Are blogs killing traditional journalism?

Doom and gloom for journalists. Recent weeks have seen a number of stories about the demise of local papers prompted by the rise of the Internet. Last Sunday The Observer had a similar piece that asked a leading question: Who would you rather trust - the BBC or a blogger? The answer was supposed to be obvious, but reading the comment section has been enlightening. Many of us are starting to answer "bloggers of course!"

The bulk of the argument by Nick Cohen is this:

"Why, then, mourn the passing of the hack? The best reason for wanting my colleagues to survive is that serious reporters and broadcasters offer a guarantee that what they say is true. If they stray, their editors impose journalistic standards and insist on objectivity. They may not have the best or fullest story or the most vivid account, but readers should be able to assume their work is reliable, while a blogger's commitment to objectivity can never be assumed."

I don't know what newspapers is Nick Cohen reading, but this bears little resemblance to the British press as it is now. In one corner you have the tabloids, whose relationship with truth and accuracy is akin to that of a vampire and garlic. On the other end you have ideologically-driven rags whose every page is dedicated to pushing specific ideologies (e.g. Daily Mail and immigration).

Bloggers wear their biases clearly, and there is no encouragement to dumb-down a topic. Blogs written by experts are much better places to find informed opinion than a piece written by someone with little grasp of what is being talked about.

I don't think blogs will kill journalism, but they will act as a much needed supplement. In some sense, we are all journalists now, aren't we?

5th COMMUNIA workshop

Last week I attended the 5th COMMUNIA workshop on Accessing, Using, Reusing Public Sector Content and Data. I was pleasantly surprised by the level of the presentations, the depth of the discussion, and the pragmatic approach to the topic of public sector information. I mean pleasantly surprised not because the previous workshops were irrelevant or lacked quality, but because one expects wide-ranging workshops like these to be uneven in quality. As you can surmise from my introduction, this workshop broke the trend, and quality and relevance were very even.

The highlights for me were:

• Tom Watson MP (Minister for Digital Engagement and Civil Service Issues). I must admit that I was sceptical about the inclusion of a politician in the programme, and was therefore expecting a contentless keynote. However, it became clear that Tom Watson MP really gets that when we talk about creativity nowadays, we are not only talking about the "creative industries".
  
• Simon Field (Chief Technology Officer, Office for National Statistics). This was one of my favourite presentations, not only because it contained slides from Edward Tufte, but because it made a very important point about not only hodling the right data, but the way you present it is of utter importance.
  
• Richard Owens (WIPO). Again, a meaty presentation from policymakers, showing that the "openness" agenda is gaining traction in some policy circles.
  
• Edward Betts (Open Library). Very interesting presentation about the open library project. I particularly liked some of the references to the potential copyright problems of ghost writing (as in actual deceased writers), or the copyright of reincarnated people.
  
• Hilary Roberts (Imperial War Museum on Flickr Commons). Hilary presented a clear example of how to distribute content from a museum colection online, and about the reasons behind the reluctance from memory institutions to adopt CC.

Kudos to the organisers, this was highly enjoyable workshop, despite the open source fashion show (trust me, you DO NOT want to know).

PRS not horsing around with copyright

(First ear muffs, next headphones?)

The British Performing Right Society (PRS) has been in the news recently thanks to its continuing struggle with Google. The PRS is also known for its forceful pursuit of performance fees from an unsuspecting public, such as suing companies whose workers listen to the radio where it can be heard by the public, or asking garage owners to tell their customers to turn off the radio as they drive in.

Now a stable owner in Wiltshire has been asked by the PRS that she must turn off her radio when employees are around, or pay a licence fee. The problem is that the purpose of the music is not for the employee's benefit (who do not like classic music and turn it off at any opportunity), it is for the benefit of the equine guests at the Malthouse Equestrian Centre.

I know that attacking the PRS is like flogging a dead horse, they are such an easy target that I will stop hoofing a laugh and happily ride away from any further equestrian puns. However, there are some interesting questions here. Shouldn't the law establish a minimum number of employees that would qualify a business for licence fee? If purpose and intent are of importance as to whether or not a fee should be paid, shouldn't there be an exception for equine listeners? Similarly, I am left wondering about how exactly does the PRS calculate how to collect its royalties. For example, we have to assume that they are collecting fees for composers and publishers that they do not represent. Who gets that money? Do they pocket the difference, or give it back to the licence fee payers? Is there a change in fee for works whose composer should be assumed to be in the public domain. I know that the sound recordings in most instances will still be under copyright even if the composer is long dead, but shouldn't there be reduced fee as the work performed only applies to publishers and not composers?

And what about the fairness of calculating exactly how much a licence should be worth? A woman who plays music to her reluctant employees and a handful of guest horses is surely not in the same category as a pub owner with hundreds of customers. The PRS makes this point in its fee guideline to customers:

"The rates in this section vary depending on the number of days in the year music is played in the workplace, canteens or staff rooms; the number of half-hour units per day music is played in the workplace, the number of employees in the workplace to whom the music is audible and the number of employees to whom the canteen/room is available."

Fair enough, but my question is whether there is a societal interest in having a blunt collective rights management system that seems intent in squeezing the last penny from the public. This is particularly relevant when one considers that collective rights societies have already extracted money from the radio station. Is this fair?

I will leave you with this thought. In Spain the burden of proof lies with the collecting society, which has given rise to a number of cases of cafes and bars playing only Creative Commons music. Shouldn't we have something similar in the UK? It would be interesting to have some test case in which a bar plays only CC-licensed music.

Blurring the real and virtual boundaries

Mathias Klang has posted about an interesting development in the increasing complex interaction between the real and the virtual worlds. Swedish game developer MindArk has been granted a banking licence by Swedish Financial Supervisory Authority. MindArk are known for developing and managing the remarkable Entropia Universe, which is the "first virtual universe with a real cash economy". Entropia is almost always mentioned when talking about virtual economies because its virtual currency has a high exchange rate with real currencies, and they also offer credit cards and other innovative financial mechanisms. The fact that they are now a recognised credit institution is a huge development for virtual worlds, as it makes it even more likely that there will be a viable commercial interface between the real and the virtual.

This comes at the same time as other developments are coming along in virtual worlds which I believe open some interesting interacting options between avatars and real life. For example, World of Warcraft is now advertising a service that allows users to "print" their avatar with a 3D printer, hence having a real world representation of their characters.

My mage gets ready to teleport into the real world.

The possibility of having more direct interaction with avatars outside of virtual worlds opens up interesting questions. What is to be done about intellectual property rights? Could anyone set an avatar 3D printing service without Blizzard's consent? What are the rights of the resulting statuettes? This does not even mention what could happen with an over-imposed world of augmented reality. I know some people are already starting to talk about the IP implications of 3D printing, so at least there is a discussion about these questions out there (LawClanger has been writing an article on this).

Do these developments mean that there will be orcs storming virtual banks, as predicted by Charles Stross?

Software patent workshop reminder

Computer Implemented Inventions Workshop

Wednesday 1 April 2009
Venue: Moot Court Room, Old College

This event is the idea of Professor Philip Leith, Queen's University Belfast, and it is organised as part of SCRIPT's Information Technology Law Foresight Fora. The objective of the event is to bring together a small number of practitioners and policymakers from Europe to discuss the current state of case law and practice with regards to computer implemented inventions (CII). There has been a split between UK and EPO case law, and it is hoped that this workshop will explore some of the issues that led to such state of affairs.

There are very few spaces available, if you would like to attend email Andrés Guadamuz at a.guadamuz@ed.ac.uk

	Programme
WEDNESDAY 1 APRIL 2009
9:30-10.00	Registration and Coffee
10:00 -10:05	Welcome Andrés Guadamuz, SCRIPT
10.05-10:10	Introduction to CII at the European Patent Office Joerg Machek, EPO
10:10-11:10	CII practice and case law in Europe Chris Gabriel and Alex Gardiner, EPO
11:10-11:40	CII practice - A European patent attorney's perspective Axel H Horns, Patentanwalt Axel H Horns
11:40-12:10	CII practice - A UK patent attorney's perspective David Pearce, Potter Clarkson
12-10-12:40	UK case law David Musker, R G C Jenkins
12:40-13:30	LUNCH
13:30-14:30	Round Table
14:30	COFFEE

Do androids dream of electric sheep?

They would, if they were in Wales.



Baaa!

SCRIPTed conference deadline

The hard-working organisers of the excellent and much awaited SCRIPTed conference have written to let me know that there are only a small number of places left, so get thee to the registration page ASAP! The programme is looking extremely good, but I am biased because I am chuffed at being in the last panel with Lilian Edwards and TJ McIntyre.

The keynote speakers are:

• Professor Bartha Maria Knoppers, University of Montreal, Montreal, Canada
  “Population Biobanks: International Collaboration and Access”
• Professor Jon Bing, University of Oslo, Oslo, Norway
  “The computerisation of legal decisions”
• Mr Antony Taubman, World Intellectual Property Organization, Geneva, Switzerland (new director of the WTO IP Division)
  “Centripetal and Centrifugal Trends in International Governance of IP”

I'm really looking forward to the event, so much so that I have almost finished my presentation, which is uncharacteristic of me.

There will also be a workshop on software patents / computer implemented inventions the day after the conference, so if you are interested email me to reserve a space.

UN-star Galactica

For the last weeks I have been glued to my torrents watching the final episodes of Battlestar Galactica (two episodes to go!). In case anyone objects to the downloading, I own the entire series on DVD, save for the unaired ones of course. To me there is no doubt that Galactica is the best drama out at the moment, in any genre. It deals with the big topics of our era: torture, evil, genocide, religion, power, war. If cultural relevance required a measure, it could be called the Galactica.

However, its relevance seems to have inspired the U.N. I was surprised to learn that yesterday there was a panel at the U.N. discussing the issues of "human rights, children and armed conflict, terrorism, human rights and reconciliation and dialogue among civilizations and faith" portrayed in the series. The Today programme even had a spot on it, although both the journalist and John Humphreys could not disguise their contempt.

Frakkin' well done.

Update: Galactica is not just for geeks.

UK public sector websites to contain user comments

One of the most useful features of the participatory web and the user-generated revolution is that it allows interaction from consumers (gosh, how do I hate it when I start using journalistic commonplace terms such as revolution, debacle or meltdown). Now the British government is about to jump in the bandwagon, as Gordon Brown announced last week that government websites will allow users to make comments and recommendations. The Prime Minister said that:

"For I believe government has been much too slow to make use of the enormous democratising power of information. People take it for granted that they will access other people’s reviews and ratings before buying something on e-bay or Amazon, and yet we do not yet have systematic access to other people’s experiences when choosing a GP practice or nursery. We have clearly got the balance wrong when online businesses have higher standards of transparency than the public services we pay for and support."

I for one find this to be very good news, it's almost as if the PM has finally realised that we are in the 21st century, and that there are other ways of garnering the public's interest. Wouldn't it be great if you were able to find out if your GP is any good?

Nevertheless, David Mitchell has written an excellent article on yesterday's Observer where he warns about implementing this policy (David Mitchell is UK's version of PC in the Mac ads). He rightly points out that comment sections across the web are often filled with vitriolic and unjustifiably angry posts that have no other objective than denigrate and mock the writer. Do we really want hundreds of comment pages around the country that consist of nothing more than baseless and angry rants about public service staff? This is a good point, as everyone who has spent any time in blogs and internet forums will attest to.

The solution? A new internet meme is born! Mitchell suggest that people should go to any website with a comment function, and should simply write "It just goes to show you can't be too careful!" This bland one-liner should act as a form of soothing counterpart to all the bilious animosity prevalent online.

So you know, it just goes to show you can't be too careful!

New report on the state of global Cyber-censorship released

Yesterday was World Day Against Cyber-censorship [insert snarky comment about the abundance of "Days against X" here]. To celebrate (is "celebrate" the right word?), Reporters Without Borders has released a report on the state of internet control and surveillance. The report labels 12 countries as "enemies of the internet", claiming that they have turned their access to the network into an intranet, allowing them to completely monitor what gets through. The Dirty Dozen of censorship are Burma, China, Cuba, Egypt, Iran, North Korea, Saudi Arabia, Syria, Tunisia, Turkmenistan, Uzbekistan and Vietnam. Other countries mentioned in the document as places which exert excessive control are Australia, Bahrain, Belarus, Eritrea, Malaysia, South Korea, Sri Lanka, Thailand, United Arab Emirates, Yemen, and Zimbabwe.

The report does make an interesting point about the effectiveness of cyber-censorship:

"But is blocking of news online still effective? Through experience and thanks to their technical knowledge, Internet users have learned to get round some censorship installed on the Web by their governments. In countries where access to news is prized, it is not unusual to find software to defeat online censorship installed on computers in cybercafés, and also managers willing to put them to use if need be. Internet experts belonging to some of the most recognised institutions constantly create and fine-tune software versions so as to adapt them to the reality of the virtual world and to ensure that news is accessible to all."

While the document mentions some private companies, I was surprised not to find mention of some of the new censorship threats in countries like the UK, such as Cleanfeed. Nevertheless, this is a sobering and welcome reminder of just how restrictive the web can be.

YouTube starts blocking music videos in the UK

This news item has been covered everywhere, but it is worth highlighting. YouTube has decided to blackout all of its official music videos as of yesterday in the UK due to a negotiating failure with the British Performing Right Society (PRS), the collecting agency for British writers and composers. YouTube claims:

"Our previous licence from PRS for Music has expired, and we've been unable so far to come to an agreement to renew it on terms that are economically sustainable for us. There are two obstacles in these negotiations: prohibitive licensing fees and lack of transparency. We value the creativity of musicians and songwriters and have worked hard with rights-holders to generate significant online revenue for them and to respect copyright. But PRS is now asking us to pay many, many times more for our licence than before. The costs are simply prohibitive for us - under PRS's proposed terms we would lose significant amounts of money with every playback. In addition, PRS is unwilling to tell us what songs are included in the license they can provide so that we can identify those works on YouTube -- that's like asking a consumer to buy an unmarked CD without knowing what musicians are on it."

PRS on the other hand are "shocked and disappointed". ORLY?

So, who is in the right here? There can be no doubt that YouTube have taken this step as a negotiating strategy, and it does seem a bit disproportionate. However, it is the logical strategy given the over-reaching demandsthe from PRS. Seemingly, PRS is suffering from chronic short-sightedness that would rather lose the vast promotional value of YouTube to its associates in exchange for a squeezing a few more pence from the service providers. Demographics do not lie, and YouTube has become one of the best places to promote new musical talent to younger audiences, as well as cementing interest in established brands. I find it astounding that PRS does not see the new technologies as allies instead of cash cows that must be milked for all they are worth.

Who wins? Believe it or not, independent labels win. As of today, typing "music video" on YouTube will return several independent videos not affected by the blackout, including one of my new favourite songs, Oren Lavie's amazing "Her Morning Elegance". Here is an anecdote for the bright sparks at PRS: I first saw this video on YouTube after it went viral, and now I have the CD playing on my computer as I write.

I have little doubt that PRS will have to cave in on this one, as I cannot imagine PRS members being happy about being shut out of one of the largest promotional outlets they have at the moment. If they do not relinquish their demands, other valuable services are set to follow YouTube's lead, such as MySpace.

Why seeding is good for you

xkcd's take on the PirateBay trial.

So kids, fire up your torrent clients and start seeding.

Open source, file systems and patents

Do you ever wonder how things work? Here at TechnoLlama we spend an obscene amount of time wondering precisely how applications and gadgets work. How does a media server allow me to watch downloaded TV shows in my PS3? How are long files negotiated between a Mac and a PC? Which file protocols are required to make Linux and Windows systems talk to one another? The answer to some of these essential yet often neglected questions is one of standards. If every device in the world operated its own file system, then things would not be able to communicate with one another. Mac, Linux and PC formats would each exist in their own little worlds and the technology world would be a little bit more difficult than what it is. Thankfully, file systems can talk to one another, allowing us to execute files across platforms, so the ext* system in Linux can access information in Windows FAT drive.

This seems straightforward enough, but the issue is that some file systems are protected by patents, specifically, Windows File Allocation Table (for example, this 1989 U.S. patent). Traditionally, interaction with devices has been permitted through cross-licensing agreements between the major file system providers, which has allowed some of these patents to go unchallenged. This has been for everyone's benefit, as a world where different file systems could not talk to one another would be problematic to say the least. However, the delicate balance has finally been broken as Microsoft has sued car-navigation maker TomTom for infringement of their file system patents.

Some background information is required. Gadgets and electronic devices that have some form of graphical user interface require an operating system to run on. Media players, digital cameras, mobile phones, GPS systems, PDAs, all of them have built-in and often bespoke operating systems. The Linux kernel is very popular with gadget manufacturers because it offers a stable, scalable, modifiable and cheap option for manufacturers. In order for these devices to talk to Windows, they have to implement some form of compatibility with Microsoft's FAT, which would require a licence. These are commonly handled in the industry through cross-licensing, Microsoft allows the manufacturer to use FAT if they in turn licence them with some of their own claims. Cross-licensing is widely practised, and allows the industry to operate without having to go to the courts at the drop of a hat. However, the Linux kernel is licensed through the GPL v2, which imposes an obligation on developers using modified code to allow the user to "copy, distribute or modify the Program subject to these terms and conditions." Furthermore, the GPL makes it clear that even if a developer is subject to patent infringement restrictions through litigation or an agreement, then they must stop distribution of the modified code. Section 7 reads:

"If, as a consequence of a court judgement or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program."

This is clear as day. If anyone develops a program using the Linux kernel code and embeds it to a gadget, then they must make that code available without restrictions. What has come to light is that Microsoft has entered into secret cross-licensing agreements with various manufacturers who use the Linux kernel that amount to breach of the condition set in section 7 of the GPL. TomTom refused to sign such an agreement, so they got sued.

This could very well be the opening shot in the much awaited software patent war between Microsoft and FOSS developers. If the allegations are true, then the Free Software Foundation may not have any other option but to start suing people for breach of the GPL. The question is, who will be sued first?

*opens popcorn and sits watching avidly the ensuing Armageddon*

Book Review: Rainbows End

Before being attacked by the Lynne Trusses of the world, the title of Vernor Vinge's Rainbows End is not missing an apostrophe. The book is named after a retirement community which was chosen by either "an everyday illiterate or someone who really understood the place.” Vinge is part of a wave of technologically sophisticated authors depicting the post-internet world, this cadre includes Charles Stross, William Gibson and Cory Doctorow, yet I am reluctant to call this movement cyberpunk. Post-cyberpunk maybe?

The book is very technical in nature, and includes dialogue on instant messaging (thankfully not on chatspeak); it also introduces several new acronyms for neuroscience technologies that we may have in the future: JITT (Just In Time Training), and YGBM (You Gotta Believe Me). It is possible that all of this SMing and techno-speak may put-off some people, but they do work in the context of the hyper-connected world described by Vinge. While the text conversations get clunky at times, the story makes up for it, and the characters jump out of the page, particularly the main character, erstwhile poet and recovered Alzhaimer sufferer Robert Gu.

The world of Rainbows End is what makes the novel memorable, and I beleive that it showcases three new technologies that make it an excellent read for cyberlaw classes. In this world, medicine has not only managed to expand lifespans considerably, it has begun reversing the process of ageing, particularly neurological debilitating diseases such as Alzheimers. Vinge's real triumph is to describe what would a world inhabited by rejuvenated elderly would look like, particularly because medicine cannot cure everything. So there are people like Robert Gu who have made astounding recoveries, while there are other lucid yet infirm elderly on wheelchairs. This world is also one where wireless broadband is ubiquitous, but the internet looks nothing like ours. Computers are wearable and include contact lenses that over-impose an information layer to reality, so the future web is a vast world of augmented reality where people can wear avatars in everyday life, but also where everything and everyone is tagged with information. The third technological feature of this world is that it is a strictly controlled hardware environment, where every piece of gear has embedded protection that connects with both Homeland Security and with certificate authorities. This allows a level of control that we cannot dream of, but it is also a rather vulnerable world.

There are some really interesting considerations of this post-geriatric world. Leaving aside the bioethics of the technologies described, I found the social implications staggering. We already live in an era sharply divided along generational lines. The wired generations live in a different world than that of the analog ones. While the number of older people adopting some of the technologies is growing (my mother has joined Facebook and frequents internet forums), there is still a large disconnect with the possibilities presented by the user-generated world, so there are entire generations left behind. This is not really explored in social research in cyberspace, but Vinge presents us with an important question. What if lifespans keep getting longer, and older generations have the mental learning capabilities that they had when they were younger? The answer is both shocking and elegant. Send them to school! In Rainbows End, schools are filled with the very young and the very old, both learning how to use and navigate the datastreams. This makes a lot of sense, but it also presents some challenges for a society where the old and the new clash in such manner. There is an endearing connection between teenagers and the old geezers that I found both believable and desirable. Technology could bring back respect for one's elders. What a liberating idea!

Rainbows End is also the ultimate user-generated world. Users can modify themselves, but also their environment. There is one fan-generated layer covering the entire world which has mapped Pratchett's Discworld into our own, so if you were in China you would be in the Agatean Empire, if you were in London you would see Ankh-Morpork, and presumably if you were in Australia you would see XXX. In fact, the world is filled with these "belief circles" where fans choose which reality to inhabit, and sometimes they clash and fight for recognition and space.

Finally, Rainbows End depicts a tightly controlled network environment, where every piece of hardware must have a valid certificate issued by an authorised certificate authority. This is simply the endgame of Trusted Computing, and the embedding of technological protection measures not only into media, but into every single piece of equipment that has a chip inside. While in theory, this allows a level of surveillance unmatched even by our CCTV crazy environment, it can also be circumvented. Vinge's genius is that he recognises that even if those pushing for secure hardware environments get their wishes fulfilled, hackers would still be able to circumvent the technologies by using illegal gear. But also, Vinge describes the dangers of such a world, which would be vulnerable to cascading failures if someone was able to attack a single ceritficate authority and void a whole lot of permissions.

To conclude, Rainbows End is a wonderful look at the near future, but one that leaves some questions for us to decide. I like his view of the post-geriatric world, and I think that augmented reality will soon be here. The book is filled little gems and witticisms that make it highly enjoyable and readable if you get past the texting.

And yes, rainbows do end.

Amazon to restrict read-aloud functions

The Guardian has an excellent post on the Amazon Kindle controversy. The Author's Guild threatened legal action against Amazon because the Kindle's read-aloud function "is not paying anyone for audio rights". Neither does my sister when she reads books to my nephews, but I digress.

What a sad state of affairs, some authors seem intent on stifling a new technology simply because they are not squeezing out the last penny from users.

It's GikII time

GikII returns! Wait, we've tried that one before. GikII Strikes Back! Nah, George Lucas does not deserve it. Thy Geek Will Be Done! Better...

After three successful runs dealing with the legal implications of Harry Potter, tattoos, knitted Daleks, Buffy avatars (or was it Angel's avatar?), robots behaving badly, and MMOGs; GikII is back bigger and better. This year we are splitting in two camps, SoGikII in Sydney, and GikII 4 in Amsterdam.

So reserve the following dates in your calendar:

SoGikII
9 June, 2009
Sydney, Australia

GikII 4
17-18 September 2009
IViR, University of Amsterdam

Eircom to filter out pirate sites

Ireland has been suffering a bit of a copyright nightmare recently. Firstly, Eircom was sued by the music industry, and settled out of court conceding that it would implement some form of "three-strikes-and-you're-out" policy. As Sheldon from BBT would say "It is a sports analogy. Baseball to be precise".

Now it seems like Eircom will further bow down to the demands of an angry music industry by filtering out "pirate sites". This is such a far-reaching, disproportionate and blunt response that I am quite literally lost for words. It seems like the response from a panicked music industry is to revert Western ISPs to a type of totalitarian filtering state where only approved content can get through. Whatever happened to our dream of a free Internet?

What worries me the most is that strategies like these one tend to replicate across the globe. First it was New Zealand with its "guilt by accusation" legislation. Then it was Ireland thanks to a spineless Eircom. I am not a fan of slippery slope arguments, but it would not be an exaggeration to fear that something similar could happen in other countries. I am particularly concerned about potential official action following the Digital Britain report.

Here is an idea for a new business. Go somewhere sunny and set up a remote VPN company. What? Someone already wrote a book about such a thing? Drat!

The DRM war was won, but...

Some people didn't get the memo.


Curiously though, I think I know who the person in the cartoon is!

Dissecting a virtual world phishing attack

An interesting development in the latest cybercrime trends has been a marked increase in attacks against online games and virtual worlds, as I have posted previously. One element that I have missed in the discussion about game hacking has been the methods with which cyber-criminals obtain login details and passwords in order to empty the virtual coffers of gamers around the world. I had generally assumed that hackers obtained passwords through a combination of means, including keylogger software, social hacking, guesswork and bad security on the part of the user. I was not aware of large-scale phishing attacks, so when I received my first WoW phishing message, I was both taken aback by its realism, and also in awe of how many people must be falling for this.

First some background. Last year I opened a US World of Warcraft account for occasionally playing when I am back in Costa Rica. I generally do not use this account, so it would be ripe for hijacking. Yesterday I received this message from what looked like a legitimate Blizzard account. I will reproduce it in its entirety only removing the actual link for obvious reasons:

------------------

Subject: Blizzard Account Administration
From: Blizzard [donotreply@blizzard.com]
Reply-To: Blizzard [donotreply@blizzard.com]

Greetings,

An investigation of your World of Warcraft account has found strong evidence that the account in question is being sold or traded. As you may not be aware of, this conflicts with Blizzards EULA under section 4 Paragraph B which can be found here:
WoW -> Legal -> End User License Agreement

And Section 8 of the Terms of Use found here:
WoW -> Legal -> Terms of Use

The investigation will be continued by Blizzard administration to determine the action to be taken against your account. If your account is found violating the EULA and Terms of Use, your account can, and will be suspended/closed/or terminated. In order to keep this from occurring, you should immediately verify that you are the original owner of the account.

To verify your identity please visit the following webpage:
[HTTPS link removed]

Only Account Administration will be able to assist with account retrieval issues. Thank you for your time and attention to this matter, and your continued interest in World of Warcraft.

Sincerely,
Account Administration
Blizzard Entertainment

------------

This was a short and concise message that actually seems plausible, as it arrived to the email account with which my US WoW account is registered. It reads well, with no suspiciously dodgy English or ludicrous made-up names; it also points to the relevant legal documents and articles. Thankfully, I immediately checked the links, and rightly enough, the most important one did not direct to Blizzard, it led to ripside.com, which is a small website hosting service. I visited using Google Chrome (which is new enough not to have developed exploits), and this is what I found:

Which looks exactly like the Blizzard's own account management screen found here. Once I entered some meaningless login and password, I got a large page asking for all sorts of details, including name, address, email, and interestingly, the following:

In short, this is all that is needed for anyone to hijack an account, take all the money and items with them, and run. Every guild has stories of members who have been compromised, and from time to time one can hear the desperate cry of a poor sod in Trade chat who shouts "I'VE BEEN HACKED!"

It is important to stress that Blizzard seems to be taking this very seriously, so they have initiated a campaign to make sure users are aware of the security risks involving their account. There is also a procedure in place in order to reinstate money and items to the victims. However, what is not mentioned anywhere is that these actions constitute a crime, and I am concerned that this is precisely the reason why there is such an increase in hacking activities against gamers. As I have mentioned before, there seems to be some reluctance from crime enforcement agencies to respond to cybercrime in general, and game account hacking would seem to be even at the lowest end of priorities. So, a geek had his magic sword stolen? Who cares?

If hackers have moved towards sophisticated phishing attacks, then we are talking about an entirely new level of engagement. Banking phishing sites are usually taken down within hours of the attack through action from anti-phishing organisations. However, the offending site in this specific attack is still up and running 24 hours after the message was received. This seems to indicate that cyber-criminals are catching up to efforts to curb their scams, and are moving to easier pickings in the shape of virtual worlds. The fact is that virtual goods are worth real money, so the temptation for criminals to make some quick earnings through hacking must be the drive behind the growing number of hijacks. While a criminal will certainly get more money from hacking a bank account, it seems that they realise that hacking a virtual world account is less likely to result in prosecution.

The last element in the line of attacks is that according to the email headers, this message came from New Zealand and what appears to be a compromised Hotmail account. Hotmail seems to be a favourite of phishers and spammers, with Youtube videos explaining how to create fake Hotmail accounts.

Much as with bank phishing, there seems to be a toxic triangle that allows some of this to happen. Firstly, email services like Hotmail seem to make it easy for hackers to exploit the system to send fake emails. Secondly, law enforcement and anti-phishing authorities seem unaware and/or uninterested about the phenomenon. Thirdly, users are still falling for many of these attacks due to lack of care and lack of education.

I'm now off to install some anti-keylogger software. I don't want to lose my enchanted knives.

5th COMMUNIA Workshop, London

(via Jonathan Gray)

5th COMMUNIA Workshop: Accessing, Using and Reusing Public Sector Content and Data

when: 26-27th March 2009
where: New Academic Building, London School of Economics, London UK

Across the world there is a growing recognition of the social and commercial value of public sector content and data: be that the text of laws, the holdings of public museums, or the geospatial and environmental information collected by government agencies. Moreover, it is likely that better access to and use of such information is
central to improving governance and increasing democratic participation.

The 5th COMMUNIA workshop, co-organised by the Open Knowledge Foundation and London School of Economics, will focus on how we can unlock the huge potential of public sector material. It was also examine the current obstacles to doing this -- legal, technological and social -- as well as how they can be overcome. In particular, much
of the value of public sector material can only be realized if it is reused and interlinked -- both activities that are currently difficult for a variety of legal and technological reasons.

The workshop will bring together researchers, policy-makers, stakeholders and representatives from across Europe for presentations and discussions about projects, policies and practices aimed at disseminating, connecting and building upon public sector material.

There will be four main sessions focusing on:

* Social and economic value of public sector material
* Getting the rights right: law and policy
* Getting the right tools for the job: technology and communities
* Exemplars and Obstacles: case studies

Attendance is free, but advance registration is required:
http://communia.eventbrite.com/

The agenda is at:
http://communia-project.eu/ws05