Gordon Brown's been "Jim Hackered"

On a topic entirely unrelated to privacy, Matron wonders if she is the only one who thinks that Gordon Brown has been completely "Jim Hackered" by Joanna Lumley on the Gurkha issue. Watch this video of the statement she gave after her meeting with the Prime Minister today and compare her strategy with that used by the famous TV Minster at the end of the "Big Brother" episode when he finally gets one over on Sir Humphrey. To quote young Bernard Woolley: "I'd say, 'Checkmate!'"

Principiis obsta et finem respice!

After a long conference and work induced absence, Matron's blogging reflexes were triggered today not by the big important developments of the day (RIPA and IMP consultations, ICO RAND report etc. - maybe more about those later, time permitting), but by a small news piece in the Guardian, which reports that a Brazilian MP has just proposed draft legislation that would force Rio de Janeiro's state government to publish an online list of all HIV carriers. The reasoning behind this proposal is, apparently, a wish to protect medical staff and other citizens from contamination.

It reminded Matron of an ongoing discussion she has with the inimitable Lilian Edwards (currently a pleased-as-punch and fully paid-up member of the "hydra-headed gang of online privacy pirates" whose purpose is to damage behavioural advertising company Phorm. But that, again, is another story.) about the merits - or not - of a general right of disclosure of other people's personal information on the internet. The discussion centred largely on such disclosures by individuals on social networking sites, so, obviously, this potentially state-sponsored Brazilian proposal would go far beyond that and raises a completely different set of issues. But Matron can't help wondering whether some of the same considerations do apply in this context as well.

If we do accept that individual privacy can be restricted to protect some other common good (like a perceived notion of public safety) or individual right (like freedom of speech, expression and opinion), what are the limits? Indeed, are there any limits or should we be able to expose everything about another person, strip them digitally naked so-to-speak, if it serves a justifiable purpose?

As she often does, Matron looks to the German Constitutional Court's for an answer. It's case law defines individual behaviour as falling into three separate "spheres": the public, the private and the intimate sphere. Interference with an individual's privacy in the interest of competing rights is permitted, subject to certain limitations like necessity and proportionality, in the public and the private sphere, but not in the intimate sphere. The Court recognises that in relation to each individual there exists a "core area" of privacy - arising from individuals' human dignity and their right to self-determination and self-development - that must not be touched or interfered with by anyone for any purpose, however well-meaning.

In this day and age, it's a controversial concept with security-conscious state protectors on the one side and freedom of speech advocates armed with "floodgate" arguments on the other, both questioning its legitimacy.

But can there really be a right to information about another individual - and a right to spreading that information - in the same way as there should be a right to information - both collecting and disclosing it - about the activities of governments and public authorities (the latter, of course, being the notions that underpin Freedom of Information legislation and the right to the freedom of the press)?

But governments supposedly work for us and the transparency and accountability that are the ultimate objective of these rights of information gathering and disclosure are necessary to even out the unequal power relationship between the state and the individual. They are part of the system of checks and balances that is meant to stabilise our democratic political system.

Can the same really be said about our relationship with other individuals and can there be a right to gather and disclose information about our friends, acquaintances, enemies as well as people we barely know or don't know at all? Again, what would be the limits of such a right? Indeed, is there, should there be, a limit at all? Where does citizen journalism end and -seemingly inconsequential but potentially damaging - gossip begin? And what new power relationships - some open, some hidden from view - are we creating or re-creating in this brave new online world?

So resist the beginnings and consider the end. Or should it be the other way around?

Of geeks and men

Matron just returned from a few days in Athens where she attended the inaugural WebSci'09 conference. For the blissfully ignorant, web science is the latest project of WWW Godfather Tim Berners-Lee and the newly made up Dame Prof. Wendy Hall (yes, this really is the correct title, there's nothing like a dame, as we all know). A few years ago, they got together to create the Web Science Research Initiative (WSRI - apparently pronounced Woozri according to Dame Wendy) with a view to bring several research areas together to form a new academic discipline.

Matron was warned before she travelled that she would meet some hardcore geeks there. Real geeks that is, not like the ones she normally meets who are actually interested in things like law and policy and society and stuff. And indeed, the place was packed to the rafters with creatures who quite clearly may not be able to survive in bright sunlight. But very interesting it was too.

Now, Matron is not sure herself if "a new new discipline was born" in Athens as Dame Wendy apparently claimed during her closing address (Matron could be wrong about the attribution of that statement as by then she was already back in her hotel room, all conferenced out). But the interdisciplinary opportunities are certainly worth pursuing.

What was almost touching, though, was the way in which the hardcore geeks were going about discovering as "new" a number of subjects (privacy for a start) that have been discussed by social scientists, Internet lawyers et al. for more than a decade. Apparently, "web science" is all about the way in which the existence of the web affects society as a whole, as individuals live more and more of their life online. Matron wants to be neither patronising nor scathing, but it seems to her that that particular wheel may already have been invented. Or at the very least been designed in some detail. Nonetheless, the more the merrier. And as the general consensus among tech lawyers and social scientists seems to be that we need computer scientist to think about the issues close to our hearts ab initio, that is when they first inventi new technologies rather than as an afterthought (see, for example, in the area of privacy-enhancing technologies), any cross-fertilisation between disciplines has to be a good thing. So here's to the success of the project - plus Athens certainly was a very nice place to wet the babies head.

Geeks of the world, rejoice!

On a much more cheerful note, Matron was very happy to see that the announcement for this year's GikII conference finally went up this week. For the uninitiated, GikII is a conference on the intersections between law, technology and popular culture. It is now in it's forth year and very rightly so, as it is - in the oft quoted words of a regular attendee - "like a normal conference, just without the boring papers".

It has become so popular in the legal geek community that it will also be transported to the Southern Hemisphere this summer: SoGikII will take place ("in a beach hut in Sydney" according to some of its organisers) on 9 June. What's not to love about that prospect? Matron, who has not been able to find the small pot of gold at the end of the rainbow that it would take to fly her to Oz and back is very, very jealous of those who will attend. But then the fact that Northern GikII will take place in trendy Amsterdam this year (17/18 September) is some compensation.

So, in the words of GikII co-founder panGloss, get your geek on and respond to the Call for Papers for either Holland or Australia. The only rule is that "you must not be boring", because, Toto, this ain't Kansas!

The hour draweth nigh...

Matron just looked at the calendar and noticed that today is the day when all EU member states must have fully implemented the Data Retention Directive into domestic law - "fully" in this context meaning transposition for internet data as well as for telephony data.

The UK has not yet made that deadline although transposition is probably imminent following the recent publication of the government's response to the relevant consultation (see Matron's previous post on the issue). The good news is that other countries are also still dragging their feet, many of them having waited for the recent ECJ decision in relation to the Ireland challenge (again, see Matron's previous rant on the decision) before deciding whether they should implement the Directive at all, given it's dubious human right credentials.

What with all the excitement, Matron isn't quite sure whether to be pleased or disappointed at a piece of news she picked up at a conference in Salzburg last month, namely that the Austrian government, so far a stern resister of data retention, has now invited the Ludwig Bolzmann Institute for Human Rights in Vienna under the leadership of Prof. Hannes Tretter to draft the Austrian law concerning the implementation of the directive. Now, Matron has had the good fortune to participate in a seminar hosted by Prof Tretter last year, and he did not seem to her to be the kind of chap who would take the human rights issues arising from these measures lightly. On the other hand, the fact that the Austrian government does now seriously consider transposition seems a bit of a drawback for civil rights campaigners.

In a press release (in German), the Institute confirms that it is itself doubtful about the compatibility of the directive with human rights and that it expects further legal actions to be brought in the future, both before the ECJ and the ECtHR. However, in view of the fact that these actions could take years to be resolved and that the member states' obligation to implement the directive continues to exist in the meantime, the Institute is restricted to pursuing a course of damage limitation while, at the same time, considering the potential consequences, both in domestic and EU law, of transposing a legal measure that may violate human rights.

So there may be a smidgen of light at the end of the tunnel, but it remains a very long tunnel!

Should some pigs be more equal than others?

The Guardian, among others, reports today that the BBC programme makers might have been breaching the Computer Misuse Act 1990 when they bought themselves a botnet on the internet as part of a programme showing how easy it is for criminals to use those botnets for sending spam or carrying out distributed denial of service attacks.

Well, duh! Of course it is. As Struan Robertson, editor of out-law.com and legal director at solicitors Pinsent Masons explains, never mind the newly revised section 3 offence of "unauthorised access with intent to impair" (which is apparently what security firm Sophos wants to charge the BBC with). Using computers that form part of a botnet to send e-mails or website access requests without the owners' knowledge or consent is likely to fulfill the criteria of a plain-vanilla section 1 offence of unauthorised access. Section 1 requires no mens rea in excess of the knowledge that the access is unauthorised, knowledge which - presumably - the BBC hacks will have had.

But wait a minute, the BBC did it to do good, not bad. Apparently,

"...following its demonstration, it warned users that their PCs had been compromised, and it had closed down the botnet.

If the users pay attention and secure their PCs, they should be better off than if the BBC had not become involved."

That's alright then, case closed, all is well. Robertson again:

"The maximum penalty for this offence is two years' imprisonment. But it is very unlikely that any prosecution will follow because the BBC's actions probably caused no harm. On the contrary, it probably did prompt many people to improve their security."

Hmm, that's all well and good and Matron is the last person to deny that there should maybe be room in the world for a bit of "benevolent" or "ethical" hacking. However, historically, the courts have taken a dim view of such arguments, most notably in the US, where Robert Lyttle, a member of hacker group The Deceptive Duo was jailed for four months in 2005 after he was convicted of hacking a number of US government websites , allegedly with the intention of highlighting security failures. OK, the fact that his partner-in-crime, Benjamin Stark, was also convicted of online credit card fraud makes pleas that they acted in the interest of online security, patriotism and world peace sound a wee bit hollow.

But the fact remains that hackers the world over have been been on notice for years, most notably since the adoption of the Cybercrime Convention, that the intention with with they gain unauthorised access to someone else's computer is neither here nor there. Which means, presumably, that the integrity of the computer system itself is seen as the protected good here and not a woolly notion of some abstract good or evil that will be achieved by hacking the system (a point, incidentally, which was made beautifully in a completely different context by the German Constitutional Court last year, when it created the new basic right of "security and confidentiality of information technology systems").

So, should we really have one law for the BBC and one for the rest of us? Matron wonders...

Hail the forces of light!

It is always a pleasure to agree with Tim Berners-Lee and the forces of light...