Hacker News Reader

Comment by xg15 | Hacker News Reader

I'll agree that copyright has gone haywire as much as the next guy, but this seems to be the exact kind of defense strategy that will archieve nothing but annoy the judge.

The project seems to be based on the assumption that copyright really protects particular sequences of bytes - and that therefore, if you can sufficiently change the representation of a protected work, you're off the hook.

IANAL, but that seems far from the intentions of copyright.

The 4'33 case [0] comes to mind, where a work of nothing but silence was protected. From what I understood, in that case, the actual contents of the work didn't matter a lot (it was all just silence after all) - but what did matter was whether or not someone was consciously using this piece as a base for their own work.

My understanding is that copyright bans the act of using a protected work in an unauthorized manner. By that logic, it doesn't matter how an illegal copy is represented if the data is used with the intention of sharing an illegal copy.

[0] http://news.bbc.co.uk/2/hi/entertainment/2276621.stm

View on HN

A classic analogy for explaining the difference: https://ansuz.sooke.bc.ca/entry/23

Came here to post that link.

In a nutshell, we programmers tend to like to think that we can use technical means to show that copyright is fundamentally nonsensical / inconsistent / imperfect, as though copyright were a mathematical proof and providing a counter-example would somehow make it go away. This is fundamentally missing the point.

Poignant excerpt:

I think Colour is what the designers of Monolith are trying to challenge, although I'm afraid I think their understanding of the issues is superficial on both the legal and computer-science sides. The idea of Monolith is that it will mathematically combine two files with the exclusive-or operation. You take a file to which someone claims copyright, mix it up with a public file, and then the result, which is mixed-up garbage supposedly containing no information, is supposedly free of copyright claims even though someone else can later undo the mixing operation and produce a copy of the copyright-encumbered file you started with. Oh, happy day! The lawyers will just have to all go away now, because we've demonstrated the absurdity of intellectual property!

The fallacy of Monolith is that it's playing fast and loose with Colour, attempting to use legal rules one moment and math rules another moment as convenient. When you have a copyrighted file at the start, that file clearly has the "covered by copyright" Colour, and you're not cleared for it, Citizen. When it's scrambled by Monolith, the claim is that the resulting file has no Colour - how could it have the copyright Colour? It's just random bits! Then when it's descrambled, it still can't have the copyright Colour because it came from public inputs. The problem is that there are two conflicting sets of rules there. Under the lawyer's rules, Colour is not a mathematical function of the bits that you can determine by examining the bits. It matters where the bits came from. The scrambled file still has the copyright Colour because it came from the copyrighted input file. It doesn't matter that it looks like, or maybe even is bit-for-bit identical with, some other file that you could get from a random number generator. It happens that you didn't get it from a random number generator. You got it from copyrighted material; it is copyrighted. The randomly-generated file, even if bit-for-bit identical, would have a different Colour. The Colour inherits through all scrambling and descrambling operations and you're distributing a copyrighted work, you Commie Mutant Traitor.

If all that mattered were the bits, then wouldn’t it be sufficient to just re-encode a video? All the bits are different now...

It seems to me that changing the bits only helps to avoid detection. Not to avoid the legal issues.

It wouldn't be just an equality check on the bits anyway, rather some kind of theoretical function over the bits. For example, is this JPG image a copyrighted image? Perhaps my function would be:

    - take the source image, reduce it to a 10px by 10px grid
    - take the image in question, reduce it to a 10px by 10px grid
    - for each pixel, calculate the deviation between the source pixel and the candidate pixel
    - if the sum of the squares of the deviation is smaller than some threshold, output true.

The point is that no matter how clever a function you make, it cannot capture the notion of where the bits came from and can only capture information about what the bits are. Computers care about the latter. All these clever schemes care about the latter. Copyright law cares about the former.

From a copyright law perspective, the notion that you might have two files on your computer whose bits are completely identical in every way, but only one of which you are legally permitted to copy, is perfectly reasonable.

it changes the nature of the question.

now they have to prove you extracted the specific copyrighted material from those random bits that where exchanged.

sure copyright would still exist, but proving one infringed on it becomes borderline impossible.

From the article:

> Hey, Reddit, Ycombinator, and Metafilter readers! You know what, I'm proud that this article has become a benchmark, but I've written a lot of others I like too, some of them more recently than 2004. It would sure be nice if my other articles got some love instead of just this one being linked from a discussion every week.

Off topic but their blog starts in Feb 1997.

Now I am fairly sure i was doing something blogging like then, but ... actually still having it up... impresses me for the sheer ability to keep something running that long.

Just a clarification on 4'33": recordings of it are not pure silence (and are not intended to be). They're recordings of actual musicians on an actual stage, not playing any music. So you hear lots of little environment sounds, movements, coughs, etc. It seems plausible for a particular recording of that piece to be copyrighted. Or for the instructions to be.

The issue in that link is weird because it seems like part of the problem is that he credited Cage on his own album, admitting that he was copying it.

Good point. I wasn't aware of that. Thanks for the clarification.

> I'll agree that copyright has gone haywire as much as the next guy, but this seems to be the exact kind of defense strategy that will archieve nothing but annoy the judge.

I think a good analogy is that of two twin brothers A and B. One of them (A) commits a crime and is caught on camera. The judge, however, can't convict A because the video evidence isn't conclusive because of the existence of B. You can say that B is annoying the judge because he doesn't play along, but that's not how it works.

At best it is a way of hiding evidence, but any encryption scheme works just as well for that purpose. It doesn't change the legality of using the bits that were derived from the copyrighted material

The question is liability of hosting those bits.

I have copyrighted data block A.

I generate random, uncopyrighted data A1 and store on host X I XOR A1 with A and get A2, storing this on Y.

Y is derived from A (and A1) but A1 is totally original random data whose generation is totally unrelated to A.

So, who is hosting the derivative data? Y, possibly, but both A1 and A2 look like random data, there's no way to tell which is the random one.

Y is definitely derived work.

The knowledge that "A = X(A1) xor Y(A2)" is also derived work. That fact will be known by someone, and will definitely be infringing.

"possibly" here means that while Y is hosting derived work, even the uploader doesn't know that for a fact since the software doing the uploading doesn't expose this detail.

Knowledge of how to combine them being a derived work is an interesting theory. One challenge is that facts aren't typically copyrightable. On the other hand you could argue contributory infringement instead.

The hosts are protected anyway by DMCA safe harbour provisions, just like if you uploaded an encrypted copy of an infringing file to Google Drive.

> So, who is hosting the derivative data? Y, possibly

Y, definitely. Like you said yourself, Y's data is derived from A.

> both A1 and A2 look like random data, there's no way to tell which is the random one.

Any encryption scheme will cause the file to look like random data. All that means is that seeing the file contents alone is not enough to prove the crime. It doesn't mean that the file contents become free of infringement.

Does any host get safe harbour, or just the big ones with lawyers?

In any case, encryption schemes have keys, distinct from data and generated during encryption. In this case, there are two sets of data, either of which could be key or data, and one of which could of been generated before, and independently of the other. In fact, for any data block A, and random data X - there is a block Y that combines with X to produce A - any/all A, any/all X.

Y's data is obviously the data and X's data is obviously the key. It doesn't matter if you can tell that just by looking at the data or just by looking at the key. What you can tell just by looking at the data is irrelevant, that is what I am saying.

> In fact, for any data block A, and random data X - there is a block Y that combines with X to produce A - any/all A, any/all X.

That is true with basically any encryption scheme, the only peculiarity here is that key and data are the same length (which is irrelevant to the legality of the situation anyway).

> what you can tell just by looking at the data is irrelevant

Why? hosting derivative work is illegal, hosting random data (keys) isn't, the distinction between X's data and Y's data is the distinction between liable and not-liable. If you can't tell which is which, then both are innocent under reasonable doubt.

> That is true with basically any encryption scheme

What's isn't true is the ease with which the A can be generated from X given Y. In other encryption schemes, key and data are distinct components - and not just by size.

Because looking at the bits themselves is just one way of many to prove beyond a reasonable doubt what someone was trying to accomplish in the first place. In fact having the bits themselves doesn't even necessarily prove anything. If someone puts a murder weapon in my possession without my knowledge, does that make me guilty?

> In other encryption schemes, key and data are distinct components

Key and data are distinct components here too. You said yourself you generated the key data with no knowledge of the infringing content, so that makes them distinct. Size of the key is the only difference with this scheme compared to more typical ones.

I'd say showing a host is hosting a copyrighted file is the main way this is proven, and it's hard to host a file without broadcasting evidence of guilt. This is in no way comparable to possessing a murder weapon.

> You said yourself you generated the key data with no knowledge of the infringing content, so that makes them distinct.

The 'key' differs by history, which isn't know from looking at the bits. There is no way to distinguish which is the key without knowing how they where generated.

But by "distinct" I mean that you cannot switch the roles of key and encrypted data in most encryption schemes, that is not true in this case.

> Size of the key is the only difference with this scheme compared to more typical ones.

That's not true, in traditional schemes the key of any size is still the key in how it's used to decrypt the encrypted data; you cannot decrypt the key using the encrypted data as a key; this is not true for OFFsystem - there is no key/data distinction, if E is the decryption function then E(A, B) = E(B, A)

> If you can't tell which is which, then both are innocent under reasonable doubt.

Nope. X is still hosting infringing content (I doubt this would even be considered derivative and not simply the encrypted original), this just made the proof harder. But "it could theoretically have happened differently" is not "reasonable doubt" if this possibility is highly unlikely in face of all other evidence. A thief doesn't get out free because the thing "could have accidentally dropped into his bag".

You're demanding that the court, should only look at the tiny piece of the puzzle that you provide. They have no reason to do so.

In this case, I'd assume, instead of diving into the technicalities of the algorithm, they'd be more interested in the fact that the openly stated purpose of the whole system is to circumvent copyright.

Any host gets safe harbor as long as they accept DMCA takedown notices and respond to them within a reasonable amount of time. You don't need a lawyer to comply with this law in general, but if you are in the business of hosting legally dubious content you will need lawyers one way or another.

That would be a good analogy if they just claimed the network gives you anonymity and therefore lets you break the law with impunity.

But they're making the claim that the system lets you share copyrighted work without breaking the law.

Because they XOR'ed copyrighted bits with other copyrighted bits therefore how can anyone own the resulting garbage? This is the part that will be laughed out of the court room.

Whether it can be proved that a particular node participated in the infringement is a different story, but if that is your threat model you want strong encryption not XOR.

The allegation will be: I downloaded A from X and B from Y, XORed them together and got copyrighted work.

However, X will say that Y could have manufactured B that way. And Y will say the same.

> This is the part that will be laughed out of the court room.

You can laugh all you want, but you can't convict anyone.

Great, X and Y have infringed the copyright for both A and B. I'm not convinced they don't have more legal exposure rather than less (if B is copyrighted too).

The main point is that there will be nobody in court in the first place.

Assume you have published random block A.

Now I claim that you have infringed copyright of a work because XORing your A with my C gives that work.

I hope you can agree that I can't sue you based on that. And this is exactly how this system works.

If I need your A in order to produce the copyrighted work, it seems likely to me that the argument will be made that it's a derivative work or another way of copying the copyrighted work. It might event work. It would certainly be expensive to find out.

As a rule, trying to get clever with technology to get around the legal system rarely works well. Especially when you can't afford to defend yourself.

The point being made is that the system creates such deniability that it's impossible to say who the perpetrator is.

Let A and B be two data blocks produced by different people, and C be a copyrighted work.

It becomes known that A⊕B⇒C, and so the copyright holder of C would like to sue someone.

It is obvious that either the person who produced A or the person who produced B is infringing on the copyright of C. However, it is impossible to say which one it is; it is impossible to say whether A is a derivative work of B and C (B⊕C⇒A) or if B is a derivative work of A and C (A⊕C⇒B).

(Of course, good luck explaining that to a judge.)

Let's iterate on that more. So A and B a blocks on the network. Yet a 3rd person publishes some freely-licensed works; they F1 and F2. In order to be stored in OFF, they get xor'ed against existing blocks, and just so happen to xor against A and B. So A⊕F1⇒A' and B⊕F2⇒B'. So someone wanting to download F1 will download A and A', then get F1 by A⊕A'⇒F1. Neither the person publishing F1 and F2 nor the person downloading them have any idea that A⊕B⇒C. So now someone lawfully downloading F1 and F2 appears to be downloading C, because the blocks they're downloading are [A, B, A', B']; and [A, B] are what it takes to infringe on C. But they had no idea that A⊕B⇒C, they were just interested in F1 and F2. So now you can't say that downloading A and B together indicates unlawfully downloading C.

(Again, good luck explaining that to a judge.)

So the point is to make it really hard to say who did what.

Maybe it's just me, but doesn't this make it exceptionally clear that multiple people have colluded to both do a thing and hide who was the responsible party? I think the US legal system might have tools for handling such groups of people. I'm reasonably sure this isn't unprecedented, except perhaps in the technological details.

I think it might strain credulity that these "random" blocks "just happen" to have these particular properties. So much so that I doubt the argument would stand in face of the argument that F1 and F2 were deliberately crafted derivative works of C, made in an effort to allow piracy of C.

> multiple people have colluded

Yes, everyone using OFFSystem is colluding to make it hard to tell who did what. There are legitimate reasons one someone might want to engage in such a system--including privacy. It's the same thing with Tor; everyone with a Tor node is colluding to make it hard to tell who's talking with what other nodes.

> it might strain credulity that these "random" blocks "just happen" to have these particular properties

The OFFSystem is designed such that blocks do "just happen" to have those particular properties. Any new thing put on the OFFSystem will make use of many random blocks that are already on the OFFSystem. For simplicity, in the examples I gave, storing 1 new data block used just 1 existing data block, but that number is configurable; the default is 2. So when a user stores F in to the OFFSystem, the software will randomly select 2 existing data blocks on the network (S, R), and combine F with them in order to store it: S⊕R⊕F⇒data-block-to-store; the software having having no idea what S and R have previously been used for. For simplicity, I've also been assuming that a file you want to store fits in 1 block; a source block is 128KiB; storing a file larger than that will take storing many blocks. So in all, by default, storing a file will make use of 2×(filesize/128KiB) randomly-selected data blocks already on the network. The idea is that after a short time, virtually every data block on the network will have many unrelated uses.

It would be entirely plausible that someone has both a legitimate use for A (e.g. F1) and a legitimate use for B (e.g. F2) with no one involved in that legitimate use having any idea that together they have the illegitimate use A⊕B⇒C, because the whole system was designed to make that likely.

Switching sides, kinda: OK, so you might not be able to assign much culpability to any given data block, so just assign culpability to sharing the metadata that A⊕B⇒C, right?

It's my understanding that that metadata is stored in a "descriptor block" stored in to the network like any other data block (but isn't combined with a set of random other blocks already on the network). I am unsure what the format of that data is, it might very well be easy to identify a block as being a descriptor block (or maybe not, I have no idea).

Going after those who download the descriptor block is problematic for the same reasons--that block will end up being reused for other files, the same as any other data block; they could be using it for any number of purposes.

OK, so you go after those that say "hey, use this X descriptor block to get such-and-such copyrighted file". Well, there's a reasonable amount of precedent that that sharing a link to a copyrighted work doesn't constitute infringement in many jurisdictions (e.g. hosting a torrent file or a magnet link isn't infringing; it's actually seeding or leaching the contents of the torrent that's infringing).

OK, so you go after those that downloaded the descriptor block, then shortly afterward downloaded the data blocks referred to by the descriptor block, and that's reasonable suspicion. Well (1) tracking that is a lot harder than tracking who downloaded an individual block, and (2) there's still a sliver of plausible deniability, so then then you get a subpoena to search their computer for C.

Again, the whole point is to make it really _hard_ to tell who's doing what.

No, I think this whole thing makes it impeccably clear which blocks are the data and which blocks are the encryption pad since all of that is in the URL.

There’s no philosophical argument here, in my opinion.

xor is a commutative operation; there is no technical distinction between the "data" and "encryption pad" as you call them. The URL identifies an unordered set of blocks, and does not distinguish which of them are the pre-existing "randomizer" blocks ("encryption pad" blocks, as you call them), and which one is the new block ("data" block, as you call it). The URL has a set of blocks, you xor them all together in any order, and you get the result.

All encryption functions are total, it’s just that the block size of XOR is 1 bit.

If you decided to take AES-256 and then split your data into blocks of 256 bits and then encrypted them with other groups of blocks of 256 bits, you would get exactly the same conceptual result.

That being said (this definition is absolutely irrelevant) - it doesn’t matter if you have an unordered set of blocks; if by applying them together you get the data then every one who held the block is liable.

Would you say that if you stored child porn on a RAID array and then distributed this RAID array across several people and removed one disk then philosophically the only moment when that porn really exists is only when it is combined to get the data in memory?

I'm not sure why you've brought up philosophy twice now; what I'm showing is that the system makes it hard, practically, to tell who did what; no philosophy involved.

All but one of the blocks were already used by other people for entirely unrelated purposes. Only one of the blocks was created in the process of uploading illicit material, and it is impossible to know which one that is (from inspecting the blocks themselves; if you knew when each block was created--which the system does not track--then you could just say "the last one to be created"). You had asserted that the URL tells you which block that is; all I said to you is that it does not.

And even if you did identify which block that was, after a short time, another unsuspecting user of the network will end up using that block-involved-in-illicit-activity as a randomizer block for an entirely unrelated purpose; say: uploading cat gifs. And then others download those cat gifs, and download that block; having no idea that that block is also used to download child porn.

The idea of the system is that after a short time, virtually every data block on the network will have many unrelated uses. And because of those many unrelated uses, one cannot say that transmission of any given block indicates one of those uses over any of the other uses.

I haven't made any sort of philosophical argument that the illicit material does not exist until it when the data blocks are combined in memory, or anything like that. I have only made the argument that because each data block has many unrelated uses, it is difficult to prove who is using it for which uses. As I said in another comment, you can start to figure out things if you keep track of patterns of which blocks are downloaded when; but tracking that is a lot harder than tracking a single block. And that's the point of the system; to make it hard to prove specific assertions about who did what.

How were A and C constructed?

Were they constructed from the derivative work? Or did they choose or generate A and C so that A xor C produces the derived work?

In all of those cases, they are still derivative work.

It feels like you don't really understand how the laws work, perhaps?

Intent is very very important.

If I'm hosting stuff for the express purpose of allowing people to download what I have, download what someone else has, and then do math with the two parts to get a copyrighted work, a judge (& jury) will have more than enough to rule against all of the people involved.

> You can laugh all you want, but you can't convict anyone.

That is an incredibly naive and incorrect view of how the (US, at least) legal system works.

Also consider that in a civil suit, the burden of proof is much, much lower than in a criminal case. So the word "convict" does not apply here.

The only thing here unique to OFFSystem is that if you have hundreds or thousands of nodes, it's (theoretically) not possible to prove who "owns" A and who owns B, so who do you take to court?

But then we get back to intent. The current legal consensus is that if a tool has legitimate non-infringing uses that are actually realistically happening in practice, then it gets very muddy and a plaintiff has to work hard to prove that any particular user is responsible for infringement. But in the case of OFFSystem, its express purpose is to enable copyright infringement. That is literally the stated purpose of the entire thing. Legally, anyone who participates in that system is assumed to be there to enable copyright infringement, and can be held liable, if not for direct infringement, then contributory infringement.

That's how the law actually works, for better or worse. And even if you're in the clear, do you want to be dragged through court and be responsible for legal fees, and the general uncertainty of what's going to happen to you?

If the law where clear cut, yes. When the law is uncertain, it's not possible to either fully comply, or fully violate the law - avoiding "being caught" prevents legal action on an issue that may or may not be legal. That this is possible/necessary is due to the structure of the legal system.

What intensives have people to risk being a legal test case? It's clear to me those with influence over the law purposefully keep things ambiguous in order to have it both ways (threaten, without risk of being threatened) - maybe the opposing sides should be able to take advantage of the ambiguity just as much - after all, privacy is the right even of those with nothing to hide.

I agree it's a good analogy, but I think you can also use it to illustrate my point.

In your example, the goal of the judge is not to convict whoever is seen on the video. Their goal is to convict whoever commited the crime - and the camera footage may or may not be essential in reconstructing that information.

The fact that A has an identical twin makes the video into less conclusive evidence, but this just means other pieces of evidence are required - it does not change anything about the original crime.

In fact, if A was bragging on Twitter how he is about to commit the crime and no one will be able to prove it was him, the tweets themselves would probably become evidence.

In the same way, I believe (IANAL) two files being byte-for-byte identical is usually strong evidence that one file is a copy of the other in the copyright sense. However, it's neither a necessary criterion, nor strictly speaking even a sufficient one (e.g. in the 4'33 case).

but the proof that the byte-for-byte duplicate exists isn't available. yes you maybe know that A,B,C can be combined to create the byte-for-byte duplicate but they can also be combined to create a completely different file.

so just monitoring the network proves nothing. you have to get access to the end result on the users device.

the point is copyright is now much harder to prove.

> will achieve nothing but annoy the judge

Funny how existing BS arguments that benefit copyright holders haven't annoyed judges so much

There is no ultimate defence, but there is forcing attackers to lose viable defence ground - Once they attack you on basis X, they can't defend themselves on basis not-X; or vice versa.

Because copyright law was created to benefit copyright holders.

We might even say that copyright holders were created by copyright law, no? =)

Reply on news.ycombinator.com