cyprus, Cayman Islands etc: Tecno Develp, Line Holdings,    Dugsberry Inc, Alpha Prime, Alpha Minerals etc.
Vietnam: PetroVietnam (PTSC), Ministry of Natural Resources (MONRE)
  USA: EXXON MOBIL, US Department of agriculture and hundreds of attorneys and DOJ accounts including: McCallion & Associates LLP, Goodkind, Labaton, Rudoff & Sucharow, LLP, and hundreds of bullshit agencies we don’t even know why we pay taxes to support all of them.</blockquote>

We've had a chance to go through the files.  One file is a file structure that doesn't even look anywhere close to being complete.  Just looking at the extensions alone, one can easily get a sense that these files are all over the map.  There's power point slides, PDF files, gif images, .doc files - really, you name it, it's probably there.

Also included in this was two preview leaks.  The first preview appears to be predominantly two languages: Italian and Russian - though some documents are in French and English among others.

Some of the files were pictures of scanned documents.  There was a set of a screenshot of some people's e-mail inbox (some in English, others, not).

One PDF appears to be an oil drilling agreement document (in English) with ExxonMobil regarding a "Master Marine Survey Agreement Order #2288701".  In fact, there were a few documents surrounding oil drilling plans that seem almost freakishly detailed.  Another PDF appears to be a flow chart regarding some alleged illegal activities (money laundering) with "Medici Enterprise's" (also in English).  One PDF appears to be from the Australian Government Department of Defence - a letter to the "Bureau de la defense".  The letter appears to be in French.

That first file is about 27MB big.

The second "preview" leak appears to be much larger - weighing in at around 60MB in size.  A large majority of these files appear to be little more than scans of passports of different people from different countries.  There were a number of files in Russian, but two files were in English.  One dealt with gas company PetroVietnam.  The other dealt with what appears to be something with India and Kabul.  It mentions someone by the name of Shri Gurpreet Singh.

There's not a whole lot more I can really read in to these documents.  It would require a different set of knowledge to drill down deeper in to the significance of these documents.  Some of this might involve someone who is more familiar with environmental sciences, geology and math to understand one document in particular.

I can say that what is leaked certainly looks impressive given the different types of content that seems to be present in this "preview" release.  Exactly how significant, I can't personally say.  It's unclear when the full release will happen or what the implications might be, but given the number of countries involved inside these documents, it looks like this could be a big international story for whenever or even if the data dump actually occurs.

[Hat tip: <a href=http://twitter.com/#!/anonymouSabu/status/95329662665887744 target=_blank>anonymouSabu</a>]

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/94630/load-gearing-up-for-massive-8gb-multinational-data-dump/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>OSCE &#8211; Three Strikes Laws Incompatible with International Obligations to Free Speech</title>
		<link>http://www.zeropaid.com/news/94284/osce-three-strikes-laws-incompatible-with-international-obligations-to-free-speech/</link>
		<comments>http://www.zeropaid.com/news/94284/osce-three-strikes-laws-incompatible-with-international-obligations-to-free-speech/#comments</comments>
		<pubDate>Wed, 13 Jul 2011 23:29:44 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[copyright]]></category>
		<category><![CDATA[france]]></category>
		<category><![CDATA[free speech]]></category>
		<category><![CDATA[graduated response]]></category>
		<category><![CDATA[human rights]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[internet]]></category>
		<category><![CDATA[piracy]]></category>
		<category><![CDATA[three strikes law]]></category>
		<category><![CDATA[three-strikes]]></category>
		<category><![CDATA[us]]></category>
		<category><![CDATA[usa]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=94284</guid>
		<description><![CDATA[<p><img width="200" height="62" src="http://www.zeropaid.com/wp-content/uploads/2011/07/OSCE_logo_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="OSCE_logo_crop" title="OSCE_logo_crop" /></p><h3>The Organization for Security and Co-operation in Europe (OSCE), the <a href=http://en.wikipedia.org/wiki/Organization_for_Security_and_Co-operation_in_Europe target=_blank>world's largest security-oriented intergovernmental organization</a> has <a href=http://www.osce.org/home/80718 target=_blank>issued a report</a> that explicitly states that a three strikes law is a disproportionate response to dealing with copyright infringement.</h3>

Last month, Frank La Rue, the UN’s Special Rapporteur <a href=http://www.zeropaid.com/news/93617/un-report-3-strikes-is-a-violation-of-human-rights/ target=_blank>slammed attempts to put in place three strikes laws as a violation of human rights</a>.  Now, it appears, that another large organization agrees with this.

The OSCE recently <a href=http://www.osce.org/home/80718 target=_blank>published</a> a paper documenting freedom of speech on the internet and laws that impacted such freedoms.  The available PDF states the following with regards to the emerging of three strikes laws around the world:

<blockquote>The increased use of so-called “three-strikes” legal measures to combat Internet piracy is worrisome given the growing importance of the Internet in daily life. “Three-strikes” measures provide a “graduated response” resulting in restricting or cutting off the users’ access to the Internet in cases where a user has attempted to download pirated material. The third strike usually leads to the user’s access to the Internet being completely cut off. This disproportionate response is most likely to be incompatible with OSCE commitment on the “freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.” (55) In the Charter for European Security, the participating States in 1999 “reaffirmed the importance of independent media and the free flow of information as well s the public’s access to information [and committed] to take all necessary steps to ensure the basic conditions for free and independent media and unimpeded transborder and intra-State flwo of information, which [they] consider the be an essential component of any democratic, free and open society.” (56) Any interference with such a fundamental human right, as with any other human right, must be motivated by a pressing social need, whose existence must be demonstrated by the OSCE participating States and must be proportionate to the legitimate aim pursued. (57) Access to the Internet must be recognized as a human right, and therefore “graduated response” mechanisms which could restrict users’ access to the Internet should be avoided by the OSCE participating States.</blockquote>

<blockquote>(55) Paragraph 9.1. of the Final Act of the Copenhagen Meeting of the Conference on the Human Dimension of the CSCE, June 1990. http://www.osce.org/documents/odihr/2006/06/19392_en.pdf

(56) Paragraph 26 of the Charter for European Security adopted at the OSCE Istanbul Summit 1999. See at
http://www.osce.org/mc/17502.

(57) See Paragraph 26 of the Final Document o fthe Moscow Meeting of the Conference on the Human
Dimension of the CSCE, at http://www.osce.org/fom/item_11_30426.html. See also Olsson v. Sweden
(No. 1), judgment of 24 March 1988, Series A no. 130, § 67, and Bladet Tromsø and Stensaas v. Norway
[GC], no. 21980/93, ECHR 1999-III.</blockquote>

In other words, if a government of a given state supports their international obligations to free speech, then the "graduated response" laws where users are cut off after a third accusation of infringement must be avoided.  You can't have free speech and a three strikes law at the same time.

It's particularly interesting that this finding was made since France, the country that has a three strikes law already in place, is also a member of the OSCE.  Another member of interest is the US, the same country that has been pushing other countries to implement a three strikes law.

What this report essentially does is help solidify the point that a "graduated response" or a three strikes law is a violation of human rights.  There are international bodies that do agree with this.

The next question will no doubt be whether countries will actually listen to the report or push for laws that disregards human rights.  We already know that the United States seems to be content with <a href=http://www.zeropaid.com/news/94265/assessing-americas-6-strike-regime/ target=_blank>sacrificing their national security in favor of a six strikes agreement</a>, so, it's difficult to say that free speech will be a motivating factor to slow down the implementation of these laws.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="200" height="62" src="http://www.zeropaid.com/wp-content/uploads/2011/07/OSCE_logo_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="OSCE_logo_crop" title="OSCE_logo_crop" /></p><h3>The Organization for Security and Co-operation in Europe (OSCE), the <a href=http://en.wikipedia.org/wiki/Organization_for_Security_and_Co-operation_in_Europe target=_blank>world's largest security-oriented intergovernmental organization</a> has <a href=http://www.osce.org/home/80718 target=_blank>issued a report</a> that explicitly states that a three strikes law is a disproportionate response to dealing with copyright infringement.</h3>

Last month, Frank La Rue, the UN’s Special Rapporteur <a href=http://www.zeropaid.com/news/93617/un-report-3-strikes-is-a-violation-of-human-rights/ target=_blank>slammed attempts to put in place three strikes laws as a violation of human rights</a>.  Now, it appears, that another large organization agrees with this.

The OSCE recently <a href=http://www.osce.org/home/80718 target=_blank>published</a> a paper documenting freedom of speech on the internet and laws that impacted such freedoms.  The available PDF states the following with regards to the emerging of three strikes laws around the world:

<blockquote>The increased use of so-called “three-strikes” legal measures to combat Internet piracy is worrisome given the growing importance of the Internet in daily life. “Three-strikes” measures provide a “graduated response” resulting in restricting or cutting off the users’ access to the Internet in cases where a user has attempted to download pirated material. The third strike usually leads to the user’s access to the Internet being completely cut off. This disproportionate response is most likely to be incompatible with OSCE commitment on the “freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.” (55) In the Charter for European Security, the participating States in 1999 “reaffirmed the importance of independent media and the free flow of information as well s the public’s access to information [and committed] to take all necessary steps to ensure the basic conditions for free and independent media and unimpeded transborder and intra-State flwo of information, which [they] consider the be an essential component of any democratic, free and open society.” (56) Any interference with such a fundamental human right, as with any other human right, must be motivated by a pressing social need, whose existence must be demonstrated by the OSCE participating States and must be proportionate to the legitimate aim pursued. (57) Access to the Internet must be recognized as a human right, and therefore “graduated response” mechanisms which could restrict users’ access to the Internet should be avoided by the OSCE participating States.</blockquote>

<blockquote>(55) Paragraph 9.1. of the Final Act of the Copenhagen Meeting of the Conference on the Human Dimension of the CSCE, June 1990. http://www.osce.org/documents/odihr/2006/06/19392_en.pdf

(56) Paragraph 26 of the Charter for European Security adopted at the OSCE Istanbul Summit 1999. See at
http://www.osce.org/mc/17502.

(57) See Paragraph 26 of the Final Document o fthe Moscow Meeting of the Conference on the Human
Dimension of the CSCE, at http://www.osce.org/fom/item_11_30426.html. See also Olsson v. Sweden
(No. 1), judgment of 24 March 1988, Series A no. 130, § 67, and Bladet Tromsø and Stensaas v. Norway
[GC], no. 21980/93, ECHR 1999-III.</blockquote>

In other words, if a government of a given state supports their international obligations to free speech, then the "graduated response" laws where users are cut off after a third accusation of infringement must be avoided.  You can't have free speech and a three strikes law at the same time.

It's particularly interesting that this finding was made since France, the country that has a three strikes law already in place, is also a member of the OSCE.  Another member of interest is the US, the same country that has been pushing other countries to implement a three strikes law.

What this report essentially does is help solidify the point that a "graduated response" or a three strikes law is a violation of human rights.  There are international bodies that do agree with this.

The next question will no doubt be whether countries will actually listen to the report or push for laws that disregards human rights.  We already know that the United States seems to be content with <a href=http://www.zeropaid.com/news/94265/assessing-americas-6-strike-regime/ target=_blank>sacrificing their national security in favor of a six strikes agreement</a>, so, it's difficult to say that free speech will be a motivating factor to slow down the implementation of these laws.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/94284/osce-three-strikes-laws-incompatible-with-international-obligations-to-free-speech/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>There&#8217;s a Reason Why They Called it &#8216;Sownage&#8217;</title>
		<link>http://www.zeropaid.com/news/94219/theres-a-reason-why-they-called-it-sownage/</link>
		<comments>http://www.zeropaid.com/news/94219/theres-a-reason-why-they-called-it-sownage/#comments</comments>
		<pubDate>Wed, 06 Jul 2011 11:56:31 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[data]]></category>
		<category><![CDATA[data loss]]></category>
		<category><![CDATA[hack]]></category>
		<category><![CDATA[hacker]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[PSN]]></category>
		<category><![CDATA[pwned]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[sony]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=94219</guid>
		<description><![CDATA[<p><img width="200" height="133" src="http://www.zeropaid.com/wp-content/uploads/2009/05/sony_logo_1_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="sony_logo_1_crop" title="sony_logo_1_crop" /></p><h3>May and June of 2011 may be two months Sony would rather forget.  It's pretty much next to impossible to really track just how many times the multinational company was hacked.  Still, that doesn't mean there are efforts out there to show just how much the company got hacked.</h3>

We've offered very detailed coverage of the hacking of Sony.  One of our reports was <a href=http://www.zeropaid.com/news/93671/lulzsec-hacks-sony-for-6th-time-uploads-data-to-pirate-bay/ target=_blank>simply titled</a>, "Lulzsec Hacks Sony for 6th Time, Uploads Data to Pirate Bay".

That one article alone is just the tip of the iceberg with regards to the millions of user accounts that were compromised and the countless times a Sony website was defaced.

Recently, datalossdb.org <a href=http://datalossdb.org/incident_highlights/53-sony-had-how-many-breaches target=_blank>pointed</a> to <a href=http://attrition.org/security/rant/sony_aka_sownage.html target=_blank>an interesting posting on attrition.org</a> which offers a condensed history of the hacking activities of Sony.  Scrolling down a little, you can see a table which shows some of the compromises that occurred between April 4th to June 28 of this year.  In that time span alone, the table documents exactly 20 times Sony had been compromised.  Even the table is just the tip of the iceberg if you were to look at the notes: "This table does not count any Denial of Service (DoS) attacks against Sony as an incident."

We do note that the entry before the 16th hack shows the confusion the media had over whether or not a high ranking member of LulzSec was arrested (our sources would indicate that it was a chatroom operative and barely even considered a member of LulzSec)

To add insult to injury, the posting also offers "legacy" Sony hacks which were prior to the more recent incidences that date back as far as 1999.  The legacy hacks appear to be little more than website defaces, but it does show the security problems one company has had over the years.

The author notes the newly coined term "Sownage" which is the ownage of Sony.

What I also like about this is that it shows just how difficult it was to keep track of the hacking on Sony.  Even DatalossDB, a website devoted to specific kinds of compromised data, <a href=http://datalossdb.org/incident_highlights/53-sony-had-how-many-breaches target=_blank>admits</a>, "We thought keeping track of entities involved in the Epsilon breach was tough, but the recent spate of attacks on Sony networks has us working overtime trying to update the database."

I can fully attest to how keeping track of the Sony breaches and hacking was at least a part time commitment and I'm sure my colleague Jared Moya would agree that the Sony data breaches was certainly an eventful moment.

We should point out, in all fairness, that Sony did at least attempt to do some damage control.  For example, <a href=http://www.zeropaid.com/news/93318/psn-outage-day-11-sony-to-offer-welcome-back-program/ target=_blank>Sony did offer a welcome back package for the PSN outage to it's PSN users</a> which included free giveaways of services.  In addition, they created a new employee position to watch over the security of Sony.  For some users, this was enough, for others, the damage was already done as they bid farewell to being a Sony Playstation customer.

For a number of people that have Sony as a part of their lives, life seems to be returning to normal.  According to DatalossDB, the last Sony data breach <a href=http://datalossdb.org/incidents/3930-177-172-e-mail-addresses-acquired-by-hackers target=_blank>occurred on June 19th</a>, when Sony Pictures France had 177,000 accounts compromised.

For Sony, I would imagine the hacking has wreaked absolute havoc on the PR front if anything else.  I can also see that it would require a complete overhaul in security measures and policy - maybe even a whole new attitude toward security - between before these latest breaches occurred and now in order to prevent such a catastrophic occurrence from ever happening again.  There's little doubt that no company wants to go through what Sony did, but to ensure it never happens, other companies should take any necessary steps to stop something like this from ever happening in the first place.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="200" height="133" src="http://www.zeropaid.com/wp-content/uploads/2009/05/sony_logo_1_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="sony_logo_1_crop" title="sony_logo_1_crop" /></p><h3>May and June of 2011 may be two months Sony would rather forget.  It's pretty much next to impossible to really track just how many times the multinational company was hacked.  Still, that doesn't mean there are efforts out there to show just how much the company got hacked.</h3>

We've offered very detailed coverage of the hacking of Sony.  One of our reports was <a href=http://www.zeropaid.com/news/93671/lulzsec-hacks-sony-for-6th-time-uploads-data-to-pirate-bay/ target=_blank>simply titled</a>, "Lulzsec Hacks Sony for 6th Time, Uploads Data to Pirate Bay".

That one article alone is just the tip of the iceberg with regards to the millions of user accounts that were compromised and the countless times a Sony website was defaced.

Recently, datalossdb.org <a href=http://datalossdb.org/incident_highlights/53-sony-had-how-many-breaches target=_blank>pointed</a> to <a href=http://attrition.org/security/rant/sony_aka_sownage.html target=_blank>an interesting posting on attrition.org</a> which offers a condensed history of the hacking activities of Sony.  Scrolling down a little, you can see a table which shows some of the compromises that occurred between April 4th to June 28 of this year.  In that time span alone, the table documents exactly 20 times Sony had been compromised.  Even the table is just the tip of the iceberg if you were to look at the notes: "This table does not count any Denial of Service (DoS) attacks against Sony as an incident."

We do note that the entry before the 16th hack shows the confusion the media had over whether or not a high ranking member of LulzSec was arrested (our sources would indicate that it was a chatroom operative and barely even considered a member of LulzSec)

To add insult to injury, the posting also offers "legacy" Sony hacks which were prior to the more recent incidences that date back as far as 1999.  The legacy hacks appear to be little more than website defaces, but it does show the security problems one company has had over the years.

The author notes the newly coined term "Sownage" which is the ownage of Sony.

What I also like about this is that it shows just how difficult it was to keep track of the hacking on Sony.  Even DatalossDB, a website devoted to specific kinds of compromised data, <a href=http://datalossdb.org/incident_highlights/53-sony-had-how-many-breaches target=_blank>admits</a>, "We thought keeping track of entities involved in the Epsilon breach was tough, but the recent spate of attacks on Sony networks has us working overtime trying to update the database."

I can fully attest to how keeping track of the Sony breaches and hacking was at least a part time commitment and I'm sure my colleague Jared Moya would agree that the Sony data breaches was certainly an eventful moment.

We should point out, in all fairness, that Sony did at least attempt to do some damage control.  For example, <a href=http://www.zeropaid.com/news/93318/psn-outage-day-11-sony-to-offer-welcome-back-program/ target=_blank>Sony did offer a welcome back package for the PSN outage to it's PSN users</a> which included free giveaways of services.  In addition, they created a new employee position to watch over the security of Sony.  For some users, this was enough, for others, the damage was already done as they bid farewell to being a Sony Playstation customer.

For a number of people that have Sony as a part of their lives, life seems to be returning to normal.  According to DatalossDB, the last Sony data breach <a href=http://datalossdb.org/incidents/3930-177-172-e-mail-addresses-acquired-by-hackers target=_blank>occurred on June 19th</a>, when Sony Pictures France had 177,000 accounts compromised.

For Sony, I would imagine the hacking has wreaked absolute havoc on the PR front if anything else.  I can also see that it would require a complete overhaul in security measures and policy - maybe even a whole new attitude toward security - between before these latest breaches occurred and now in order to prevent such a catastrophic occurrence from ever happening again.  There's little doubt that no company wants to go through what Sony did, but to ensure it never happens, other companies should take any necessary steps to stop something like this from ever happening in the first place.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/94219/theres-a-reason-why-they-called-it-sownage/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Latest Anti-Sec Dump Targets Anguilla, Brazil, Zimbabwe and Australian Government Servers</title>
		<link>http://www.zeropaid.com/news/93992/latest-anti-sec-dump-targets-anguilla-brazil-zimbabwe-and-australian-government-servers/</link>
		<comments>http://www.zeropaid.com/news/93992/latest-anti-sec-dump-targets-anguilla-brazil-zimbabwe-and-australian-government-servers/#comments</comments>
		<pubDate>Mon, 27 Jun 2011 19:47:02 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[anonymous]]></category>
		<category><![CDATA[AntiSec]]></category>
		<category><![CDATA[australia]]></category>
		<category><![CDATA[brazil]]></category>
		<category><![CDATA[government]]></category>
		<category><![CDATA[hacktivist]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[leak]]></category>
		<category><![CDATA[political]]></category>
		<category><![CDATA[zimbabwe]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=93992</guid>
		<description><![CDATA[<p><img width="128" height="128" src="http://www.zeropaid.com/wp-content/uploads/2011/06/Anonymous_Blue.jpg" class="attachment-post-thumbnail wp-post-image" alt="Anonymous_Blue" title="Anonymous_Blue" /></p><h3>LulzSec might be gone as an entity, but their effect, and leaks, are living on.  This time, their latest leak is targeting several government servers.  Anonymous clearly is picking up where LulzSec left off.</h3>

Previously, the major AntiSec dump <a href=http://www.zeropaid.com/news/93919/lulzsecs-first-secret-document-dump-hits-web-one-day-early/ target=_blank>consisted of content from the Arizona police force</a>.  This time, the Anti-Sec dump consists of sensitive content from the servers of a number of governments.  The news comes after LulzSec <a href=http://www.zeropaid.com/news/93956/lulzsec-says-bon-voyage-to-anti-security-movement/ target=_blank>officially called it quits as an entity</a> - their membership has reportedly been absorbed back in to Anonymous.

The content of several servers have been uploaded to MediaFire.  The first batch is <a href=http://twitter.com/#!/AnonymousIRC/status/85543880115752960 target=_blank>content from the government servers of Anguilla</a>.  The second batch appears to be <a href=http://twitter.com/#!/AnonymousIRC/status/85544559727226881 target=_blank>passwords from the Brazilian government servers</a>.  The third batch is <a href=http://twitter.com/#!/AnonymousIRC/status/85549377153806336 target=_blank>the userbase of Zimbabwe</a>.  The fourth batch is vaguely content <a href=http://twitter.com/#!/AnonymousIRC/status/85550583347556352 target=_blank>from Australia</a>.

Anonymous is currently working on exposing content from the US as well, but such content has not made an appearance as of this writing.  In a subsequent Tweet, Anonymous <a href=http://twitter.com/#!/AnonymousIRC/status/85554872530911232 target=_blank>commented</a>, "Currently uploading about everything about Zimbabwe Government on Internet there is to know. Who actually likes Robert Mugabe?"

We'll keep you posted on any further developments.  Anonymous hasn't issued a statement about the nature of these leaks as of this writing.

<strong>Update:</strong>Anonymous has now <a href=http://twitter.com/#!/AnonymousIRC/status/85566345768472576 target=_blank>posted the entire Zimbabwe government</a>.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="128" height="128" src="http://www.zeropaid.com/wp-content/uploads/2011/06/Anonymous_Blue.jpg" class="attachment-post-thumbnail wp-post-image" alt="Anonymous_Blue" title="Anonymous_Blue" /></p><h3>LulzSec might be gone as an entity, but their effect, and leaks, are living on.  This time, their latest leak is targeting several government servers.  Anonymous clearly is picking up where LulzSec left off.</h3>

Previously, the major AntiSec dump <a href=http://www.zeropaid.com/news/93919/lulzsecs-first-secret-document-dump-hits-web-one-day-early/ target=_blank>consisted of content from the Arizona police force</a>.  This time, the Anti-Sec dump consists of sensitive content from the servers of a number of governments.  The news comes after LulzSec <a href=http://www.zeropaid.com/news/93956/lulzsec-says-bon-voyage-to-anti-security-movement/ target=_blank>officially called it quits as an entity</a> - their membership has reportedly been absorbed back in to Anonymous.

The content of several servers have been uploaded to MediaFire.  The first batch is <a href=http://twitter.com/#!/AnonymousIRC/status/85543880115752960 target=_blank>content from the government servers of Anguilla</a>.  The second batch appears to be <a href=http://twitter.com/#!/AnonymousIRC/status/85544559727226881 target=_blank>passwords from the Brazilian government servers</a>.  The third batch is <a href=http://twitter.com/#!/AnonymousIRC/status/85549377153806336 target=_blank>the userbase of Zimbabwe</a>.  The fourth batch is vaguely content <a href=http://twitter.com/#!/AnonymousIRC/status/85550583347556352 target=_blank>from Australia</a>.

Anonymous is currently working on exposing content from the US as well, but such content has not made an appearance as of this writing.  In a subsequent Tweet, Anonymous <a href=http://twitter.com/#!/AnonymousIRC/status/85554872530911232 target=_blank>commented</a>, "Currently uploading about everything about Zimbabwe Government on Internet there is to know. Who actually likes Robert Mugabe?"

We'll keep you posted on any further developments.  Anonymous hasn't issued a statement about the nature of these leaks as of this writing.

<strong>Update:</strong>Anonymous has now <a href=http://twitter.com/#!/AnonymousIRC/status/85566345768472576 target=_blank>posted the entire Zimbabwe government</a>.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/93992/latest-anti-sec-dump-targets-anguilla-brazil-zimbabwe-and-australian-government-servers/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Mexican Congress Rejects ACTA</title>
		<link>http://www.zeropaid.com/news/93899/mexican-congress-rejects-acta/</link>
		<comments>http://www.zeropaid.com/news/93899/mexican-congress-rejects-acta/#comments</comments>
		<pubDate>Thu, 23 Jun 2011 18:21:29 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[acta]]></category>
		<category><![CDATA[agreement]]></category>
		<category><![CDATA[bill]]></category>
		<category><![CDATA[congress]]></category>
		<category><![CDATA[copyright]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[law]]></category>
		<category><![CDATA[legal]]></category>
		<category><![CDATA[mexico]]></category>
		<category><![CDATA[piracy]]></category>
		<category><![CDATA[vote]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=93899</guid>
		<description><![CDATA[<p><img width="200" height="124" src="http://www.zeropaid.com/wp-content/uploads/2011/06/mexico-flag_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="mexico-flag_crop" title="mexico-flag_crop" /></p><h3>The Anti-counterfeiting Trade Agreement has certainly been the most famous and controversial international agreements surrounding copyright.  It left many stakeholders anywhere between unsatisfied to vehemently opposed.  Now, one country involved in the negotiations has had their congress rejected the trade agreement outright.</h3>

ACTA is a very long running story that is continuing to this day.  It was first <a href=http://www.zeropaid.com/news/9511/us_proposes_pirate_bay_killer_trade_agreement/ target=_blank>exposed by Wikileaks in 2008</a> - one month and three years ago to be more precise.  Over the years, it became notorious for things like a global DMCA, a global three strikes law and making law enforcement use substantially more resources at their borders strictly for intellectual property related enforcement.  It was essentially a wish-list by record labels, major game manufactures and Hollywood before they focused on web censorship (as seems to be <a href=http://www.zeropaid.com/news/93893/leaked-document-copyright-industry-wants-a-great-firewall-of-britain/ target=_blank>a popular for them these days</a>)

For many, the secrecy surrounding this agreement was one major point of objection.  <a href=http://www.zeropaid.com/news/9754/over_100_international_public_interest_organizations_demand_acta_be_made_public/ target=_blank>Over 100 consumer rights groups from around the world</a> jointly demanded ACTA be made public in 2008.  Trying to pry ACTA out of secrecy wasn't easy and, in fact, <a href=http://www.zeropaid.com/news/9762/us_advocacy_organizations_sue_government_to_make_acta_public/ target=_blank>there were lawsuits against governments</a> solely to make ACTA officially public.  It wouldn't be until the end of 2010 before <a href=http://europa.eu/rapid/pressReleasesAction.do?reference=IP/10/1504&format=HTML&aged=0&language=EN&guiLanguage=en target=_blank>ACTA was finally made public</a>.

While a lot has changed, a lot remained the same within ACTA and many, to this day, still want to see ACTA scrapped.  Proponents say that it's up to the governments around the world to implement the trade agreement and how they choose to implement it is strictly up to them.  With plenty of organizations pressuring these governments to implement things like ACTA, many see this as partly why these laws are outright bi-passing democracy itself.  The only hope is that governments around the world reject ACTA.  Well, we can report that Mexico has done just that.

Techdirt <a href=http://www.techdirt.com/articles/20110622/16200014814/mexican-congress-says-no-to-acta.shtml target=_blank>notes</a> that the Mexican congress has officially rejected ACTA.  The report referenced a <a href=https://twitter.com/#!/Mematematica/statuses/83635742907179008 target=_blank>Tweet</a> which is linked to the <a href=http://www.senado.gob.mx/index.php?ver=sp&mn=2&sm=2&id=9376&lg=61 target=_blank>government website</a> (Spanish, <a href=http://translate.google.com/translate?hl=en&sl=es&u=http://www.senado.gob.mx/index.php%3Fver%3Dsp%26mn%3D2%26sm%3D2%26id%3D9376%26lg%3D61&ei=hYADTtOFBPHUiAK--IX-DQ&sa=X&oi=translate&ct=result&resnum=1&ved=0CBsQ7gEwAA&prev=/search%3Fq%3Dhttp://www.senado.gob.mx/index.php%253Fver%253Dsp%2526mn%253D2%2526sm%253D2%2526id%253D9376%2526lg%253D61%26hl%3Den%26client%3Dfirefox-a%26hs%3DJDp%26rls%3Dorg.mozilla:en-US:official%26prmd%3Divns target=_blank>Google translation</a>)  The translation states the following:

<blockquote>The Standing Committee of H. Congress, respectfully urges the Federal Executive Power for the scope of its powers, instruct the ministries and agencies involved in negotiating the Anti Counterfeiting Trade Agreement (ACTA), not to sign the agreement.</blockquote>

It was apparently one bill rolled up into a package of bills because the government was running out of time.  As Techdirt points out, the only way Mexico will sign ACTA at this point is if the executive branch defies the will of congress and signs anyway.

No doubt this is another blow to the agreement.  How much of a blow remains to be seen, but it is, no doubt, encouraging to see. 

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="200" height="124" src="http://www.zeropaid.com/wp-content/uploads/2011/06/mexico-flag_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="mexico-flag_crop" title="mexico-flag_crop" /></p><h3>The Anti-counterfeiting Trade Agreement has certainly been the most famous and controversial international agreements surrounding copyright.  It left many stakeholders anywhere between unsatisfied to vehemently opposed.  Now, one country involved in the negotiations has had their congress rejected the trade agreement outright.</h3>

ACTA is a very long running story that is continuing to this day.  It was first <a href=http://www.zeropaid.com/news/9511/us_proposes_pirate_bay_killer_trade_agreement/ target=_blank>exposed by Wikileaks in 2008</a> - one month and three years ago to be more precise.  Over the years, it became notorious for things like a global DMCA, a global three strikes law and making law enforcement use substantially more resources at their borders strictly for intellectual property related enforcement.  It was essentially a wish-list by record labels, major game manufactures and Hollywood before they focused on web censorship (as seems to be <a href=http://www.zeropaid.com/news/93893/leaked-document-copyright-industry-wants-a-great-firewall-of-britain/ target=_blank>a popular for them these days</a>)

For many, the secrecy surrounding this agreement was one major point of objection.  <a href=http://www.zeropaid.com/news/9754/over_100_international_public_interest_organizations_demand_acta_be_made_public/ target=_blank>Over 100 consumer rights groups from around the world</a> jointly demanded ACTA be made public in 2008.  Trying to pry ACTA out of secrecy wasn't easy and, in fact, <a href=http://www.zeropaid.com/news/9762/us_advocacy_organizations_sue_government_to_make_acta_public/ target=_blank>there were lawsuits against governments</a> solely to make ACTA officially public.  It wouldn't be until the end of 2010 before <a href=http://europa.eu/rapid/pressReleasesAction.do?reference=IP/10/1504&format=HTML&aged=0&language=EN&guiLanguage=en target=_blank>ACTA was finally made public</a>.

While a lot has changed, a lot remained the same within ACTA and many, to this day, still want to see ACTA scrapped.  Proponents say that it's up to the governments around the world to implement the trade agreement and how they choose to implement it is strictly up to them.  With plenty of organizations pressuring these governments to implement things like ACTA, many see this as partly why these laws are outright bi-passing democracy itself.  The only hope is that governments around the world reject ACTA.  Well, we can report that Mexico has done just that.

Techdirt <a href=http://www.techdirt.com/articles/20110622/16200014814/mexican-congress-says-no-to-acta.shtml target=_blank>notes</a> that the Mexican congress has officially rejected ACTA.  The report referenced a <a href=https://twitter.com/#!/Mematematica/statuses/83635742907179008 target=_blank>Tweet</a> which is linked to the <a href=http://www.senado.gob.mx/index.php?ver=sp&mn=2&sm=2&id=9376&lg=61 target=_blank>government website</a> (Spanish, <a href=http://translate.google.com/translate?hl=en&sl=es&u=http://www.senado.gob.mx/index.php%3Fver%3Dsp%26mn%3D2%26sm%3D2%26id%3D9376%26lg%3D61&ei=hYADTtOFBPHUiAK--IX-DQ&sa=X&oi=translate&ct=result&resnum=1&ved=0CBsQ7gEwAA&prev=/search%3Fq%3Dhttp://www.senado.gob.mx/index.php%253Fver%253Dsp%2526mn%253D2%2526sm%253D2%2526id%253D9376%2526lg%253D61%26hl%3Den%26client%3Dfirefox-a%26hs%3DJDp%26rls%3Dorg.mozilla:en-US:official%26prmd%3Divns target=_blank>Google translation</a>)  The translation states the following:

<blockquote>The Standing Committee of H. Congress, respectfully urges the Federal Executive Power for the scope of its powers, instruct the ministries and agencies involved in negotiating the Anti Counterfeiting Trade Agreement (ACTA), not to sign the agreement.</blockquote>

It was apparently one bill rolled up into a package of bills because the government was running out of time.  As Techdirt points out, the only way Mexico will sign ACTA at this point is if the executive branch defies the will of congress and signs anyway.

No doubt this is another blow to the agreement.  How much of a blow remains to be seen, but it is, no doubt, encouraging to see. 

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/93899/mexican-congress-rejects-acta/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>LulzSec Denies Involvement in UK Hack, Not Arrested After All</title>
		<link>http://www.zeropaid.com/news/93830/lulzsec-denies-involvement-in-uk-hack-not-arrested-after-all/</link>
		<comments>http://www.zeropaid.com/news/93830/lulzsec-denies-involvement-in-uk-hack-not-arrested-after-all/#comments</comments>
		<pubDate>Tue, 21 Jun 2011 17:58:22 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[arrest]]></category>
		<category><![CDATA[fake]]></category>
		<category><![CDATA[fbi]]></category>
		<category><![CDATA[hack]]></category>
		<category><![CDATA[hacker]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[lulzsec]]></category>
		<category><![CDATA[uk]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=93830</guid>
		<description><![CDATA[<p><img width="200" height="100" src="http://www.zeropaid.com/wp-content/uploads/2009/04/united_kingdom_flag_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="united_kingdom_flag_crop" title="united_kingdom_flag_crop" /></p><h3>Rumours were apparently circulating that LulzSec was involved in hacking the UK government.  These rumours were followed up by <a href=http://nakedsecurity.sophos.com/2011/06/21/lulzsec-suspect-arrested-scotland-yard/ target=_blank>a supposed arrest</a> of one of its members, but LulzSec has denied both today.</h3>

There was some dramatic news this morning regarding LulzSec.  One story was about LulzSec hacking and obtaining the 2011 UK census data.  Numerous outlets including the <a href=http://online.wsj.com/article/BT-CO-20110621-706717.html target=_blank>Wall Street Journal</a> were reporting this news.  What followed was an even more dramatic story that someone from LulzSec was arrested.  This, again was reported on high profile news outlets like <a href=http://www.cbsnews.com/8301-501465_162-20072897-501465.html target=_blank>CBS</a> and ZDNET and the Associated Press.  So, what was true about LulzSec?  It turns out, none of the above.

LulzSec was ridiculing the news.  Here's a series of Tweets of them discussing the news:

<a href=http://twitter.com/#!/LulzSec/status/83164092998758400 target=_blank>LulzSec</a>: "Seems the glorious leader of LulzSec got arrested, it's all over now... wait... we're all still here! Which poor bastard did they take down?"

<a href=http://twitter.com/#!/LulzSec/status/83217898008616961 target=_blank>LulzSec</a>: "People should keep releasing fake LulzSec stuff. It helps filter out the peon masses from the respectable, fact-checking media outlets."

<a href=http://twitter.com/#!/LulzSec/status/83172676960661504 target=_blank>LulzSec</a>: "But hey, if someone out there hacked the UK government in the name of #AntiSec, well done sirs!"

<a href=http://twitter.com/#!/LulzSec/status/83172344398487552 target=_blank>LulzSec</a>: "Anyone in the world can copy and paste The Lulz Boat ASCII art and general lighthearted theme. Smarten up, check the feed first. #AntiSec"

<a href=http://twitter.com/#!/LulzSec/status/83172089711964161 target=_blank>LulzSec</a>: "Just saw the pastebin of the UK census hack. That wasn't us - don't believe fake LulzSec releases unless we put out a tweet first."

So, where did the rumours come from exactly?  It's very hard to say with so many media outlets reporting on the same thing.  One report from <a href=http://nakedsecurity.sophos.com/2011/06/21/lulzsec-suspect-arrested-scotland-yard/ target=_blank>Naked Securty</a> was pointing to a page on a <a href=http://content.met.police.uk/News/eCrime-unit-arrest-man/1260269113895/1257246745756 target=_blank>UK police website</a> while saying it was LulzSec that was arrested.  However, the original police report makes no mention of LulzSec.  The report merely says that a 19 year old was arrested following "an investigation into network intrusions and Distributed Denial of Service (DDoS) attacks against a number of international business and intelligence agencies by what is believed to be the same hacking group."

The arrest was made while working with the FBI.

Looking at the police report, if other outlets were using the same police report, I think it's a fairly easy mistake to make because LulzSec and Anonymous were making numerous headlines for their hacking and/or DDoS attacks.  The way it was described sort of sounds like it is LulzSec they are describing, but it's pretty obvious afte checking <a href=http://twitter.com/#!/LulzSec/ target=_blank>their Twitter feed</a> that they had nothing to do with either hacking the UK website or being arrested.  Will members of LulzSec be arrested?  Maybe, but not today.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="200" height="100" src="http://www.zeropaid.com/wp-content/uploads/2009/04/united_kingdom_flag_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="united_kingdom_flag_crop" title="united_kingdom_flag_crop" /></p><h3>Rumours were apparently circulating that LulzSec was involved in hacking the UK government.  These rumours were followed up by <a href=http://nakedsecurity.sophos.com/2011/06/21/lulzsec-suspect-arrested-scotland-yard/ target=_blank>a supposed arrest</a> of one of its members, but LulzSec has denied both today.</h3>

There was some dramatic news this morning regarding LulzSec.  One story was about LulzSec hacking and obtaining the 2011 UK census data.  Numerous outlets including the <a href=http://online.wsj.com/article/BT-CO-20110621-706717.html target=_blank>Wall Street Journal</a> were reporting this news.  What followed was an even more dramatic story that someone from LulzSec was arrested.  This, again was reported on high profile news outlets like <a href=http://www.cbsnews.com/8301-501465_162-20072897-501465.html target=_blank>CBS</a> and ZDNET and the Associated Press.  So, what was true about LulzSec?  It turns out, none of the above.

LulzSec was ridiculing the news.  Here's a series of Tweets of them discussing the news:

<a href=http://twitter.com/#!/LulzSec/status/83164092998758400 target=_blank>LulzSec</a>: "Seems the glorious leader of LulzSec got arrested, it's all over now... wait... we're all still here! Which poor bastard did they take down?"

<a href=http://twitter.com/#!/LulzSec/status/83217898008616961 target=_blank>LulzSec</a>: "People should keep releasing fake LulzSec stuff. It helps filter out the peon masses from the respectable, fact-checking media outlets."

<a href=http://twitter.com/#!/LulzSec/status/83172676960661504 target=_blank>LulzSec</a>: "But hey, if someone out there hacked the UK government in the name of #AntiSec, well done sirs!"

<a href=http://twitter.com/#!/LulzSec/status/83172344398487552 target=_blank>LulzSec</a>: "Anyone in the world can copy and paste The Lulz Boat ASCII art and general lighthearted theme. Smarten up, check the feed first. #AntiSec"

<a href=http://twitter.com/#!/LulzSec/status/83172089711964161 target=_blank>LulzSec</a>: "Just saw the pastebin of the UK census hack. That wasn't us - don't believe fake LulzSec releases unless we put out a tweet first."

So, where did the rumours come from exactly?  It's very hard to say with so many media outlets reporting on the same thing.  One report from <a href=http://nakedsecurity.sophos.com/2011/06/21/lulzsec-suspect-arrested-scotland-yard/ target=_blank>Naked Securty</a> was pointing to a page on a <a href=http://content.met.police.uk/News/eCrime-unit-arrest-man/1260269113895/1257246745756 target=_blank>UK police website</a> while saying it was LulzSec that was arrested.  However, the original police report makes no mention of LulzSec.  The report merely says that a 19 year old was arrested following "an investigation into network intrusions and Distributed Denial of Service (DDoS) attacks against a number of international business and intelligence agencies by what is believed to be the same hacking group."

The arrest was made while working with the FBI.

Looking at the police report, if other outlets were using the same police report, I think it's a fairly easy mistake to make because LulzSec and Anonymous were making numerous headlines for their hacking and/or DDoS attacks.  The way it was described sort of sounds like it is LulzSec they are describing, but it's pretty obvious afte checking <a href=http://twitter.com/#!/LulzSec/ target=_blank>their Twitter feed</a> that they had nothing to do with either hacking the UK website or being arrested.  Will members of LulzSec be arrested?  Maybe, but not today.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/93830/lulzsec-denies-involvement-in-uk-hack-not-arrested-after-all/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>300 Irish Internet Users Wrongfully Receive First Strike Notices</title>
		<link>http://www.zeropaid.com/news/93791/300-irish-internet-users-wrongfully-receive-first-strike-notices/</link>
		<comments>http://www.zeropaid.com/news/93791/300-irish-internet-users-wrongfully-receive-first-strike-notices/#comments</comments>
		<pubDate>Fri, 17 Jun 2011 23:00:54 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[copyright]]></category>
		<category><![CDATA[eircom]]></category>
		<category><![CDATA[infringement]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[ireland]]></category>
		<category><![CDATA[law]]></category>
		<category><![CDATA[legal]]></category>
		<category><![CDATA[p2p]]></category>
		<category><![CDATA[three strikes law]]></category>
		<category><![CDATA[un]]></category>
		<category><![CDATA[wifi]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=93791</guid>
		<description><![CDATA[<p><img width="200" height="133" src="http://www.zeropaid.com/wp-content/uploads/2009/08/Ireland_flag_300_crop.png" class="attachment-post-thumbnail wp-post-image" alt="Ireland_flag_300_crop" title="Ireland_flag_300_crop" /></p><h3>False accusations have long been a subject for those sceptical of a three strikes law.  Given the complexity of tying an IP address to a subscriber is much too complicated for any form of automated system, it should come as no surprise for sceptics to find out that people are wrongfully receiving notices for copyright infringement.</h3>

Record labels have been pressuring ISPs to implement a three strikes law in Ireland for years.  In fact, in 2008, the record labels went to the extreme length of <a href=http://www.zeropaid.com/news/9323/record_labels_sue_irish_isp_demand_music_piracy_filtering/ target=_blank>suing Irish ISP Eircom in a bid to get them to implement a three strikes law</a>.  In 2009, the ISP folded to pressure and <a href=http://www.zeropaid.com/news/9984/irish_isp_agrees_to_threestrikes_policy_for_filesharers/ target=_blank>agreed to implement a three strikes law for its users</a>.  Then, as of 2010, Eircom <a href=http://www.zeropaid.com/news/89206/irish-isp-begins-voluntary-three-strikes/ target=_blank>implemented the three strikes policy on their subscribers</a> much to the <a href=http://www.zeropaid.com/news/89224/pirate-bay-blasts-irish-3-strikes-isp/ target=_blank>outrage of many people including the Pirate Party of Ireland</a>.

There's plenty of ways to be critical of a three strikes law or policy.  One way is to be critical of the technical nature of such a policy.  It's all well and good to be able to find an IP address on a file-sharing network, but it's quite a different matter of actually tying that to an actual person.  For instance, one person could by hijacking someone's IP address via an insecure Wifi network.  Even marginally secure Wifi networks won't guard against any possible threat.  Back in 2010, a USB device <a href=http://www.zeropaid.com/news/89039/chinese-usb-wifi-crackers-make-three-strikes-laws-obsolete/ target=_blank>circulated the Chinese marketplace that would crack in to Wifi networks</a>.  Ultimately speaking, one person could be using someone else's IP address to share copyrighted material unbeknownst to the actual subscriber.  Of course, there;s also the study even further back in 2008 which showed that <a href=http://www.zeropaid.com/news/9535/study_bittorrent_users_prone_to_false_copyright_infringement_claims/ target=_blank>even a printer could be framed for copyright infringement</a>.

So really, it's should come as no surprise to copyright observers that false accusations are being made even with a three strike policy present.  That was certainly the case, as <a href=http://edri.org/edrigram/number9.12/irish-dpa-investigates-three-strikes target=_blank>EDRI points out</a>, in Ireland when 300 users received first strike notices over infringements they never even committed. According to IT Law in Ireland, <a href=http://www.tjmcintyre.com/2011/06/300-false-accusations-data-protection.html target=_blank>Eircom is investigating the matter</a> and offered the following explanation:

<blockquote>This was due to a software failure caused when the clocks went back last October, it said.</blockquote>

As was noted in the posting, it's very peculiar that there is an effort to take on the enormous task of identifying people via IP address, yet, this same effort can't even account for daylight savings time.  It get's even more interesting:

<blockquote><blockquote>The DPC said it was investigating the complaint "including whether the subject matter gives rise to any questions as to the proportionality of the graduated response system operated by Eircom and the music industry"</blockquote>

This is unsurprising - when the Eircom / IRMA three strikes settlement was being agreed the Data Protection Commissioner identified significant data protection problems with it. These problems remain, notwithstanding the deeply flawed High Court judgment which approved of the system - a judgment which, for example, decided on the question of whether or not IP addresses are personal data without once considering the views of the Article 29 Working Party. It is not surprising that the Data Protection Commissioner was not convinced by that judgment (the judgment was problematic at least in part because the Commissioner was not represented - the only parties before the court had a vested interest in the system being implemented). However, until a concrete complaint arose no further action could be taken.

The complaint in this case has now triggered that action, and it seems likely that the Commissioner will reach a decision reflecting his previous views that using IP addresses to cut off customers' internet connections is disproportionate and does not constitute "fair use" of personal information. If so, the Commissioner has the power and indeed the duty to issue an enforcement notice which would prevent Eircom from using personal data for this purpose - which would ultimately seem likely to put the matter back before the courts. </blockquote>

Indeed, there have been numerous legal questions surrounding a three strikes law.  Early this month, Frank La Rue, the UN’s Special Rapporteur on freedom of opinion and expression <a href=http://www.zeropaid.com/news/93617/un-report-3-strikes-is-a-violation-of-human-rights/ target=_blank>said that a three strikes law was a violation of the International Covenant on Civil and Political Rights</a>.

What all this seems to suggest is the crumbling of the attempt to implement a global three strikes law.  Even if secret agreements like ACTA or TPP say that countries must implement a three strikes law, it now runs in to obstacles such as the UN Rapporteur and complaints about false accusations.

I would go so far as to say that the window of opportunity to force a global three strikes law is passing.  It certainly was more possible three years ago to try and force countries to implement a three strikes law, but now it is becoming increasingly difficult to not only persuade countries to implement them, but to make sure countries that have some form of implementation to keep the policy in place.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="200" height="133" src="http://www.zeropaid.com/wp-content/uploads/2009/08/Ireland_flag_300_crop.png" class="attachment-post-thumbnail wp-post-image" alt="Ireland_flag_300_crop" title="Ireland_flag_300_crop" /></p><h3>False accusations have long been a subject for those sceptical of a three strikes law.  Given the complexity of tying an IP address to a subscriber is much too complicated for any form of automated system, it should come as no surprise for sceptics to find out that people are wrongfully receiving notices for copyright infringement.</h3>

Record labels have been pressuring ISPs to implement a three strikes law in Ireland for years.  In fact, in 2008, the record labels went to the extreme length of <a href=http://www.zeropaid.com/news/9323/record_labels_sue_irish_isp_demand_music_piracy_filtering/ target=_blank>suing Irish ISP Eircom in a bid to get them to implement a three strikes law</a>.  In 2009, the ISP folded to pressure and <a href=http://www.zeropaid.com/news/9984/irish_isp_agrees_to_threestrikes_policy_for_filesharers/ target=_blank>agreed to implement a three strikes law for its users</a>.  Then, as of 2010, Eircom <a href=http://www.zeropaid.com/news/89206/irish-isp-begins-voluntary-three-strikes/ target=_blank>implemented the three strikes policy on their subscribers</a> much to the <a href=http://www.zeropaid.com/news/89224/pirate-bay-blasts-irish-3-strikes-isp/ target=_blank>outrage of many people including the Pirate Party of Ireland</a>.

There's plenty of ways to be critical of a three strikes law or policy.  One way is to be critical of the technical nature of such a policy.  It's all well and good to be able to find an IP address on a file-sharing network, but it's quite a different matter of actually tying that to an actual person.  For instance, one person could by hijacking someone's IP address via an insecure Wifi network.  Even marginally secure Wifi networks won't guard against any possible threat.  Back in 2010, a USB device <a href=http://www.zeropaid.com/news/89039/chinese-usb-wifi-crackers-make-three-strikes-laws-obsolete/ target=_blank>circulated the Chinese marketplace that would crack in to Wifi networks</a>.  Ultimately speaking, one person could be using someone else's IP address to share copyrighted material unbeknownst to the actual subscriber.  Of course, there;s also the study even further back in 2008 which showed that <a href=http://www.zeropaid.com/news/9535/study_bittorrent_users_prone_to_false_copyright_infringement_claims/ target=_blank>even a printer could be framed for copyright infringement</a>.

So really, it's should come as no surprise to copyright observers that false accusations are being made even with a three strike policy present.  That was certainly the case, as <a href=http://edri.org/edrigram/number9.12/irish-dpa-investigates-three-strikes target=_blank>EDRI points out</a>, in Ireland when 300 users received first strike notices over infringements they never even committed. According to IT Law in Ireland, <a href=http://www.tjmcintyre.com/2011/06/300-false-accusations-data-protection.html target=_blank>Eircom is investigating the matter</a> and offered the following explanation:

<blockquote>This was due to a software failure caused when the clocks went back last October, it said.</blockquote>

As was noted in the posting, it's very peculiar that there is an effort to take on the enormous task of identifying people via IP address, yet, this same effort can't even account for daylight savings time.  It get's even more interesting:

<blockquote><blockquote>The DPC said it was investigating the complaint "including whether the subject matter gives rise to any questions as to the proportionality of the graduated response system operated by Eircom and the music industry"</blockquote>

This is unsurprising - when the Eircom / IRMA three strikes settlement was being agreed the Data Protection Commissioner identified significant data protection problems with it. These problems remain, notwithstanding the deeply flawed High Court judgment which approved of the system - a judgment which, for example, decided on the question of whether or not IP addresses are personal data without once considering the views of the Article 29 Working Party. It is not surprising that the Data Protection Commissioner was not convinced by that judgment (the judgment was problematic at least in part because the Commissioner was not represented - the only parties before the court had a vested interest in the system being implemented). However, until a concrete complaint arose no further action could be taken.

The complaint in this case has now triggered that action, and it seems likely that the Commissioner will reach a decision reflecting his previous views that using IP addresses to cut off customers' internet connections is disproportionate and does not constitute "fair use" of personal information. If so, the Commissioner has the power and indeed the duty to issue an enforcement notice which would prevent Eircom from using personal data for this purpose - which would ultimately seem likely to put the matter back before the courts. </blockquote>

Indeed, there have been numerous legal questions surrounding a three strikes law.  Early this month, Frank La Rue, the UN’s Special Rapporteur on freedom of opinion and expression <a href=http://www.zeropaid.com/news/93617/un-report-3-strikes-is-a-violation-of-human-rights/ target=_blank>said that a three strikes law was a violation of the International Covenant on Civil and Political Rights</a>.

What all this seems to suggest is the crumbling of the attempt to implement a global three strikes law.  Even if secret agreements like ACTA or TPP say that countries must implement a three strikes law, it now runs in to obstacles such as the UN Rapporteur and complaints about false accusations.

I would go so far as to say that the window of opportunity to force a global three strikes law is passing.  It certainly was more possible three years ago to try and force countries to implement a three strikes law, but now it is becoming increasingly difficult to not only persuade countries to implement them, but to make sure countries that have some form of implementation to keep the policy in place.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/93791/300-irish-internet-users-wrongfully-receive-first-strike-notices/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>British Student Faces Extradition to the US for Linking to Copyrighted Material</title>
		<link>http://www.zeropaid.com/news/93775/british-student-faces-extradition-to-the-us-for-linking-to-copyrighted-material/</link>
		<comments>http://www.zeropaid.com/news/93775/british-student-faces-extradition-to-the-us-for-linking-to-copyrighted-material/#comments</comments>
		<pubDate>Fri, 17 Jun 2011 01:08:27 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[britain]]></category>
		<category><![CDATA[google]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[legal]]></category>
		<category><![CDATA[linking]]></category>
		<category><![CDATA[tv]]></category>
		<category><![CDATA[TVShack]]></category>
		<category><![CDATA[uk]]></category>
		<category><![CDATA[us]]></category>
		<category><![CDATA[website]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=93775</guid>
		<description><![CDATA[<p><img width="200" height="81" src="http://www.zeropaid.com/wp-content/uploads/2011/01/tvshack_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="tvshack_crop" title="tvshack_crop" /></p><h3>He created a website that allegedly linked to copyrighted material.  Now, the US wants Richard O'Dwyer, the former owner of TVShack, to face a US court over his websites activities prior to both domain seizures.</h3>

It's unlikely that when O'Dwyer started TVShack, he imagined that he would face extradition demands from the US.  That's exactly what is happening today.  TVShack.net was the original domain for the website.  It was a fairly popular website for people to find links to things like TV shows.  However, all that came to an end last July when federal officials <a href=http://www.zeropaid.com/news/89640/feds-seize-7-linking-websites-1-cyberlocker-for-infringement/ target=_blank>shut down the linking website's domain name</a> as part of their "Operation In Our Sites" campaign.  The website quickly <a href=http://www.zeropaid.com/news/89830/tvshack-back-up-under-different-domain/ target=_blank>re-emerged as TVShack.cc</a>.  Then, at the end of November, ICE (Immigration and Customs Enforcement) seized the domain again in part of their "Operation In Our Sites v 2.0".  Officially, the website never came back again as clone sites were all that remained after that.

The owner is apparently out on bail after being arrested and wont face a court in Britain until September.  As far as the US is concerned, that apparently isn't enough.  According to British newspaper, The Star, <a href=http://www.thestar.co.uk/news/local/sheffield_student_faces_jail_in_america_over_movie_clips_on_website_1_3479234 target=_blank>the US is demanding that he face a court in the US for linking to copyrighted material</a>.  The report says that the Computer Science student is in complete disbelief over the charges.  From the report:

<blockquote>A source close to Richard said: “He’s in total disbelief over the charges against him and very anxious about the impact this may have on his studies since he has two years left of his degree. He’s daunted and frightened by the

prospect of being extradited to America let alone the disruption to his career.”

His mother Julia O’Dwyer said the decision to put him on trial in the US was ‘madness’.

“Richard clearly has a talent for web design but was foolish in not understanding the implications of copyright,” she said.

“Yet to try to haul him off to America for trial while he’s midway through his university studies is so utterly disproportionate it defies belief.”</blockquote>

ZDNet, also covering the story, <a href=http://www.zdnet.co.uk/news/regulation/2011/06/16/student-faces-extradition-to-us-for-hosting-links-40093132/ target=_blank>contains the following</a>:

<blockquote>Terms of his bail involved not entering ports or airports and not applying to register new domain names. On Tuesday, O'Dwyer appeared before the City of Westminster Magistrates' Court for a brief preliminary hearing. His lawyer said the extradition demands made by the US breached O'Dwyer's human rights and there was no basis for extradition.

"The server was not based in the US at all. Mr O'Dwyer did not have copyrighted material on his website; he simply provided a link. The essential contention is that the correct forum for this trial is in fact here in Britain, where he was at all times," Cooper is quoted in the report as saying.</blockquote>

There appears to not be any connection to the US and there was no copyrighted material on the TVShack servers.  That is definitely a source of contention for those criticial of the US move.  TechDirt offered <a href=http://www.techdirt.com/articles/20110615/14240014708/us-trying-to-extradite-uk-tvshack-admin-over-questionable-copyright-charges.shtml target=_blank>offered some interesting observations on that</a>:

<blockquote>Where this becomes really troubling is that other, very similar sites have been found legal in the UK multiple times. Running a site that users use to put up links and which doesn't host any actual content, is not seen as illegal in the UK. So it seems particularly ridiculous that there's some sort of attempt to extradite the guy to the US to face charges here. As some have pointed out it appears to be "an attempt to make US federal laws applicable in the UK."

Unfortunately, the details of the extradition request are a bit muddled in all of the UK papers reporting on it. Lots of them are comparing the situation to the famous Gary McKinnon situation, but I think this is clearly different. This just seems blatantly vindictive for no good reason.</blockquote>

The details of the case are, indeed, rather troubling.  If someone in Britain can be extradited to the US for linking to copyrighted material, why can't the owners of Google, Bing or any other search engine face similar charges - especially given that all of them do have bigger ties to the US than TVShack.  It seems like a very questionable response at best given the nature of the website.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="200" height="81" src="http://www.zeropaid.com/wp-content/uploads/2011/01/tvshack_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="tvshack_crop" title="tvshack_crop" /></p><h3>He created a website that allegedly linked to copyrighted material.  Now, the US wants Richard O'Dwyer, the former owner of TVShack, to face a US court over his websites activities prior to both domain seizures.</h3>

It's unlikely that when O'Dwyer started TVShack, he imagined that he would face extradition demands from the US.  That's exactly what is happening today.  TVShack.net was the original domain for the website.  It was a fairly popular website for people to find links to things like TV shows.  However, all that came to an end last July when federal officials <a href=http://www.zeropaid.com/news/89640/feds-seize-7-linking-websites-1-cyberlocker-for-infringement/ target=_blank>shut down the linking website's domain name</a> as part of their "Operation In Our Sites" campaign.  The website quickly <a href=http://www.zeropaid.com/news/89830/tvshack-back-up-under-different-domain/ target=_blank>re-emerged as TVShack.cc</a>.  Then, at the end of November, ICE (Immigration and Customs Enforcement) seized the domain again in part of their "Operation In Our Sites v 2.0".  Officially, the website never came back again as clone sites were all that remained after that.

The owner is apparently out on bail after being arrested and wont face a court in Britain until September.  As far as the US is concerned, that apparently isn't enough.  According to British newspaper, The Star, <a href=http://www.thestar.co.uk/news/local/sheffield_student_faces_jail_in_america_over_movie_clips_on_website_1_3479234 target=_blank>the US is demanding that he face a court in the US for linking to copyrighted material</a>.  The report says that the Computer Science student is in complete disbelief over the charges.  From the report:

<blockquote>A source close to Richard said: “He’s in total disbelief over the charges against him and very anxious about the impact this may have on his studies since he has two years left of his degree. He’s daunted and frightened by the

prospect of being extradited to America let alone the disruption to his career.”

His mother Julia O’Dwyer said the decision to put him on trial in the US was ‘madness’.

“Richard clearly has a talent for web design but was foolish in not understanding the implications of copyright,” she said.

“Yet to try to haul him off to America for trial while he’s midway through his university studies is so utterly disproportionate it defies belief.”</blockquote>

ZDNet, also covering the story, <a href=http://www.zdnet.co.uk/news/regulation/2011/06/16/student-faces-extradition-to-us-for-hosting-links-40093132/ target=_blank>contains the following</a>:

<blockquote>Terms of his bail involved not entering ports or airports and not applying to register new domain names. On Tuesday, O'Dwyer appeared before the City of Westminster Magistrates' Court for a brief preliminary hearing. His lawyer said the extradition demands made by the US breached O'Dwyer's human rights and there was no basis for extradition.

"The server was not based in the US at all. Mr O'Dwyer did not have copyrighted material on his website; he simply provided a link. The essential contention is that the correct forum for this trial is in fact here in Britain, where he was at all times," Cooper is quoted in the report as saying.</blockquote>

There appears to not be any connection to the US and there was no copyrighted material on the TVShack servers.  That is definitely a source of contention for those criticial of the US move.  TechDirt offered <a href=http://www.techdirt.com/articles/20110615/14240014708/us-trying-to-extradite-uk-tvshack-admin-over-questionable-copyright-charges.shtml target=_blank>offered some interesting observations on that</a>:

<blockquote>Where this becomes really troubling is that other, very similar sites have been found legal in the UK multiple times. Running a site that users use to put up links and which doesn't host any actual content, is not seen as illegal in the UK. So it seems particularly ridiculous that there's some sort of attempt to extradite the guy to the US to face charges here. As some have pointed out it appears to be "an attempt to make US federal laws applicable in the UK."

Unfortunately, the details of the extradition request are a bit muddled in all of the UK papers reporting on it. Lots of them are comparing the situation to the famous Gary McKinnon situation, but I think this is clearly different. This just seems blatantly vindictive for no good reason.</blockquote>

The details of the case are, indeed, rather troubling.  If someone in Britain can be extradited to the US for linking to copyrighted material, why can't the owners of Google, Bing or any other search engine face similar charges - especially given that all of them do have bigger ties to the US than TVShack.  It seems like a very questionable response at best given the nature of the website.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/93775/british-student-faces-extradition-to-the-us-for-linking-to-copyrighted-material/feed/</wfw:commentRss>
		<slash:comments>43</slash:comments>
		</item>
		<item>
		<title>Editorial: Should We Thank the Hackers for These Security Breaches?</title>
		<link>http://www.zeropaid.com/news/93739/editorial-should-we-thank-the-hackers-for-these-security-breaches/</link>
		<comments>http://www.zeropaid.com/news/93739/editorial-should-we-thank-the-hackers-for-these-security-breaches/#comments</comments>
		<pubDate>Wed, 15 Jun 2011 04:52:47 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[CitiGroup]]></category>
		<category><![CDATA[epic fail]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[internet]]></category>
		<category><![CDATA[lulzsec]]></category>
		<category><![CDATA[NHS]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[sony]]></category>
		<category><![CDATA[websites]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=93739</guid>
		<description><![CDATA[<p><img width="200" height="200" src="http://www.zeropaid.com/wp-content/uploads/2011/06/Computer_Security_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="Computer_Security_crop" title="Computer_Security_crop" /></p><h3>For the past few months or so, there have been numerous stories about security breaches.  Earlier in the saga of security breaches, Sony wound up becoming the centre of attention for people breaking in to whatever system Sony had some control over whether it be their network, their website or a host of other hacks.  More recently, Sony has found itself in good company with other organizations who had their security breached.  Drew Wilson argues that we should really be thanking some of these hackers who bring to attention security vulnerabilities and pay more attention to online security.</h3>

Let's set a very stripped down scene here.  A person with malicious intentions decides they want to break in to a website, steal people's identities and sell those identities on the black market for a huge profit without a care of what happens to countless innocent victims.  So, this person invests some time in figuring out how to break in to a large organization.  The person breaks in successfully, steals hundreds of thousands of identities.  By the time the organization knows about the breach, let alone the public, the crime has already taken place and the sale of this sensitive information has already happened.  Who gets the blame here: the person that broke in to organization in the first place to commit the crime or the organization for failing to keep their organization secure enough from such intrusions?

Chances are, such a question will garner a wide variety of opinions ranging from "how awful it is that someone would sell peoples identities?" to "what was the organization thinking allowing for such a thing to take place?".  The real question that should be asked, in my view, is what are the details of that incident?  Did this hacker go to the extreme lengths of corporate espionage?  Like, did this person take a job offering, got hired on and did some sort of sophisticated inside job?  Did this person simply rip open a paper door and picked up an insecure, unattended laptop off of someones table?  Such details, in my view, alter who is more responsible for the security breach.

Some of these security breaches that have happened lately, for me, really places the blame on some of the organizations that got hacked.  First, what should be expected of someone who works as a security arm of an organization?  If someone's job is to monitor the security of a website for a large organization, what should they be doing?  For me, I would expect them to at least know a thing or two about internet security and how to secure a website.  Next, be aware of how people are breaking in to websites in the first place and asking, "OK, this is how this person did that on x website, how could this affect our website and how are we guarded against such an attack if we are?"  Finally, assess the likelihood of different attacks and build or fix the website accordingly.  I would argue that one could go a step further and deliberately find ways of hacking in to your own website for security purposes and patch up the website accordingly.  Heck, why not hire a skilled independent hacker and monitor that person as they try and hack in to the website and figure out how to patch the site accordingly?  Other things I might expect would be encrypting personal information.  If personal information is on server y, then it better have security as tight and strict as US copyright laws.  Ideally, not all of the information would be stored on a single server if you are a large company.  So, really these are just some of the expectations that first come to mind for me (someone who wouldn't know everything there is to know about securing a website of a large organization) when it comes to web security of a large organization.

So, when reports came in on a regular basis that Sony was getting hacked, it really seemed like these sorts of attacks were exclusive to Sony.  This is just one organization that may have <a href=http://www.zeropaid.com/news/93609/sony-hacked-again-account-data-posted-to-the-pirate-bay/ target=_blank>stored passwords and personal information in plain text</a> (not encrypted).  Some might think, "This is clearly an isolated case and it was one company that decided to be negligent about security.  Other organizations are smarter then that."  Really, for weeks, the stories you'd read about security in some places would suggest that this sort of activity was exclusive to Sony.  In the last few weeks, there are reports circulating that suggest that security issues are simply not exclusive to Sony.

The National Health Services of the UK (NHS) had their administration passwords <a href=http://www.telegraph.co.uk/technology/news/8567008/Fears-for-patients-data-after-hackers-hit-NHS.html target=_blank>obtained by LulzSec</a> a while ago and only reported last week when they offered some security advice.  The Canadian Conservative Party of Canada <a href=http://www.canada.com/technology/Tories+admit+hash+brown+hackers+partial+donors+list/4913339/story.html#ixzz1OiLfpXpj target=_blank>had their website hacked and a donor list was subsequently leaked</a>.  The United States Senate was <a href=http://gamutnews.com/20110614/23491/senate-server-hacked-by-lulzsec.html target=_blank>recently hacked</a> as well roughly two weeks after the US government declared that a cyber-attack was an <a href=http://www.theatlanticwire.com/technology/2011/05/pentagon-cyber-attacks-act-war/38298/ target=_blank>"act of war"</a>.  I could go on all day about who has been recently hacked like <a href=http://venturebeat.com/2011/06/13/lulzsec-bethesda-hack/ target=_blank>Bethesda</a>, <a href=http://www.geekosystem.com/lulzec-titani-takedown/ target=_blank>servers for EVE Online, Minecraft, The Escapist League of Legends</a>.  The point is that it really is starting to sound like hacking these sites are actually really easy.  A lot of these hacks were done by LulzSec, one hacking group.  I really wonder how easy it really wound up being to hack these places in the first place because people like LulzSec make it sound like it's really easy.  That, in and of itself, is a little freaky in my mind.  How easy could it be to hack a large organizations website?  Well, a recently disclosed hack really sets off alarm bells in my mind.

According to the Daily Mail, Citigoup, a major banking institution was hacked and 200,000 accounts were compromised.  How was the hack accomplished?  <a href=http://www.dailymail.co.uk/news/article-2003393/How-Citigroup-hackers-broke-door-using-banks-website.html target=_blank>the simple act of changing numbers in a URL</a>.  No special DOS commands, no hacking utilities, not even very much skill at all.  Just a browser and an internet connection.  All the intruder had to do was log in to their account, then change some numbers in the URL to obtain someone else's banking details.  The scary part above that?  The response of one of their investigators:

<blockquote>One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.

He said: 'It would have been hard to prepare for this type of vulnerability.'</blockquote>

In what world is changing a URL in a browser to obtain other account holders information considered so sophisticated that security can't stop it?  You don't have to take it from just me that this sounds ridiculous, just read <a href=http://it.slashdot.org/story/11/06/14/2046216/How-Citigroup-Hackers-Easily-Gained-Access target=_blank>some of the comments on Slashdot</a>:

<blockquote>this quote is the single stupidest and most frightening things I have ever read on the internet.</blockquote>

<blockquote>this is NOT a hard vulnerability to prepare for. If the only method of user authentication you are doing is based off a string of characters received from the URL your not even qualified to build an ecommerce site for some mom-and-pop 2-sales-a-week company, let alone a bank.</blockquote>

<blockquote>any session allows them to go digging around willy nilly is so unbelievably stupid, I can't even find the words.</blockquote>

Some other reaction to this story on Slashdot:

<blockquote>I don't understand how this could happen to a bank [...]. It's ridiculous.</blockquote>

<blockquote>Heads need to roll for this one... Amazing. Words escape me.</blockquote>

It was a <a href=http://www.fark.com/comments/6293788 target=_blank>pretty similar reaction on Fark</a>:

<blockquote>The fark are those IT people doing all day?</blockquote>

<blockquote>If you're working for a financial institution and you're passing account information in through the address bar, your whole department needs to be laid off.</blockquote>

On ZeroPaid, we've already <a href=http://www.zeropaid.com/bbs/showthread.php/62180-How-Citigroup-hackers-broke-in-through-the-front-door-using-bank-s-website%28DailyM%29 target=_blank>have a response</a>:

<blockquote>You gotta be f***ing sh****ing me, that is what they pass off as security?</blockquote>

So, I think I'm in pretty good company when I say this revelation is both frightening and outrageous.

At what point does a security breach move form a malicious attack to simple negligence on the organizations part?  It's the kind of security that is the equivalent to being able to, with minimal effort, remove a heavy stone wall, by hand, with a crowbar in ten minutes.  It shouldn't be possible at all - just like it shouldn't be possible to breach security at an online banking institute by changing numbers in a URL.  If security measures are this easy to bi-pass at other banks, it's no wonder whatsoever that credit card information or banking information is being passed around like trading cards in certain private IRC chatrooms.  Many people do know what can potentially happen when certain bits of personal information is out in the wild.  This is where you hear stories of people suddenly finding out that they owe thousands of dollars thanks to purchases they never made in countries they don't even live in.  Other stories like how some poor woman, for instance, having hundreds of thousands of dollars put on a loan against a house she thought was paid off and a bank tapping their feet at her doorstep asking where their money is at.  How about stories like some guy finally getting a handle on life only to find out his bank account was completely cleaned out because of a wire transfer he didn't authorize.  God help them if the bank in question won't believe them when they say they were fraudulently charged.  Bottom line, innocent people are being screwed here likely because there was some form of incompetence somewhere along the line in some of these organizations.

Where is the accountability in all of this?  Where does it say that if you are negligent in protecting people's private information, that could be financially detrimental to people if put in the wrong hands, you are going to face some serious consequences beyond a typical wrap on the wrist?  How often are people even prosecuted for data breaches of this magnitude when they do happen anyway?  How can we trust organizations with out money, sometimes our life savings, if security seems so lax with some of them?

So where's the hackers in all of this?  No doubt some of them will misuse private information because hacking can be financially motivated.  Some of the hacking done by LulzSec, I think, should be thanked because it really puts to the forefront the importance of security online.  One commentator <a href=http://risky.biz/lulzsec target=_blank>had an nice rant about LulzSec</a> saying that security professionals are getting a kick out of what LulzSec is doing</a>:

<blockquote>So for the last ten years I've been working in media, trying to raise awareness of the idea that maybe, just maybe, using insecure computers to hold your secrets, conduct your commerce and run your infrastructure is a sh***y idea.

No one who mattered listened. Executives think it's FUD. They honestly think that if they keep paying their annual AV subscriptions they'll be shielded by Mr. Norton's magic cloak.

Security types like LulzSec because they're proving what a mess we're in. They're pointing at the elephant in the room and saying "LOOK AT THE GIGANTIC F***ING ELEPHANT IN THE ROOM ZOMG WHY CAN'T YOU SEE IT??? ITS TRUNK IS IN YR COFFEE FFS!!!"

There is no security, there will be no security. The horse has bolted, and it's not going to be the infrastructure that's going to change, it's going to be us.</blockquote>

I certainly agree to that.  If, in large organizations, there's a culture surrounding web security that allows what we've seen happen in the last few weeks, then something about that culture needs to change before these kinds of security breaches gets any more out of hand than it already has.  For the hackers that simply expose the security flaws and don't misuse the information they obtain, I think they should be thanked because a lot of them are really bringing to light how shoddy security can be.  Just because an organization has an internationally recognized name doesn't mean its invulnerable to any threat that exists today.  To those that misuse the information, I have no hesitation in saying that they should be ashamed of themselves - especially if people are severely affected by the misuse of that information.

I think all of this serves as a wake-up call that organizations need to ensure that there is sufficient funding and/or resources devoted to security - especially those who have financial information.  Sure, times are tough, but security of personal information shouldn't be something to skimp out on - especially after what we are seeing in these kinds of reports these days.  So, to those who hack ethically, I say you should be thanked because this is an excellent way to start some kind of change.  If change does happen, let's hope it's for the better.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="200" height="200" src="http://www.zeropaid.com/wp-content/uploads/2011/06/Computer_Security_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="Computer_Security_crop" title="Computer_Security_crop" /></p><h3>For the past few months or so, there have been numerous stories about security breaches.  Earlier in the saga of security breaches, Sony wound up becoming the centre of attention for people breaking in to whatever system Sony had some control over whether it be their network, their website or a host of other hacks.  More recently, Sony has found itself in good company with other organizations who had their security breached.  Drew Wilson argues that we should really be thanking some of these hackers who bring to attention security vulnerabilities and pay more attention to online security.</h3>

Let's set a very stripped down scene here.  A person with malicious intentions decides they want to break in to a website, steal people's identities and sell those identities on the black market for a huge profit without a care of what happens to countless innocent victims.  So, this person invests some time in figuring out how to break in to a large organization.  The person breaks in successfully, steals hundreds of thousands of identities.  By the time the organization knows about the breach, let alone the public, the crime has already taken place and the sale of this sensitive information has already happened.  Who gets the blame here: the person that broke in to organization in the first place to commit the crime or the organization for failing to keep their organization secure enough from such intrusions?

Chances are, such a question will garner a wide variety of opinions ranging from "how awful it is that someone would sell peoples identities?" to "what was the organization thinking allowing for such a thing to take place?".  The real question that should be asked, in my view, is what are the details of that incident?  Did this hacker go to the extreme lengths of corporate espionage?  Like, did this person take a job offering, got hired on and did some sort of sophisticated inside job?  Did this person simply rip open a paper door and picked up an insecure, unattended laptop off of someones table?  Such details, in my view, alter who is more responsible for the security breach.

Some of these security breaches that have happened lately, for me, really places the blame on some of the organizations that got hacked.  First, what should be expected of someone who works as a security arm of an organization?  If someone's job is to monitor the security of a website for a large organization, what should they be doing?  For me, I would expect them to at least know a thing or two about internet security and how to secure a website.  Next, be aware of how people are breaking in to websites in the first place and asking, "OK, this is how this person did that on x website, how could this affect our website and how are we guarded against such an attack if we are?"  Finally, assess the likelihood of different attacks and build or fix the website accordingly.  I would argue that one could go a step further and deliberately find ways of hacking in to your own website for security purposes and patch up the website accordingly.  Heck, why not hire a skilled independent hacker and monitor that person as they try and hack in to the website and figure out how to patch the site accordingly?  Other things I might expect would be encrypting personal information.  If personal information is on server y, then it better have security as tight and strict as US copyright laws.  Ideally, not all of the information would be stored on a single server if you are a large company.  So, really these are just some of the expectations that first come to mind for me (someone who wouldn't know everything there is to know about securing a website of a large organization) when it comes to web security of a large organization.

So, when reports came in on a regular basis that Sony was getting hacked, it really seemed like these sorts of attacks were exclusive to Sony.  This is just one organization that may have <a href=http://www.zeropaid.com/news/93609/sony-hacked-again-account-data-posted-to-the-pirate-bay/ target=_blank>stored passwords and personal information in plain text</a> (not encrypted).  Some might think, "This is clearly an isolated case and it was one company that decided to be negligent about security.  Other organizations are smarter then that."  Really, for weeks, the stories you'd read about security in some places would suggest that this sort of activity was exclusive to Sony.  In the last few weeks, there are reports circulating that suggest that security issues are simply not exclusive to Sony.

The National Health Services of the UK (NHS) had their administration passwords <a href=http://www.telegraph.co.uk/technology/news/8567008/Fears-for-patients-data-after-hackers-hit-NHS.html target=_blank>obtained by LulzSec</a> a while ago and only reported last week when they offered some security advice.  The Canadian Conservative Party of Canada <a href=http://www.canada.com/technology/Tories+admit+hash+brown+hackers+partial+donors+list/4913339/story.html#ixzz1OiLfpXpj target=_blank>had their website hacked and a donor list was subsequently leaked</a>.  The United States Senate was <a href=http://gamutnews.com/20110614/23491/senate-server-hacked-by-lulzsec.html target=_blank>recently hacked</a> as well roughly two weeks after the US government declared that a cyber-attack was an <a href=http://www.theatlanticwire.com/technology/2011/05/pentagon-cyber-attacks-act-war/38298/ target=_blank>"act of war"</a>.  I could go on all day about who has been recently hacked like <a href=http://venturebeat.com/2011/06/13/lulzsec-bethesda-hack/ target=_blank>Bethesda</a>, <a href=http://www.geekosystem.com/lulzec-titani-takedown/ target=_blank>servers for EVE Online, Minecraft, The Escapist League of Legends</a>.  The point is that it really is starting to sound like hacking these sites are actually really easy.  A lot of these hacks were done by LulzSec, one hacking group.  I really wonder how easy it really wound up being to hack these places in the first place because people like LulzSec make it sound like it's really easy.  That, in and of itself, is a little freaky in my mind.  How easy could it be to hack a large organizations website?  Well, a recently disclosed hack really sets off alarm bells in my mind.

According to the Daily Mail, Citigoup, a major banking institution was hacked and 200,000 accounts were compromised.  How was the hack accomplished?  <a href=http://www.dailymail.co.uk/news/article-2003393/How-Citigroup-hackers-broke-door-using-banks-website.html target=_blank>the simple act of changing numbers in a URL</a>.  No special DOS commands, no hacking utilities, not even very much skill at all.  Just a browser and an internet connection.  All the intruder had to do was log in to their account, then change some numbers in the URL to obtain someone else's banking details.  The scary part above that?  The response of one of their investigators:

<blockquote>One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.

He said: 'It would have been hard to prepare for this type of vulnerability.'</blockquote>

In what world is changing a URL in a browser to obtain other account holders information considered so sophisticated that security can't stop it?  You don't have to take it from just me that this sounds ridiculous, just read <a href=http://it.slashdot.org/story/11/06/14/2046216/How-Citigroup-Hackers-Easily-Gained-Access target=_blank>some of the comments on Slashdot</a>:

<blockquote>this quote is the single stupidest and most frightening things I have ever read on the internet.</blockquote>

<blockquote>this is NOT a hard vulnerability to prepare for. If the only method of user authentication you are doing is based off a string of characters received from the URL your not even qualified to build an ecommerce site for some mom-and-pop 2-sales-a-week company, let alone a bank.</blockquote>

<blockquote>any session allows them to go digging around willy nilly is so unbelievably stupid, I can't even find the words.</blockquote>

Some other reaction to this story on Slashdot:

<blockquote>I don't understand how this could happen to a bank [...]. It's ridiculous.</blockquote>

<blockquote>Heads need to roll for this one... Amazing. Words escape me.</blockquote>

It was a <a href=http://www.fark.com/comments/6293788 target=_blank>pretty similar reaction on Fark</a>:

<blockquote>The fark are those IT people doing all day?</blockquote>

<blockquote>If you're working for a financial institution and you're passing account information in through the address bar, your whole department needs to be laid off.</blockquote>

On ZeroPaid, we've already <a href=http://www.zeropaid.com/bbs/showthread.php/62180-How-Citigroup-hackers-broke-in-through-the-front-door-using-bank-s-website%28DailyM%29 target=_blank>have a response</a>:

<blockquote>You gotta be f***ing sh****ing me, that is what they pass off as security?</blockquote>

So, I think I'm in pretty good company when I say this revelation is both frightening and outrageous.

At what point does a security breach move form a malicious attack to simple negligence on the organizations part?  It's the kind of security that is the equivalent to being able to, with minimal effort, remove a heavy stone wall, by hand, with a crowbar in ten minutes.  It shouldn't be possible at all - just like it shouldn't be possible to breach security at an online banking institute by changing numbers in a URL.  If security measures are this easy to bi-pass at other banks, it's no wonder whatsoever that credit card information or banking information is being passed around like trading cards in certain private IRC chatrooms.  Many people do know what can potentially happen when certain bits of personal information is out in the wild.  This is where you hear stories of people suddenly finding out that they owe thousands of dollars thanks to purchases they never made in countries they don't even live in.  Other stories like how some poor woman, for instance, having hundreds of thousands of dollars put on a loan against a house she thought was paid off and a bank tapping their feet at her doorstep asking where their money is at.  How about stories like some guy finally getting a handle on life only to find out his bank account was completely cleaned out because of a wire transfer he didn't authorize.  God help them if the bank in question won't believe them when they say they were fraudulently charged.  Bottom line, innocent people are being screwed here likely because there was some form of incompetence somewhere along the line in some of these organizations.

Where is the accountability in all of this?  Where does it say that if you are negligent in protecting people's private information, that could be financially detrimental to people if put in the wrong hands, you are going to face some serious consequences beyond a typical wrap on the wrist?  How often are people even prosecuted for data breaches of this magnitude when they do happen anyway?  How can we trust organizations with out money, sometimes our life savings, if security seems so lax with some of them?

So where's the hackers in all of this?  No doubt some of them will misuse private information because hacking can be financially motivated.  Some of the hacking done by LulzSec, I think, should be thanked because it really puts to the forefront the importance of security online.  One commentator <a href=http://risky.biz/lulzsec target=_blank>had an nice rant about LulzSec</a> saying that security professionals are getting a kick out of what LulzSec is doing</a>:

<blockquote>So for the last ten years I've been working in media, trying to raise awareness of the idea that maybe, just maybe, using insecure computers to hold your secrets, conduct your commerce and run your infrastructure is a sh***y idea.

No one who mattered listened. Executives think it's FUD. They honestly think that if they keep paying their annual AV subscriptions they'll be shielded by Mr. Norton's magic cloak.

Security types like LulzSec because they're proving what a mess we're in. They're pointing at the elephant in the room and saying "LOOK AT THE GIGANTIC F***ING ELEPHANT IN THE ROOM ZOMG WHY CAN'T YOU SEE IT??? ITS TRUNK IS IN YR COFFEE FFS!!!"

There is no security, there will be no security. The horse has bolted, and it's not going to be the infrastructure that's going to change, it's going to be us.</blockquote>

I certainly agree to that.  If, in large organizations, there's a culture surrounding web security that allows what we've seen happen in the last few weeks, then something about that culture needs to change before these kinds of security breaches gets any more out of hand than it already has.  For the hackers that simply expose the security flaws and don't misuse the information they obtain, I think they should be thanked because a lot of them are really bringing to light how shoddy security can be.  Just because an organization has an internationally recognized name doesn't mean its invulnerable to any threat that exists today.  To those that misuse the information, I have no hesitation in saying that they should be ashamed of themselves - especially if people are severely affected by the misuse of that information.

I think all of this serves as a wake-up call that organizations need to ensure that there is sufficient funding and/or resources devoted to security - especially those who have financial information.  Sure, times are tough, but security of personal information shouldn't be something to skimp out on - especially after what we are seeing in these kinds of reports these days.  So, to those who hack ethically, I say you should be thanked because this is an excellent way to start some kind of change.  If change does happen, let's hope it's for the better.

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/93739/editorial-should-we-thank-the-hackers-for-these-security-breaches/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>New Zealands Three Strikes Law was Pushed, Bought and Paid for by the US &#8211; Wikileaks</title>
		<link>http://www.zeropaid.com/news/93326/new-zealands-three-strikes-law-was-pushed-bought-and-paid-for-by-the-us-wikileaks/</link>
		<comments>http://www.zeropaid.com/news/93326/new-zealands-three-strikes-law-was-pushed-bought-and-paid-for-by-the-us-wikileaks/#comments</comments>
		<pubDate>Mon, 02 May 2011 00:31:34 +0000</pubDate>
		<dc:creator>Drew Wilson</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[copyright]]></category>
		<category><![CDATA[file sharing]]></category>
		<category><![CDATA[international]]></category>
		<category><![CDATA[law]]></category>
		<category><![CDATA[legal]]></category>
		<category><![CDATA[new zealand]]></category>
		<category><![CDATA[p2p]]></category>
		<category><![CDATA[piracy]]></category>
		<category><![CDATA[three strikes law]]></category>
		<category><![CDATA[us]]></category>

		<guid isPermaLink="false">http://www.zeropaid.com/?p=93326</guid>
		<description><![CDATA[<p><img width="200" height="100" src="http://www.zeropaid.com/wp-content/uploads/2009/05/new-zealand-flag_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="new-zealand-flag_crop" title="new-zealand-flag_crop" /></p><h3>The slow trickle of leaked diplomatic cables from Wikileaks may not be in the headlines as much as it was when it started, but revelations keep pouring out of the website.  Recently, new diplomatic cables published on the site revealed just how, not only influential the US was, but just how much control the US had over the passage of the three strikes law in New Zealand.</h3>

If there wasn't any anti-American sentiment before in New Zealand, there certainly will be for some after new diplomatic cables were published revealing the role the US had in pushing for a three strikes law in New Zealand.  The New Zealand's new three strikes law was the most controversial copyright laws in the country and one of the most controverisal in the world.  While the law was being proposed, <a href=http://www.zeropaid.com/news/90209/new-zealand-three-strikes-law-debate-heats-up/ target=_blank>debate was fierce</a>.  The law sparked repeated blackout protests where websites would black out their website logo's in protest of the law since it is widely seen as a censorship law more than a copyright enforcement law.  Last month, in spite of major opposition and protests, New Zealand <a href=http://www.zeropaid.com/news/93080/new-zealand-passes-three-strikes-law/ target=_blank>passed the law anyway</a> to the dismay of the New Zealand population.  Now, thanks to Wikileaks, we can see just how far back the United States was pushing New Zealand to pass that law in the first place.

A diplomatic cable that was sent <a href=http://wikileaks.ch/cable/2005/04/05WELLINGTON334.html target=_blank>clear back in 2005</a> shows that the US was offering up money to put in new copyright laws.  The cable was very detailed about the budget cost at the time:

<blockquote>Total costs: NZ $533,000 (US $386,158) 
 
     Start-up costs: NZ $78,000 (US $56,510) 
 
     Salaries:      NZ $215,000 (US $155,768) 
 
     Operating costs: NZ $240,000 (US $173,880) 
 
Start-up costs (NZ dollars): 
     Furnishings                             $25,000 
     IT costs (equipment)                    $45,000 
     Sundries                                $8,000 
 
Salaries (NZ dollars): 
     Unit head                               $90,000 
     Intelligence and policy development     $60,000 
     Licensing and enforcement officer       $40,000 
     Administrative support                  $25,000 
 
Operating costs (NZ dollars): 
     Accommodations (rental, utilities)      $55,000 
     IT support                              $15,000 
     Legal costs (investigation, prosecution)$75,000 
     Training (internet piracy, law)         $50,000 
     Travel costs                            $35,000 
     Employer liabilities                    $10,000 
 
NOTE: In U.S. dollars, legal costs would be $54,338 and 
training costs would be $36,225. </blockquote>

In another cable in 2005, we see the US saying that establishing fair use type laws being a bad idea:

<blockquote>The New Zealand government has proposed amendments to the Copyright Act 1994 that would allow format-shifting, or the duplication of sound recordings to another format for a purchaser's private use without the copyright owner's permission.  The amendments also would extend to all communication works a provision in the Copyright Act that permits time-shifting, or the recording of a broadcast or cable program for private use solely for the purpose of viewing or listening to the recording at a more convenient time or for making a complaint.  The amendments were proposed and released as a cabinet paper in June 2003, after a review of how digital technology had affected the country's copyright law (see Paragraph 13).  Legislation incorporating the amendments is being drafted and is expected to be introduced in Parliament in April. (ref D) 
 
As the International Intellectual Property Alliance noted in its Special 301 submission, these exceptions to copyright protection would send the wrong message to consumers and undermine efforts to curb unauthorized copying of CDs in New Zealand.  They would cost the industry in revenue and profits and discourage innovation.  However, Associate Minister of Commerce Judith Tizard still is discussing the issue with the music industry and has expressed a desire for a solution that satisfies all parties, although the format-shifting and time-shifting exceptions remain for now as proposed in the cabinet paper.  We will continue to work with the government and industry on this issue.  In the meantime, with discussions ongoing, we believe a Special 301 listing over this issue would not be helpful. </blockquote>

It's ironic that they would view fair use provisions like this as something that would discourage innovation since fair use in the US brings in billions to the economy.  The only innovation that comes out of restricting these types of activities are ways of skirting the laws more than anything else.  The question the New Zealand government is this: Should the government be passing laws that encourages innovation for future law breakers or should the government be passing laws that encourage innovation for people who contribute to society legally?  That's ultimately the choice the New Zealand government faces when considering broader exceptions to copyright.

In 2008, there was another <a href=http://wikileaks.ch/cable/2008/02/08WELLINGTON64.html target=_blank>diplomatic cable</a> which showed the US considering how they would apply pressure to New Zealand:

<blockquote>Post recommends that New Zealand (GNZ) not/not be placed on the Special 301 List in 2008.  The country's overall commitment to the protection of intellectual property (IPR) is relatively high as compared to most countries cited in the Special 301 review.  Despite the slower than anticipated pace of legislative progress, the government remains committed to updating its intellectual property laws to ensure compliance with international standards, with planned revisions of the Patents Bill and the Copyright Amendments Bill ("New Technologies and Performers' Rights Bill") progressing through the legislative queue.  Some momentum has been lost over the past year due to slowdown in the legislative agenda as the Government shifts its attention to upcoming elections in 2008.  Though New Zealand generally provides adequate and effective protection of intellectual property rights (IP) under current law, Post will continue to engage Members of Parliament, the Ministry of Economic Development and local IP industry in order to press our concerns that pending legislation reflects international IP standards and passage occurs in a timely fashion.  To date issues raised about the draft Copyright Bill by IP industry are being considered by the government and will be monitored by Post.  It's reasonable to anticipate a renewed commitment to the passage of IP legislation by the GNZ post election cycle.  Placing New Zealand on the Special 301 list at this stage may prove to be counter-productive as it likely will result in a defensive rather than consultative exchange.</blockquote>

Michael Geist, recognizing the similarities between Canada/US relations and New Zealand/US relations in this case, <a href=http://www.michaelgeist.ca/content/view/5769/125/ target=_blank>commented</a>, "That recommendation is striking when compared to the regular placement of Canada on the list, despite very similar laws."

Later, in March, 2009, there was discussion specifically <a href=http://wikileaks.ch/cable/2009/03/09WELLINGTON59.html target=_blank>about the section of the copyright bill related to the three strikes law</a>:

<blockquote>On February 23, five days prior to the full implementation of the ISP provisions (sections 92 a and c) in the new Copyright Bill, Minister of Commerce Simon Power suspended the ISP sections of the law from coming into full force for 30 days (end of March 2009).  The Minister's action will give the IP rights holders represented by the Recording Industry Association of New Zealand (RIANZ) and the Australasian Performing Rights Association (APRA) additional time to negotiate with the ISP trade association, the Telecommunication Carriers Forum (TCF) a mutually agreeable code of practice for terminating the internet access of users accused of infringing copyrights.  Once the code of practice is adopted, the government will monitor its efficacy during the first six months after the law's enactment.</blockquote>

A month later, a diplomatic cable <a href=http://wikileaks.ch/cable/2009/04/09WELLINGTON88.html target=_blank>was sent noting the fierce rise in opposition to the three strikes law</a>:

<blockquote>The Copyright (New Technologies) Amendment Act 2008 was originally scheduled to go into full force on February 28, 2009 but in the weeks leading up to the deadline, public interest groups raised a chorus of concerns claiming that the law's requirement to terminate internet subscribers who allegedly "pirated" digital copyrighted materials over the internet would infringe on due process, freedom of speech and the public's right to access information.  The negative publicity led to demonstrations staged in front of Parliament, organized by a group called the Creative Freedom Foundation. 
 
The publicity drew the attention of some minority party politicians who hoped to ride a new populist wave.  The United Future Party's leader Peter Dunne wanted Parliament to strike section 92A entirely from the new copyright bill through an arcane legal maneuver which would have required the Governor General to quash the provision.  ACT Party leader Rodney Hyde also joined in the chorus calling for repeal of the section while he castigated the previous Labour government for its "poor" drafting of the Bill.  Both United and ACT are current members of the National led coalition government. 
 
In reaction, a core panel was formed within the Cabinet consisting of the Commerce Minister Simon Power, Communications/IT Minister Steven Joyce, Broadcasting Minister Jonathan Coleman and Attorney General Chris Finlayson to develop a game plan and dampen the negative publicity.  Meanwhile, Dunne had been asked by Simon Power to consider reformulating the provision in language more acceptable to the ISPs instead of stripping the law entirely of its content. 
 
The response developed by the four ministers and announced by Simon Power as lead was to suspend section 92A for 30 days during which time the IP rights holders would hammer out a code of practice with the Telecommunication Carriers Forum (TCF - industry association representing NZ's major ISPs - Telecom, Telstra, Vodafone, Kordia and Callplus) which would serve as the regulatory foundation for section 92A.  The law would then go into force at the end of March and after 90 days it would be reviewed as to its appropriate application. </blockquote>

In response to the uprising for drafting such a poorly conceived law, the cable goes on to make the following recommendations:

<blockquote>Throughout the final stages of the law's (near) implementation, the Embassy continued to met with IPR stakeholders and GNZ officials to ascertain progress and encourage resolution.  To determine how a "workable" section 92A provision can be secured, Econoff met with Rory McLeod, Director at Ministry of Economic Development (MED) with responsibility for IPR within GNZ along with Paula Wilson, Deputy Director for Trade Negotiations at MFAT, and was given assurance that the government remains committed to redrafting Section 92A. 
 
Embassy will continue to stress with GNZ officials the need for a shorter rather than protracted timeline for the redraft and will ascertain the details of a notice and comment period for public submissions once released by GNZ. During this hiatus we've proposed holding DVC(s) between NZ and U.S. interlocutors to possibly help with drafting and as a public diplomacy tool to dispel public misperceptions about proper role of IPR protection.  U.S. agencies have the benefit of 10 years worth of experience in enforcing the U.S. Digital Millennium Copyright Act that may serve useful to New Zealand officials in their effort to implement section 92A.</blockquote>

What's most hilarious about this is the fact that the embassy is citing the DMCA as a ten year success.  Bruce Lehman, the architect of the DMCA, acknowledged as far back as 2007 that the DMCA was <a href=http://news.slashdot.org/story/07/03/24/0653218/DMCA-Creator-Admits-Failure-Blames-RIAA target=_blank>failure where blame solely rests on the shoulders of the RIAA for failing to adapt to a modern marketplace</a>.  It's very unnerving the idea that not only was the US basically lobbying New Zealand to implement very bad laws, but also citing unrelated examples and casting failed policy as success stories.  It defies logic.

By May, another cable <a href=http://wikileaks.ch/cable/2009/05/09WELLINGTON115.html target=_blank>showed</a> that the US was working with the MPA and other players to try and force the issue of passing a three strikes law:

<blockquote>Econoff learned from Tony Eaton of the NZ Motion Picture Association (MPA) that Minister Power met on May 12 with Eaton, Campbell Smith, CEO of the Recording Industry of NZ (RIANZ), Brett Cottle, CEO Australian Performing Rights Association NZ and lawyers from the Copyright Division of the Ministry of Economic Development (MED) to discuss Power's three-step plan to re-draft and enact section 92A by end of 2009. </blockquote>

Apparently, the three step plan was already hammers out.  The first step would be to put together a preselected panel of copyright law experts they deem worthy of redrafting the law.  The second step "will be a consultative period among MED, the IPR rights holders and the NZ telecommunication firms (i.e., the NZ internet service providers - ISPs) to be concluded no later than September 2009."  The third step would be to implement the recommended content to 92A.  In essence, it sounds like they wanted to stage something that seems impartial so as to make the process seem more legitimate.

Would government officials implement different policy if somehow the policy recommended was different than the three strikes law?  Doesn't sound like it:

<blockquote>Minister Power has made it clear to MED officials and to industry reps that the GNZ has no intention of going back on its commitment to strengthen NZ's copyright regime.  He expressed privately that he wants to avoid some of the hysterical public reaction that accompanied the last attempt to revise S92A.  His plan looks to be well thought out and with the input from a panel of top IPR experts the new provision will avoid the earlier criticism of poor draftsmanship.  The Embassy in the meantime has repeated its offer of assistance to GNZ officials to offer consultations with USG copyright experts through a DVC.</blockquote>

In short, if you criticized the three strikes law, you were simply being hysterical.  Overall, if you opposed the law, you seemed to be looked upon as merely an opposition force.  The good news is, the citizens of New Zealand were not alone with receiving this kind of attitude from their own government.  Just look at the attitude given to Canadians when <a href=http://www.zeropaid.com/news/93279/wikileaks-diplomatic-cable-us-pulled-the-strings-in-previous-canadian-dmca/ target=_blank>they discovered that they didn't like what they saw in the copyright laws being pushed by American interests</a>.

Overall, I think it is infuriating the way the US has conducted themselves on copyright on the international stage.  In New Zealand, they are even pushing the country to implement laws even the US <a href=http://www.zeropaid.com/news/90967/nsa-yelled-at-france-over-three-strikes-legislation/ target=_blank>wouldn't dare pass themselves</a> because of it's over-restrictiveness.  I think Americans would be equally offended if, say, Chinese diplomats went to the US and dictated what laws should be passed on, say, internet laws for instance.  If the US government wants to know why there is so much resentment directed to the US, maybe they should look at how the US is dictating law-making in other countries as one example why people in other countries are so fed up with American influence in the first place.  With revelations like this, you'd think that governments all over the world exist only to pander to US interests at the expense of their local populations.  I think, for many people in countries outside of the US, it should be shocking how little governments utilize their sovereign rights to control what goes on in their own countries.

I'll be blunt on this matter.  If the US waltzes in to your country and demands the country implement a three strikes law, do yourselves a favour, grow a spine and tell the US to "[insert adjective here] off".

[Special thanks to Michael Geist for <a href=http://www.michaelgeist.ca/content/view/5769/125/ target=_blank>gathering these cables</a>]

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></description>
			<content:encoded><![CDATA[<p><img width="200" height="100" src="http://www.zeropaid.com/wp-content/uploads/2009/05/new-zealand-flag_crop.jpg" class="attachment-post-thumbnail wp-post-image" alt="new-zealand-flag_crop" title="new-zealand-flag_crop" /></p><h3>The slow trickle of leaked diplomatic cables from Wikileaks may not be in the headlines as much as it was when it started, but revelations keep pouring out of the website.  Recently, new diplomatic cables published on the site revealed just how, not only influential the US was, but just how much control the US had over the passage of the three strikes law in New Zealand.</h3>

If there wasn't any anti-American sentiment before in New Zealand, there certainly will be for some after new diplomatic cables were published revealing the role the US had in pushing for a three strikes law in New Zealand.  The New Zealand's new three strikes law was the most controversial copyright laws in the country and one of the most controverisal in the world.  While the law was being proposed, <a href=http://www.zeropaid.com/news/90209/new-zealand-three-strikes-law-debate-heats-up/ target=_blank>debate was fierce</a>.  The law sparked repeated blackout protests where websites would black out their website logo's in protest of the law since it is widely seen as a censorship law more than a copyright enforcement law.  Last month, in spite of major opposition and protests, New Zealand <a href=http://www.zeropaid.com/news/93080/new-zealand-passes-three-strikes-law/ target=_blank>passed the law anyway</a> to the dismay of the New Zealand population.  Now, thanks to Wikileaks, we can see just how far back the United States was pushing New Zealand to pass that law in the first place.

A diplomatic cable that was sent <a href=http://wikileaks.ch/cable/2005/04/05WELLINGTON334.html target=_blank>clear back in 2005</a> shows that the US was offering up money to put in new copyright laws.  The cable was very detailed about the budget cost at the time:

<blockquote>Total costs: NZ $533,000 (US $386,158) 
 
     Start-up costs: NZ $78,000 (US $56,510) 
 
     Salaries:      NZ $215,000 (US $155,768) 
 
     Operating costs: NZ $240,000 (US $173,880) 
 
Start-up costs (NZ dollars): 
     Furnishings                             $25,000 
     IT costs (equipment)                    $45,000 
     Sundries                                $8,000 
 
Salaries (NZ dollars): 
     Unit head                               $90,000 
     Intelligence and policy development     $60,000 
     Licensing and enforcement officer       $40,000 
     Administrative support                  $25,000 
 
Operating costs (NZ dollars): 
     Accommodations (rental, utilities)      $55,000 
     IT support                              $15,000 
     Legal costs (investigation, prosecution)$75,000 
     Training (internet piracy, law)         $50,000 
     Travel costs                            $35,000 
     Employer liabilities                    $10,000 
 
NOTE: In U.S. dollars, legal costs would be $54,338 and 
training costs would be $36,225. </blockquote>

In another cable in 2005, we see the US saying that establishing fair use type laws being a bad idea:

<blockquote>The New Zealand government has proposed amendments to the Copyright Act 1994 that would allow format-shifting, or the duplication of sound recordings to another format for a purchaser's private use without the copyright owner's permission.  The amendments also would extend to all communication works a provision in the Copyright Act that permits time-shifting, or the recording of a broadcast or cable program for private use solely for the purpose of viewing or listening to the recording at a more convenient time or for making a complaint.  The amendments were proposed and released as a cabinet paper in June 2003, after a review of how digital technology had affected the country's copyright law (see Paragraph 13).  Legislation incorporating the amendments is being drafted and is expected to be introduced in Parliament in April. (ref D) 
 
As the International Intellectual Property Alliance noted in its Special 301 submission, these exceptions to copyright protection would send the wrong message to consumers and undermine efforts to curb unauthorized copying of CDs in New Zealand.  They would cost the industry in revenue and profits and discourage innovation.  However, Associate Minister of Commerce Judith Tizard still is discussing the issue with the music industry and has expressed a desire for a solution that satisfies all parties, although the format-shifting and time-shifting exceptions remain for now as proposed in the cabinet paper.  We will continue to work with the government and industry on this issue.  In the meantime, with discussions ongoing, we believe a Special 301 listing over this issue would not be helpful. </blockquote>

It's ironic that they would view fair use provisions like this as something that would discourage innovation since fair use in the US brings in billions to the economy.  The only innovation that comes out of restricting these types of activities are ways of skirting the laws more than anything else.  The question the New Zealand government is this: Should the government be passing laws that encourages innovation for future law breakers or should the government be passing laws that encourage innovation for people who contribute to society legally?  That's ultimately the choice the New Zealand government faces when considering broader exceptions to copyright.

In 2008, there was another <a href=http://wikileaks.ch/cable/2008/02/08WELLINGTON64.html target=_blank>diplomatic cable</a> which showed the US considering how they would apply pressure to New Zealand:

<blockquote>Post recommends that New Zealand (GNZ) not/not be placed on the Special 301 List in 2008.  The country's overall commitment to the protection of intellectual property (IPR) is relatively high as compared to most countries cited in the Special 301 review.  Despite the slower than anticipated pace of legislative progress, the government remains committed to updating its intellectual property laws to ensure compliance with international standards, with planned revisions of the Patents Bill and the Copyright Amendments Bill ("New Technologies and Performers' Rights Bill") progressing through the legislative queue.  Some momentum has been lost over the past year due to slowdown in the legislative agenda as the Government shifts its attention to upcoming elections in 2008.  Though New Zealand generally provides adequate and effective protection of intellectual property rights (IP) under current law, Post will continue to engage Members of Parliament, the Ministry of Economic Development and local IP industry in order to press our concerns that pending legislation reflects international IP standards and passage occurs in a timely fashion.  To date issues raised about the draft Copyright Bill by IP industry are being considered by the government and will be monitored by Post.  It's reasonable to anticipate a renewed commitment to the passage of IP legislation by the GNZ post election cycle.  Placing New Zealand on the Special 301 list at this stage may prove to be counter-productive as it likely will result in a defensive rather than consultative exchange.</blockquote>

Michael Geist, recognizing the similarities between Canada/US relations and New Zealand/US relations in this case, <a href=http://www.michaelgeist.ca/content/view/5769/125/ target=_blank>commented</a>, "That recommendation is striking when compared to the regular placement of Canada on the list, despite very similar laws."

Later, in March, 2009, there was discussion specifically <a href=http://wikileaks.ch/cable/2009/03/09WELLINGTON59.html target=_blank>about the section of the copyright bill related to the three strikes law</a>:

<blockquote>On February 23, five days prior to the full implementation of the ISP provisions (sections 92 a and c) in the new Copyright Bill, Minister of Commerce Simon Power suspended the ISP sections of the law from coming into full force for 30 days (end of March 2009).  The Minister's action will give the IP rights holders represented by the Recording Industry Association of New Zealand (RIANZ) and the Australasian Performing Rights Association (APRA) additional time to negotiate with the ISP trade association, the Telecommunication Carriers Forum (TCF) a mutually agreeable code of practice for terminating the internet access of users accused of infringing copyrights.  Once the code of practice is adopted, the government will monitor its efficacy during the first six months after the law's enactment.</blockquote>

A month later, a diplomatic cable <a href=http://wikileaks.ch/cable/2009/04/09WELLINGTON88.html target=_blank>was sent noting the fierce rise in opposition to the three strikes law</a>:

<blockquote>The Copyright (New Technologies) Amendment Act 2008 was originally scheduled to go into full force on February 28, 2009 but in the weeks leading up to the deadline, public interest groups raised a chorus of concerns claiming that the law's requirement to terminate internet subscribers who allegedly "pirated" digital copyrighted materials over the internet would infringe on due process, freedom of speech and the public's right to access information.  The negative publicity led to demonstrations staged in front of Parliament, organized by a group called the Creative Freedom Foundation. 
 
The publicity drew the attention of some minority party politicians who hoped to ride a new populist wave.  The United Future Party's leader Peter Dunne wanted Parliament to strike section 92A entirely from the new copyright bill through an arcane legal maneuver which would have required the Governor General to quash the provision.  ACT Party leader Rodney Hyde also joined in the chorus calling for repeal of the section while he castigated the previous Labour government for its "poor" drafting of the Bill.  Both United and ACT are current members of the National led coalition government. 
 
In reaction, a core panel was formed within the Cabinet consisting of the Commerce Minister Simon Power, Communications/IT Minister Steven Joyce, Broadcasting Minister Jonathan Coleman and Attorney General Chris Finlayson to develop a game plan and dampen the negative publicity.  Meanwhile, Dunne had been asked by Simon Power to consider reformulating the provision in language more acceptable to the ISPs instead of stripping the law entirely of its content. 
 
The response developed by the four ministers and announced by Simon Power as lead was to suspend section 92A for 30 days during which time the IP rights holders would hammer out a code of practice with the Telecommunication Carriers Forum (TCF - industry association representing NZ's major ISPs - Telecom, Telstra, Vodafone, Kordia and Callplus) which would serve as the regulatory foundation for section 92A.  The law would then go into force at the end of March and after 90 days it would be reviewed as to its appropriate application. </blockquote>

In response to the uprising for drafting such a poorly conceived law, the cable goes on to make the following recommendations:

<blockquote>Throughout the final stages of the law's (near) implementation, the Embassy continued to met with IPR stakeholders and GNZ officials to ascertain progress and encourage resolution.  To determine how a "workable" section 92A provision can be secured, Econoff met with Rory McLeod, Director at Ministry of Economic Development (MED) with responsibility for IPR within GNZ along with Paula Wilson, Deputy Director for Trade Negotiations at MFAT, and was given assurance that the government remains committed to redrafting Section 92A. 
 
Embassy will continue to stress with GNZ officials the need for a shorter rather than protracted timeline for the redraft and will ascertain the details of a notice and comment period for public submissions once released by GNZ. During this hiatus we've proposed holding DVC(s) between NZ and U.S. interlocutors to possibly help with drafting and as a public diplomacy tool to dispel public misperceptions about proper role of IPR protection.  U.S. agencies have the benefit of 10 years worth of experience in enforcing the U.S. Digital Millennium Copyright Act that may serve useful to New Zealand officials in their effort to implement section 92A.</blockquote>

What's most hilarious about this is the fact that the embassy is citing the DMCA as a ten year success.  Bruce Lehman, the architect of the DMCA, acknowledged as far back as 2007 that the DMCA was <a href=http://news.slashdot.org/story/07/03/24/0653218/DMCA-Creator-Admits-Failure-Blames-RIAA target=_blank>failure where blame solely rests on the shoulders of the RIAA for failing to adapt to a modern marketplace</a>.  It's very unnerving the idea that not only was the US basically lobbying New Zealand to implement very bad laws, but also citing unrelated examples and casting failed policy as success stories.  It defies logic.

By May, another cable <a href=http://wikileaks.ch/cable/2009/05/09WELLINGTON115.html target=_blank>showed</a> that the US was working with the MPA and other players to try and force the issue of passing a three strikes law:

<blockquote>Econoff learned from Tony Eaton of the NZ Motion Picture Association (MPA) that Minister Power met on May 12 with Eaton, Campbell Smith, CEO of the Recording Industry of NZ (RIANZ), Brett Cottle, CEO Australian Performing Rights Association NZ and lawyers from the Copyright Division of the Ministry of Economic Development (MED) to discuss Power's three-step plan to re-draft and enact section 92A by end of 2009. </blockquote>

Apparently, the three step plan was already hammers out.  The first step would be to put together a preselected panel of copyright law experts they deem worthy of redrafting the law.  The second step "will be a consultative period among MED, the IPR rights holders and the NZ telecommunication firms (i.e., the NZ internet service providers - ISPs) to be concluded no later than September 2009."  The third step would be to implement the recommended content to 92A.  In essence, it sounds like they wanted to stage something that seems impartial so as to make the process seem more legitimate.

Would government officials implement different policy if somehow the policy recommended was different than the three strikes law?  Doesn't sound like it:

<blockquote>Minister Power has made it clear to MED officials and to industry reps that the GNZ has no intention of going back on its commitment to strengthen NZ's copyright regime.  He expressed privately that he wants to avoid some of the hysterical public reaction that accompanied the last attempt to revise S92A.  His plan looks to be well thought out and with the input from a panel of top IPR experts the new provision will avoid the earlier criticism of poor draftsmanship.  The Embassy in the meantime has repeated its offer of assistance to GNZ officials to offer consultations with USG copyright experts through a DVC.</blockquote>

In short, if you criticized the three strikes law, you were simply being hysterical.  Overall, if you opposed the law, you seemed to be looked upon as merely an opposition force.  The good news is, the citizens of New Zealand were not alone with receiving this kind of attitude from their own government.  Just look at the attitude given to Canadians when <a href=http://www.zeropaid.com/news/93279/wikileaks-diplomatic-cable-us-pulled-the-strings-in-previous-canadian-dmca/ target=_blank>they discovered that they didn't like what they saw in the copyright laws being pushed by American interests</a>.

Overall, I think it is infuriating the way the US has conducted themselves on copyright on the international stage.  In New Zealand, they are even pushing the country to implement laws even the US <a href=http://www.zeropaid.com/news/90967/nsa-yelled-at-france-over-three-strikes-legislation/ target=_blank>wouldn't dare pass themselves</a> because of it's over-restrictiveness.  I think Americans would be equally offended if, say, Chinese diplomats went to the US and dictated what laws should be passed on, say, internet laws for instance.  If the US government wants to know why there is so much resentment directed to the US, maybe they should look at how the US is dictating law-making in other countries as one example why people in other countries are so fed up with American influence in the first place.  With revelations like this, you'd think that governments all over the world exist only to pander to US interests at the expense of their local populations.  I think, for many people in countries outside of the US, it should be shocking how little governments utilize their sovereign rights to control what goes on in their own countries.

I'll be blunt on this matter.  If the US waltzes in to your country and demands the country implement a three strikes law, do yourselves a favour, grow a spine and tell the US to "[insert adjective here] off".

[Special thanks to Michael Geist for <a href=http://www.michaelgeist.ca/content/view/5769/125/ target=_blank>gathering these cables</a>]

Have a tip?  Want to contact the author?  You can do so by sending a PM via the <a href="http://www.zeropaid.com/bbs/" target="_blank">forums</a> or via e-mail at <em>drew@zeropaid.com</em>.]]></content:encoded>
			<wfw:commentRss>http://www.zeropaid.com/news/93326/new-zealands-three-strikes-law-was-pushed-bought-and-paid-for-by-the-us-wikileaks/feed/</wfw:commentRss>
		<slash:comments>34</slash:comments>
		</item>
	</channel>
</rss>

<!-- Performance optimized by W3 Total Cache. Learn more: http://www.w3-edge.com/wordpress-plugins/

Page Caching using disk: enhanced (User agent is rejected)

Served from: www.zeropaid.com @ 2012-02-13 09:58:11 -->
