Computer Ethics, Summer 2011

LT 412;  6:00-9:00 TTh, June 28, Class 11

Read Baase, chapter 5 (on hacking, computer crime, and jurisdiction)

Today's latest:



i4i v Microsoft

Microsoft employee Martin Sawicki wrote, of i4i's structured-xml approach,
    Word 11 will make it obsolete

More in the notes from the previous class.


Here's a theory that might have settled the case in Microsoft's favor:

    embedded codes are prior art.

Why didn't this work? Over and over again the patent describes the invention as an improvement over embedded codes.

Here's one paragraph from the patent that might apply here:

The present invention has a number of benefits over documents combining content with embedded codes. Most of the benefits flow from the fact that the invention recognizes the separateness of content and structure. Document structure is dependent on a number of factors; such as how the document will be used, its intended audience, required formats for special uses, and the like. Content is generally less variable.

The version of Word at stake certainly did recognize "the separateness of content and structure". Is this what the patent comes down to? While the second sentence here might suggest that any separation of content and structure is covered by the patent, the first sentence suggests again that anything you can do with embedded codes is prior art.



Microsoft appealed the case to the Federal Circuit, and then to the Supreme Court. But you cannot appeal a finding of fact as to claims interpretation. The issue MS brought to the Supreme Court was the fairness of the presumption that patents were valid, which thus required "clear and convincing evidence" to overturn a patent. The Supreme Court upheld this standard, though they did agree that in the case of prior art that had not been previously considered by the patent office then a weaker "preponderance of evidence" standard could apply. But that didn't help Microsoft.

Discussion:



State Street Bank case, and Business-Method patents

Patent 5193056

decided 1998; patent filed 1993
Basic outcome: financial-services software containing an algorithm is patentable. From the 1998 Federal Circuit decision:

(...) the transformation of data, representing discrete dollar amounts, by a machine through a series of mathematical calculations into a final share price, constitutes a practical application of a mathematical algorithm, formula, or calculation, because it produces 'a useful, concrete and tangible result' -- a final share price momentarily fixed for recording and reporting purposes and even accepted and relied upon by regulatory authorities and in subsequent trades.

Until then, while software might be patentable, business methods that contained software or algorithms could not be patented (to be more precise, this "business-methods exception" to patentability was an oft-stated maxim, but the courts had never ruled directly on it). State Street allowed the patenting of business software. State Street Bank had been granted a patent, and the case came as SSB apparently sued another bank which then tried to use the business-methods exception as a defense.

The State Street Bank case introduced the rule that a business method could be patented if it involved computers and "it produces a useful, concrete, and tangible result".

Once the USPTO began patenting software as part of a business process, it became too difficult to distinguish between sofware-as-algorithmic-invention and software-as-business-method. So the USPTO also reversed its longstanding refusal to grant patents purely for software (until then, software patents had to list some hardware involvement, although that was mostly a formality in practice).

This case opened the door to a huge influx of business-method patents, including Amazon's "one-click" method (below). For a while, the USPTO required business-method patents to involve computers (specifically, to have some connection to "the technological arts"), but even that was eventually thrown out in 2005 as too hard to enforce. However, there remains a great deal of overlap between business-method patents and software patents.

Exhibit A: Amazon "one-click" patent, # 5960411, granted 1999. Twenty-three days later, Amazon got an injunction against Barnes & Noble, and eventually won their case. BN had to stop using their "ExpressLane" shopping method.

The essential feature of the 1-click patent appears to be that you don't have to go through the usual multi-screen checkout process; you can just click "send me this stuff the usual way", and it will remember all your previous entries.

Paul Barton-Davis, one of Amazon's founding programmers, called the 1-Click patent "a cynical and ungrateful use of an extremely obvious technology" [emphasis added]. By "ungrateful", Barton-Davis apparently meant that Amazon had benefitted enormously from public-domain software ideas.

Other examples:
Several more-mundane patents on online shopping carts

IBM[?]'s patent on suggesting new purchases based on past ones

See the Bilski case (later) for more updates.




Patent ruling in Apple "Cover Flow" feature.
album cover-flow image

Graph of phone-patent lawsuits

Google and Microsoft sue GeoTag
GeoTag appears to be a classic troll. But the article mentions Skyhook, and suggests it is not a troll. Does this matter? What about i4i?

Here's the GeoTag patent: 5,930,474

This patent is definitely an example of an idea, the implementation of which is obvious, given the availability of GPS. Should such things be patentable?


Stallman article: why software is different


1. There's no advance warning (but isn't this true of any patent?)

2. There is no easy way to read them. They are deliberately obscure. And, for software, this is directly tied to the fact that the algorithms are very general.

3. Some patents are just plain inappropriate, but fighting them is exhorbitant.

4. chicken-and-egg problem with converting from .gif to .png: how can you get browsers to support this? (This is partially resolved by browser plug-ins.)

5. "prior art" is very hit-or-miss; sometimes (often!) it was considered too obvious to document. More specifically, ideas ruled by the PTO to be patentable were often "CS folklore" but too obvious to publish.

6. Software tends to use many ideas per application, and so one software project might require licensing of many diffferent pieces. This makes incremental innovation difficult, for anyone. (Even microsoft.) This problem exists for software because writing software is in some sense much easier than traditional engineering, and so you can afford to put more ideas in.

7. Software licensing terms tend not to take into account the fact that projects use many ideas, and a given patented piece should be only a small part of the total.

8. Open source.

9. Patented standards are a large social cost.

10. It is not possible to search the patent database before the patent is granted

11. Tremendous software progress is often made with negligible investment; we don't need patents to encourage development.

12. Computing has a high rate of radical, as opposed to incremental, change.

An issue that Stallman doesn't address directly is that 20 years is a very long time in the software industry, and that locking an idea up for that long has the practical effect of stifling growth, not encouraging it. Software patents have had the effect of postponing adoption until patent expires (cf James Gosling's first language) (hint: his second language was Java).

A related issue is that weak patents can have HUGE social costs, by blocking core technologies that everyone needs.

And basic ideas are still being patented for a new use (eg the Steir hair patent)

Finally, another issue is the obvious-in-context problem I mentioned above, that does seem to be a special issue with software: often an idea is an immediate, trivial corollary of some later development, or of some more abstract way of looking at the situation. However, some earlier out-of-context patent may still apply. The XOR-cursor and Eolas patents may be of this type. It's not that embedded applets is an innovative idea, per se, it just takes a critical mass of web sites to become relevant.

Is software legitimately a special case?




Paul Graham

This would be a good time to take a quick look at the Paul Graham paper. Graham is both a venture capitalist and a software engineer (and a Lisp programmer!). One of his first points is the following:

One thing I do feel pretty certain of is that if you're against software patents, you're against patents in general. Gradually our machines consist more and more of software. Things that used to be done with levers and cams and gears are now done with loops and trees and closures. There's nothing special about physical embodiments of control systems that should make them patentable, and the software equivalent not.

Here are a few more, based largely on his experience as a venture capitalist. Patents, he feels, don't matter much to software startups, unlike physical-machine startups.
Graham has three reasons why patents don't matter:
  1. Software is complicated; the real issue isn't the software but developing -- and designing -- it. However, this argument also works the other way; if you have an idea, then you are better off pursuing patent enforcement than development, because development is hard. But also note Graham's point that if a big company tries to copy a little company's patents, there will be a "thousand little things the big company will get wrong".
  2. Startups seldom compete head-to-head with big companies; they "change the paradigm". You don't go into the word-processing business; you invent Writely (now part of Google Apps?). And, "big companies are extremely good at denial". They will go to great lengths to pretend that you don't exist, to "keep you in their blind spot". Suing a startup would mean you realized they were dangerous. He cites IBM as an example; it would have been demeaning for them to sue microcomputer developers. Also, for Microsoft to sue web-app developers (or smartphone developers) would be to admit that Windows is fading.
  3. Hacker opinion is against big patent lawsuits. If you're a big high-tech company, you'll lose a lot of your best people if you're seen "doing evil". This might be true for Google; it's less clear at Microsoft (though the employees there do care about principles). It's probably not true at Eolas.
What do you think of these? How does the Eolas case fit in?

The argument is sometimes made that patents have real value for startups, so that they can cross-license if accused of violating other patents. Is this a legitimate argument in favor of patents?


And here's a student project from Stanford, dated 2000:
http://cse.stanford.edu/class/cs201/projects-99-00/software-patents
The authors are Carr, Gray, Watkins and Yang, and the patents they consider in depth are



MP3 patents and lawsuits

The MP3 idea was not obvious, and remains fairly complex. Alcatel-Lucent v Microsoft: Alcatel-Lucent won $1.5 billion in an infringement suit about mp3 decoders Feb 22, 2007

MS countersued for other patents

The judge eventually set aside the damages, and the appellate court agreed.


Aug 6, 2007: MS won new trial

MS is now suing A-L for other patents.

check out mp3licensing.com (Thompson) Royalty Rates: basic mp3 decoder: $0.75/unit

mp3 was published in 1991. Will all US mp3 patents expire in 2011? Original holder: Thompson Consumer Electronics & Fraunhofer Institute. These still hold the "core" mp3 patents.

MP3 Patent claimants:

To date, (some) patent holders have announced that no action will be taken against open-source decoders.

The mp3 compression algorithm is admittedly a deep idea. Part of it involves the use of wave decomposition to store the information more efficiently; part of it involves "psychoacoustics" to identify parts of a sound file that are "unhearable" and so can be deleted.



Note that patents are for the use of an idea in a specific context:

Patent problems:

submarine patents: you don't hear about them until too late!

prior art: hard to find, hard to document, trivial ideas were never written down!
This problem, at least, will go away with the passage of time.

non-obviousness: difficult to contest many ideas go into one program! Technology evolves extremely rapidly Violates settled expectations (important part of law!) What's patented seems to be more a matter of chance than anything else.

ignorance is no defense: "submarine" patents entire process is secret: you can be making good-faith effort to be noninfringing and get hit with a huge verdict.

wilful: you had advance notice of infringing. Your belief that the patent was invalid may NOT be a defense, although it has been accepted as a defense in some cases. Damages automatically triple.


Europe

EU Parliament voted in July 2005  648-14 AGAINST the EPO (European Patent Office) directive.

March 17, 2009: European Patent Office has asked the EU's "Enlarged Board of Appeal" to decide on the exclusion of software from patentability. The EPO has long been pushing for software patentability, and this is seen by some as an attempt to bypass the European Parliament.
See http://lwn.net/Articles/324022
Also http://press.ffii.org/Press_releases/EPO_seeks_to_validate_software_patents_without_the_European_Parliament.
Also http://www.ffii.org/EPOReferral. Note especially Q3, under Questions. Under some earlier rulings (T163/85 and T190/94), patentability required "a technical effect on a physical entity in the real world". However, other rules did not include this requirement.

European patent law is similar to the Diamond v Diehr standard: machines that use software are patentable, but not software that stands alone. However, in the US the Diehr standard evolved into software patentability; in Europe software remains unpatentable as such.

Here's an article from FFII.org entitled, "Why are Software Patents so Trivial?", in which they suggest that this is a fundamental problem: http://eupat.ffii.org/analysis/frili.


Who are the stakeholders in software patents? Are we stakeholders? Compare pharmaceuticals. http://www.pbs.org/cringely/pulpit/2005/pulpit_20050818_000863.html: "Do you feel helped by patent reform?"

If the Eolas patent had succeeded earlier in the game, Firefox might never have been started, and then Internet Explorer would still likely lack tabs, plug-ins, and other core features.

WHY does the situation seem so different from pharmaceuticals?


Role of "patent trolls", or patent licensing firms
("troll" as in "the troll under the bridge, demanding tolls", not "trolling" as in fishing for "flames")

Note that the established-company-versus-established-company defense of a "patent bank" is useless here.


Patents and standards-setting

Company A participates in creation of a standard; they suggest solution S for a particular issue. After the standard is widely adopted, company A announces that they have patented S, and that they will license it for a significant fee.

N-Data patent on ethernet speed autonegotiation:

http://arstechnica.com/news.ars/post/20080123-ftc-defends-ethernet-forces-patent-troll-back-under-bridge.html



Barriers to entry

Patent Trolls: companies that have no assets but patent claims, and don't attempt to produce anything but simply collect. Is this bad? Or are such companies just creating a market for small inventors to sell their inventions?

I4i is not such a company; they did produce an XML-based product.



Patent and open source

The open-source community is a strong proponent of eliminating software patents.

Is the open-source community entitled to:

Is the open-source community entitled to the asterisk phone switch?

Does MS intend to destroy or hobble or marginalize linux through patents?

It is very well documented that the patent process can have a very NEGATIVE impact on open-source development, and on generally accepted software adoption.

So if the purpose of software patents is to aid technological process, and it doesn't do that, are software patents a good idea?

What happens if the software in question is made available through a site in Europe, which (as of now) doesn't have strong software-patent laws? Should the site warn visitors from the US?

Is this at all like thepiratebay.org?



Patents: are the right ideas being patented? Or are patents being granted to trolls for peripheral ideas?
xor:   trolls?
rsa:   good
spreadsheets:   trolls?
eolas:   trolls?






NTP v RIM (Research In Motion): maker of Blackberry

Summer 2011: we covered this case only briefly.

See http://www.spectrum.ieee.org/mar06/3087

Thomas Campana filed his first patent in 1991, for an email system with wireless links. The system has been called a merger of email and wireless pagers, which existed at that time. It remains very unclear just what claim is patented.

Note that in 1991 email was still in its infancy.

Was this really a "business method" patent?? The software case is quite weak, unless the claim is for the business idea of email to wireless devices. There has been some discussion in the media about how the patent covers the way forwarding is handled, and where messages are stored, but I see NO evidence of that in the actual patent application. (This may actually have been disinformation from RIM, as they proposed a different forwarding system as a "workaround", part of a negotiating tactic.)

See http://www.spectrum.ieee.org/mar06/3087.

Campana founded his company NTP to enforce his patents. A lawsuit was brought in 2000, after RIM (and others) wouldn't agree to a license.

Campana died in October 2004.

RIM settled for $612 million in Mar 2006 , after an original verdict of $33 million (part of the final settlement is that there are no ongoing royalty payments, so this isn't as egregious as it might seem. Still, the settlement amount just seemed to balloon.)

The patent had been challenged with the USPTO. The PTO retracted one or two of the patents in Feb 2006, but the presiding judge in the case (Judge Spencer) refused to stay the case pending further USPTO findings. [Proceedings are still pending within the USPTO regarding other Campana patents.] I am trying to find out the USPTO final decision here. Here is a RIM update on the patent-office reexamination; I do not think it is final and it is also a press release.

Just a day after a judge in the NTP-RIM patent fight said that he would not wait for the US Patent Office to complete a review of NTP's patents, that same Patent Office announced a "non-final" ruling on one of the NTP patents, suggesting that the original patent might not be valid. -- techdirt.com

How could the court and the USPTO be so far apart on this?

NTP owned nothing but patents, but Thomas Campana -- co-founder -- did "invent" the technology. So NTP is not a classic "patent troll".

The case was before Judge James Spencer of the US District Court for Eastern Virginia, known as the home of the "rocket docket": part of the court's culture was strict adherence to timetables. RIM engaged the mega-lawfirm of Jones,Day, which irritated Judge Spencer regularly (probably with delay tactics). This was a classic Bad Idea. However, it also appears that Judge Spencer had little if any awareness of the central debates regarding software and business-method patents.

Case: NTP, Inc. v. Research In Motion, Ltd., No. 3:01CV767, 2003 WL 23100881 (E.D. Va. Aug. 5, 2003)

During the trial, RIM put on a demo of some supposedly pre-Campana text-messaging software, BUT a major part of it was post-Campana's-patent. Another bad idea. However, there actually was pre-Campana text-messaging software! It is even cited in the '592 patent.

RIM failed to prove the patent invalid in court. Supposedly, in court the burden would be on NTP to prove the patent valid, while during a USPTO reexamination the burden of proof is supposedly on the challengers. So the burden-of-proof issue should have worked in RIM's favor.It did not.

Original verdict: $33 million. RIM could have been liable for triple damages if infringement was found to be "willful". However, Judge Spencer compromised here on 42%, raising the award to $47 million.

RIM appealed Judge Spencer's decision to the appellate circuit court.


The core problem with RIM: they did implement a system very much like Campana's idea. The only new idea is essentially that effort is made to make the blackberry completely transparent to your laptop's normal email software (ie blackberry email is eventually forwarded, through the blackberry, into your laptop, but is also viewable (and can be responded to) on the blackberry itself.

The core problem with NTP's wireless email patents: the only new element is the use of RF links in an email network. (Store-and-forward idea is acknowledged as prior art). BUT:

Prior art clearly includes the following:
    1. Use of RF for IP links
    2. Email based on ANY set of IP links
    3. Use of RF to send short text messages to pagers

There is room for innovation in terms of identifying the nearest wireless hub, but that does not appear to be part of the patent. The patent does include lots of detail about switches and gateways, all of which appears to be standard according to RFC 821.

One central idea of the NTP patent: if a wireless unit is out of range, messages are stored at Network Operations Center (NOC). However, this idea is a fundamental part of the original SMTP rfc 821 (August 1982). Specifically, rfc 821 implicitly calls for a forwarding node to hold messages when retrying to contact the next hop, and the final server in the line holds messages indefinitely when waiting for the user to connect and download email.

Whether or not this storage strategy was really the main idea, RIM seized on it when they lost their case; they developed an alleged "workaround" that handled message storage differently:
    http://www.businessweek.com/technology/content/feb2006/tc20060210_490726.htm
When you're out of range, RIM stores your messages at their Network Operations Center, or NOC. The workaround would store them on the senders' server, that is, the RIM NOC apparently wouldn't accept messages from sendersuntil the destination was available and prepared to accept delivery. Or something like that.

Note that if the alleged workaround still violated NTP's very vague patents, it would take another multi-year trial to establish that. One possiblility to consider is that the workaround was intended only as a negotiating tactic when trying to settle on a dollar amount for royalties: it would allow RIM to avoid a shutdown injunction and thus would give them some leverage. And, indeed, the settlement of $600 million wasn't much larger than what NTP had won in court with the added benefit of a RIM shutdown.

On the face of it, NTP's patents were for a SYSTEM, that is, for software. But the system claim is rather weak; all the components were pre-existing. The patent makes much more sense as a BUSINESS METHOD patent, but apparently this distinction was never clarified through the course of the trial.

One problem with the claim that NTP's patents were for a business method is that such patents were not granted until a 1998 court case. NTP's patents were applied for in 1991.

It seems surprising to me, but this distinction (between system and method patents) played little if any role in the trial.


Despite the well-established idea of store-and-forward delivery of email over any type of IP links, Judge Spencer allegedly claimed (I don't have a source for this, but remember reading it) that the case "wasn't even close". How could this be?

One possibility is that the judge saw the Campana patent as a non-IP way of delivering email over the last link. That is, neither NTP nor RIM was really bringing the Internet to handheld browsers; they were extracting email messages and then sending them over a proprietary protocol. That might make sense as a genuine invention.

However, we're again up against the "inevitability" issue here: the idea itself is obvious, and what RIM really brought to the table was the capital to build the appropriate wireless network.


Nobody disputes that RIM developed their system independently.

Patents for genuine hardware electronics methods are not an issue here: modulation techniques receiver--cpu interaction NTP's patents covered only the system, not the devices.

Real issue: patent system often ignores the fundamental CS principle of abstraction (ie building networks with any links) (If this was a business-method patent, that might make this issue irrelevant.)




The PTO has by now issued non-final opinions withdrawing most of the NTP patents. How could the court and the PTO be so far apart in their understanding of the issue? Perhaps two things:
The central issue is that NTP patented the idea of sending email to small portable wireless devices and RIM implemented just that. But when you look at the building blocks, there basically aren't any. NTP introduced no technical innovations. All the components were obvious.

Should you be able to patent the idea of sending email to wireless devices? Given that wireless devices were already widespread, but nobody was sending email to them, at least not as endpoints?


District Court issues

[quotes from NTP's Memorandum of Points and Authorities in Opposition to RIM's First (or Second) Motion for Summary Judgement]

1. RIM seemed focused on obtaining summary judgement before the "Markman hearing" (or claim-construction hearing), a hearing at which the judge rules on the meaning of various patent claims. This seems awkward. NTP's reply:

RIM's preemptive May 3. 2002 motion for partial summary judgment flies in the face of its prior arguments and representations to the Court. The motion is an attempt to short-circuit the Court's procedural schedule regarding claim construction and to burden NTP with briefing before RIM even files its responsive claim chart and prior art statement. RIM's motion - which RIM admits will likely "miss the mark altogether" - seeks to force the Court to engage in a wasteful, piecemeal, incomplete and ultimately fruitless claim interpretation exercise before the disputed claim terms are briefed or even identified.

2. RIM introduced the Zabarsky prior art rather late in the game. It is not clear why they didn't pick up on this earlier. Perhaps the idea of positioning their devices as pagers didn't occur to them.

3. NTP was an advocate of the "push" idea:

The Campana patents bridged this email-wireless divide by providing universal connectivity for email between wired and wireless systems. For the First time, email sent to a user at his or her normal electronic mail system could be "pushed" to the user's mobile processor in a format suitable for standard email operations such as viewing, replying and forwarding. The user no longer needed to find his or her email; instead, the email would find the user.

This "push" idea, though, is not new: it's what happens when a cellular network calls you (the call is "pushed" to you), and it's what happens in SMTP whenever the next hop is reachable. The last sentence sounds seductive, but again it is difficult to see the innovation here except in the context of actually building a wireless email network.

Another NTP description that makes the invention appear very deep is:

Campana opened access between the world of landline-based electronic mail systems and the wireless world. Campana taught the ability to "push" the email stored in the user's mailbox on the email server all the way to a mobile destination processor operated by that user. As Campana recognized, the wireless user would be unable to periodically request email because of all of the drawbacks cited above (e.g., uncertainty. delay and inconvenience/cost). Thus, the wireless user would be best served by a system that delivered email without the need for any request from the user - similar to the way that a server delivers email to the user's desktop computer when Outlook requests it.

But is this meaningful? It seems likely that anyone using RF links for email in 1995 would have found all the ideas here obvious. However, the notion that laptop users had to dial in to retrieve email was also something that many people felt was "inevitable".

NTP also focused on their system as a way of addressing the "inconvenience of dialing up": the difficulty finding a compatible phone jack, and the possibility that there was no email to be received. This seems to be a very tame description when compared to the utility of receiving email while walking around. It seems likely that Campana did not anticipate that part!

3.5: Note that all of the above amounts to a business justification for believing that there would be a market for small RF-capable email devices. If you accept that all the pieces for RF-based email were already in place, this can be interpreted as suggesting that the real innovation isn't the invention, but RIM's marketing of it.

4. RIM tried to claim their software was "not an email system". This might be true in some precise sense, in that it is clearly an add-on to an email system. RIM's precise claim was

The Blackberry relay and the Redirector software are not a part of any email system. They do not alter or modify any existing email system with which they may be used. Rather, they are peripheral components....

To which NTP replied:

The blackberry Redirector software is part of the email system on which it is installed. ... Indeed, RIM admits that the redirector software cannot operate independently and has no utility unless and until it is installed on an email server ....

Until now, RIM has always characterized the blackberry ... as part of an electronic mail system. ... Indeed, this Court is the only entity to which RIM has ever asserted that the Blackberry is not part of an electronic email system.

This is an interesting argument. If Campana's patent is for an entire system, what if RIM just implements the part that corresponds to Campana's addition? Generally, that would still qualify as infringing.

5. RIM tried to interpret some NTP claims very literally; for example, by claiming that the phrases below were equivalent. NTP argued that the crucial "the" made the difference. RIM's argument was that NTP's patent required both an RF and a wireline transmission to the same processor. Clearly, the Campana patent wording is very vague; in fact, it is vague even by the execrable standards of the patent world. Who is being obfuscatory here, RIM or NTP?

A system for transmitting originated information from one of a plurality of originating processors in an electronic mail system to at least one of a plurality of destination processors in the electronic mail system comprising...

a RF information transmission network for transmitting the originated information to at least one RF receiver which transfers the originated information to the at least one if the plurality of destination processors

6. RIM argued that NTP's patent required the RF receiver and destination processor to be distinct units. That seems specious, in that consolidating components is routine.

7. RIM tried to argue that their wireless units acted as pagers: email was not addressed to the blackberry itself, but only to the user's usual email address. The blackberry system intercepted the email and forwarded it to the blackberry.

First, this kind of forwarding was standard by 1990; most unix email systems provided for .forward files to specify such forwarding. However, RIM has a point: the Campana patents assume that the RF nodes have email addresses. This is not quite true of the Blackberry system: the email address is separate.

Note that the core issue of lack of novelty and obviousness was never raised directly. Indirectly, it appears in the guise that NTP's patents are to be construed very narrowly because the basic ideas were already extant.


Appellate court notes; ruling of Aug 2, 2005

Somehow, in the appellate case RIM is constantly on the defensive with relatively farfetched claims. What happened to the central idea that Campana's patents were about to be overturned?

In their appeal, RIM appears to be trying to narrow the scope of the NTP claims. Somehow the assertion that there was prior art for

was lost. (They may have felt that was a lost cause.)

Arguably, though, it should have been evident from the evidence they were submitting that their claim amounted to a mass of details, not any grand principle.

Perhaps they should have focused on the patent's own claim of prior art in trying to limit the patent claims??

RIM argued before the appellate court that the district court erred in construing the claim terms:
    (a) "electronic mail system" (appearing in the '960, '670, and '172 patents);
    (b) "gateway switch" (appearing in the '960 patent); and
    (c) "originating processor" and "originated information" (appearing in the '960, '670, and '592 patents).

It seems clear that the district court did NOT grasp the generality of any of these three terms, but the appeals court did NOT overrule. Instead they found

... the court looks to those sources available to the public that show what a person of ordinary skill in the art would have understood disputed claim language to mean

RIM argues there are two ordinary meanings of "electronic mail system": a broad definition that encompasses "communicating word processors, PCs, telex, facsimile, videotex, voicemail and radio paging systems (beepers)" and a narrow definition that defines the term in the context of "pull" technology. They were apparently trying to argue that the blackberry system was not an "electronic mail system" in the narrow sense, and therefore wasn't covered by the patents.

The appellate court cited Tanenbaum, Computer Networks, a classic text.

The court also wrote:

The message is next sorted by the recipient's ISP mail server into the recipient's particular "mailbox," where it is stored until the recipient initiates a connection with the server and downloads the message off the server onto his or her personal machine. This configuration is commonly referred to as a "pull" system because emails cannot be distributed to the user's machine without a connection being initiated by the user to "pull" the messages from the mail server.

Pull system??? This is marketing terminology.

Campana's particular innovation was to integrate existing electronic mail systems with RF wireless communications networks.

A message originating in an electronic mail system may be transmitted not only by wireline but also via RF, in which case it is received by the user and stored on his or her mobile RF receiver.

Is the court suggesting that this is a "push" system? Yes, in fact. But this was a major misunderstanding of prior art.

The BlackBerry system uses "push" email technology to route messages to the user's handheld device without a user-initiated connection.

How is a blackberry different from a laptop with persistent Internet connectivity, limited to port 25 (email)?

An important issue for the court was that blackberries were NOT seen as email endpoints. Rather, they were seen as portable intermediate nodes: they would receive email, they could display the email, but the email's ultimate destination was the user's laptop (via some cable). This is an interesting strategy, in that it makes the blackberry transparent to the laptop that is receiving the email. However, it is not part of the patent debate either!

The appeals court agreed with the district court that the latter's interpretation of "electronic email system" as including the blackberry system was entirely reasonable. This degenerated into more push/pull debate, but part of the issue was that Campana himself tried to characterize an "electronic mail system" as a wire system in order to make his system appear different from Zabarsky's.

The appeals court said, [p 19 of pdf version]

Campana described prior art "electronic-mail services" as "basically a wireline - to - wireline, point-to-point type of system" (emphasis in the court's quote). The use of the term "basically" suggests that an electronic mail system may include other types of connections, including wireless connections. Moreover, Campana provided an example of one prior art electronic mail system in commercial use .... In this prior art electronic mail system, "groups of processors ... may be distributed at locations which are linked by the [PSTN]. The individual processors may be portable computers with a modem which are linked to the [PSTN] through wired or RF communications as indicated by a dotted line" [Campana quotes from 5436960]

Note that the appeals court is essentially granting here that RF links in email were prior art! See that patent, paragraph beginning "FIG. 1 illustrates a block diagram". Note also that, in the images, Fig 1 appears twice, and in one the "RF information transmission network" is deleted. RF links to end-users were never shown. Figures are in http://cs.luc.edu/pld/ethics/campana/960 and http://cs.luc.edu/pld/ethics/campana/451.

As for the contested term "originating processor", the appeals court says "We do not hold that the 'originating processor' is always the processor on which text of the email message was created".[p 23] That is, the blackberry is still an originating processor in the sense of Campana's patents even if the message was created on the associated laptop.



uspto.gov -> patents -> patft (uspto.gov/patft) Search by patent number:
http://patft.uspto.gov/netahtml/PTO/srchnum.htm

Look at patents


5436960 One of Campana's earliest patents. It contains the acknowledgement of RF links in prior-art email, though

6317592 Electronic mail system with RF communications to mobile processors This is the "newest" patent. Claim 150 (really paragraph 150) was singled out as having been infringed. (It is reproduced below.) (6 of 9 NTP v RIM claims)

6198783 System for wireless serial transmission of encoded information Modulation techniques

6067451 Electronic mail system with RF communications to mobile processors. See the Appendix, under Background Art, for prior art. Note that in Figure 3, some of the underlying telecom infrastructure is shown ("closest LATA switches"). The first non-prior-art diagram is Figure 8 (page 9). (2 of 9 NTP v RIM claims)

Diagrams, and some text pages in .bmp format, are at http://cs.luc.edu/pld/ethics/campana.

6272190 System for wireless transmission and receiving of information and method of operation thereof

4644351: Zabarsky patent, possible prior art. Note that this is cited in the '592 patent. Paging is also cited there as prior art, in the paragraph beginning, "FIG. 2 illustrates a diagram of a prior art network"

A communications system for carrying messages via a radio channel between one central site of a plurality of central sites and a plurality of two-way remote data units is disclosed. Each central site has a radio coverage area and each remote unit has a unique address and association with one of the central sites. When a message addressed to one of the remote units is received in a central site, a file of remote unit addresses is searched to find the location and central site association of the remote unit to which the message is addressed. If an address match is found indicating that the remote transceiver is in the coverage area of the message-receiving central site, the addressed message is stored and transmitted in that site. If an address match is found indicating that the remote transceiver is in another central site, the addressed message is conveyed to that site for transmission.

This would seem to cover delivering text to specific end-users; eg paging.



Here are two primary claims. The "patentese" is unfortunate and confusing, but the core claim in both cases is using RF links to transmit email.

claim 248 of patent 6067 451

246. In a system comprising a communication system which transmits electronic mail containing information, with the electronic mail being inputted to the communication system from a plurality of processors, a RF system and an interface connecting the communication system to the RF system with the information contained in the electronic mail and an identification of a RF device in the RF system being transmitted from the interface to the RF system and broadcast by the RF system to an identified RF device, the identified RF device comprising:

a RF receiver, which receives the information when the identification of the device is detected in a broadcast by the RF system to the RF receiver; and

a memory, coupled to the RF receiver, which stores the information received by the RF receiver contained in the electronic mail inputted to the communication system.

247. The RF device in accordance with claim 246 further comprising:

a processor, coupled to the memory, which after the information has been outputted from the memory, processes the information.

248. The RF device in accordance with claim 247 further comprising:

at least one application program, executed by the processor, which processes the information.

Fig. 8 is the first non-prior-art figure. It is described under the "BEST MODE FOR CARRYING OUT THE INVENTION" heading.

Certainly Campana appears to be patenting the use of RF links in email.

claim 150 of patent 6317592

150. In a communication system comprising a wireless system which communication system transmits electronic mail inputted to the communication system from an originating device which executes electronic mail programming to originate the electronic mail, mobile processors which execute electronic mail programming to function as a destination of electronic mail, and a destination processor to which the electronic mail is transmitted from the originating device and after reception of the electronic mail by the destination processor, information contained in the electronic mail and an identification of a wireless device in the wireless system are transmitted by the wireless system to the wireless device and from the wireless device to one of the mobile processors, the wireless device and one mobile processor comprising:

a wireless receiver connected to the one mobile processor with the one mobile processor receiving the information contained in the electronic mail after the identification of the wireless device is detected by the wireless receiver in a broadcast by the wireless system.

Patent 5436960

FIG. 1 illustrates a block diagram of a typical electronic mail system 10 in commercial use such as by AT&T Corporation. The electronic mail system 10 is comprised of a plurality of single processors or groups of processors #1-#N with N being any number with each group having individual processors A-N with N being any number. The groups of processors #1-#N may be distributed at locations which are linked by the public switch telephone network 12. The individual processors may be portable personal computers with a modem which are linked to the public telephone switch network 12 through wired or RF communications as indicated by a dotted line. Groups of associated processors #1-#3 may have diverse configurations with the illustrated configurations only being representative of possible architectures of groups of associated processors. The groups of associated processors may be connected to a host or mainframe computer through various communication mechanisms such as direct telephone communications (#1), communications through a local area network (#2), or communications through a private automatic branch exchange (#3)...

This sure sounds to me like an acknowledgement that RF links by themselves are prior art.



Patent reexaminations (from http://en.wikipedia.org/wiki/NTP,_Inc.)

NTP has appealed most of the rejections to the Federal Circuit.

Final BPAI decisions for:

To look these up, start at http://portal.uspto.gov/external/portal/pair. Actual documents are under the "image file wrapper" tab. Don't forget "select new case" as appropriate!

In the '451 rejection, the patent examiner found that the "Perkins" prior art included all features of the NTP system, at least when the NTP system was "broadly construed". Also, NTP tried to argue that Perkins wasn't an "electronic mail system", by construing that term very narrowly.

See also page 114, regarding "obviousness". NTP made the following claims as to why their approach was an improvement:

  1. the RF receiver is detachable from the destination processor and operates to wirelessly receive the email messages while it is detached...
  2. the RF receiver includes its own memory to store the received email messages intended for the destination processor and does not require power from the destination processor to receive and store those messages.
  3. the RF receiver provides reception and reveiew of email messages without need of the destination processor for which the email messages are intended.
Alas for NTP, "none of NTP's claims [being appealed] requires an RF receiver which recieves email while it is detached...". In other words, NTP does not have a patent on the "detachability" feature they claimed was the central feature!

On page 125, the decision states,

Furthermore, satisfaction of a long-felt but unresolved need is not evidence of nonobviousness unless it is shown that widespread efforts of skilled workers having knowledge of the prior art had failed to find a solution to the problem.

That is consistent with the idea that what RIM really brought to the table was not innovation, but the willingness to invest in the considerable infrastructure needed to support something that many office workers would find useful but would they find it useful enough?

Judge Spencer, of the DC trial, did claim

Furthermore, NTP offered irrefutable evidence of nonobviousness in the form of tremendous commercial success of the infringing Blackberry products, which indicated the satisfaction of 'long-felt' need."

But the BPAI doesn't buy the theory that meeting long-felt need is evidence of nonobviousness!

Actually, this is a very important point, suggesting that there is in fact a difference between an invention and a business idea.




DataTreasury (datatreasury.com)

They have developed technology for storage of digital images of bank checks. They actually did develop the whole system, although again the inevitability issue arises here. They did not develop any of the actual root technology: scanners, or data security, or digital storage systems with enough capacity to hold images for negligible cost.

From their website:

The Corporation was founded in 1998 and was granted its first two Network architectural patents (5,910,988 and 6,032,137) in 1999 and 2000, respectively. The patents detail the important and revolutionary aspects of DataTreasury's systems for remote image capture, document imaging, centralized processing and electronic storage. Our innovations were particularly noted for enhanced security, fault tolerance and high reliability. These key elements form the underpinnings of DataTreasury's technology.

That said, it is clear that none of DataTreasury's ideas are revolutionary.

From politico.com/news/stories/0308/9202.html The company had benefited from a controversial 1998 court ruling that broadened the definition of a patent to include business processes.

The proposed (but never passed) patent-reform act of 2007 singled out this patent for congressional revocation.

It appears that DataTreasury is claiming a business-method patent on the use of electronic image scanning for check processing. They are looking for very significant licensing fees. Again, every piece of the technology has been around from well before the patent (scanning, secure storage, ???)

Should a new (but straightforward) application of existing technology be patentable?

The DataTreasury patent has been singled out by Congress for action, but it is not clear what will happen.



Patent reform:

Someone tried patenting a movie storyline a few years ago. This patent WAS rejected.


Patent Reform Act of 2007: H.R. 1908 and S. 1145 (did not pass)

Those in bold are the most significant.

did not pass (yet)  Here are some of the proposed changes in U.S. patent law

Discuss: first-to-file: who benefits? how are small inventors affected? How are prior-art rules affected?

publish applications.

This has again been introduced in 2009; apparently the issues are the damages calculation, post-issuance reexamination proceedings, and defining inequitable conduct. At least the last provision has been removed from the 2009 bill. A good-faith defense for believing a patent was invalid is also included. Also included is a definition of prior art to include anything "available to the public"; publication no longer would have to occur.

[Note that NTP argued that RIM's conduct was held to be inequitable simply because NTP had sent them a letter outlining its patent claims, and RIM had disagreed.]


KSR v Teleflex, April 30, 2007

Some good patent news

This Supreme Court case altered the legal standard for disproving "non-obviousness" in favor of defendants. It is now slightly easier to challenge patents on this basis.

Teleflex had a patent on a pedal coupled to an electronic throttle control (basically cruise control). The question was whether that was "obvious".

The proper question to have asked was whether a pedal designer of ordinary skill, facing the wide range of needs created by developments in the field of endeavor, would have seen a benefit to upgrading [a prior art patent] with a sensor

not thought of it by themselves, and not motivated to implement the change, but simply saw the benefit. The old "nonobviousness" standard often in effect required proving that a patent was "prior art". This test was known as the "teaching-suggestion-motivation" test. All three pieces had to be there. Another sentence from that decision:

[t]he combination of familiar elements according to known methods is likely to be obvious when it does no more than yield predictable results.

Does that cover my obvious-in-context approach? Does that suggest that not clicking the mouse is obvious?

Teaching-suggestion-motivation test: too narrow

Would this have helped RIM? Probably.


Bilski case

Federal Circuit decision released October 30, 2008
Supreme Court decision released June 28, 2010 (decision here)

This was a very significant case. It was decided at the appellate level by an en banc sitting of the Federal Circuit. They proposed a "machine or transformation" test for patentability of abstract processes. The Supreme Court then heard the case, and while they did not uphold the "machine or transformation" test, they ruled that Bilski's invention was not patentable because it was too abstract. There had been widespread speculation that the Supreme Court would use the Bilski case to rein in business-method patents, or at least make the patentability rules a little clearer. They apparently did not do either.

Bilski patent: Claimed method of managing the risk of bad weather in commodities trading.

He submitted a patent application seeking exclusive rights to a method of using hedge contracts to reduce the risk that a commodity's wholesale price might change.

Again, the technique fails under both prior-art and obviousness standards. But those don't apply in the same way to business-method patents.

The patent was rejected by the Patent Board of Appeals. The Board, in rejecting the claim, asked the fedearl circuit court for assistance in determining patentability of non-technological method claims.

The federal circuit court did the following:

The court by its own action grants a hearing en banc. The parties are requested to file supplemental briefs that should address the following questions:

  1. (1) Whether claim 1 of the 08/833,892 patent application claims patent-eligible subject matter under 35 U.S.C. §101? (the patent-eligibility rules)
  2. (2) What standard should govern in determining whether a process is patent-eligible subject matter under section 101?
  3. (3) Whether the claimed subject matter is not patent-eligible because it constitutes an abstract idea or mental process; when does a claim that contains both mental and physical steps create patent-eligible subject matter?
  4. (4) Whether a method or process must result in a physical transformation of an article or be tied to a machine to be patent-eligible subject matter under section 101?
  5. (5) Whether it is appropriate to reconsider State Street Bank & Trust Co. v. Signature Financial Group, Inc., 149 F.3d 1368 (Fed. Cir. 1998), and AT&T Corp. v. Excel Communications, Inc., 172 F.3d 1352 (Fed. Cir. 1999), in this case and, if so, whether those cases should be overruled in any respect?

The appellate court did affirm the need for a physical transformation. Their central doctrine is "Machine or Transformation". This would have been a problem for business patents, and perhaps software patents.

Note that their reasoning was taken straight from the few SCOTUS cases on record.

The following question arises whenever a patent is applied for on an abstract process: 

[Is the patent] tailored narrowly enough to encompass only a particular application of a fundamental principle rather than to pre-empt the principle itself?

Benson: NO
Diehr: YES (one of the prior SCOTUS cases)
Bilski: NO

This part of the Federal Circuit's reasoning may still stand.

Part of the Benson ruling:

Transformation and reduction of an article 'to a different state or thing' is THE clue to the patentability of a process claim that does not include particular machines.

The Diehr patent was for making rubber, using a computer to control the process. It wins the "different state or thing" standard hands down.

The federal circuit dismissed the "useful, concrete, or tangible result" test: that is NOT enough to establish patentability.

They also reject the "technological arts" test (see above) that was once-upon-a-time part of the method-patent rules. They agree that it is too hard to tell whether something involves the technological arts; however, unlike the USPTO, they end up ruling the OTHER WAY; that is, to reject MORE broadly than the TA test.

machine-or-transformation test: emphasize the OR.

We will, however, consider some of our past cases to gain insight into the transformation part of the test. A claimed process is patent-eligible if it transforms an article into a different state or thing. This transformation must be central to the purpose of the claimed process. But the main aspect of the transformation test that requires clarification here is what sorts of things constitute "articles" such that their transformation is sufficient to impart patent-eligibility under §101.

Tanning leather curing rubber (Diehr case)

The raw materials of many information-age processes, however, are electronic signals and electronically-manipulated data. And some so-called business methods, such as that claimed in the present case, involve the manipulation of even more abstract constructs such as legal obligations, organizational relationships, and business risks. Which, if any, of these processes qualify as a transformation or reduction of an article into a different state or thing constituting patent-eligible subject matter?

Note that while the Bilski decision does not claim to reverse State Street (the case that led to business-method patents), most commentators seem to feel that it has that effect. It is less clear that Bilski would have had a significant effect on software patents.

Applying the Machine-or-Tranformation test to famous cases

RSA? material transformation in "real" terms The transformation is to a file. While it is electronic, it is decidedly material.

MP3? material transformation in "real" terms? An mp3 file isn't a physical thing, but it does have a certain "thingness". People think of them as things, and buy them as things. An mp3 file is material.

NTP? maybe no? The argument can be made that there is no "material thing" on the table here. Email messages are NOT it; the patent only addresses the delivery of email.

DataTreasury? It seems unlikely that DataTreasury's patents would stand up to this new test.

Supreme Court

Pamela Samuelson, writing in the March 2010 CACM, noted that the Supreme Court appeared during oral arguments to believe that some way was needed to disallow patenting of nontechnological processes. Justice Scalia asked whether horse-training techniques should be patentable, and techniques to "win friends and influence people". Justice Sotomayor asked whether speed-dating methods could be patentable, and Justice Breyer asked if a professor could patent an improved teaching method.

However, this did not quite happen. Here are a few quotes from the decision, written by Justice Kennedy [emphasis by pld]:

Section 101 specifies four independent categories of inventions or discoveries that are patent eligible: “process[es],” “machin[es],” “manufactur[es],” and “composition[s] of matter.” “In choosing such expansive terms, . . . Congress plainly contemplated that the patent laws would be given wide scope”

This Court’s precedents provide three specific exceptions to §101’s broad principles: “laws of nature, physical phenomena, and abstract ideas.”

The machine-or-transformation test is not the sole test for patent eligibility under §101. The Court’s precedents establish that although that test may be a useful and important clue or investigative tool, it is not the sole test for deciding whether an invention is a patent-eligible “process” under §101. In holding to the contrary, the Federal Circuit violated two principles of statutory interpretation: Courts “ ‘should not read into the patent laws limitations and conditions which the legislature has not expressed,’ ” Diamond v. Diehr, 450 U. S. 175, 182, and, “[u]nless otherwise defined, ‘words will be interpreted as taking their ordinary, contemporary, common meaning,’ ”

Section 101 similarly precludes a reading of the term “process” that would categorically exclude business methods. The term “method” within §100(b)’s “process” definition, at least as a textual matter and before other consulting other Patent Act limitations and this Court’s precedents, may include at least some methods of doing business.

Because petitioners’ patent application can be rejected under the Court’s precedents on the unpatentability of abstract ideas, the Court need not define further what constitutes a patentable “process,” beyond pointing to the definition of that term provided in §100(b) and looking to the guideposts in Benson, Flook, and Diehr. Nothing in today’s opinion should be read as endorsing the Federal Circuit’s past interpretations of §101. [that is, the Supreme Court is not endorsing the State Street Bank case -- pld]

The appeals court may have thought it needed to make the machine-or-transformation test exclusive precisely because its case law had not adequately identified less extreme means of restricting business method patents. In disapproving an exclusive machine-or-transformation test, this Court by no means desires to preclude the Federal Circuit’s development of other limiting criteria that further the Patent Act’s purposes and are not inconsistent with its text.

In other words,

We can kick this patent out without resorting to a Machine or Transformation test, and while we probably think the MoT test is too broad, we're not going to say anything further.

Return to Gottschalk v Benson (which Bilski v Kappos did apparently firmly uphold)

It is easy to interpret Bilski as reinforcing the Benson decision. It is up to the Supreme Court, however, to decide if Benson was in fact the right approach. The idea expressed in Benson that the algorithm was "too general" and might be used for anything seems in hindsight rather quaint; it is clear a few decades later that this is going to be the case with perhaps the majority of software patents. For example RSA patented a method of encryption that could be used for anything: banking, personal matters, commerce, digital signatures, etc.



A brief history of hacking
Legal tools
Felony prosecutions
Zero-day exploits: cisco, MBTA
Trust and SSL
Jurisdiction
Trusting software
Voting
Linking

Hacking

To some of you, hacking is clearly wrong and there shouldn't even be a question here. If you're one of them, just pay attention to the legal-strategies-against-hackers part. However, is using a website in a manner contrary to the provider's intentions always hacking? A more serious case is logging on to a site, but not changing anything and in particular not committing theft.

Baase's "three phases of hacking"

1. Early years: "hacking" meant "clever programming"

2. ~1980-~1995:
    hacking as a term for break-in
    largely teenagers
    "trophy" hacking
    phone lines, BBSs, gov't systems
    lots of social engineering to get passwords
  
1994 Kevin Mitnick Christmas Day attack on UCSD (probably not carried out by Mitnick personally), launched from apollo.it.luc.edu. [!]
   
3. post-1995: hacking for money

early years / trophy
Phone phreaking: see Baase, p 256
Joe "The Whistler" Engressia was born blind in 1949, with perfect pitch. He discovered (apparently as a child) that, once a call was connected, if you sent a 2600 Hz tone down the line, the phone system would now let you dial a new call, while continuing to bill you for the old one. Typically the first call would be local and the second long-distance, thus allowing a long-distance call for the price (often zero) of a local call. Engressia could whistle the 2600 Hz tone.
       
According to the wikipedia article on John Draper, Engressia also discovered that the free whistle in "Cap'n Crunch" cereal could be modified to produce the tone; Engressia shared this with Draper who popularized it. Draper took the nickname "Cap'n Crunch".

As an adult, Engressia wanted to be known as "Joybubbles"; he died August 2007
       
Draper later developed the "blue box" that would generate the 2600 Hz trunk-line-idle tone and also other tones necessary for dialing.
       
How do we judge these people today? At the time, they were folk heroes. Everyone hated the Phone Company!
   
Is phone-phreaking like file sharing? Arguably, there's some public understanding now that phone phreaking is wrong. Will there later be a broad-based realization that file-sharing is wrong?
   
How wrong is what they did? Is there a role for exposing glitches in modern technology?
   
From Bruce Sterling's book The Hacker Crackdown: Law and Disorder on the Electronic Frontier, mit.edu/hacker:

What did it mean to break into a computer without permission and use its computational power, or look around inside its files without hurting anything? What were computer-intruding hackers, anyway -- how should society, and the law, best define their actions? Were they just browsers, harmless intellectual explorers? Were they voyeurs, snoops, invaders of privacy? Should they be sternly treated as potential agents of espionage, or perhaps as industrial spies? Or were they best defined as trespassers, a very common teenage misdemeanor? Was hacking theft of service? (After all, intruders were getting someone else's computer to carry out their orders, without permission and without paying). Was hacking fraud? Maybe it was best described as impersonation. The commonest mode of computer intrusion was (and is) to swipe or snoop somebody else's password, and then enter the computer in the guise of another person -- who is commonly stuck with the blame and the bills.


  
What about the Clifford Stoll "Cuckoo's Egg" case: tracking down an intruder at Berkeley & Livermore Labs; Markus Hess was a West German citizen allegedly working for the KGB. Hess was arrested and eventually convicted (1990). Berkeley culture at that time was generally to tolerate such incidents.

Robert Tappan Morris (RTM) released his Internet worm in 1988; this was the first large-scale internet exploit. Due to a software error, it propagated much more aggressively than had been intended, often consuming all the available CPU. It was based on two vulnerabilities: (1) a buffer overflow in the "finger" daemon, and (2) a feature [!] in many sendmail versions that would give anyone connecting to port 25 a root shell if they entered the secret password "wiz".

Were Morris's actions wrong? How wrong? Was there any part that was legitimate? RTM was most likely trying to gain fame for discovering a security vulnerability. There was no financial incentive.

The jury that convicted him spent several hours discussing Morris's argument that when a server listened on a port (eg an email server listening on port 25), anyone was implicitly authorized to send that port anything they wanted. That is, it is the server's responsibility to filter out bad data. While the jury eventually rejected this argument, they clearly took it very seriously.

Mitnick attack: how much of a problem was that, after all? There are reports that many Mitnick attacks were part of personal vendettas. (Most of these reports trace back to John Markoff's book on Mitnick; Markoff is widely believed to have at a minimum tried to put a slant on the facts that would drive book sales.)



Stage 3: even now, not all attacks are about money.

Baase, p 259:
"In 1998, the US Deputy defense secretary desribed a series of attacks on US military computers as 'the most organized and systematic attack the Pentagon has seen to date.' Two boys, aged 16 and 17, had carried them out."
   
What about the London attack of about the same era on air-traffic control?

2000: the "Love Bug" or ILOVEYOU virus, by someone named de Guzman. If you read the subject and opened the document, an MS-word macro launched the payload.

MS-word macros were (and are) an appallingly and obviously bad idea. Should people be punished for demonstrating this in such a public way? Was there a time when such a demonstration might have been legitimate?

Yahoo ddos attack & mafiaboy, aka Michael Calce
The attack was launched in February 2000. Calce got discovered by bragging about the attack pseudonymously on chatrooms. Alas for him, he'd previously used his pseudonym "mafiaboy" in posts that contained more-identifying information.

Conficker worm, April 1, 2009, apparently about creating a network of email 'bots.

Putting a dollar value on indirect attacks

This is notoriously hard. One of Mitnick's colleagues (Phiber Optik?) was facing damage claims from one of the Baby Bell companies in excess of $100,000, when it was pointed out that the stolen document was in fact for sale for under $25.

Mark Abene (Phiber Optik) was imprisoned for a year. That was rather long for the actual charge. Mitnick himself spent nearly five years in prison, 4.5 of which were pre-trial. That situation is similar to that of Terry Childs in San Francisco, who is still in prison.



Calce, Abene & Mitnick now both work in computer security. Is this appropriate?

One theory is that gaining notoriety for an exploit is the way to get a security job. Is that appropriate?

If not, what could be done differently?



Modern phishing attacks (also DNS attacks)


Stealing credit-card numbers from stores. (Note: stores are not supposed to retain these at all. However, many do.)

Boeing attack, Baase p 262: how much should Boeing pay to make sure no files were changed?

TJX attack: Baase p 87 and p 271

The breakin was discovered in December 2006, but may have gone back to 2005.

40 million credit-card numbers were stolen! And 400,000 SSNs, and a large number of drivers-license numbers.

Hackers apparently cracked the obsolete WEP encryption on wi-fi networks to get in, using a "cantenna" from outside the building. Once in, they accessed and downloaded files. There are some reports that they eavesdropped on data streaming in from stores, but it seems likely thatdirect downloads of files was also involved.

Six suspects were eventually arrested. I believe they have all now been convicted; there's more information in the privacyrights.org page below (which also pegs the cost to TJX at $500-1,000 million).

For a case at CardSystems Solutions, see http://www.schneier.com/blog/archives/2005/06/cardsystems_exp.html. Here the leak was not due to wi-fi problems, but lack of compliance with standards was apparently involved. Schneier does a good job explaining the purely contractual security requirements involved, and potential outcomes. Schneier also points out

Every credit card company is terrified that people will reduce their credit card usage. They're worried that all of this press about stolen personal data, as well as actual identity theft and other types of credit card fraud, will scare shoppers off the Internet. They're worried about how their brands are perceived by the public.

The TJX and CardSystems attacks were intentional, not just data gone missing.

When attacks ARE about money, often the direct dollar value is huge. And tracing what happened can be difficult. An entire bank account may be gone. Thousands of dollars may be charged against EVERY stolen credit-card number.


Here's a summary of several incidents: http://www.privacyrights.org/ar/ChronDataBreaches.htm#CP.

An emerging standard is Payment Card Industry Data Security Standard (PCI DSS), supported by MasterCard, Visa, Discover, American Express, and others. See http://www.pcicomplianceguide.org/pcifaqs.php for some particulars; a more official site is https://www.pcisecuritystandards.org. Note that PCI DSS is not a law, but is "private regulation". Once upon a time, the most effective regulators of steam-powered ships were insurance companies [reference?]. This is similar, but MasterCard and Visa are not quite the same as insurers. From the FAQ above:

Q: What are the penalties for noncompliance?
A: The payment brands may, at their discretion, fine an acquiring bank $5,000 to $100,000 per month for PCI compliance violations. The banks will most likely pass this fine on downstream till it eventually hits the merchant. Furthermore, the bank will also most likely either terminate your relationship or increase transaction fees.  Penalties are not openly discussed nor widely publicized, but they can catastrophic to a small business. 

It is important to be familiar with your merchant account agreement, which should outline your exposure.

If you are a store, you can refuse to pay the fine. But then you will lose the ability to accept credit cards. This is extremely bad!

Visa's CISP program is described at http://www.visa.com/cisp.

The PCI standards do allow merchants to store the name and account-number data. However, this is strongly discouraged. Sites that keep this information are required by PCI to have it encrypted. CardSystems was keeping this data because they were having a higher-than-expected rate of problems with transactions, and they were trying to figure out why.

To some extent, PCI DSS compliance is an example of how ethical behavior is in your own long-term best interest.