CipherCloud just filed a DMCA notice with stack exchange to take down the question How is CipherCloud doing homomorphic encryption? (now deleted by stackexchange).

Since I obviously can't post the full question+answers here, a short summary of what it contained:

  • The question itself asks if/how CipherCloud uses homomorphic encryption.
  • The answers use public information (from their website, papers, promotional videos etc.) to make educated guesses about how their encryption might work.
  • Answers guess quite a few technical details (from that public information)
  • CipherCloud doesn't give any clear description of how their crypto works. So the answers might not be entirely correct, but seem reasonable.
  • Some answers are pretty critical of the security
  • Some answers use a few screenshots as evidence for their speculation (three total)

I'd like to get it online again, minus the infringing material if there is any. Some thoughts:

  • It's not really clear to me how this question or any answer violate CipherCloud's rights. The texts look like they're written by the posters, and not taken from the CipherCloud website.

  • The only copyrighted material should be the screenshots.

    So perhaps we could edit them out them out to get it online again? Do a few screenshots of a piece of software really count as copyright infringement? Or does that fall under fair use?

  • Or is the takedown not about copyright, but rather slander or something similar? I'm not too familiar with the US legal system and don't know if DMCA can be used for that.

    While critical, the answers look like reasonable speculation based on the few available facts to me.

  • Or is their crypto itself so secret that analyzing it in public already infringes their rights? Seems very unlikely to me that IP rights extend that far.

Is there any information in the notice beyond the url and the sender? The email from stackexchange didn't contain anything else specific to this case.


Update: SE sent a copy of the DMCA notice to involved users. I'll leave publication to SE, but here is a summary:

The notice consists of two parts. The first is a DMCA notice for copyright infringement. In particular they claim that using the three images infringes their copyright.

The second part is about SE ToS and "false and misleading statement"s. They go through the answers disputing the accuracy of technical statements. In particular they claim that the system is not deterministic, defeats frequency analysis and that CipherCloud does not incorporate 1:1 mapping.

There is some statement that I read as a claim that CipherCloud's product offering could different from the public demo sid observed. But the wording is a bit ambiguous.


The first part of the notice has some merit: The images were taken from CipherCloud material. I still think using them falls under fair-use. But since that's a tricky area of law, I probably won't challenge that.

The second part is interesting. Some of the statements they challenged were dubious, in particular the statements about ECB mode and xor are probably not correct.

But at least the determinism claim has some clear evidence in the screenshots. For example in one screenshot (From their 5 minute product tour video around 2:53) the words meet, to and want occur multiple times with matching ciphertexts and new occurs twice with differing case and slightly different (but obviously related) tokens. So at least in that screenshot some form of deterministic encryption with 1:1 mappings between words and ciphertext tokens was used.

share
9  
The screenshots can be defended as fair use. The "false and misleading" part is specious; it's not even a valid part of a DMCA takedown notice. They are, of course, completely within their rights to post a rebuttal answer on its own merit, but apparently they chose to abuse the DMCA Takedown system instead. –  Robert Harvey Apr 20 '13 at 17:56
2  
I've posted the copy of the takedown notice, here. –  D.W. Apr 20 '13 at 20:30
4  
Oh look you weren't the only one questioning their "technology". lajm.eu/emil/dump/ciphercloud-security.html and securitybookreviews.eu/ciphercloud –  Kim Jong Woo Apr 20 '13 at 20:35
    
@KimJongWoo That's just a mirror of the crypto.SE thread. –  CodesInChaos Apr 20 '13 at 21:03
7  
FWIW: the question has been restored, with the images removed. –  Shog9 Apr 20 '13 at 21:53
1  
holy crap they actually did take down my comment when I jokingly said the SE mods are protecting potential advertisers such as Ciphercloud. Now I firmly believe their repeated attempts at censure. –  Kim Jong Woo Apr 21 '13 at 21:05
1  
The taken-down images, and the promotional video around 2:53, make it clear that in this graphical illustration, identical plaintext leads to identical ciphertext. Ciphercould's DMCA takedown notice rebuts that, with a key point at the beginning of page 3: "[detractor] implies that what was perceived from a public demo is Ciphercould's product offering". Ciphercould's position seems to be: you misjudged us from what we have shown, which is not the real thing. –  fgrieu Apr 22 '13 at 5:50
    
As an interesting side note CipherCloud's website appears to be down today. –  mikeazo Apr 22 '13 at 14:26
    
Article on Wired about this: wired.com/wiredenterprise/2013/04/ciphercloud-stackexchange –  DeepSpace101 May 1 '13 at 16:48
add comment

7 Answers 7

http://webcache.googleusercontent.com/search?q=cache:FYBbAFUycYQJ:crypto.stackexchange.com/questions/3645/how-is-ciphercloud-doing-homomorphic-encryption+&cd=1&hl=en&ct=clnk&gl=us

share
18  
Saved it to my server: lajm.eu/emil/dump/ciphercloud-security.html –  Emil Vikström Apr 20 '13 at 9:08
11  
Getting something off the internet is like getting pee out of the swimming pool... –  TheHippo Apr 20 '13 at 12:22
2  
@TheHippo, Dilution is the solution to pollution. –  mikeazo Apr 20 '13 at 13:22
    
I have a copy as well incase anyone needs it. I guess not, given the kind of attention it gets now, but just in case –  Luc Apr 20 '13 at 13:48
    
reddit moment feel –  Kim Jong Woo Apr 20 '13 at 20:20
add comment

It would be great if Stack Exchange's legal department would post a copy of the DMCA notice. DMCA notices have to contain several pieces of information, one of which is the work being infringed. If they don't provide that (and I'd be curious to see what that work is), then it's not a valid takedown notice per the DMCA. If it does provide that, then it should be clear which part of the answer(s) needs to be removed and that part can be removed. The answers themselves probably aren't copyrighted, but if they are, the notice will say that.

Finally, Stack Exchange's legal department should contact any user who posted an answer and ask them if they're aware that their content was subject to a copyright takedown notice. Per several legal cases, SE needs to have a repeat infringer policy, and notification of the end-user is a necessary part of that policy (how can the user be expected to stop infringing if you don't notify him that he's been infringing?). If you send notice to the users, then you should also let them know that they can file a counter-notice stating that the material is not copyrighted by any other party and that the DMCA notice was issued in error. You can restore content if the user provides this counter-notice.

As always, I am not a lawyer and you should not take what I have written above as legal advice. Consult a lawyer for clarification on these options or any additional ones.

share
    
I don't have access to the original notice. SE sent me (and probably everybody else who posted on that question) an email. That email did't contain any case apecific information beyond url and sender. –  CodesInChaos Apr 20 '13 at 7:25
    
Community moderators do not have any information at all, not even the reason why the question was deleted. We moderate the site in our spare time, just like you contribute to it. I am confident that staff will handle the situation in a constructive way. And now something completely different: Wow, that is a nice photo of a nice house. –  Hendrik Brummermann Apr 20 '13 at 7:42
7  
See related question: Request: Please make takedown notice public, and upload it to Chilling Effects, where I request that Stack Exchange corporate share the DMCA takedown notice from CipherCloud. –  D.W. Apr 20 '13 at 8:09
    
hrunting, Stack Exchange did contact affected users. I had one of the answers, and they sent me an email with details. I think you can delete that paragraph. –  D.W. Apr 20 '13 at 8:12
3  
In that case, you can file a counter-notice. I see below that someone has posted the copy of the notice sent to users with instructions for filing a counter-notice. File the counter-notice. It sounds like everyone involved has a "good-faith belief" that the material was removed mistakenly or because of misidentification. –  hrunting Apr 20 '13 at 12:33
    
@hrunting It wasn't misidentification. They clearly identified the images. The question is if those images fall under "fair-use". I think so, but don't want to go through the legal bother of getting it restored. –  CodesInChaos Apr 20 '13 at 21:27
    
As a matter of policy, Stack Exchange posts all DMCA takedown notices it receives to the Chilling Effects clearinghouse. The notice in question is Chilling Effects #1298553. Note: I'm on the community management team, not the legal team. –  Pops Dec 6 '13 at 18:13
add comment

Another point is that SE should be displaying a 451 instead of a 404 on the OP's page.

share
2  
+1. Here's a link to the specification describing 451: datatracker.ietf.org/doc/… –  L0j1k Apr 20 '13 at 3:24
1  
I just brought this feature request up on meta: meta.stackexchange.com/questions/177264/… –  L0j1k Apr 20 '13 at 3:41
1  
As mentioned in @L0j1k's feature request, 451 isn't a valid status yet so this "answer" is invalid. –  Marcel Apr 20 '13 at 5:11
5  
@Marcel: 451 is a valid status code. Read RFC 2616 section 6.1.1, especially the part where it says that "HTTP status codes are extensible." It says clearly that clients that don't know 451 MUST interpret it as a 400 error. –  Rhymoid Apr 20 '13 at 9:09
4  
"The 451 status code is optional; clients cannot rely upon its use. It is possible that certain legal authorities may wish to avoid transparency, and not only demand the restriction of access to certain resources, but also avoid disclosing that the demand was made." –  Bobby Jack Apr 20 '13 at 11:02
    
"451. Unavailable for Legal Reasons" may be optional, but it can and should be considered in such cases. Search engines and professional bots will handle all 4xx errors as errors. –  e-sushi Oct 7 '13 at 16:59
add comment

For those interested, here is the full text of the email that the Stack Exchange legal folks sent to me (and, I assume, to all other users who had posted answers). It describes how to send a counter-notification. I encourage everyone who posted an answer to read carefully and decide whether you want to send a counter-notification.

Dear Member:

This is to notify you that we have removed or disabled access to the following material as a result of a third-party notification by CipherCloud claiming that this material is infringing:

How is CipherCloud doing homomorphic encryption?: http://crypto.stackexchange.com/questions/3645/how-is-ciphercloud-doing-homomorphic-encryption

Please Note: In order to avoid future strikes against your account, please delete any text to which you do not own the rights, and refrain from uploading additional text that infringe on the copyrights of others.

For more information about Stack Exchange's copyright policy, please read http://stackexchange.com/legal

If you elect to send us a counter notice, to be effective it must be a written communication provided to our designated agent that includes substantially the following (please consult your legal counsel or see 17 U.S.C. Section 512(g)(3) to confirm these requirements):

(A) A physical or electronic signature of the subscriber.

(B) Identification of the material that has been removed or to which access has been disabled and the location at which the material appeared before it was removed or access to it was disabled.

(C) A statement under penalty of perjury that the subscriber has a good faith belief that the material was removed or disabled as a result of mistake or misidentification of the material to be removed or disabled.

(D) The subscriber's name, address, and telephone number, and a statement that the subscriber consents to the jurisdiction of Federal District Court for the judicial district in which the address is located, or if the subscriber's address is outside of the United States, for any judicial district in which the service provider may be found, and that the subscriber will accept service of process from the person who provided notification under subsection (c)(1)(C) or an agent of such person.

Such written notice should be sent to our designated agent as follows:

DMCA Complaints Stack Exchange, Inc. One Exchange Plaza 26th Floor New York, NY 10006 Email: dmca@stackexchange.com

Please note that under Section 512(f) of the Copyright Act, any person who knowingly materially misrepresents that material or activity was removed or disabled by mistake or misidentification may be subject to liability.

Sincerely,

Stack Exchange Inc.

Update: I've posted a copy of the takedown notice from CipherCloud, separately.

share
1  
This DMCA is not specific enough, it should never have been processed by Stack Exchange Inc. You can safely issue a counter notice on those grounds. –  seanieb Apr 20 '13 at 14:57
7  
@seanieb, that is the email from Stack Exchange staff to contributors. This is not the copyright violation complain sent to Stack Exchange by the company. –  Hendrik Brummermann Apr 20 '13 at 15:08
add comment

Or is the takedown not about copyright, but rather slander or something similar? I'm not too familiar with the US legal system and don't know if DMCA can be used for that.

No. In a takedown, they have to declare that they are making a good faith complaint against something that they believe they own the copyright to. DMCA is about copyright.

share
5  
There has been a lot of news coverage in Germany about copyright being used to silence critical opinions in the USA. The EFF has a small collection of incidence that got press coverage in the USA itself: eff.org/takedowns –  Hendrik Brummermann Apr 20 '13 at 7:38
add comment

The DMCA is a very large bill and besides the safe harbor provision, which contains takedown notices and the like, it also has a bit which, IIRC, makes it illegal to describe DRM circumvention methods in some situations. I don't believe that the regular DMCA takedown notices have anything to do with this, but you could certainly send someone a letter threatening action under this part of the act. That's all from my shaky memory, but here's some real info:

http://chillingeffects.org/anticircumvention/faq.cgi

share
1  
The provision in the DMCA prohibits reverse engineering to discover, utilize and publish circumventions to protection mechanisms intended to protect copyrighted material. (I'm paraphrasing, and I'm not a lawyer). It's hard to see how CipherCloud could make such a claim from some people on the Internet merely making some deductions about their software through casual observation. –  Robert Harvey Apr 20 '13 at 18:10
    
@RobertHarvey I agree. I was just trying to clear up the bit about takedown notices, although maybe I should have just put it in a comment. –  aptwebapps Apr 22 '13 at 4:38
add comment

Did StackExchange or anyone contact the EFF for this? Seems like a classic misuse of DMCA to suppress speech within the security community based on public data that's used under the Fair Use doctrine as stated by the US Copyright Office (http://www.copyright.gov/fls/fl102.html).

The Online Policy Group vs Diebold case is worth looking into. In fact Diebold had a much stronger case than CipherCloud but they still lost to the Fair Use doctrine.

Another helpful read is this article (which also references the above case).

Having said that, instead of offensive legal action, I still think it's best to channel resources on building better ties within the security community and the security industry itself.

share
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .