For something which has the unequivocal weight of the law behind it, software copyright has had a rather bumpy history in the courts. Once we get past the obvious facts of law, namely that copyright protects source code, the application of such protection has been more difficult. The reason for this is simple: [...]]]>

For something which has the unequivocal weight of the law behind it, software copyright has had a rather bumpy history in the courts. Once we get past the obvious facts of law, namely that copyright protects source code, the application of such protection has been more difficult. The reason for this is simple: while source code is clearly protected by copyright, infringement involving code plagiarism rarely happens. Similarly, the copying of a full program is also a matter of clear copyright infringement. The law however has been struggling with non-literal copying, for example, the adoption of functionality, manuals, interfaces, computer languages, and the like. This is where the interesting legal questions are being asked and litigated, and in the last few weeks we had two very important cases decided on some of these issues in both sides of the Atlantic.

The first case is SAS v WPL decided by the European Court of Justice (a case we have discussed at length previously). SAS is a business software giant that relies heavily on proprietary control over its own programming language called Base SAS, and also by providing services and know-how. While users are allowed to program using this language to fit their own needs, SAS keeps a tight leash on the know-how elements of the equation, particularly access to the Base SAS components and training materials. World Programming Limited (WPL) is a UK software company which saw an opening in the market, it created an SAS clone (knows as WPS) which would be able to run programs coded using Base SAS and the SAS components. It also produced manuals and other supporting materials in order to train users. SAS sued WPL in England for copyright infringement, and the case was referred to the ECJ. The question at the heart of the litigation was very interesting, does SAS have a copyright claim over its programming language and training materials? In short, the answer is no.The ECJ stuck closely to the advice by the Advocate General and left the door open to wider interoperability in the software environment.

The ECJ has decided that SAS did not have copyright claim over the underlying functionality of a computer program, the programming language it is written in, nor the data format of the interface files. Moreover, the Court analysed whether any legitimate user of some piece of software has the right to “study or test the functioning of a computer program in order to determine the ideas and principles which underlie any element of the program.” The answer here was positive, as the court considered that any legitimate user “should not be prevented from performing acts necessary to observe, study or test the functioning of the program, provided that these acts do not infringe the copyright in that program.” The Court states:

“ Consequently, the owner of the copyright in a computer program may not prevent, by relying on the licensing agreement, the person who has obtained that licence from determining the ideas and principles which underlie all the elements of that program in the case where that person carries out acts which that licence permits him to perform and the acts of loading and running necessary for the use of the computer program, and on condition that that person does not infringe the exclusive rights of the owner in that program.”

While there have been some criticisms against the decision because it seems to be awkwardly drafted, in my humble opinion this truly is a landmark case with regards to software functionality and interoperability. The ECJ has enshrined those principles, and I for one believe that this is a good thing.

Now contrast that with the widely publicised case of Oracle v Google (a very good FAQ about the case here). Oracle sued Google in August 2010 alleging copyright and patent infringement of Oracle’s Java by the Android mobile operating system. A jury in San Francisco decided in favour of Google in the patent case, striking a mighty blow against software patents in the process. However, everyone agrees that the really interesting part of the case was almost a sidetrack to the main patent argument, and it was whether Oracle could claim copyright over the structure of its application programming interfaces (APIs). When designing Android, Google was careful not to use Java’s interfaces in order to avoid having to pay licence fees to Oracle. It then created its own mobile APIs based on existing open source software. While these had the similar functionality to Java, they did not use Java’s code. Oracle argued that Google was infringing copyright because its interfaces were too similar to its own.

This question is really important because APIs are at the heart of the modern software development, they are the building blocks that allow devices to interact with other services and applications, and at the basic level, they allow mobile operating systems to exist. So, if a company could prove that it has copyright protection over the basic structure of its APIs, then it would force competitors to license its own offering. The judge in the case did not have to decide this question outright, but he had to instruct the jury on the matter of whether Oracle’s APIs were protected by copyright. Judge William Alsup instructed the jury that they should assume that the APIs were subject to copyright, and that he would decide fully after the verdict. As the jury struck down the patent claim, it is now up to the judge to decide on the copyright question fully.

Here is where the comparison to the SAS case is relevant, and let us hope that someone will point Judge Alsup towards that decision for inspiration. Oracle continues to claim that the very functional aspect of its APIs is protected by copyright, which is a very similar argument to that put forward by SAS. It has always been my contention that functionality should never be a part of copyright, this is an area best protected by patents. If Google produced its own API based on other code, then one has to ask if programming something which fulfils the same functions as another software infringes copyright. The answer to this question usually has been a resounding negative.

From a purely selfish perspective, I have to admit that as the proud owner of an Android phone, I want Google to win. Anything that will make a Galaxy S3 more expensive to purchase must be discouraged.

If you live in Costa Rica, the answer to the question appears to be ‘No’. La Nacion newspaper reports today that Facebook has decided to close the accounts of 19 convicts, who had maintained a presence in the social network despite being in jail. FB took this [...]]]>

If you live in Costa Rica, the answer to the question appears to be ‘No’. La Nacion newspaper reports today that Facebook has decided to close the accounts of 19 convicts, who had maintained a presence in the social network despite being in jail. FB took this decision prompted by a direct request from the Costa Rican Ministry of Justice, which objected to the presence of these pages after earlier news reports had highlighted the practice of jailbird social media usage.

This news report highlights an interesting question of modern times. Should jailed convicts have their access to sites like Facebook removed when they lose their freedom? If so, what is the legal basis for such practice? Digging a little bit, I was very surprised to find that the case seems to be based on completely shaky legal foundations.

The report in La Nacion is not clear, but apparently Facebook removed the offending pages alleging that they violated their terms of use. I have scoured through FB’s infamous policies before, so I was very surprised to read that this was the case, so I had another look. There are a few clauses that might apply to specific cases, for example:

“We do our best to keep Facebook safe, but we cannot guarantee it. We need your help to do that, which includes the following commitments:[...]
6. You will not bully, intimidate, or harass any user.[...]
7. You will not post content that: is hateful, threatening, or pornographic; incites violence; or contains nudity or graphic or gratuitous violence.[...]
10. You will not use Facebook to do anything unlawful, misleading, malicious, or discriminatory.”

All of these are very specific issues. There were some profiles where the convicts were posing in menacing fashion, or in which they were showing knives and drug paraphernalia. There was also some discussion of smuggling items into jail. These specific cases may have fallen under some of the above prohibitions, but I have seen much worse. Then there is this other section:

“We respect other people’s rights, and expect you to do the same.
1. You will not post content or take any action on Facebook that infringes or violates someone else’s rights or otherwise violates the law.”

This is more specific. If posting to FB from jail is against the law in Costa Rica, then clearly they can remove the content. So, is it illegal to use social media from jail? Interestingly, I was not able to find a single piece of legislation that deals specifically with this issue. The main regulation about what convicts can and cannot do is a statutory instrument in the shape of the 1993 Executive Decree N° 22139-J on the rights and duties of prisoners. This clearly states that those deprived of freedom have full use of their constitutional rights, except those incompatible with their captivity. Art 6 of the decree reads:

“All prisoners or detainees shall have the same individual, social and economic rights that all citizens of the Republic hold, except those which are inconsistent with imprisonment itself. Also enjoy the guarantees to be derived from their stay in the prison system.”

Similarly, Art 12 allows prisoners a limited right to communicate to the exterior world “by mail, pay phones installed in the center, and receive regular visits”. I have to concede that there may be a more recent norm that I have missed, but at least in light of the above, there is nothing that specifically prohibits communication through social media sites. Perhaps there is a specific ban on cellular phones, which are the preferred device of choice to connect to FB, but I could not find it. Moreover, as stated in this blog, access to the Internet has been declared as a fundamental right by the Constitutional Court of Costa Rica, so any ban on communicating online would violate that principle.

So let’s assume that connecting to social media sites from jail is not illegal in Costa Rica. What is left? Facebook has a devastatingly broad Termination clause in its Terms of Use:

“If you violate the letter or spirit of this Statement, or otherwise create risk or possible legal exposure for us, we can stop providing all or part of Facebook to you. We will notify you by email or at the next time you attempt to access your account.”

Notice that the mere act of creating a “risk or possible legal exposure” for Facebook can be enough to have one’s account removed. In this case, the mere fact that there was a complaint from a small Central American government was enough to have the accounts removed, as it could be construed as the a possible legal risk for FB.

In short it seems like the removal could just be justified legally, but from what I have read this is not straightforward. I am more concerned that a media storm was started by newspapers in Costa Rica that were appalled at what they saw as a flaunting of the prison regime.

Expect this question to come up more and more in the future.

“The complaints assert that the defendants – identified only [...]]]> Magistrate Judge Gary Brown has produced an interesting document in the United States District Court for the Eastern District of New York involving four lawsuits regarding so-called copyright trolls, porn producers who sue lots of users based on IP address evidence. The ruling states:

“The complaints assert that the defendants – identified only by IP address – were the individuals who downloaded the subject “work” and participated in the BitTorrent swarm. However, the assumption that the person who pays for Internet access at a given location is the same individual who allegedly downloaded a single sexually explicit film is tenuous, and one that has grown more so over time. An IP address provides only the location at which one of any number of computer devices may be deployed, much like a telephone number can be used for any number of telephones. […]

Thus, it is no more likely that the subscriber to an IP address carried out a particular computer function – here the purported illegal downloading of a single pornographic film – than to say an individual who pays the telephone bill made a specific telephone call.

Indeed, due to the increasingly popularity of wireless routers, it much less likely. While a decade ago, home wireless networks were nearly non-existent, 61% of US homes now have wireless access.5 Several of the ISPs at issue in this case provide a complimentary wireless router as part of Internet service. As a result, a single IP address usually supports multiple computer devices – which unlike traditional telephones can be operated simultaneously by different individuals. […]  Different family members, or even visitors, could have performed the alleged downloads. Unless the wireless router has been appropriately secured (and in some cases, even if it has been secured), neighbors or passersby could access the Internet using the IP address assigned to a particular subscriber and download the plaintiff’s film.”

How refreshing to read a technically accurate and astute legal decision. More please!

The High Court of England and Wales has ruled that UK internet service providers must start taking steps to technically block access from their customers to The Pirate Bay (Virgin Media has already started). Arnold J has delivered a short copyright order in Dramatico Entertainment Ltd & Ors v British Sky [...]]]>

The High Court of England and Wales has ruled that UK internet service providers must start taking steps to technically block access from their customers to The Pirate Bay (Virgin Media has already started). Arnold J has delivered a short copyright order in Dramatico Entertainment Ltd & Ors v British Sky Broadcasting Ltd & Ors [2012] EWHC 1152 (Ch) (decision regarding infringement here). The ruling should come as no surprise to anyone following recent High Court decisions regarding copyright infringement, and the blocking is the result of a concerted campaign by copyright industry interests in the UK.

For such an important and newsworthy ruling, there is very little meat in the actual wording of the decision. This is because most of the legal framework that sustains the order was undertaken in previous cases, namely in blocking access to the Newzbin2 last year in 20th Century Fox v BT (decision here and order here); and to a lesser extent in Golden Eye v Telefónica. Interestingly, Arnold J cites, but in my opinion does not follow, the ECJ case of Scarlet v SABAM.

The legal question at the heart of this case is rather simple: does a judge have the power to order intermediaries to exercise technical blocking of specific websites where copyright infringement is taking place? Arnold J already gave a positive answer to that question in Newzbin2. In that case, he was asked to rule that the site was being used for copyright infringement, and if that was the case, to order UK ISPs to block access to that site by technical means. He was clearly impressed with the existence of filtering technology already in place in the UK (namely BT’s Cleanfeed), and therefore argued that the inclusion of a site dedicated to copyright infringement would be feasible, efficient, and would constitute a proportional response.

So, in this ruling, all that is required is for a judge to be convinced that a site is being used mostly for copyright infringement, and an order to block it can be issued. Arnold J explains:

“Section 97A of the 1988 Act empowers the High Court “to grant an injunction against a service provider, where that service provider has actual knowledge of another person using their service to infringe copyright”. I have already held that both users and the operators of TPB infringe copyright. In order for this Court to have jurisdiction to make the orders sought by the Claimants, three further matters must be established. First, that the Defendants are “service providers” within the meaning of section 97A. Secondly, that users and/or the operators of TPB use the Defendants’ services to infringe copyright. Thirdly, that the Defendants have actual knowledge of this.”

I was however, surprised at how little consideration is given to the matter of copyright infringement in The Pirate Bay. The reason for this is that the defendants in this case are UK internet service providers, and as such, they are really not interested in defending TPB. Arnold J seems content to simply restate that TPB (and its users) infringe copyright:

“As to the second matter, I am satisfied that both users and the operators of TPB use the Defendants’ services to infringe for similar reasons to those which I gave in 20CFox v BT at [99]-[113]. In this connection, I note that the evidence of Mr Sehested (as to which, see the First Judgment at [41]-[42]) was that, out of 3,299,337 instances where an IP address for a device connected to the internet and making available sound recordings from a list of 15,000 titles using an internet service provided by one of the Defendants had been identified, 970,529 instances related to Virgin, 386,268 to TalkTalk, 596,872 to Sky, 439,181 to Everything Everywhere and 6,363 to O2. (Mr Sehested explains that his company monitored instances relating to O2 for a much shorter period than the other Defendants, which explains the lower total.)”

In the decision in which TPB and its users were declared to be infringing, there was no need to serve TPB with a notice because even the courts in Sweden were unable to reach them:

“The operators of TPB have not been joined as defendants to this claim, nor has it been served upon them. They did not appear at the hearing, nor have they been represented. Nor has any user been joined, served, appeared or been represented. It might be asked why it would be appropriate for this Court to determine the preliminary issues in their absence. Counsel for the Claimants gave four answers to that question, the first three of which I agree with [...] it would be impracticable, or at least disproportionate, to require joinder or service of the operators or users of TPB. TPB was set up and originally operated by four Swedish individuals (Fredrik Neij, Gottfrid Svartholm Warg, Peter Sunde Kolmisoppi and Carl Lundström) who were convicted of criminal offences of aiding and abetting copyright infringement by the Swedish courts. It appears that, while their (unsuccessful) appeals against conviction were pending, they left the jurisdiction of the Swedish courts. While Warg is said to be in Cambodia, it is unclear where the others are. Furthermore, they have claimed that TPB is now operated by a Seychelles company called Reservella Ltd, although this is disputed. In subsequent civil proceedings brought by a number of record companies in Sweden against Warg, Neij and Sunde, the court has thus far been unable to serve the proceedings on the defendants. There is no reason to believe that any attempt to serve English proceedings on them would be any more successful. “

Fair enough, so we must consider TPB properly dealt with as infringers. Where I think that the ruling truly misses the trick is with regards to the technical aspects of the order. Arnold J seems to gloss over the fact that the order will be easily circumvented. He simply comments:

“One point is nevertheless worthy of mention. Mr Walsh’s report (as to which, see the First Judgment at [19]) drew attention to one particular method by which BT’s Cleanfeed system (as to which, see 20C Fox v BT at [70]-[73]), the use of which was required by the order I made in 20C Fox v BT, could be circumvented (as to which, see 20C Fox v BT at [192]-[198]). As Mr Walsh explained, it is straightforward to prevent that method of circumvention by using IP address blocking. IP address blocking is generally only appropriate where the relevant website’s IP address is not shared with anyone else. If it is shared, the result is likely to be overblocking (see 20C Fox v BT (No 2) at [6]). In the present case, however, TPB’s IP address is not shared. Thus IP address blocking is appropriate. Accordingly, the Defendants have agreed to orders which require IP address blocking, although the specific technical means to be employed varies from Defendant to Defendant.”

I have little comment to make to the actual legalities of the ruling. Any strict reading of the letter of the law would produce a similar result. Copyright enforcement mechanisms allow for the implementation of injunctions and court orders that will try to prevent further infringement from taking place. Blocking access to an infringing site is the logical next step in the legal fight against piracy. My comment about this ruling is that it will not work to achieve its stated goal, namely to reduce copyright infringement online. Blocking does not work. Blocking has never worked.

Buried in the middle of the huge Newzbin2 ruling, there is a little jewel that exemplifies the problems with any sort of blocking decision:

“It is not disputed that technical means of avoiding detection are available, for those knowledgeable and skilful enough to employ them. However, the central difficulty of this argument is that it rests upon assumptions about human behaviour. Experts can seek to establish a profile of those who engage in P2P file sharing, and their various reasons for doing so, and may then attempt to predict how these users may be likely to respond if confronted with the kind of regime that the DEA enacts. In theory, some may cease or substantially curtail their unlawful activities, substituting or not, for example, lawful downloading of music; others may simply seek other means to continue their unlawful activities, using whatever technical means are open. The final outcome is uncertain because it is notoriously difficult accurately to predict human behaviour…”
As it happens, the Studios’ evidence is that when a similar kind of order was made by an Italian court blocking access to the Pirate Bay, use of the site appears to have been markedly reduced. It is fair to observe that, as BT’s evidence points out, diverted traffic may not have been picked up by the monitoring results relied on; but there is no hard evidence of a substantial quantity of diverted traffic.”

What can you do against such blatant disregard of technical realities, or in front of an ossified system that fails to learn from past mistakes? We are living in an evidence-free legal environment that seems to take copyright enforcement as an act of faith. They hope to be able to curb piracy although it is difficult to predict human behaviour. The problem is that it really is not that difficult to predict what people will do. We have had more than a decade of experience, which these people continue to ignore.

Presented with a block, those knowledgeable enough will simply bypass it. The truth is that bypassing the order will become quite easy through technical means, TPB has issued instructions on how to circumvent blocks from other ISPs, which include signing up to OpenDNS, or to get people to sign up to a VPN service. Those not knowledgeable enough, will simply migrate to one of the hundreds of other services that do exactly the same thing as the Pirate Bay does. Then we are back to the game of whack-a-mole.

But perhaps the saddest part of the ruling is that it should serve as a reminder of the utter failure in the “War on Piracy”. I am sure that the irony that people will cough up money to buy a VPN service in order to infringe copyright works will be completely lost on the industry. These people should be paying the industry for their works, not some obscure VPN service. They just make it too damn difficult.

I do not consider myself a pirate, I spend thousands on content; I buy DVDs, Blu-ray discs, music CDs, books, magazines. You name it. But lately, I keep losing patience with the content industries, as they seem to make it incredibly difficult for people like me to continue operating on the right side of the law. The ridiculous region restrictions on DVDs and Blu-rays mean that as a traveller who has lived in two incompatible regions and purchases content from a third I require 3 different players to be able to reproduce my content. Moreover, I cannot get the legally purchased digital copies of my content from the iTunes store because these are “not available in my country”. I tell you what, movie industry, do you know what is available in my country and has no restrictions? Pirated copies! Yes, as The Oatmeal eloquently explained recently, it is often easier to infringe than not.

So, I predict that this will be the judgement that launched a thousand VPNs, and the content industry will only have itself to blame.

The United States Cyber Intelligence Sharing and Protection Act (CISPA) has passed in the US House of Representatives despite vocal online opposition, and the surprising threat of veto from the White House. H.R. 3523 drew criticism because it is purported to be a threat to [...]]]>

The United States Cyber Intelligence Sharing and Protection Act (CISPA) has passed in the US House of Representatives despite vocal online opposition, and the surprising threat of veto from the White House. H.R. 3523 drew criticism because it is purported to be a threat to privacy as it encourages Internet services to share user information with government agencies (full final text here).

While online groups were very vocal against CISPA, they failed to reach the same level of opposition as they did with SOPA and PIPA. It is possible that privacy is just not as sexy a subject as copyright infringement. It is possible that CISPA’s proponents were much more aware of the way in which the Internet defeated the previous two bills, and how it is on the verge of giving ACTA the killing blow. But perhaps the reason why the bill passed is because nowadays users assume that they have no online privacy anyway. It does feel like Big Brother is constantly watching us, so what damage could one more piece of legislation do?

In previous articles related to US legislative efforts, we have commented that laws passed in the United States have a lot of relevance for the rest of the world because of that country’s importance in the Web’s architecture. This assessment is also proved historically; consider the DMCA’s notice and take-down regime, which has become a de facto international standard, but there is also the fact that it has had considerable extra-territorial effects knocking down content in countries where the law was not supposed to have effect.

So, is CISPA a threat abroad as well? Does the pontiff subscribe to the Roman Catholic theology? Do members of the ursine species perform bodily functions in heavily-wooded areas?

From the start the Bill was advertised with an unhealthy dose of jingoism, its proponents sold it as a way to defend against foreign cyber-threats. While not mentioned specifically, the Act talks mostly about US intelligence agencies sharing information with private parties (with adequate security clearance) and viceversa. Checks and balances are supposedly placed on the use of that information and how it is to be stored and handled by the US government. The heavy implication here is that these threats come from abroad, or that is how the proponents sold it to the tech industry and to the media. The reality is that the final ACT is horrendously vague, and seems to create a private intelligence apparatus. My greatest concern about CISPA is that it will create surveillance sub-departments in technology companies, just like there are DMCA compliance offices everywhere.

CISPA becomes truly worrying in Sec. 1104.(b)(1), which cites the private entities that will be subject to the law. These are “cybersecurity providers” and “self-protected entities”. The definitions for these are too vague, to say the least. A cybersecurity provider is “a non-governmental entity that provides goods or services intended to be used for cybersecurity purposes.” In other words, this covers anyone who manufactures anything which can be used to secure information online, including certificate authorities and other similar security intermediaries. The clear threat here is that these intermediaries will have to snoop on their users and report back to the US federal government. Interestingly, I think that the definition clearly covers VPN and proxy providers! Similarly, a self-protected entity is “an entity, other than an individual, that provides goods or services for cybersecurity purposes to itself.” In other words, any company with antivirus software and a firewall is subject to the law. Nice piece of legislative jiggery. So, what are the responsibilities of these service providers? The Act states:

“(1) IN GENERAL-
`(A) CYBERSECURITY PROVIDERS- Notwithstanding any other provision of law, a cybersecurity provider, with the express consent of a protected entity for which such cybersecurity provider is providing goods or services for cybersecurity purposes, may, for cybersecurity purposes–
`(i) use cybersecurity systems to identify and obtain cyber threat information to protect the rights and property of such protected entity; and
`(ii) share such cyber threat information with any other entity designated by such protected entity, including, if specifically designated, the Federal Government.
`(B) SELF-PROTECTED ENTITIES- Notwithstanding any other provision of law, a self-protected entity may, for cybersecurity purposes–
`(i) use cybersecurity systems to identify and obtain cyber threat information to protect the rights and property of such self-protected entity; and
`(ii) share such cyber threat information with any other entity, including the Federal Government.”

This is truly terrifying. The vagueness in the definition of terms seems to be on purpose to cover all internet intermediaries, from the big to the small. Another worrying aspect is that CISPA spends more time reassuring businesses that all proprietary information is to be maintained as such, and that the data shared will not be used by another private entity to gain a competitive commercial advantage, than it does ensuring user privacy. Furthermore, CISPA creates a blanket exemption from liability for privacy breaches sanctioned by the Act. It reads:

“`(4) EXEMPTION FROM LIABILITY- No civil or criminal cause of action shall lie or be maintained in Federal or State court against a protected entity, self-protected entity, cybersecurity provider, or an officer, employee, or agent of a protected entity, self-protected entity, or cybersecurity provider, acting in good faith–
`(A) for using cybersecurity systems to identify or obtain cyber threat information or for sharing such information in accordance with this section; or
`(B) for decisions made based on cyber threat information identified, obtained, or shared under this section.”

For the above, read “If you spy for us, we won’t sue you”.

If you think that CISPA won’t affect us in the rest of the world, you better think again. As stated above, the US has such a prominent central role in the Web’s architecture that chances are you are already covered by the legislation. Think of the purposeful vagueness in the cited sections. The obvious implication is that if you use an American certificate authority, you will be subject to the law. Similarly, if you use a US-based or hosted antivirus, firewall, VPN, or proxy service , you should consider all of your traffic insecure. In my opinion, CISPA is clearly intended to bring into the fold the anonymising industry based in the US. But what worries me is that the law, as drafted, includes every other service provider, from search engines to social networks, from World of Warcraft to Instagram. If the law passes through the entire legislative process, we are all subject to it.

The solution is simple. The rest of the world needs to continue moving away from the incredible push towards the application of US supra-national jurisdiction that we have experienced in the last few years. Just vote with our feet and start using services that are not subject to such controls. That is, at least, until our governments buckle under the pressure and adopt similar compliance legislation and treaties.

But every cloud has a silver lining… at least your fire gun sales records are exempt from scrutiny!

The above xkcd cartoon should be required viewing for every IT professional making decisions about cybersecurity. We are now constantly faced with services that ask us to change passwords all the time, and these must meet certain requirements. The password must have a cap, a number, and increasingly, a special character [...]]]>

The above xkcd cartoon should be required viewing for every IT professional making decisions about cybersecurity. We are now constantly faced with services that ask us to change passwords all the time, and these must meet certain requirements. The password must have a cap, a number, and increasingly, a special character such as !$&# (it looks like I’m swearing!)

I would not be surprised if the number of written passwords in yellow sticky notes by the side of a laptop are on the increase. If you have a couple of minutes of idle time, type “password sticky note” into Google Image, you won’t be disappointed.

Having said that, I can see the argument for standardised requirements for stronger passwords though. Left to their own devices, most people will use 12345 as their password, or simply use “password” as a password.

In the end, the weakest link in cybersecurity is the carbon-based organism sitting behind the keyboard.

ETA: More on stupid password policies.