Digital Majority

EDPS, the European Data Protection Supervisor, confirmed the possibility of a 'Soviet Internet' (mandatory TPM chips and DRM to connect to the internet) in its recent analysis of the Harbour report. They confirm the FFII's interpretation of the amendment:

Software and services that run on the internet would have to ask for permission of the regulators.
[…]
Benjamin Henrion, FFII representative in Brussels, rings the alarm bell: "Tomorrow, popular software applications like Skype or even Firefox might be declared illegal in Europe if they are not certified by an administrative authority. This is compromising the whole open development of the internet as we know it today. Once the Soviet Union required the registration of all typewriters and printing devices with the authorities."

The European Data Protection Supervisor is confirming the fears with "guidelines to be imposed upon software and hardware products":

55. The EDPS believes that it does not make sense for Article 14, which is focused on standardisation for the purposes of enhancing data protection and privacy, to be expanded to include standardization for other, completely unrelated topics.

56. Second, by including in Article 14(1) the reference to standardisation for purposes of detecting, intercepting, or preventing infringements of intellectual property rights, this Article recognises that Member States can impose standards in this area as well (not only for privacy purposes as stated in Article 14.3), provided that such standards ensure the free circulation of such equipment in and between Member States.

57. In this context, there is a question as to whether it is appropriate for Member States to require information technologies to meet certain standards, i.e. to incorporate certain features, to detect, intercept, or prevent infringements of intellectual property rights by users. Such measures, referred to as DRM, have a significant impact on the privacy of individuals insofar as they facilitate the monitoring of an individual's activities with respect to a particular copyrighted material. For example, it would enable the copyright holder to know which pages an individual views, copies, or transfers. A comparable example in the offline word would be if someone were able to monitor which pages of a magazine an individual views. If these measures were to be adopted, they should integrate data protection and privacy safeguards.

58. For the reasons outlined above, the adoption of any Amendment allowing for such measures should be preceded by a thorough exploration of the issues at stake in the right forum, including public consultation with the relevant stakeholders, which has not taken place at this stage. Taking this into account, the EDPS does not believe that it is appropriate at this stage to adopt such measures.

59. The EDPS notes another amendment, Amendment 81, which modifies Article 22(3) of Directive 2002/22/EC. This Amendment has a similar effect as Amendment 134 analysed above. Amendment 81 which appears in italics below recognises that "a national regulatory authority may issue guidelines setting minimum quality of service requirements, and, if appropriate, take other measures, in order to prevent degradation of service and slowing of traffic over networks, "and to ensure that the ability of users to access or distribute lawful content or to run lawful applications and services of their choice is not unreasonably restricted."

60. The Amendment allows national authorities to issue guidelines to be imposed upon software and hardware products to enable the access or distribution of lawful content or applications. In other words, measures designed to prevent the access and distribution of unlawful content, including intellectual property, referred to above as DRM.

61. As is the case with Amendment 134, Amendment 81 also makes use of a provision of Directive 2002/22/EC related to a completely unrelated topic - the degradation of the service. The Amendment is focused on distribution of unlawful content, including intellectual property and is unrelated to degradation of service. As it was said above, in the light of the importance of the measures proposed and their direct impact on the privacy of individuals, the EDPS advises against adoption of this Amendment prior to engaging in an in-depth, thorough analysis of its effects.

60. The Amendment allows national authorities to issue guidelines to be imposed upon software and hardware products to enable the access or distribution of lawful content or applications. In other words, measures designed to prevent the access and distribution of unlawful content, including intellectual property, referred to above as DRM.

V. CONCLUSION

62. The EDPS is concerned about some ad hoc amendments contained in the IMCO Report which, if adopted, would result in weakening personal data and privacy protections of individuals using the Internet. He is concerned with Amendments 9, 30, 76, 81,112 130, 134 of the IMCO Report related to the processing of traffic data and the protection of intellectual property rights.

FFII has been involved in the OOXML standardisation discussion, and according to Wikipedia, there are proposals to standardize the TPM stack inside ISO:

Some efforts exists have the Trusted computing specifications standardized by ISO. This was active for a first part in October 2007 and member states of the ISO/DIS JTC1 are expected to send their opinion to ISO by July 24 2008.

The concerned documents are referred to as

* ISO/IEC DIS 11889-1 Trusted Platform Module — Part 1: Overview
* ISO/IEC DIS 11889-2 Trusted Platform Module — Part 2: Design principles
* ISO/IEC DIS 11889-3 Trusted Platform Module — Part 3: Structures
* ISO/IEC DIS 11889-4 - Trusted Platform Module — Part 4: Commands

Which means that it would be easier for National Regulatory Authorities to mandate such standard to connect to the Internet.

It is time to contact your MEP and ask them to reject this amendment 81. EDPS has also some concerns about the Harbour's IMCO report on amendments 9, 30, 76, 81,112 130, 134.