How to configure email encryption in Apple Mail

Jesus Vigo covers the steps necessary for encrypting email messages sent and received in Apple Mail.

Music Licensing Shop Harry Fox Agency Appears To Be Scrambling To Fix Its Failure To Properly License Songs

A couple of months ago, I wrote a long post trying to dig into the details of David Lowery's class action lawsuit against Spotify. In the end, while there was some question over whether or not streaming music services really need to get compulsory mechanical licenses for producing reproductions of songs, it seemed like the fact that such licenses are compulsory and can be obtained easily via having the Harry Fox Agency issue a "Notice of Intention" under Section 115, it seemed crazy to think that the various music services had not done that. In fact, we noted that the only way the lawsuits made any sense was if the various music services and HFA ignored this and didn't send out such NOIs. At the time, I noted that this would be a surprise, and it could mean the services were in deep trouble.

Or perhaps not a surprise... and, yes, some folks may be in deep trouble. Beyond Lowery's lawsuit, a few other similar lawsuits have been filed. Earlier this month, Tim Geigner wrote about a very similar lawsuit filed by Yesh Music against Tidal. Of course, what didn't get as much attention is that Yesh filed very similar lawsuits against a bunch of other music services as well, including Google Music, Slacker, Line Corporation (which runs Mix Radio) and Guerva (which I think is a misspelling of the music site Guvera). Yesh also sued Deezer a few months ago.

One of the key questions that came up following the reporting on all of these cases is the Harry Fox Agency's role in all of this. HFA, an organization that was set up by the publishers themselves is supposed to be responsible for managing compulsory licensing for the vast majority (though not all) of popular songwriters (remember, HFA is about compositions/publishing, not sound recordings). But it's beginning to look seriously like HFA just fell asleep on the job and didn't bother to do the one key thing it was supposed to do for all these music services: file Section 115 NOIs.

Both David Lowery and another songwriter, Ari Herstand, have recently posted examples of HFA suddenly sending them NOIs that appear to be rushed and are showing up way after they're supposed to. I rarely agree with Lowery about anything, but it's seriously looking like HFA totally fucked up here. Big time. Here's the notice Lowery received: As Lowery notes, this NOI was sent on February 16th, 2016, but was signed by a Spotify exec who left the company in 2015, for a song that showed up on Spotify in 2011 and using an HFA address that didn't exist until 2012. Basically... it looks like HFA is rushing around trying to send out NOIs that it failed to do properly, and doing a pretty half-assed job about it. And that seems especially stupid when it comes to issuing those NOIs to the guy who is already suing over those missing NOIs.

Herstand just received a similarly late NOI from HFA for his music appearing on Apple Music. As he notes, his notice says the music should appear on Apple Music as of March 10th of 2016, but it's actually been there since Apple Music launched last summer. He also notes this is the first NOI he's ever received from HFA, while he has received plenty of NOIs from the much smaller HFA competitor Music Reports "on a regular basis."

So, given all that, it sure looks like HFA didn't do the one thing that it was supposed to be doing all along, and that's... going to be bad news for someone. The big question is who? All of the lawsuits have been against the various music services, but without being privy to the contracts between HFA and the music services themselves, I'd be shocked if they didn't include some sort of indemnity clauses, basically saying that if music isn't licensed because of HFA's own failures to do its job that any liability falls back on HFA.

And, if that's the case, HFA could be on the hook for a ton of copyright infringement. If it's true that it's basically been ignoring the fairly simple NOI process for a lot of artists, then that's going to be a major scandal -- but one that seems a lot harder to pin on the music services themselves. They went to HFA and hired the company to handle mechanical licenses. There may be more going on behind the scenes here, but at a first pass, based on what appears to be happening, HFA may be in some seriously deep trouble.

Permalink | Comments | Email This Story

Apple Might Be Forced To Reveal & Share iPhone Unlocking Code Widely

Among the many questions swirling around the challenge to U.S. Magistrate Judge Sheri Pym's Order that Apple create software to bypass the iPhone passcode screen, a matter of paramount public interest may have been overlooked: Even if the government prevails in compelling Apple to bypass these iPhone security features: (A) evidence for use in a criminal trial obtained in this way will be challenged under the Daubert standard (described below) and the evidence may be held to be inadmissible at trial; and (B) the Daubert challenge may require disclosure of Apple's iPhone unlocking software to a number of third parties who would require access to it in order to bring the Daubert challenge and who may not secure the new software adequately. To state that neither consequence would be in the public interest would be an understatement in the extreme.

The Daubert challenge would arise because any proffered evidence from the subject iPhone would have been obtained by methodology utilizing software that had never been used before to obtain evidence in a criminal trial. The Supreme Court, in Daubert v. Merrill-Dow Pharmaceutical-Dow Pharmaceuticals, Inc., held that new methodologies from which proffered evidence is derived must, when challenged, be substantiated by expert scientific testimony in order to be admissible. In Daubert, the court stated that the criteria that must be utilized when faced with a defense challenge to scientific testimony and evidence are:

1. Can the methodology used to reach the expert's conclusion (the new software here) be tested and verified?
2. Have the methodology and software been peer-reviewed and has the review been published in a peer-reviewed journal?
3. Do the techniques used to reach the conclusion (here, to obtain the evidence) have an ascertainable error rate?
4. Has the methodology used to generate the conclusion (the evidence) been generally accepted by the relevant scientific community?

Under the Daubert standards, introduction of evidence from the iPhone, electronic communications and data stored in the phone, would require the testimony of an expert witness to, among other things:

• establish the integrity of the data (and its reliability) throughout the chain of custody;
• explain whether any person or software could modify the data coming off of the phone;
• verify that the data that came off the phone as delivered by Apple and held by law enforcement was the data that had originally been on the phone;
• explain the technical measures, such as the digital signatures attached to the data, used ensure that no tampering has occurred and their likely error rates.

Such an expert would, in preparation for his or her testimony, require access to and examination of the software, as it is inconceivable that defense counsel would simply accept the testimony of the Apple personnel without also demanding that their own, third-party, experts have access to the code.

In addition, defense counsel would undoubtedly demand the right for their own third-party experts to have access not only to the source code, but to further demand the right to simulate the testing environment and run this code on their own systems in order to confirm the veracity of evidence. This could easily compromise the security of the new unlocking code, as argued by in the amicus brief filed with Judge Pym by Jennifer Granick and Riana Pfefferkorn from Stanford's Center for Internet and Society (also covered previously by Techdirt):

There is also a danger that the Custom Code will be lost or stolen. The more often Apple must use the forensic capability this Court is ordering it to create, the more people have to have access to it. The more people who have access to the Custom Code, the more likely it will leak. The software will be valuable to anyone eager to bypass security measures on one of the most secure smartphones on the market. The incentive to steal the Custom Code is huge. The Custom Code would be invaluable to identity thieves, blackmailers, and those engaged in corporate espionage and intellectual property theft, to name a few. 

Ms. Granick and Ms. Pfefferkorn may not have contemplated demands by defense counsel to examine the software on their own systems and according to their own terms, but their logic applies with equal force to evidentiary challenges to the new code: The risk of the software becoming public increases when it is examined by multiple defense counsel and their experts, on their own systems, with varying levels of technical competency. Fundamentally, then, basic criminal trial processes such as challenges to expert testimony and evidence that results from that testimony based on this new software stand in direct tension with the public interest in the secrecy and security of the source code of the new iPhone unlocking software.

At best, none of these issues can be resolved definitively at this time because the software to unlock the phone has not been written. But the government's demand that the court force Apple to write software that circumvents its own security protocols maybe shortsighted as a matter of trial strategy, in that any evidence obtained by that software may be precluded following a Daubert inquiry. Further, the public interest may be severely compromised by a court order directing that Apple to write the subject software because the due process requirements for defense counsel and their experts to access the software and Apple's security protocols may compromise the secrecy necessary to prevent the proposed workaround from becoming available to hackers, foreign governments and others. No matter what safeguards are ordered by a court, security of the new software may be at considerable risk because it is well known that no security safeguards are impregnable.

The government may be well advised to heed the adage, "Be careful what you ask for. You may just get it." Its victory in the San Bernardino proceedings may be worse that Pyrrhic. It could be dangerous.

Kenneth N. Rashbaum is a Partner at Barton, LLP in New York, where he heads the Privacy and Cybersecurity Practice. He is an Adjunct Professor of Law at Fordham University School of Law, Chair of the Disputes Division of the American Bar Association Section of International Law, Co-Chair of the ABA Section of International Law Privacy, E-Commerce and Data Security Committee and a member of the Section Council. You can follow Ken @KenRashbaum

Liberty McAteer is an Associate at Barton LLP. A former front-end web developer, he advises software developers and e-commerce organizations on data protection, cybersecurity and privacy, including preparation of security and privacy protocols and information security terms in licensing agreements, service level agreements and website terms of service. You can follow Liberty @LibertyMcAteer

Permalink | Comments | Email This Story

Congress Keeps Holding Repeated, Pointless Hearings Just To Punish The FCC For Standing Up To ISPs On Net Neutrality

In the year since the FCC passed net neutrality rules, ISP allies in Congress have run the agency through an endless gauntlet of show-pony hearings. While most of these hearings profess to be focused on agency transparency and accountability, they're really geared toward one single purpose: to publicly shame the agency for standing up to deep-pocketed telecom campaign contributors. Given the fact the only real way to overturn the rules is for ISPs to prevail in court or via Presidential election, this showmanship has been little more than a stunning display of wasted taxpayer dollars and stunted intellectual discourse.

Undaunted, the Senate held yet another "FCC accountability" (read: pointless tongue-lashing) hearing last week, during which Senators pummeled FCC boss Tom Wheeler with many of the same, repeatedly-debunked claims net neutrality opponents have been making since the rules were approved. Among them was the claim that the rules somehow hampered broadband investment, despite the fact that objective data (including quarterly ISP earnings reports) repeatedly shows that simply isn't the case.

For somebody that's had his time repeatedly wasted simply for upsetting the telecom status quo, Wheeler remains impressively cool under fire. For example, when fellow FCC Commissioner (and former Verizon regulatory lawyer) Ajit Pai took to the hearing to again trot out the industry-backed think tank claim that broadband investment had suffered under net neutrality, Wheeler casually highlighted that repetition does not magically forge reality:

"With all due respect to my colleague, what he has just portrayed as facts are not,” Wheeler responded. He said that investment in broadband increased, along with a 13% jump in fiber investment, as well as Internet usage and increased revenue per subscriber.

But Pai insisted that is not the case. “The FCC’s policies have failed. The administration’s policies on broadband has failed,” he said.

“We are not seeing a decline in broadband infrastructure investment. You can say it and say it and say it, but that does not make it a fact,” Wheeler responded.

Pai said he would offer up sworn declarations from Internet providers showing how the new rules had caused them to slow their investment. But Wheeler, too, offered to submit corporate statements on Internet investment, which would face Securities and Exchange Commission penalties if they were misleading.

When the rules were approved you might recall that net neutrality opponents also tried to claim that the White House "improperly influenced" the creation of the rules, since the White House vocally supported the Title II approach in November of 2014, and Wheeler voiced his support for Title II in February of 2015. This, net neutrality opponents argued, was clear evidence of an unholy cabal.

Net neutrality opponents can't point out what law was broken (because none was) and FCC history is filled with examples of the White House publicly voicing its policy preference ahead of an FCC announcement (George W. Bush urging Michael Powell to deregulate media ownership, or Bill Clinton writing a public letter urging Chairman Reed Hundt to ban hard liquor ads on TV). Still, neutrality opponents dragged this tired dog out of the cupboard at the hearing as well, accompanied by a thirty page report (pdf) designed to pretend the discredited claim has gravitas. Wheeler again remained relatively unfazed:

"Here, I would like to be really clear: There were no secret instructions from the White House. I did not, as CEO of an independent agency, feel obligated to follow the president’s recommendation.”

There's two things that net neutrality opponents in DC simply refuse to acknowledge. One, the net neutrality rules were crafted after unprecedented, genuine public outcry. Two, while it's framed as a partisan fight to try and sow partisan division, net neutrality actually has broad, bipartisan support. And while accountability for laughing at the will of the people and wasting everybody's time may not be forthcoming, the reality remains that these hearings are simply a taxpayer-funded display of just how high some politicians are willing to jump for their telecom-industry campaign contributions. The political and media pretense that they're anything else is laughable.

Permalink | Comments | Email This Story

Senator Feinstein Revives Stupid Idea That Internet Companies Are 'Materially Supporting Terrorism' If ISIS Members Use Their Sites

Last year, FBI Director James Comey floated a ridiculous idea that retweeting ISIS tweets could be seen as "material support" for terrorism. Indeed, an American teenager got sentenced to 11 years in jail for pro-ISIS tweets, with the "material support" being that some of those tweets linked to pages that taught people how to use Bitcoin. Some have taken this idea even further, and argued that internet companies can be slapped with "material support for terrorism" claims or charges if they let ISIS members or other terrorists make use of their services.

This is ridiculous for many, many reasons, not the least of which is that (like in the encryption debate) it seems to presume that there's some algorithm to magically determine who is good (not a terrorist) and who is bad (terrorist!). And just like ridiculous and impossible arguments for "kicking ISIS off the open web" -- it would be ridiculously counterproductive. Not only would it be ridiculously costly to internet companies, but it would actually take away a major source of intelligence about terrorist groups, since they often reveal useful things on social media.

But guess who's seriously thinking about looking to see if it's possible to slap "material support of terrorism" charges on internet companies? Why, it's a Senator who actually is supposed to be representing many of their interests as California companies, Senator Dianne Feinstein. Jenna McLaughlin, a national security reporter for The Intercept, noted that Feinstein floated the idea this week, as if Feinstein had just thought of it:

DiFi: have we tried slapping material support charges on companies for letting terrorists use their services?

— Jenna McLaughlin (@JennaMC_Laugh) March 9, 2016

We've already discussed how dumb an idea this is (even more so that it comes from a California Senator), but ACLU deputy legal director Jameel Jaffer had an excellent response as well, highlighting the sheer stupidity of Feinstein's suggestion:

I heard that terrorists use hotels, credit cards, and phones, too. We're going to need a lot of indictments. https://t.co/N6HsYIz2Tb

— Jameel Jaffer (@JameelJaffer) March 9, 2016

Permalink | Comments | Email This Story

DailyDirt: Nuclear Power Making Progress?

The problems with nuclear power via fission have obviously not been overcome by technology (or politics). European countries have started to back off nuclear power, and the US isn't expanding its nuclear power capacity in the near future. However, nuclear power isn't dead yet. Maybe some people think it should be, but what if someone figures out how to prevent meltdowns and burn nuclear waste as fuel?

• China is expected to have an operational Generation IV nuclear fission power plant within the next few years, not sometime in 2030 or 2040. High temperature pebble-bed reactors that use helium instead of water to transfer heat are designed to avoid meltdowns with passive systems. China is looking to sell their nuclear power plants to countries like Saudi Arabia, and it also has some molten-salt reactors using thorium on the way, too. [url]
• Bill Gates has invested in TerraPower, a company that is developing nuclear energy technology called a travelling wave reactor. This kind of reactor doesn't require enriched fuels, so it avoids proliferation problems and can even consume some depleted uranium waste as fuel. But these reactors aren't fully operational just yet. [url]
• Tens of thousands of metric tons of nuclear waste is currently in "temporary" storage, above ground in power plants across the US. A few geologically stable sites have been considered for nuclear waste storage, but shale deposits have only recently been investigated. A handful of European countries, as well as Canada and Japan, have already been looking into shale deposits to store radioactive waste, but the NIMBY factor for nuclear waste makes it tough to commit to any long-term storage plans. [url]

After you've finished checking out those links, take a look at our Daily Deals for cool gadgets and other awesome stuff.

Permalink | Comments | Email This Story