Tag Archive for: French

French IT monitoring firm Centreon says no customers affected by hacking campaign, IT News, ET CIO


PARIS: French IT monitoring company Centreon said on Tuesday that none of its customers were affected by a hacking campaign described by the country’s cybersecurity agency in a recent report.

Hackers spent up to three years breaking into organizations by targeting Centreon’s monitoring software, French watchdog ANSSI said in the report that was disclosed on Monday.

“It is confirmed by ANSSI that no Centreon customers were impacted,” the French company said, adding in a statement that 15 “entities” were targeted during the hacking campaign through an obsolete open source version of the software.

Centreon did not provide the names of the 15 targeted organisations.

The company’s clients include some of the biggest French companies, such as utility EDF, telecoms firm Orange and Europe’s biggest bank BNP Paribas. The French Ministry of Justice is also a customer.

In its report, ANSSI stopped short of identifying the hackers but said they had a similar modus operandi as the Russian cyber-espionage group often nicknamed “Sandworm.”

The activity against Centreon, a Paris-based company which specializes in information technology monitoring, further highlights how attractive such firms are to digital spies.

ANSSI did not immediately reply to request seeking comment.

Source…

European Commission Wants Coronavirus Tracing Apps To Build In Strong Protections For Privacy — Unlike The French Government

Techdirt has just written about France’s incredibly hypocritical attitude to privacy when it comes to contact tracing apps for COVID-19. The European Commission seems to be rather more consistent in this area. As well as pushing privacy legislation like the GDPR and ePrivacy Directive, it has released a series of documents designed to help EU Member States create tracing apps without compromising on citizens’ privacy. For example, on April 8, it adopted a “Recommendation to support exit strategies through mobile data and apps”, which called for “a joint toolbox towards a common coordinated approach for the use of smartphone apps that fully respect EU data protection standards”. Details followed a week later, when the European Commission announced a pan-EU toolbox for “efficient contact tracing apps to support gradual lifting of confinement measures”. A 44-page document spelled out in some detail (pdf) the “essential requirements” for national apps deployed in the region — that they should be:

voluntary;

approved by the national health authority;

privacy-preserving — personal data is securely encrypted; and

dismantled as soon as no longer needed.

Finally, as if to underline the importance of respecting citizens’ privacy yet further, the European Commission released another communication (pdf) providing “Guidance on Apps supporting the fight against COVID 19 pandemic in relation to data protection”. The whole section on security is worth reading in full, since it offers a good summary of the current thinking on the best ways to preserve privacy with these apps:

The Commission recommends that the data should be stored on the terminal device of the individual in an encrypted form using state-of-the art cryptographic techniques. In the case that the data is stored in a central server, the access, including the administrative access, should be logged.

Proximity data should only be generated and stored on the terminal device of the individual in encrypted and pseudonymised format. In order to ensure that tracking by third parties is excluded the activation of Bluetooth should be possible without having to activate other location services.

During the collection of proximity data via [Bluetooth Low Energy communications between devices] it is preferable to create and store temporary user IDs that change regularly rather than storing the actual device ID. This measure provides additional protection against eavesdropping and tracking by hackers and therefore makes it more difficult to identify individuals.

The Commission recommends that the source code of the app should be made public and available for review.

Additional measures to secure the data processed can be envisaged notably with automatic deletion or anonymisation of the data after a certain point in time. In general, the degree of the security should match the amount and sensitivity of personal data processed.

All transmissions from the personal device to the national health authorities should be encrypted.

The contrast between this rigorous and comprehensive approach to safeguarding the rights of citizens and France’s cavalier disregard for the same, is stark. Unfortunately the Commission’s guidance is not legally binding and is likely to be ignored by the French government, which often insists on going its way, as with its terrible implementation of Article 17 of the EU Copyright Directive.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Techdirt.

US Court Says Fair Use Nullifies French Rightholder’s Attempt To Extract $2.25 Million From A California Art Scholar

Almost twenty-three years after a US art editor was first sued by a French company for alleged copyright infringement, a US court has told the French rightholders going after him that copyright does not work that way… at least not here in the United States. (via Courthouse News)

Photos of Pablo Picasso’s artwork were taken by one of his personal friends, Christian Zervos, over the course of four decades. The rights to these 16,000 photos were obtained by Yves Sicre de Fontbrune in 1979. Several of these photos were included in books created by American art editor Alan Wofsy. Wofsy made the mistake of trying to sell these books in Paris, which resulted in the rightsholder suing him in 1996.

That lawsuit was rejected, but the Paris Court of Appeals said otherwise in 2001. It concluded that copyright infringement had occurred and that Wofsy could be held liable for $ 1,700 per future infringement. More than a decade later, de Fontbrune went back to the court with new claims after finding a copy of one of Wofsy’s book in a French bookstore. As the federal court notes in its recitation of the facts, this 2011 legal action was a bit sketchy.

Plaintiffs asserted that, in violation of the 2001 Judgment, Defendants had continued to publish The Picasso Project. Id. at 3. The summons and complaint for the Astreinte Proceeding stated that the purchased copy contained many hundreds of Plaintiffs’ photographs, and later that the “rights to [the photographs] are the property of [Plaintiffs].” Id. at 3-4. The summons and complaint also stated that the proceedings were “for the settlement of the non-compliance penalty” of the 2001 Judgment. Id. at 4. There is no evidence that Plaintiffs ever informed the [the French court] that they no longer owned the copyrights underlying the astreinte [civil penalty]. Dkt. 70-1 at 15 (Fact 30).

So, de Fontbrune was trying to backdate the infringement to collect fines linked to copyrights it no longer owned. In addition, Wofsy was not properly served with the lawsuit, resulting in de Fontbrune moving on unopposed. After being ordered to properly serve Wofsy, another attempt was made. Wofsy apparently received this notice, but did not show up to defend himself. With the proceedings being held in Paris and Wofsy residing in San Francisco, this no-show was perhaps to be expected.

Since Wofsy wasn’t there to defend himself, the French court found in favor of de Fontbrune and the IP it no longer owned. In 2012, it awarded a $ 2.25 million judgment to the former rightsholders, concluding that Wofsy’s publication of these photos violated the 2001 ruling by the Paris Court of Appeals.

After a long discussion of French court proceedings and whether or not this decision can even be reviewed by a US federal court, the California court comes to the conclusion that it can make a ruling on the enforceability of the order issued by the Paris Appeals Court 18 years ago. And that doesn’t work out well for de Fontbrune. The enforceability of foreign judgments is subject to the Recognition Act, which says these must align themselves with US laws and policies to be enforceable.

In this case, the 2001 judgment fails. Here in the United States, fair use is a thing. Because of that, the California court [PDF] says Wofsy’s use of some of the 16,000 photographs is protected, which means de Fontbrune can’t collect $ 2.25 million for infringement that didn’t actually occur — at least not under US law.

[D]efendants contend that the purpose and character of their use of the photographs should qualify as fair use. While conceding that The Picasso Project is a commercial venture, Defendants point out that their books are reference works intended for libraries, academic institutions, art collectors and auction houses, and such institutions find it an attractive reference due to its price point. Dkt. No. 70-1 at 16, 19 (Facts 33, 42). The Picasso Project also includes information about the photographed works, such as their titles, literary references, provenance, current ownership and sales information, that is generally not included in the Zervos Catalogue. Dkt. No. 70-1 at 18 (Fact 39). Plaintiffs do not contest these facts. Id. Rather, Plaintiffs argue that Defendants’ copying has a commercial purpose, which weighs against fair use. However, the mere commercial nature of a work does not create a presumption against fair use; such a presumption “would swallow nearly all of the illustrative uses listed in the preamble paragraph of § 107, including news reporting, comment, criticism, teaching, scholarship, and research, since these activities are generally conducted for profit in this country.” Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569, 584 (1994) (citation and quotations omitted). Because Plaintiffs do not dispute that The Picasso Project is intended for libraries, academic institutions, art collectors, and auction houses, it falls within the exemplary uses named in the preamble of § 107 of the Copyright Act.

The court also points out the two publications in dispute — the 16,000-photo Zervos Catalogue and Wofsy’s “The Picasso Project” — are not competitive products. The reproduction of photos from the Zervos Catalogue does not replace the Catalogue, nor does it even come close to diminishing its market value.

Plaintiffs argue that they are competing products, but they provide no factual basis for this position. The Picasso Project can be purchased by individual volumes for about $ 150 per volume. Mot. Wofsy Decl. ¶ 38. When sold as a collection of all 28 volumes, it retails for either $ 2,780, $ 3,400, or $ 3,780. Id.; Reply Mooney Decl. (Dkt. No. 71-1) ¶ 3 & Attachment. By contrast, the original Zervos Catalogue is only available on the second-hand market, and a 2013 reprint is only available as a complete set of all of its volumes and sells for $ 20,000. Dkt. No. 70- 1 at 17 (Facts 36, 37). Plaintiffs do not dispute that The Picasso Project is intended for libraries, academic institutions, art collectors, and auction houses, whereas the Zervos Catalogue has a niche market due to its historic nature and high price. Dkt. No. 70-1 at 16, 18-19 (Facts 33, 41). Given their disparate markets and wildly different price points, no reasonable fact finder could conclude that the Zervos Catalogue and The Picasso Project compete.

Since three of the four factors weigh heavily in favor of Wofsy and his Picasso Project, the 2012 judgment de Fontbrune secured in France cannot be enforced in the United States.

[T]he court finds that the Defendants’ use of Plaintiffs’ photographs qualifies as fair use. The 2012 Judgment is, therefore at odds to the U.S. public policy promoting criticism, teaching, scholarship, and research. Defendants have carried their burden of showing that there is no genuine issue of material fact that the 2012 Judgment is repugnant to U.S. public policy.

Having reached this conclusion, the court will not recognize the 2012 Judgment.

And away goes a $ 2.25 million judgment that may have been awarded to de Fontbrune for works it had already sold the rights to. Fair use prevails and de Fontbrune will have to figure out some other form of rent-seeking if it wants to continue profiting from photos someone else took.

Permalink | Comments | Email This Story

Techdirt.

Avast & French authorities have killed the nasty Retadup botnet – HackRead

  1. Avast & French authorities have killed the nasty Retadup botnet  HackRead
  2. Police hijack a botnet and remotely kill 850,000 malware infections  TechCrunch
  3. Researchers helped French police dismantle a crypto-mining botnet  Engadget
  4. Avast and French police stop cryptomining worm, disinfect 850,000 computers  TechSpot
  5. View full coverage on read more

“malware news” – read more