Subject: Re: [pkix] A simple solution to the Internet's identity crisis

From: "Kyle Hamilton" <[email-masked]>
Date: Wed, 23 Mar 2011 22:17:13 -0700 (Pacific Daylight Time)

On Tue, Mar 22, 2011 at 7:21 PM, Matt McCutchen <[email-masked]> wrote:
> On Mon, 2011-03-21 at 22:04 -0700, Kyle Hamilton wrote:
>> - consumer can leverage existing copyright law to provide a solid
>> foundation from which to protect his privacy
>
> Copyright law is not some magic thing you can use to place arbitrary
> restrictions on the use of information.  It protects economic interests
> in works of authorship.  Personal information is not a work of
> authorship.  You need a different legal theory.

(I'm paraphrasing much of, but not all of, this theory from "Own Your Privacy" by Wes Kussmaul.  Also, I am not a lawyer, but the concepts appear sound to someone who's learned a lot about US copyright law.)

The creation of the tangible form of the information disclosure (the creation of Alice's #1) is the definition of a work of authorship ('once it is affixed in a tangible form') under copyright law.  The information contained in that copyrighted tangible structure (information about identity and reputation) has economic and/or personal value which must be protected.  Copying out of a work of authorship, particularly by automated means, creates a derived work squarely within the legitimate bounds of copyright law.  It's even more obvious when that derived work is written to disk or printed out.

It's important to note, I'm not talking solely about the identity information which is available from the authoritative public register.  For example, If I'm a member of a club which offers reciprocal benefits with a club in an area I'm traveling to, that membership is information which needs to be known only by me, my local club, and the remote club.  That information, if put in a tangible form, is copyrighted by the local club.  If the only time that information is disclosed is under the terms of a copyright license which limits redisclosure, any derived work from that information (even writing down "facts" from it) is a violation of the club's copyright license -- because the facts could not have been found without permission, and permission was contingent on that restriction being agreed upon.

Also, I believe that identity certificates are (often, but not necessarily always) works for hire, under copyright law.  This implies that the copyrights on them (as generated by the CAs who create their works affixed in a bitstring of tangible form) transfer to the people who paid for them.  (Even if the CA retains ownership of the copyright, it must necessarily grant a license for redistribution to the subject it names, or else it is useless -- so this section applies to that case as well.)  Obtaining information from a non-publicly-performed, non-published work does not have an automatic statutory exemption from copyright.  In other words, even if they are facts, the way that the facts are encoded is copyrighted.  If the only way you could have gotten those facts was by creating a derived work, even if you use knowledge only available to you to derive that work (your private key), it's still a derived work under copyright law.

Sure, copyright isn't going to protect me from the current masses of marketing lists that my own information is on... but copyright can protect my information from being added to any more of them.  Think of life in 20 years, where the old marketing lists have finally been destroyed.

The consumer, as the author of the representation of encrypted bits, can restrict the creation of derived works under copyright law.  That's all that really matters here.

I do not believe that the consumer can restrict the collection of information by the server not acting under any license, as the server can collect any information it wants to that it sees, hears, writes, and otherwise senses.  What the consumer can do, under copyright, is restrict the server from redisclosing the information which it could only have obtained after accepting a restrictive license to create a derived work.  This is not necessarily -- and will usually not be -- publicly disclosed or disclosable information.

This is pretty much the only framework which makes sense in the US right now.  I hope the situation changes to be more like the EU.

Since I'm talking about the end consumer in the US applying copyright law, I must mention the Digital Millennium Copyright Act.  Trying to bypass a technical protection measure on a work of authorship is a felony worth 20 years in prison.  The information which the consumer wants to protect can, in a deliciously ironic twist, suddenly be protected under the same measures which the MPAA and RIAA big businesses fought to get put in place, to protect their own tangible expressions of personally-identifiable information.

-Kyle H

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 24 Mar 2011 07:55:19 +0100

Kyle,

If you are really serious about this proposal I think you should
focus on security and privacy because it simply gets a bit too
fluffy for your average technologist (including myself) adding
copyright considerations.  In the mind of the public, copyright
is about DRM, GPL, and similar topics.

Assuming that the s.c. TLS privacy issue can be fixed, I'm still
wondering about the use-case.  "Secure e-mail" doesn't work because
there is no good way sending an encrypted mail without first having
exchanged encryption keys OOB.  Message encryption doesn't look
like a solution to me.  In addition, trust anchor issues makes
secure e-mail very difficult to use.

IMNSHO, secure e-mail represents the worst security standard ever
and it was indeed created by the same people who hang out in PKIX...

I'm personally a little bit tempted dipping my toe in the FOAF+SSL
pond because it could greatly expand the PKI territory.

Maybe it could even become the foundation for "secure e-mail"!
But this time for real :-)

Anders

On 2011-03-24 06:17, Kyle Hamilton wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: "Miller, Timothy J." <[email-masked]>
Date: Thu, 24 Mar 2011 09:33:17 -0400

> (I'm paraphrasing much of, but not all of, this theory from "Own Your Privacy" by Wes Kussmaul.  Also, I am not a lawyer, but the concepts appear sound to someone who's learned a lot about US copyr…

Rule #1 about law:  All legal theory is bunk until established by actual precedent.  I can construct arguments all damn day but that doesn't imply they actually *mean* anything.  Only an actual court decision tells you if any given argument holds any water at all.

-- Tim

---

From: "Kyle Hamilton" <[email-masked]>
Date: Thu, 24 Mar 2011 20:15:19 -0700 (Pacific Daylight Time)

The corollary to rule #1 that you assert about law: The public (and PKIX and IETF) reliance on the theory of consumer protection law and "truth-in-advertising" law as a means of protecting against rogue CAs is also bunk, as it has also never been tested in court.

At least under my theory there's a one-to-one presentment of a unilateral contract prohibiting redisclosure, which meets in all respects the definition of a "click-wrap license" combined with a "technological protection measure".  It must be agreed to in order to create the derived work from the collection of bits which Alice authored.  It's an action which only the person offered the license could perform, and it's an action which is by its very nature discretionary.  One can't just accidentally work hard math problems, and only coercion can force one to perform them if one does not wish to.

In other words, it's just like signing a contract: Only the person himself can legally sign the contract (otherwise it's forgery), the person must intend to be bound to the terms of the contract (otherwise it's coercion), the person must understand the contract (otherwise it's an incompetent party), and there must be an exchange of consideration (otherwise it's not a transaction).  (It's also a unilateral contract, but that's an unimportant distinction here.)

These ideas are concepts that the courts have had around for many, many years.  The main concept of law is "slow, measured changes over time".  Instead of trying to yank the idea of a dispute out of the hands of the judiciary, we need to realize that disputes are going to exist regardless of the rules, because there will -always- be situations that the rules don't specifically cover.  That's part of the service that the state offers to maintain civil order: access to the peaceful resolution of disputes.

By working within the current legal structure, with its rules that have been built up over centuries of disputes, the chance becomes much greater that the courts will hear the dispute without dismissing it for lack of standing.

(I was taught the basics of contract law as part of training for life insurance customer service.  I learned much about copyright law when I was looking for a means for net radio stations to keep correct records over tracks, plays, listeners, time, and licenses, back when CARB still had authority over copyright royalties.  I am not a lawyer and so can't give advice to anyone else, but I do know well what my rights in authorship are and how to invoke them.)

-Kyle H

---

From: Patrick Patterson <[email-masked]>
Date: Mon, 28 Mar 2011 11:39:41 -0400

Hi Anders:

> secure e-mail very difficult to use.

Bit of a shameless plug, but if you're not around the IETF meeting tomorrow, then you may want to get the slides (I don't know whether it will be jabbered / recorded) for the PLASMA BOF.

> pond because it could greatly expand the PKI territory.

Well, if that's the way you want to get your keys, then I believe that PLASMA would, in fact, let you discover/distribute keys via FOAF (I'd have to look a bit more into it, but I can't see why not)

(If you want to discuss, there is a PLASMA mailing list, just so that we don't steer this right off into the weeds :)

---
Patrick Patterson
Chief PKI Architect
Carillon Information Security Inc.
http://www.carillon.ca

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 29 Mar 2011 21:41:08 +0200

On 2011-03-28 17:39, Patrick Patterson wrote:
> Bit of a shameless plug, but if you're not around the IETF meeting
> tomorrow, then you may want to get the slides (I don't know whether
> it will be jabbered / recorded) for the PLASMA BOF.

I'm probably a "bad customer" because I think the whole secure e-mail
concept is dead wrong and will never be of any importance except for
the USG who have funded most of it.  Since this is your customer
you obviously must go this way.

I'm rather taking on the USG in the other end with the development of
NSTIC-supporting technology.  This has a potential to be used by more
people even than facebook (!), so it is quite thrilling.

However, I don't care about standardization because the "big guns"
like Google and Apple aren't spending a dime on that, and I think
they made the right decision.

A lot (if not the majority) of IT-standardization is mainly about
maintaining professional status, not about providing utility.

Anders

---

From: Massimiliano Pala <[email-masked]>
Date: Tue, 29 Mar 2011 20:16:15 -0400

On 03/29/2011 03:41 PM, Anders Rundgren wrote:
[ secure email ]
> they made the right decision.

Just my 2 cents.. but your information are not correct. Moreover,
email privacy was not important some time ago.. but since you can
get sued for the contents of your email - the need to better protect
the content (data) is more obvious every day. This applies for your
work mail, your web mail, your facebook mail, etc...

So, now more than ever.. secure messaging is *extremely* important,
IMHO.

Cheers,
Max

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 30 Mar 2011 08:22:01 +0200

> So, now more than ever.. secure messaging is *extremely* important,

Yes, but not through schemes that uses static encryption keys for
encrypting messages. S/MIME does as I have already written, not
even protect the identities of the sender and receiver which IMO
makes it pretty lame.

The following is 100 times more interesting than trying to make
S/MIME work:

http://www.freedomboxfoundation.org

it is not a standard, it is a *living* project!

Anders

---

From: Tomas Gustavsson <[email-masked]>
Date: Wed, 30 Mar 2011 09:34:26 +0200

I can bash S/MIME as much as the other guy, I'm pretty sure it will 
never fly :-)

Regarding open standard however I do think this is important, and the 
"big guns" do invest in this. For sure they use it a lot where it suits 
them, just look at SCEP usage by iOS (I know pkix does not really love 
scep but it's still open and standardized to the point where interop 
actually does work).
Without GSM or TCP/IP standards where would the big guns be? They all 
invest in standardization where they see benefit and a feasible way 
forward. For sure, in many areas they move a lot faster than 
standardization, but where (and when) they need it they will invest, and 
standards will eventually catch up.

Without open standards we might as well stop pretending there is any 
innovation at all. Most things we know work on top of open standards.

I think identity and privacy is too complex for even the big guns to 
think there is any feasible way to standardise in a foreseeable future. 
It's a too big byte to swallow.

They're just like everybody else, scratching their own itch. When the 
itch becomes painful enough you'll see standardisation coming your way.

Cheers,
Tomas