CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

http://meta.crypto.stackexchange.com/questions/250/ciphercloud-dmca-notice

by rdl • 13 years ago

249 81 13 years ago

meta.crypto.stackexchange.com

greenyoda• 13 years ago

Note that the answer below the question contains this link to the Google cache of the original article that was taken down:

http://webcache.googleusercontent.com/search?q=cache:FYBbAFU...

There doesn't seem to be anything in there that looks like an infringement of anyone's copyright.

ghayes2• 13 years ago

Aren't DMCA takedowns required, under penalty of perjury, to assert a non-frivolous copyright claim? Is there any recourse for what appears to be clear abuses of the DMCA?

dangrossman6• 13 years ago

There is recourse against truly false claims made in bad faith, but it's not the penalty of perjury part. All you swear under penalty of perjury is that you are authorized to act on behalf of the owner of some copyright allegedly infringed (i.e. you're not filing a claim about someone else's work).

Here's the actual recourse created by the bill:

> (f) MISREPRESENTATIONS- Any person who knowingly materially misrepresents under this section-- (1) that material or activity is infringing, or (2) that material or activity was removed or disabled by mistake or misidentification, shall be liable for any damages, including costs and attorneys' fees, incurred by the alleged infringer, by any copyright owner or copyright owner's authorized licensee, or by a service provider, who is injured by such misrepresentation, as the result of the service provider relying upon such misrepresentation in removing or disabling access to the material or activity claimed to be infringing, or in replacing the removed material or ceasing to disable access to it.

http://thomas.loc.gov/cgi-bin/query/F?c105:6:./temp/~c105aLN...:

JohnTHaller• 13 years ago

Their likely justification is the use of those image snippets which appear to come from their manual. Realistically, those small captures represent fair use (though I am not a lawyer so can't speak legally).

ghayes2• 13 years ago

I assume it would fall under commentary[1], esp. as it's one a single image and it has literally been written over to show the material that the comment is referencing.

[1] http://fairuse.stanford.edu/Copyright_and_Fair_Use_Overview/...

InclinedPlane2• 13 years ago

I don't think it's on copyright grounds, I think it's on circumvention grounds.

dangrossman6• 13 years ago

The DMCA notice/counternotice system is only about copyright infringement. They wouldn't get one for the circumvention prohibitions; or if they did, it would be an illegal use of those notices.

ck22• 13 years ago

I think "used" needs be replaced with the word "abused". It's appropriate here.

With no penalty for false DMCA claims, it's a "stop us if you can" mentality.

The real reason may have been the conclusion that "Ciphercloud is NOT doing homomorphic encryption" ?

(but google cache still works)

dangrossman6• 13 years ago

The penalty for materially misrepresenting a DMCA claim is actual damages plus costs and attorney fees. That's automatic, written into the bill, unlike many other torts/crimes where you need exceptional circumstances to get attorneys fees in addition to the damages.

ck22• 13 years ago

So years later you can get content restored?

Are there lawyers who will take on cases for consignment only?

It's a calculation that little people will not be able to take on the big people.

This is why corporations have zero fear of incorrectly killing individual content on youtube, little chance of penalty and they can smother any attempt to fight them.

cft• 13 years ago

Except that 512(f) of DMCA is practically unenforceable [1], since the standard is to prove that they "knowingly materially" misrepresented:

[1] http://blog.ericgoldman.org/archives/2013/04/another_512f_cl...

gcb02• 13 years ago

This will only ever be enforced in the case of someone sending a request under a false name.

Anything else is impossible to prove

goronbjorn• 13 years ago

When a company does something like this, whether or not the claims/criticisms are actually true, their actions tacitly imply that they believe that the claims are true. In other words, terrible PR/technical brand management.

danbruc3• 13 years ago

Now let the Streisand effect do its work...

(I made a snapshot of the page from Google's cache only to discover that at least two others used the very same service within the last hour to do exactly the same...and there are a few services to snapshot web pages.)

rubbingalcohol2• 13 years ago

Here's one. DMCA claim is bullshit. This is fair use: http://static.rubbingalcoholic.com/images/temp/ciphercloud.p...

sergiotapia2• 13 years ago

Google cache of question in...question (lol): http://webcache.googleusercontent.com/search?q=cache:FYBbAFU...

danbruc3• 13 years ago

That looks really horrible and I am somewhat tempted to write and publish a GreaseMonkey script that does bad things to CipherCloud protected pages...

sergiotapia2• 13 years ago

Why would you (or anyone) deliberately try to hurt a company? Just because their tech is not 'on par'? Please think about how it would hurt that company and the employees (and their families!).

qb452• 13 years ago

So they use AES as a building block of substitution cipher?

One would think that if something is insecure anyway they could at least make it efficient.

pi18n2• 13 years ago

We should start a collection of these kinds of stories as case studies in why laws allowing any entity to legally compel removal of content are ripe for abuse.

DMCA as a law isn't even that ridiculous or reprehensible; it mostly offers protection for websites that have user-submitted content. And yet here we are.

The damages clause needs to be strengthened if we wish to continue having free speech on the internet.

CodesInChaos3• 13 years ago

EFF has a collection of DMCA abuses: https://www.eff.org/takedowns

tzs• 13 years ago

More comments are on the duplicate (now dead) submission [1].

[1] https://news.ycombinator.com/item?id=5579615

plumeria2• 13 years ago

Just have someone put it on wikileaks?

plumeria2• 13 years ago

Or snapshots in a torrent file...

smartwater• 13 years ago

Before takedown: http://imgur.com/8r9cDxS

patrickyeon• 13 years ago

In a situation like this, who files the counter-claim(s) to get the content restored?

I would SE as an organization cannot, as they are the safe harbor in this case, but it sounds like the takedown notice wasn't specific enough for the relevant users to know what they can leave up. Does each user involved need to counter-claim so that SE can put the question and answers back up? Can one user claim that nothing on the site was infringing and have that be enough to protect SE?

moxie2• 13 years ago

What's interesting is that there is a whole ecosystem of companies like CipherCloud that do the minimum required to provide solutions for those interested in "compliance," not "security."

My sense has been that their customers are predominately those bound by things like HIPPA or PCI, who want to use cloud services, but can't do it with a straight face unless they can say they're "encrypting" their data.

What their customers want isn't security; it's the minimum required that will allow them to use salesforce.com. Incriminating details on StackExchange aren't a problem because their customers don't already know CipherCloud is insecure, they're a problem because it would make it harder for customers to say they're in compliance with a straight face.

DanBC3• 13 years ago

Is it really that simple? Or is it that crypto is difficult and buyers have no knowledge and thus are wide open for people selling snake-oil?

pyre3• 13 years ago

It can be both. There are going to be companies that are serious about actually protecting their customers (but don't have the technical know-how to be an informed customer), and there are companies that see these laws/rules (PCI, HIPPA) as hindrances to cast aside with the least possible effort.

moxie2• 13 years ago

On some level, the fact that compliance regulations exist is an indication that security is not a priority for many of the entities that it applies to.

Certainly snake-oil is a problem, but I think this particular area is one where buyers are most concerned about being able to effectively claim that they made what seemed like reasonable efforts.

_b8r0• 13 years ago

I've mirrored Emil Vokstrom's mirror[1] here[2] and I encourage HNers outside of the US to do the same and post here.

[1] http://lajm.eu/emil/dump/ciphercloud-security.html

[2] http://securitybookreviews.eu/ciphercloud/

shared4you• 13 years ago

Mirror of Google's webcache, including images:

http://bdsatish.in/math/crypto-se-3645/

jaytaylor• 13 years ago

I've mirrored everything I can find[0].

[0] http://scala.sh/ciphercloud/

daigoba66• 13 years ago

For reference, it's HIPAA not HIPPA. Common mistake.

anoopelias• 13 years ago

Just listen to Cryptography I in coursera.

Never ever, use your own algorithm for encryption. Always use tried, tested and known algos. And don't even change it one bit (literally!).

Only the key remains secret.

PeterisP2• 13 years ago

If something can be destroyed by the truth, then it should be.

If a crypto company abuses DMCA to fight this, then they deserve the Streisand effect. You should send the materials to someone in a free country where DMCA doesn't apply and speech is still free, and they can host the documents and discussion.

DanBC3• 13 years ago

I haven't seen the DMCA notice. I think the screenshots are the things being DMCAd. If so, they clearly fall under fair use.

Someone should issue a counter notice. And get them put back up.

What's interesting to me is what happens if StackExchange put these back up, and then the cryptocompany sends a DMCA to SE's hosts.

AnthonyMouse3• 13 years ago

Isn't it the same thing then? Just send a counter-notice to SE's hosts?

Of course, that doesn't stop all of Stack Exchage from being down for "10 business days" in the meantime. Should be interesting to see the public response to that if it actually happens.

rubbingalcohol2• 13 years ago

Situations like this really highlight how out of step the DMCA is with peoples' right to free speech and fair use. DMCA takedowns put too much compliance burden on individuals who are unaware of or intimidated by the counter-notice process.

At the very least, there should be more stringent requirements for legitimate takedown claims and stricter penalties for abusing the process.

jimktrains2• 13 years ago

http://webcache.googleusercontent.com/search?q=cache:crypto....

Has a version from Apr 12, 2013 15:33:47 GMT.

acd• 13 years ago

Freedom of speech must include that random company x cannot take down your internet discussion using some strange acronym as an excuse.

Encryption and security does usually not get any better by pretending its secure and not letting anyone dig around the solution.

npsimons• 13 years ago

Encryption and security does usually not get any better by pretending its secure and not letting anyone dig around the solution.

Indeed. Schneier has some excellent discussion on this topic, singling out closed source encryption as always eventually being cracked, and the security world's consideration of open source as a pre-requisite for security:

http://www.schneier.com/crypto-gram-9909.html

I've never understood how anyone with at least an ounce of intelligence can claim that something is more secure just because it's closed source.

mleach• 13 years ago

Putting the merits of their technology aside, I've had numerous unpleasant experiences working with the CipherCloud Founders as both a Salesforce Partner and Customer. They use fear tactics to scare prospects into believing a) their data is unsafe in the cloud and b) their competition uses inferior encryption algorithms.

This DMCA takedown is unfortunately just another of their "just try and stop us" tactics.

CodesInChaos3• 13 years ago

Now stackexchange forwarded the DMCA notice to the involved users. http://meta.crypto.stackexchange.com/q/250/180

CipherCloud claim copyright infringement on the three images used to evidence the posts.

They also claim that certain statements in the posts are false, misleading defaming. While some statements look indeed wrong, others (in particular the determinism claim) are clearly evidenced in screenshots. They hint that their actual product might use different encryption from the demo video.

DanBC3• 13 years ago

Did CipherCloud get Google's permission to use the GMail logo on their website?

Or Microsoft's permission to use the MS Office 365 logo?

volokoumphetico• 13 years ago

long story short, stackexchange didn't want to lose a potential ad sale. It's not good for their business to have users question products advertised on stackexchange network.

jared3143• 13 years ago

I wonder if doing something similar to Ciphercloud, using a homomorphic encryption library like libScarab[0], would actually make it secure. I guess I still don't understand what Ciphercloud does.

[0] https://hcrypt.com/scarab-library/

betterunix2• 13 years ago

FHE is far too slow for any practical use. In a few more years, things might be different, but for now anyone marketing a practical FHE solution is probably lying.

jared3143• 13 years ago

I'm still trying to find performance numbers that prove it impractical. Otherwise, it just sounds like a problem that could be mitigated by clustering.

caf2• 13 years ago

The original question and answers has been put back up, without the CipherCloud screenshots.

http://crypto.stackexchange.com/questions/3645/how-is-cipher...

a3n• 13 years ago

So wrong answers (assuming they're wrong) and speculation are now speech that can legally be suppressed? You can't say anything that's wrong or a guess?

CodesInChaos3• 13 years ago

DMCA'd CipherCloud discussion on stackexchange online again (minus images). The Copyright part of the notice only covered the images and stackexchange apparently didn't consider the text part of the posts a ToS violation.

I expanded my analysis, but you'll need to check the original material for evidence since the embedded images were subject to the notice.

http://crypto.stackexchange.com/q/3645/180

CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

Related Stories