Why is this Canadian university scared of you seeing its Privacy Impact Assessment?
I'm coming to DEFCON! On Aug 9, I'm emceeing the EFF POKER TOURNAMENT (noon at the Horseshoe Poker Room), and appearing on the BRICKED AND ABANDONED panel (5PM, LVCC - L1 - HW1–11–01). On Aug 10, I'm giving a keynote called "DISENSHITTIFY OR DIE! How hackers can seize the means of computation and build a new, good internet that is hardened against our asshole bosses' insatiable horniness for enshittification" (noon, LVCC - L1 - HW1–11–01).
Barbra Streisand is famous for many things: her exciting performances on the big screen, the small screen, and the stage; her Grammy-winning career as a musician (she's a certified EGOT!); and for all the times she's had to correct people who've added an extra vowel to the spelling of her first name (I can relate!).
But a thousand years from now, her legacy is likely to be linguistic, rather than artistic. The "Streisand Effect" – coined by Mike Masnick – describes what happens when someone tries to suppress a piece of information, only to have that act of attempted suppression backfire by inciting vastly more interest in the subject:
https://en.wikipedia.org/wiki/Streisand_effect
The term dates to 2003, when Streisand sued the website Pictopia and its proprietors for $50m for reproducing an image from the publicly available California Coastal Records Project (which produces a timeseries of photos of the California coastline in order to track coastal erosion). The image ("Image 3850") incidentally captured the roofs of Streisand's rather amazing coastal compound, which upset Streisand.
But here's the thing: before Streisand's lawsuit, Image 3850 had only been viewed six times. After she filed the case, another 420,000 people downloaded that image. Not only did Streisand lose her suit (disastrously so – she was ordered to pay the defendants' lawyers $177,000 in fees), but she catastrophically failed in her goal of keeping this boring, obscure photo from being seen:
https://en.wikipedia.org/wiki/Streisand_effect
Streisand has since called the suit "a mistake." On the one hand, that is very obviously true, but on the other hand, it's still admirable, given how many other failed litigants went to their graves insisting that their foolish and expensive legal gambit was, in fact, very smart and we are all very stupid for failing to understand that.
Which brings me to Ian Linkletter and the Canadian Privacy Library. Linkletter is the librarian and founder of the nonprofit Canadian Privacy Library, a newish online library that collects and organizes privacy-related documents from Canadian public institutions. Linkletter kicked off the project with the goal of collecting the Privacy Impact Assessments from every public university in Canada, starting in his home province of BC.
These PIAs are a legal requirement whenever a public university procures a piece of software, and they're no joke. Ed-tech vendors are pretty goddamned cavalier when it comes to student privacy, as Linkletter knows well. Back in 2020, Linkletter was an ed-tech specialist for the University of British Columbia, where he was called upon to assess Proctorio, a "remote invigilation" tool that monitored remote students while they sat exams.
This is a nightmare category of software, a mix of high-tech phrenology (vendors claim that they can tell when students are cheating by using "AI" to analyze their faces); arrogant techno-sadism (vendors requires students – including those sharing one-room apartments with "essential worker" parents on night shifts who sleep during the day – to pan their cameras around to prove that they are alone); digital racism (products are so bad at recognizing Black faces that some students have had to sit exams with multiple task-lights shining directly onto their faces); and bullshit (vendors routinely lie about their tools' capabilities and efficacy).
Worst: remote invigilation is grounded in the pedagogically bankrupt idea that learning is best (or even plausibly) assessed through high-stakes testing. The kind of person who wants to use these tools generally has no idea how learning works and thinks of students as presumptively guilty cheats. They monitor test-taking students in realtime, and have been known to jiggle test-takers' cursors impatiently when students think too long about their answers. Remote invigilation also captures the eye-movements of test-takers, flagging people who look away from the screen while thinking for potential cheating. No wonder that many students who sit exams under these conditions find themselves so anxious that they vomit or experience diarrhea, carefully staring directly into the camera as they shit themselves or vomit down their shirts, lest they be penalized for looking away or visiting the toilet.
Linkletter quickly realized that Proctorio is a worst-in-class example of a dreadful category. The public-facing materials the company provided about its products were flatly contradicted by the materials they provided to educators, where all the really nasty stuff was buried. The company – whose business exploded during the covid lockdowns – is helmed by CEO Mike Olsen, a nasty piece of work who once doxed a child who criticized him in an online forum:
Proctorio's products are shrouded in secrecy. In 2020, for reasons never explained, all the (terrible, outraged) reviews of its browser plugin disappeared from the Chrome store:
Linkletter tweeted his alarming findings, publishing links to the unlisted, but publicly available Youtube videos where Proctorio explained how its products really worked. Proctorio then sued Linkletter, for copyright infringement.
Proctorio's argument is that by linking to materials that they published on Youtube with permissions that let anyone with the link see them, Linkletter infringed upon their copyright. When Linkletter discovered that these videos already had publicly available links, indexed by Google, in the documentation produced by other Proctorio customers for students and teachers, Proctorio doubled down and argued that by collecting these publicly available links to publicly available videos, Linkletter had still somehow infringed on their copyright.
Luckily for Linkletter, BC has an anti-SLAPP law that is supposed to protect whistleblowers facing legal retaliation for publishing protected speech related to matters of public interest (like whether BC's flagship university has bought a defective and harmful product that its students will be forced to use). Unluckily for Linkletter, the law is brand new, lacks jurisprudence, and the courts have decided that he can't use a SLAPP defense and his case must go to trial:
Linkletter could have let that experience frighten him away from the kind of principled advocacy that riles up deep-pocketed, thin-skinned bullies. Instead, he doubled down, founding the Canadian Privacy Library, with the goal of using Freedom of Information requests to catalog all of Canada's post-secondary institutions' privacy assessments. Given how many bodies he found buried in Proctorio's back yard, this feels like the kind of thing that should be made more visible to Canadians.
There are 25 public universities in BC, and Linkletter FOI'ed them all. Eleven provided their PIAs. Eight sent him an estimate of what it would cost them (and thus what they would charge) to assemble these docs for him. Six requested extensions.
One of them threatened to sue.
Langara College is a 19,000-student spinout of Vancouver Community College whose motto is Eruditio Libertas Est ("Knowledge is Freedom"). Linkletter got their 2019 PIA for Microsoft's Office 365 when he FOI'ed the Nicola Valley Institute of Technology (universities often recycle one another's privacy impact assessments, which is fine).
That's where the trouble started. In June, Langara sent Linkletter a letter demanding that he remove their Office 365 PIA; the letter CC'ed two partners in a law firm, and accused Linkletter of copyright infringement. But that's not how copyright – or public records – work. As Linkletter writes, the PIA is "a public record lawfully obtained through an FOI request" – it is neither exempted from disclosure, nor is it confidential:
https://www.privacylibrary.ca/legal-threat/
Langara claims that in making their mandatory Privacy Impact Assessment for Office 365 available, Linkletter has exposed them to "heightened risks of data breaches and privacy incidents," they provided no evidence to support this assertion.
I think they're full of shit, but you don't have to take my word for it. After initially removing the PIA, Linkletter restored it, and you can read it for yourself:
I read it. It is pretty goddamned anodyne – about as exciting as looking at the roof of Barbra Streisand's mansion.
Sometimes, where there's smoke, there's only Streisand – a person who has foolishly decided to use the law to bully a weaker stranger out of disclosing some innocuous and publicly available fact about themselves. But sometimes, where there's smoke, there's fire. A lot of people who read my work are much more familiar with ed-tech, privacy, and pedagogy than I am. If that's you, maybe you want to peruse the Langara PIA to see if they are hiding something because they're exposing their students to privacy risks and don't want that fact to get out.
There are plenty of potential privacy risks in Office 365! The cloud version of Microsoft Office contains a "bossware" mode that allows bosses to monitor their workers' keystrokes for spelling, content, and accuracy, and produce neat charts of which employees are least "productive." The joke's on the boss, though: Office 365 also has a tool that lets you compare your department's usage of Office 365 to your competitors, which is another way of saying that Microsoft is gathering your trade secrets and handing it out to your direct competitors:
So, yeah, there are lots of "features" in Office 365 that could give rise to privacy threats when it is used at a university. One hopes that Langara correctly assessed these risks and accounted for them in its PIA, which would mean that they are bullying Linkletter out of reflex, rather than to cover up wrongdoing. But there's only one way to find out: go through the doc that Linkletter has restored to public view.
Linkletter has excellent pro bono representation from Norton Rose Fulbright, a large and powerful law-firm that is handling his Proctorio case. Linkletter writes, "they have put this public college on notice that any proceeding is liable to be dismissed pursuant to the Protection of Public Participation Act, BC’s anti-SLAPP legislation."
Langara has now found themselves at the bottom of a hole, and if they're smart, they'll stop digging.
Support me this summer on the Clarion Write-A-Thon and help raise money for the Clarion Science Fiction and Fantasy Writers' Workshop!
If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:
Sent the ask about the motion to dismiss thing - apparently I got it wrong and there are only WaPo printers in VA (I'm not 100% sure but I just checked what was said and it only mentions printers). Idk if it's just bc I'm a layperson but this seems absolutely bonkers to me that this was approved somehow because... they printed the newspaper there?
have you seen the case where the coal mine baron sues john oliver for defamation over the nutter butter squirrel bit? that was filed west virginia. idk why the virginias have decided they want to be *the* dream location for defamation plaintiffs...
the aclu wrote an amicus brief in the bob murray v. john oliver case which may be the funniest legal brief i've ever read. the whole thing is worth a read. my favorite parts are footnote 3 ("anyone can have dreams"), the argument header "Anyone can Legally Say 'Eat Shit' Bob", and the quotes "It is apt that one of Plaintiffs’ objections to the show is about a human-sized squirrell named Mr. Nutterbutter, because this case is nuts.", "Bob Murray thinks John Oliver was mean to him, and he doesn’t want him to be mean again. While that is sad for Bob Murray, it is unconstitutional for a court to order such relief", and the single greatest use of a photograph inside a legal brief i've ever seen:
okay but i got a little off track there. i bring this up because, in the wake of Oliver winning his lawsuit against Bob Murray, his show did a segment on SLAPP lawsuits. the clip can be found embedded here, and Oliver discusses the virginia(s)' weak anti-SLAPP laws which allowed the depp v. heard case to proceed in the first place.
anyway. this doesn't really answer your question. the virginia court found that depp met the minimum contacts requirement, a civpro rule used to determine when it is appropriate for a court in one state to assert personal jurisdiction over a defendant from another state.
the seminal minimum contacts case, from SCOTUS and thus binding on all lower courts, is International Shoe (International Shoe Co. v. Washington, 326 U.S. 310 (1945), the Supreme Court held that for a defendant to have minimum contacts, the defendant needs some combination of the two following factors: systematic and continuous activity within the forum jurisdiction).
if i was an appellate lawyer working on this case, i'd certainly be looking at Calder v. Jones (a defamation case involving Florida & California). 465 U.S. 783 (1984). i'd be analogizing that the appropriate venue would be California for this case, as its where AH and depp lived during their relationship, where both their careers were, etc.
But if I was depp's team, I'd be looking at Thousand Oaks Barrel Co., LLC v. Deep South Barrels LLC, 241 F. Supp. 3d 708 (2017)(holding that a company that directed electronic activity into Virginia with the manifest intent to do business with Virginia residents by setting up an interactive ecommerce website accessible to Virginia residents and used that website to fulfill Virginia customers’ Internet purchases was sufficient to establish minimum contacts). Based on that wildly broad interpretation, you could analogize that WaPo prints newspapers that are delivered to Virginia residents so by choosing to publish her article in WaPo, now she's subject to personal jx in Virginia.
[if you found this post helpful or informative, please consider subscribing to my substack, it does take me a decent amount of time to research, write, and source posts like this, and substack subscriptions are deeply appreciated]
Singer Marilyn Manson has dropped his years-long lawsuit against former girlfriend actor Evan Rachel Wood — and has agreed to pay Wood over
MY TAKE ON LAW&CRIME'S ARTICLE
"Warner changed course dramatically on Monday when he agreed to settle his case against Wood and pay her $327,000 in attorneys fees. According to a statement released by Wood’s attorneys, Warner originally offered to pay just a portion of Wood’s legal fees, but relented when Wood refused, ultimately agreeing to pay Wood’s entire legal bill.
Law&Crime has reviewed the settlement agreement, which has not been made public, which discharges Wood from the legal claims Warner made against her."
There is no need to "settle" between two sides in order for one of them to pay what the court has ordered. Settlement would be needed only if each side needs the other one to make a compromise with something. For example, Manson pays less and drops the charges in return. But Rachel's lawyer presented different story:
“As the trial court correctly found, Warner’s claims were meritless,” Kump said. “Warner’s decision to finally abandon his lawsuit and pay Ms. Wood her full fee award of almost $327,000 only confirms as much.”
For Warner to abandon his lawsuit however no settlement is needed. He just needs to pay what the court has ordered.
This automatically means that Rachel has conceded to something, after all. Which means, the settlement that Law&Crime reviewed didn't only concern the anti-slapp amount which Manson was already ordered to pay. It concerned the whole case.
Now what could Rachel have possible conceded which her lawyer does not mention in his statement?
Option A: She may have agreed not to trash Manson further in the press. However, her lawyer already broke this promise (if it existed) on her behalf with his statement.
Option B: She may have agreed to pay Manson to stop suing her and the payment of the whole amount of the anti-slapp money was only deducted from the settlement money she (or her insurence company) coughed.
So, if the settlement only concerns the payment of the anti-slapp amount and Kump freeley delivered the news to the media, what could possibly be the reason for the settlement agreement to not be made public? And who is playing a publicity stunt then?
But let's try to summarize what seems to be the reason for the settling of this lawsuit:
A much poorer man tried to seek justice against a times-wealthier woman who have wronged him. She just needed to comfortably hide behind an outdated legislation (the anti-slapp laws in the era of misinformation are a joke) until he is completely exhausted financially. Now her lawyers keep defaming him. Hurray for the American justice system which declared Rachel's crimes a protected speech!
From the drop box fiasco to lawsuits targeting speech, we should reject the use of legal actions to harm political opponents or silence critics, Kilian says.
Wisconsin came close to passing anti-SLAPP protections this year. Then the bill stalled in the Senate — with opposition from the same lawmaker who once dragged Wausau Pilot & Review into a costly defamation lawsuit. Why that matters for public speech.
This is the Legislature’s latest attempt to have Wisconsin join more than a dozen other states that have targeted SLAPPs — strategic lawsuits against public participation — by adopting the Uniform Public Expression Protection Act.
The Wisconsin Assembly passed a bill to protect against lawsuits intended to discourage news coverage and quiet speech, as well as measures requiring schools to adopt policies on appropriate communications between staff and students and establishing a definition of antisemitism during a Tuesday floor session.
