One of the most revealing books I’ve read (that I translated into Italian for local publisher) is Alan Cooper‘s The Inmates are Running the Asylum. Is a book about programming and the fact that core decisions come from a bunch of geeks working down below the basement of the company’s building, while marketing and PR guys occupy the fancy upper floors (have you seen the British sit-com “The IT Crowd“?) Continue reading “The freedom of being a stone-age man or I don’t want to live “smart””
Computer search and seizure. An odd law is coming…
The Italian center-left wing has proposed a bill (currently passed in Senate, and now to be examined in the other chamber) that allows the law enforcement to obtain the use of computer seized during computer-crime related investigation, early before the final judgement comes to an end.
The “idea” backing the proposal (that will likely become a full-force law in a few time) is that there is no harm for the defendant if the police uses his computer waiting for the trial. At the end of the day, if the defendant will be acquitted – says the accompaining text to the draft law – he will get his computer back, and will start using it as if nothing happened. The reason for this law – this is clearly stated – is to give the brand new computers used for criminal purposes to the law enforcement agencies that still use old and crappy technology at no cost.
This is the very same approach adopted for houses and vehicles used by drug dealers and mafia mobs so in principle there shouldn’t be a particular concern for this new law.
Personally I disagree from this statement, since a computer is something different than a car or some other premises. It stores information often unrelated to the investigated crime, and/or information related to innocent third parties.
Why should these people be exposed to a mass infringement of their personal life?
Google executives acquitted in Italy from defamation charges
Today the Court of Milan made public the decision in the criminal trial against four Google executives, charged of defamation and illegal personal data handling in relationship to the publication on the video sharing platform ? of a video containing act of bullyism against a person affected by the Down Syndrome.
The legal basis for the charges, following the prosecutor’s theory of the case, was that those executives failed to exercise a pre-emptive control over the contents published by Google final users’, thus allowing the infringement of the reputation of the concerned person and of an NGO representing Down-Syndrome-affected persons.
The Court acquitted all the defendant from the charges of defamation, while found them liable of the illegal personal data handling charge. The whole sentence (including the legal technicalities that support the decision) will be public within the next 30 days.
This indictment is the last component of a long series of court decisions that kill Network Neutrality and turn ISPs and Telcos into Digital Vigilantes while, in the meantime, no actual protection is given to the victims of online crimes.
The Peppermint and The Pirate Bay cases, the legal argument against Youtube and the one between an entertainment-backed lobbying group by one side and Telecom Italia, the ISP’s association and the Data Protection Authority on the opposite and – finally – this indictment are all linked through the same connection: to erode the absence of the legal duty to preemptively contol internet users’ activity established by the UE directive on e-commerce.
What is bizarre, in this Google trial, is that for the very first time the existence of the ISP’s duty to perform a mass-control of user activities has been asserted thank to the data protection regulation. The same data protection regulation that forbade the disclosure of the identities of people allegedly accused by the entertainment industry of copyright infringement through P2P networks.
Is still to early to understand the Court mind (since the basis for the decision will be disclosed within the next 30 days. It is, nevertheless possible to try an educated guess based on the Court records. To put it short, here is a probable explanation for the decision:
1 – there is a rule of law into the Criminal Code that says: to not stop a fact equals to cause it,
2 – data protection law requires a prior authorization to be obtained before handling personal data,
3 – a video to be posted online is personal data,
4 – therefore Google executives had to check whether the user who posted the video got the preemptive authorisation from the people of the video, and
5 – by failing to do so, they infringed the data protection law
6 – furthermore, by not controlling in advance, they let the video to libel the victim of the violence (this charge has been dismissed.)
It is too early to assess the damages provoked by this decision, but it is not unreasonable to imagine that – should this court decision become “case law” – the telco market will suffer an alteration of the competion among the various players. The smallest one can’t handle the increasing risk (and cost) of being sued or investing in momentum-generating policies. Big international players might find Italy a lesser attractive place to do business in.
French Data Protection Agency (CNIL) Releases New Guidelines on “Discovery”
Axel Spies, a friend and a very skilled Washington-based lawyer just released a summary on the new French Data Protection Authority deliberation in re: transnational discovery of personal data.
Here is the summary’s full-text.
Aggregate data and Italian Data Protection Authority
An Italian Data Protection Authority decision issued on June, 25, 2009 set the deadline of Sept. 30, 2009 for telco operators and ISPs that must notify the Data Protection Authority the list of their mining activities executed on customers’ aggregate data (such as traffic volumes, paths and so on.) The aim of this decision is to spot illegal (at least, under Data Protection Authority opinion) data handling “masked” by activities performed to keep the infrastructure running
The Data Protection Authority, after having received the information, will decide what can be still done without informing the customer, what can be done AFTER having informed the customer and obtained his approval and what cannot be done at all. Furthermore, the Data Protection Authority will release a set of technical and management rules to ensure the concerned subjects’ compliance.
If these new set of rules will mimic those recently established for data-retention purposes and system administrators, telcos and ISPs will face again a mayhem of useless bureaucracy so hard to understand that the Data Protection Authority itself did release a FAQ to explain what these regulation actually meant (and we’re still waiting for the FAQ interpretation.)
Although the decision is limited to the Internet and telephony world, it is clear that in the near future it will affects too energy firms, banks, insurance companies and, in general, everybody who relies upon aggregate data to tweak its supply chain of services.
Once again, the Italian Data Protection Authority is proved to be one of the biggest blocking factor of Italian telco market, while not granting citizens some sort of protection.