If Section 92A comes into effect then all ISPs must follow a policy of disconnecting people before a trial based on accusations of copyright infringement. One of the largest groups of ISPs, the TCF, released their draft code of practice today asking for feedback. Here's the press release, the homepage and the policy itself (PDF, 300KB). A lot of competing interests will be vying to affect this TCF draft, and so we should all prepare to have our say. This code of practice cannot undo the problems of Section 92A: that internet connections are terminated based on accusations of copyright infringement before a trial and before any evidence has been held up to court scrutiny, although to be fair this draft does try to manage this situation. It asks ISPs to measure "evidence that would be acceptable to a court", but remember that "the definition of an Internet Service Provider goes much further than the traditional ISP [...] includes schools, universities, libraries, businesses, government departments and any other organisation that provides internet services." and all of these organisations are now expected to replace a court and understand copyright law such as copyright between businesses and between the arts and free speech. The TCF should be applauded for trying to manage this appalling law, and we're glad to see the sections on Vulnerable Customers and Essential Service Providers (page 14). Of particular interest is Section F (pages 31-33) a proposed amendment currently not in the code. This proposed ammendment seems to indicate that a single accusation may reveal your personal contact details, however more analysis is yet to come. Get reading people and post your analysis in the forum or in email to us. UPDATE: InternetNZ’s response to the TCF draft policy

The proposed ammendment is a a shame.. for a second there I thought we'd be protected by NZ privacy law... until APRA whined about that too :/

That was a lot to read, and I'm going to admit I skipped some of it... But basically what I see is:
- Three Strikes and You're Out (basically)
- The process will be repeated ad-infinitum downstream until it reaches a user.
- Counter Notification process is defined, but the recording industry have an alternative.
- You can't just issue a notice for any copyright you own, you need to pay (each ISP that you intend to notify) to be a 'Pre-approved rightsholder'

Basically it seems that once a Pre-Approved Rightsholder tells an ISP (with appropriate detail, but no evidence required) that an offense was committed on an IP address at a time that ISP then either issues an 'Education Notice' to users, or passes the notification on to 'downstream ISPs'.

When you receive an 'Education Notice' you can counter-claim ("No I didn't, they're wrong") - the ISP logs the dispute and informs the Rightsholder that the dispute has been lodged with (non-identifying) details of the dispute.

Each month the ISP must send a 'Copyright Notice' to any user that has received one or more 'Education Notice' in the last month. After 18 Months these notices expire.

If you have have three 'Copyright Notices' active (basically non-disputed in the last 18 months) then you will receive a final notice. You'd then have 48 hours to tell the ISP if you are Vulnerable Customer or provide Essential Services. If the ISP decides you are not, or you don't claim such, then 48 hours later your internet ceases to be.

That's the basic process.

Now the tricky bit.. The Rightsholders consulted so far seem to think the counter-notice thing is an out for pirates. Basically that anyone receiving a notice would just immediately say "no, not me!"

There is some validity to this in that the TCF's code doesn't seem to spell out what a Rightsholder can do after a dispute. There is no process for the Rightsholder to re-assert the validity of the claim. Which makes sense, as with no external adjudicator or evidence standards there really is no way to get beyond he-said, she-said on a dispute. So essentially for a Rightsholder the dispute is a dead-end.

But here is the alternative, proposed, it seems, by the Rightsholders... You dispute with the ISP and the ISP passes that dispute in full (including identifying and contact details) to the Rightsholder. It is then up to you to resolve it with the Rightsholders, and the Rightsholder to inform the ISP of the outcome. Frankly this seems completely unfair, and unbalanced. Who among us would feel confident arguing, in private essentially, with a movie studio?

Clearly the policy is an improvement in the incredibly vague legislation, but it doesn't really address the fundamental problems: Presumption of guilt, putting ISPs in the role of judge and jury, lack of evidential standards or requirements.

I am no lawyer, but a few thoughts:

1.
It would seem all downstream ISP's - now defined as Businesses, libraries, universities ect. - will need to keep a database of login activity going back at-least a month in order to identify infringers on their networks. For many organisations, schools and libraries in particular, this might be pushing the limit of their technical know how.

2.
Making copyright holders pay to be 'pre-approved', basically guarantees that small copyright holders, such as myself, will not be protected under this law. Am I really going to pay the $20 fee or whatever it will be, to become preapproved, to send an 'education notice' to someone who has stolen a $10 piece of IP off me? Probably not. But if I was one of the big 5 record companies that would be a good deal.

3.
Its not very clear how they will identify people on shared networks (on a sub net mask) or dynamic IP address. For example, I know people at my university have figured out how to use bittorrent on the university network. Under this system the copy right holder would send the infringement notice to the University with the IP address that the bad packets came from. Only problem is that one IP address has many users assigned to it.

4.
Without a central database of notification, circumventing the law just involves changing ISPs on your third notice. But I dont want to give anyone ideas as a central database is a draconian measure.

1. For many 'downsteam ISPs' who will be providing access through a NAT gateway it will be absolutely impossible for them to identify which user(s) are responsible for infringing activity. They are simply unable to comply. When I used to flat with a few other people maybe I could have claimed to be a downstream ISP? Any of my flatmates who were using the internet connection in my name could be infringing and there'd be no way at all for me to know which one it was.

2. The Pre-Approval seems to be on a per-ISP basis. So if a user with Xtra infringes you, then you need to pay Xtra. Then if someone on Orcon does it, you need to pay them too. And so on. The best option would be to go as far upstream as possible. Try an register with wholesale ISPs who provide IP service to smaller retail ISPs, as it seems once you're registered with an ISP you are automatically registered with all their downstream ISPs. Note here that the top-level ISP gets the registration money to cover costs of processing. The downstream ISPs get nothing, but are required to conform to an equal standard.

3. See 1... Without maintaining details traffic accounting logs (impractical at best, and still not really enough), it's impossible for a provider of address-translated access to identify which user has generated an infringement? So is that a free-pass for the organisation involved? Or do they have to wear the infringement if they can't pass it on?

4. Well yes, basically. Depending on the intensity of the rightsholder's enforcement (are they actively seeking infringements every day?) that could be very possible. But in practice moving ISPs is a pain in the ass, especially with UBS DSL where you have to wait for Telecom to re-prevision the connection which can take up to a week. It's also unclear in the law or the policy if a user can open a new connection with an ISP that has terminated them, or after what time period. Either you can, and you could cycle around through a few ISPs constantly. Or you can't and your pool could run out pretty quickly.

Also, ISPs already communicate about customers with 'churn' notification, perhaps they will communicate about this stuff as well somehow? ISPs might not want to do business with people who are going to be generating complaints. ISPs often take a loss on signing up new customers, unless you stay for a certain period of time, you are no value to them. If it seems likely they have to kick you off after 3-months, maybe they won't sign you up at all.

Which raises another point. I have a 24-month contract with my ISP. What are my obligations with regard to that contract if they terminate my account before that time?

New story about this http://creativefreedom.org.nz/story.html?id=89

Comment from Rochelle Hume about this.

How about requiring the all those gathering evidence of copyright infringement to be, or use, only agents/companies licensed and operating under New Zealand's Private Investigtors and Security Guards Act 1974.

Reposted from the General thread at Matthew's suggestion:

I had something of a brainwave this afternoon regarding a workable code of practice if 92A and 92C were to remain. An ISP could require an allegation to be made in the form of a declaration under the Oaths and Declarations Act 1957. The allegation would have to be knowledge that copyright is being breached and that the offending party is not engaging in a permitted act.

Under s 111 of the Crimes Act, it is illegal to make a false declaration with a penalty of up to 3 years imprisonment. If an ISP or a victim of a complaint feels that it is frivilous, they could make a complaint to the police, who would prosecute at their expense (ie the government's), rather than costing an ISP thousands of dollars in civil litigation.