94
$\begingroup$

CipherCloud just filed a DMCA notice with stack exchange to take down the question How is CipherCloud doing homomorphic encryption? (now deleted by stackexchange).

Since I obviously can't post the full question+answers here, a short summary of what it contained:

  • The question itself asks if/how CipherCloud uses homomorphic encryption.
  • The answers use public information (from their website, papers, promotional videos etc.) to make educated guesses about how their encryption might work.
  • Answers guess quite a few technical details (from that public information)
  • CipherCloud doesn't give any clear description of how their crypto works. So the answers might not be entirely correct, but seem reasonable.
  • Some answers are pretty critical of the security
  • Some answers use a few screenshots as evidence for their speculation (three total)

I'd like to get it online again, minus the infringing material if there is any. Some thoughts:

  • It's not really clear to me how this question or any answer violate CipherCloud's rights. The texts look like they're written by the posters, and not taken from the CipherCloud website.

  • The only copyrighted material should be the screenshots.

    So perhaps we could edit them out them out to get it online again? Do a few screenshots of a piece of software really count as copyright infringement? Or does that fall under fair use?

  • Or is the takedown not about copyright, but rather slander or something similar? I'm not too familiar with the US legal system and don't know if DMCA can be used for that.

    While critical, the answers look like reasonable speculation based on the few available facts to me.

  • Or is their crypto itself so secret that analyzing it in public already infringes their rights? Seems very unlikely to me that IP rights extend that far.

Is there any information in the notice beyond the url and the sender? The email from stackexchange didn't contain anything else specific to this case.

Update: SE sent a copy of the DMCA notice to involved users. I'll leave publication to SE, but here is a summary:

The notice consists of two parts. The first is a DMCA notice for copyright infringement. In particular they claim that using the three images infringes their copyright.

The second part is about SE ToS and "false and misleading statement"s. They go through the answers disputing the accuracy of technical statements. In particular they claim that the system is not deterministic, defeats frequency analysis and that CipherCloud does not incorporate 1:1 mapping.

There is some statement that I read as a claim that CipherCloud's product offering could different from the public demo sid observed. But the wording is a bit ambiguous.

The first part of the notice has some merit: The images were taken from CipherCloud material. I still think using them falls under fair-use. But since that's a tricky area of law, I probably won't challenge that.

The second part is interesting. Some of the statements they challenged were dubious, in particular the statements about ECB mode and xor are probably not correct.

But at least the determinism claim has some clear evidence in the screenshots. For example in one screenshot (From their 5 minute product tour video around 2:53) the words meet, to and want occur multiple times with matching ciphertexts and new occurs twice with differing case and slightly different (but obviously related) tokens. So at least in that screenshot some form of deterministic encryption with 1:1 mappings between words and ciphertext tokens was used.

$\endgroup$
9
  • 16
    $\begingroup$ The screenshots can be defended as fair use. The "false and misleading" part is specious; it's not even a valid part of a DMCA takedown notice. They are, of course, completely within their rights to post a rebuttal answer on its own merit, but apparently they chose to abuse the DMCA Takedown system instead. $\endgroup$
    – Robert Harvey
    Commented Apr 20, 2013 at 17:56
  • 4
    $\begingroup$ I've posted the copy of the takedown notice, here. $\endgroup$
    – D.W.
    Commented Apr 20, 2013 at 20:30
  • 6
    $\begingroup$ Oh look you weren't the only one questioning their "technology". lajm.eu/emil/dump/ciphercloud-security.html and securitybookreviews.eu/ciphercloud $\endgroup$
    – Kim Jong Woo
    Commented Apr 20, 2013 at 20:35
  • $\begingroup$ @KimJongWoo That's just a mirror of the crypto.SE thread. $\endgroup$
    – CodesInChaos
    Commented Apr 20, 2013 at 21:03
  • 11
    $\begingroup$ FWIW: the question has been restored, with the images removed. $\endgroup$
    – Shog9
    Commented Apr 20, 2013 at 21:53
  • 4
    $\begingroup$ holy crap they actually did take down my comment when I jokingly said the SE mods are protecting potential advertisers such as Ciphercloud. Now I firmly believe their repeated attempts at censure. $\endgroup$
    – Kim Jong Woo
    Commented Apr 21, 2013 at 21:05
  • 5
    $\begingroup$ The taken-down images, and the promotional video around 2:53, make it clear that in this graphical illustration, identical plaintext leads to identical ciphertext. Ciphercould's DMCA takedown notice rebuts that, with a key point at the beginning of page 3: "[detractor] implies that what was perceived from a public demo is Ciphercould's product offering". Ciphercould's position seems to be: you misjudged us from what we have shown, which is not the real thing. $\endgroup$
    – fgrieu Mod
    Commented Apr 22, 2013 at 5:50
  • 1
    $\begingroup$ As an interesting side note CipherCloud's website appears to be down today. $\endgroup$
    – mikeazo Mod
    Commented Apr 22, 2013 at 14:26
  • 1
    $\begingroup$ Article on Wired about this: wired.com/wiredenterprise/2013/04/ciphercloud-stackexchange $\endgroup$
    – DeepSpace101
    Commented May 1, 2013 at 16:48

7 Answers 7

Reset to default
46
$\begingroup$

http://webcache.googleusercontent.com/search?q=cache:FYBbAFUycYQJ:crypto.stackexchange.com/questions/3645/how-is-ciphercloud-doing-homomorphic-encryption+&cd=1&hl=en&ct=clnk&gl=us

$\endgroup$
6
  • 21
    $\begingroup$ Saved it to my server: lajm.eu/emil/dump/ciphercloud-security.html $\endgroup$
    – Emil Vikström
    Commented Apr 20, 2013 at 9:08
  • 14
    $\begingroup$ Getting something off the internet is like getting pee out of the swimming pool... $\endgroup$
    – TheHippo
    Commented Apr 20, 2013 at 12:22
  • 2
    $\begingroup$ @TheHippo, Dilution is the solution to pollution. $\endgroup$
    – mikeazo Mod
    Commented Apr 20, 2013 at 13:22
  • 2
    $\begingroup$ I have a copy as well incase anyone needs it. I guess not, given the kind of attention it gets now, but just in case $\endgroup$
    – Luc
    Commented Apr 20, 2013 at 13:48
  • $\begingroup$ reddit moment feel $\endgroup$
    – Kim Jong Woo
    Commented Apr 20, 2013 at 20:20
  • $\begingroup$ This link (as well as @EmilVikström's) is down. $\endgroup$
    – forest
    Commented Sep 5, 2018 at 1:58
27
$\begingroup$

It would be great if Stack Exchange's legal department would post a copy of the DMCA notice. DMCA notices have to contain several pieces of information, one of which is the work being infringed. If they don't provide that (and I'd be curious to see what that work is), then it's not a valid takedown notice per the DMCA. If it does provide that, then it should be clear which part of the answer(s) needs to be removed and that part can be removed. The answers themselves probably aren't copyrighted, but if they are, the notice will say that.

Finally, Stack Exchange's legal department should contact any user who posted an answer and ask them if they're aware that their content was subject to a copyright takedown notice. Per several legal cases, SE needs to have a repeat infringer policy, and notification of the end-user is a necessary part of that policy (how can the user be expected to stop infringing if you don't notify him that he's been infringing?). If you send notice to the users, then you should also let them know that they can file a counter-notice stating that the material is not copyrighted by any other party and that the DMCA notice was issued in error. You can restore content if the user provides this counter-notice.

As always, I am not a lawyer and you should not take what I have written above as legal advice. Consult a lawyer for clarification on these options or any additional ones.

$\endgroup$
7
  • 1
    $\begingroup$ I don't have access to the original notice. SE sent me (and probably everybody else who posted on that question) an email. That email did't contain any case apecific information beyond url and sender. $\endgroup$
    – CodesInChaos
    Commented Apr 20, 2013 at 7:25
  • $\begingroup$ Community moderators do not have any information at all, not even the reason why the question was deleted. We moderate the site in our spare time, just like you contribute to it. I am confident that staff will handle the situation in a constructive way. And now something completely different: Wow, that is a nice photo of a nice house. $\endgroup$
    – Hendrik Brummermann Mod
    Commented Apr 20, 2013 at 7:42
  • 10
    $\begingroup$ See related question: Request: Please make takedown notice public, and upload it to Chilling Effects, where I request that Stack Exchange corporate share the DMCA takedown notice from CipherCloud. $\endgroup$
    – D.W.
    Commented Apr 20, 2013 at 8:09
  • $\begingroup$ hrunting, Stack Exchange did contact affected users. I had one of the answers, and they sent me an email with details. I think you can delete that paragraph. $\endgroup$
    – D.W.
    Commented Apr 20, 2013 at 8:12
  • 3
    $\begingroup$ In that case, you can file a counter-notice. I see below that someone has posted the copy of the notice sent to users with instructions for filing a counter-notice. File the counter-notice. It sounds like everyone involved has a "good-faith belief" that the material was removed mistakenly or because of misidentification. $\endgroup$
    – hrunting
    Commented Apr 20, 2013 at 12:33
  • $\begingroup$ @hrunting It wasn't misidentification. They clearly identified the images. The question is if those images fall under "fair-use". I think so, but don't want to go through the legal bother of getting it restored. $\endgroup$
    – CodesInChaos
    Commented Apr 20, 2013 at 21:27
  • 3
    $\begingroup$ As a matter of policy, Stack Exchange posts all DMCA takedown notices it receives to the Chilling Effects clearinghouse. The notice in question is Chilling Effects #1298553. Note: I'm on the community management team, not the legal team. $\endgroup$
    – Pops StaffMod
    Commented Dec 6, 2013 at 18:13
26
$\begingroup$

Another point is that SE should be displaying a 451 instead of a 404 on the OP's page.

$\endgroup$
6
  • 2
    $\begingroup$ +1. Here's a link to the specification describing 451: datatracker.ietf.org/doc/… $\endgroup$
    – L0j1k
    Commented Apr 20, 2013 at 3:24
  • 1
    $\begingroup$ I just brought this feature request up on meta: meta.stackexchange.com/questions/177264/… $\endgroup$
    – L0j1k
    Commented Apr 20, 2013 at 3:41
  • 1
    $\begingroup$ As mentioned in @L0j1k's feature request, 451 isn't a valid status yet so this "answer" is invalid. $\endgroup$
    – Marcel
    Commented Apr 20, 2013 at 5:11
  • 10
    $\begingroup$ @Marcel: 451 is a valid status code. Read RFC 2616 section 6.1.1, especially the part where it says that "HTTP status codes are extensible." It says clearly that clients that don't know 451 MUST interpret it as a 400 error. $\endgroup$
    – Rhymoid
    Commented Apr 20, 2013 at 9:09
  • 4
    $\begingroup$ "The 451 status code is optional; clients cannot rely upon its use. It is possible that certain legal authorities may wish to avoid transparency, and not only demand the restriction of access to certain resources, but also avoid disclosing that the demand was made." $\endgroup$
    – Bobby Jack
    Commented Apr 20, 2013 at 11:02
  • 2
    $\begingroup$ "451. Unavailable for Legal Reasons" may be optional, but it can and should be considered in such cases. Search engines and professional bots will handle all 4xx errors as errors. $\endgroup$
    – e-sushi
    Commented Oct 7, 2013 at 16:59
16
$\begingroup$

For those interested, here is the full text of the email that the Stack Exchange legal folks sent to me (and, I assume, to all other users who had posted answers). It describes how to send a counter-notification. I encourage everyone who posted an answer to read carefully and decide whether you want to send a counter-notification.

Dear Member:

This is to notify you that we have removed or disabled access to the following material as a result of a third-party notification by CipherCloud claiming that this material is infringing:

How is CipherCloud doing homomorphic encryption?: How is CipherCloud doing homomorphic encryption?

Please Note: In order to avoid future strikes against your account, please delete any text to which you do not own the rights, and refrain from uploading additional text that infringe on the copyrights of others.

For more information about Stack Exchange's copyright policy, please read http://stackexchange.com/legal

If you elect to send us a counter notice, to be effective it must be a written communication provided to our designated agent that includes substantially the following (please consult your legal counsel or see 17 U.S.C. Section 512(g)(3) to confirm these requirements):

(A) A physical or electronic signature of the subscriber.

(B) Identification of the material that has been removed or to which access has been disabled and the location at which the material appeared before it was removed or access to it was disabled.

(C) A statement under penalty of perjury that the subscriber has a good faith belief that the material was removed or disabled as a result of mistake or misidentification of the material to be removed or disabled.

(D) The subscriber's name, address, and telephone number, and a statement that the subscriber consents to the jurisdiction of Federal District Court for the judicial district in which the address is located, or if the subscriber's address is outside of the United States, for any judicial district in which the service provider may be found, and that the subscriber will accept service of process from the person who provided notification under subsection (c)(1)(C) or an agent of such person.

Such written notice should be sent to our designated agent as follows:

DMCA Complaints Stack Exchange, Inc. One Exchange Plaza 26th Floor New York, NY 10006 Email: [email protected]

Please note that under Section 512(f) of the Copyright Act, any person who knowingly materially misrepresents that material or activity was removed or disabled by mistake or misidentification may be subject to liability.

Sincerely,

Stack Exchange Inc.

Update: I've posted a copy of the takedown notice from CipherCloud, separately.

$\endgroup$
2
  • 1
    $\begingroup$ This DMCA is not specific enough, it should never have been processed by Stack Exchange Inc. You can safely issue a counter notice on those grounds. $\endgroup$
    – seanieb
    Commented Apr 20, 2013 at 14:57
  • 10
    $\begingroup$ @seanieb, that is the email from Stack Exchange staff to contributors. This is not the copyright violation complain sent to Stack Exchange by the company. $\endgroup$
    – Hendrik Brummermann Mod
    Commented Apr 20, 2013 at 15:08
8
$\begingroup$

Or is the takedown not about copyright, but rather slander or something similar? I'm not too familiar with the US legal system and don't know if DMCA can be used for that.

No. In a takedown, they have to declare that they are making a good faith complaint against something that they believe they own the copyright to. DMCA is about copyright.

$\endgroup$
1
  • 8
    $\begingroup$ There has been a lot of news coverage in Germany about copyright being used to silence critical opinions in the USA. The EFF has a small collection of incidence that got press coverage in the USA itself: eff.org/takedowns $\endgroup$
    – Hendrik Brummermann Mod
    Commented Apr 20, 2013 at 7:38
4
$\begingroup$

The DMCA is a very large bill and besides the safe harbor provision, which contains takedown notices and the like, it also has a bit which, IIRC, makes it illegal to describe DRM circumvention methods in some situations. I don't believe that the regular DMCA takedown notices have anything to do with this, but you could certainly send someone a letter threatening action under this part of the act. That's all from my shaky memory, but here's some real info:

http://chillingeffects.org/anticircumvention/faq.cgi

$\endgroup$
2
  • 4
    $\begingroup$ The provision in the DMCA prohibits reverse engineering to discover, utilize and publish circumventions to protection mechanisms intended to protect copyrighted material. (I'm paraphrasing, and I'm not a lawyer). It's hard to see how CipherCloud could make such a claim from some people on the Internet merely making some deductions about their software through casual observation. $\endgroup$
    – Robert Harvey
    Commented Apr 20, 2013 at 18:10
  • $\begingroup$ @RobertHarvey I agree. I was just trying to clear up the bit about takedown notices, although maybe I should have just put it in a comment. $\endgroup$
    – aptwebapps
    Commented Apr 22, 2013 at 4:38
4
$\begingroup$

Did StackExchange or anyone contact the EFF for this? Seems like a classic misuse of DMCA to suppress speech within the security community based on public data that's used under the Fair Use doctrine as stated by the US Copyright Office (http://www.copyright.gov/fls/fl102.html).

The Online Policy Group vs Diebold case is worth looking into. In fact Diebold had a much stronger case than CipherCloud but they still lost to the Fair Use doctrine.

Another helpful read is this article (which also references the above case).

Having said that, instead of offensive legal action, I still think it's best to channel resources on building better ties within the security community and the security industry itself.

$\endgroup$
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .