1	THE LEGAL AND POLICY LANDSCAPE CONCERNING DRM TECHNOLOGIES Pamela Samuelson, UC Berkeley, Tutorial for the Law & Technology of DRM Conference, February 27, 2003
2	GOALS Provide you with sufficient background on legal & policy initiatives that will be discussed during the conference so that the speakers can make their key points, rather than explaining legal and policy background during the conference sessions Provide you with a sense about what aspects of DRM technologies are controversial and why, but in a balanced way
3	COPYRIGHT IN A NUTSHELL Authors of original works of authorship Generally have 5 exclusive rights: Reproduce work in copies Make derivative works Distribute copies to the public Public performance and public display Series of limitations and exceptions to those exclusive rights, including fair use
4	UNIVERSAL v. SONY Universal City Studios & Disney sued Sony in late 1970’s for contributory copyright infringement for making & selling Betamax VCRs Sony’s technology materially contributed to unauthorized copying of copyrighted works (TV programs) Such copying was not fair use because it was non-transformative (not used to make new work) & users copied entire work, so private copies = infringements Sony knew or should have known of underlying infringements by users Sony could install $15 circuits to “read” broadcast flags
5	SONY BETAMAX 1984 Supreme Court ruled: Not contributory infringement to make/sell technology with substantial non-infringing uses Fair use to make private, noncommercial copies for time-shifting purposes (Ku discusses) Presume private noncommercial copying is fair; only overcome if proof of meaningful harm When new technology poses novel questions, courts should construe in light of fundamental purposes of law
6	AFTERMATH OF SONY (#1) Vault v. Quaid (5^th Cir. 1988) Vault made Prolok copy-protection software which it licensed to software developers who then licensed the copy-protected software to end-users Quaid made Ramkey which “spoofed” Prolok and allowed copies to be made Court rejected contributory infringement claim because of Ramkey had a substantial noninfringing use, namely, to enable backup copying, relying on Sony Betamax decision
7	AFTERMATH OF SONY (#2) In late 1980’s digital audio tape (DAT) machines were about to be distributed in the US market Sound recording industry perceived DAT as a threat because it enabled perfect digital copies Contributory copyright infringement suit was unlikely to succeed because of substantial noninfringing uses of DATs Moratorium led to inter-industry negotiations Congress passed Audio Home Recording Act of 1992: consumer-grade DAT machines must install SCMS chips which allow unlimited first generation copies, but second generation copies degrade in quality
8	AUDIO HOME RECORDING ACT First technology mandate aimed at protecting copyrighted works (but narrowly drawn to exclude computers) No lawsuit for copyright infringement can be based on noncommercial copies of DAT & analog recordings “Tax” on DAT machines and tapes go into royalty pool from which copyright owners can draw Anti-circumvention provision: illegal to make or distribute technology, the primary purpose or effect of which is to circumvent SCMS RIAA v. Diamond Multimedia: AHRA doesn’t apply to MP3 players, so needn’t install SCMS chips; MP3 players enable “place-shifting” which is fair use under Sony
9	AFTERMATH OF SONY (#3) Inter-industry consortium standard-setting is alternative way to achieve ubiquitous DRM-like technology without legislation Consumer electronics and movie industry agreed on Content Scramble System (CSS) as standard DRM-like technology for DVD players and disks in 1995-96 Need a license from DVD CCA to make DVD player because of patents Installation of CSS and various security measures (including anti-RE clauses in end user licenses) are conditions of DVD CCA licenses Unlike AHRA, no personal use copying allowed
10	PRELUDE TO DMCA Vault v. Quaid is a precedent under which many circumvention technologies would be lawful 1995 Clinton Administration White Paper: copyright owners need additional protection because of dangers of digital infringement use of technical measures can be undermined by acts of circumvention and availability of circumvention tools 1996 WIPO Copyright Treaty requires “adequate protection” and “effective remedies” against circumvention of technical measures
11	PRELUDE TO MANDATES AHRA is a “precedent” for tech mandates, such as Hollings bill and broadcast flag, to control technologies in order to protect copyrighted works CSS standard for DVD players/disks is a “precedent” for standard-setting as a way to accomplish ubiquitous installation of DRM-like technologies without legislation
12	DMCA RULES Congress passed the Digital Millennium Copyright Act in 1998 It created two new intellectual property rights: Anti-circumvention rules (sec. 1201) Protection for copyright management information (sec. 1202) Rules are complex and somewhat ambiguous Let’s review the rules, then work through decisions and cases thus far
13	ACTS OF CIRCUMVENTION 1201(a)(1)(A): illegal to circumvent effective technical measures used by copyright owners to protect access to their works No corresponding provision making it illegal to circumvent other technical measures, such as copy controls Was this intended to leave room for circumvention of copy controls as long as it didn’t result in copyright infringement? (Reese paper) What to do if copyright owners “merge” access and copy controls? (Reese paper)
14	EXCEPTIONS TO 1201(a)(1)(A) (d) Non-profit “shopping” privilege (e) Legitimate law enforcement/national security (f) When necessary for program interoperability (g) “Legitimate” encryption research (h) To protect minors vs. harmful material (i) To protect against collection of personal data (surveillance without notice) (j) Computer security testing
15	ENCRYPTION RESEARCH 1201 (g) allows circumvention for legitimate encryption research (Liu paper) Acquisition of content must have been lawful Circumvention must be necessary & in good faith Must request permission from copyright owner 1^st Must give results to copyright owner Care in disseminating results (advance knowledge or facilitate infringement—what if paper on Internet?) Whether trained in encryption or employed in field OK to make (a)(2) tool but silent as to (b)(1) tool
16	LOC RULEMAKING Purpose: to consider whether 1201(a)(1)(A) is having adverse effects on non-infringing uses of certain classes of works LOC was given power to issue rules, in effect, creating new exceptions to 1201(a)(1)(A) Results of 1^st rulemaking: Works affected by broken access control & Lists of sites that filtering software blocks 2^nd rulemaking underway with submissions by many individuals or organizations
17	1201(c): RIGHTS UNAFFECTED (1) No effect on rights, limits or defences, including fair use, under this title (2) No effect on contributory or vicarious liability (3) No requirement to respond to technical measures in computer/consumer products (4) No effect on free speech/press rights Narrowly construed in case-law so far
18	ANTI-DEVICE PROVISIONS 1201(a)(2): illegal to make, import, offer to public, provide or o/w traffic in technologies that bypass access controls 1201(b)(1): illegal to make, etc. technologies that bypass other technical protection measures used by copyright owners to protect a right in their works (e.g., anti-copying measures in VCR tapes)
19	ANTI-DEVICE PROVISIONS (A) Primarily designed or produced to circumvent (B) No commercially significant use except to circumvent (C) Marketed as a circumvention device Only 3 of 7 exceptions to 1201(a)(1)(A) also exempt anti-device rules; only (f) allows making of both (a)(2) and (b)(1) tools Is there an implied right to make a tool if necessary to engage in other privileged circumventions?
20	OTHER DMCA RULES 1201(k): mandate Macrovision DRM in VCRs (2^nd “precedent” for tech mandates) 1202 protects the integrity of “copyright management information” from alteration/removal 1203 provides broad remedies to successful plaintiffs (injunctions, statutory damages, etc.) 1204 makes willful violation of 1201 or 1202 for profit/financial gain a crime: up to $500K fine for 1^st offense, up to 5 yrs in jail up to $1M for 2^nd offense & up to 10 yrs in jail
21	SUCCESSFUL DMCA CLAIMS RealNetworks v. Streambox (W.D. Wash. 2000) Sony v. Gamemasters (N.D. Cal. 1999) Universal City Studios v. Reimerdes (SDNY 2000), aff’d sub nom. Universal City Studios v. Corley (2d Cir. 2001)
22	REALNETWORKS Streambox VCR allowed users to make personal use copies of content streamed with RN technology RN claimed 2 technical protection measures: “Authentication procedure” (i.e., exchange of messages between RN server sw & player = access control) “Copy switch” in RealMedia files lets content owner configure to allow downloads or not (= copy control) VCR was designed to bypass these two TPMs Bypassing authentication violated 1201(a)(2) Bypassing control switch violated 1201 (b)(1) Harm to RN = potential lost customers
23	STREAMBOX DEFENSES VCR has substantial non-infringing uses to enable fair use copying, and so is lawful under Sony-Betamax Technical measures were not “effective” because easy for users to capture streaming content and many ways to make personal use copies No obligation under 1201(c)(3) to build software responsive to “copy switch” NB: Didn’t raise an interoperability defense as to authentication procedure
24	RULING ON VCR DEFENSES Distinguished Sony-Betamax because many copyright owners didn’t object to TV-taping (fair use typically raised when copyright owners object) Sony-Betamax was overturned by 1201 (but what about (c)(2) added during struggle?) Copy switch is effective enough Unclear response to (c)(3) defense about not being obliged to respond to another firm’s TPM (a)(2) & (b)(1) violated so preliminary injunction
25	SONY v. GAMEMASTERS Most claims in Gamemasters were TM infringement claims; Sony won these Gamemasters sold game enhancer software that enabled end users to play Sony games country-coded for Japan Not copyright infringement to make/sell game enhancer software because of Galoob v. Nintendo But country-code = access control, and game enhancer program bypassed this, so 1201 violation (Reese paper) Effect of 1201 ruling is to give Sony an exclusive right to control the complementary product market (NB: it offers a product that competed with defendant’s game enhancer)
26	ANTI-COMPETITIVE USES? Dan Burk (UCLA L. Rev.): courts should create concept of “DMCA misuse” (akin to copyright misuse) Gamemasters is an example because game enhancer was not a “piracy” tool (couldn’t infringe using it) Sony was using the DMCA claim to control a complementary product market and exclude a competitor from the market Howard Berman: DMCA didn’t repeal anti-trust laws Courts may read limiting language into the DMCA rules where no potential for “piracy”
27	BACKGROUND TO CORLEY DVD movies are protected by CSS (Content Scrambling System) Norwegian teenager wrote a program, DeCSS, to bypass CSS & posted it on the Internet Corley edits 2600 Magazine, well-known computer hacker journal As part of 2600 story on the controversy about DeCSS, Corley posted DeCSS on the web & linked to sites where DeCSS was posted Universal et al. claimed this violated 1201(a)(2)
28	TRIAL COURT RULING CSS is an effective technical protection measure used by Universal et al. to control access to DVD movies; DeCSS primarily designed to bypass it Whether TPM is “effective” doesn’t depend on whether it uses strong or weak encryption Posting DeCSS on a website = “offer[ing] to the public” or “provid[ing]” a circumvention tool within meaning of 1201(a)(2); so is linking Statutory & constitutional defenses unpersuasive; injunction against both source and object code
29	STATUTORY DEFENSE Corley raised 1201(f) interoperability defense JJ testified at trial that he developed DeCSS to aid Linux programmers to make a Linux DVD player DCt rejected the 1201(f) defense this was not the “sole” purpose of developing DeCSS DeCSS ran on Windows, not Linux Linux developers could get license from DVD CCA Corley can’t raise defense because he’s not trying to develop an interoperable program 1201(f) doesn’t apply to interoperating with data (PI)
30	FIRST AMENDMENT Corley, a journalist, claimed a 1^st A right to post or link because DeCSS was a controversial issue of public importance Not given much attention in Corley opinions Corley also claimed that DeCSS is speech which he has a right to utter under the 1^st A 2d Cir: code 1^st A protected; functionality limits scope Corley claimed the DMCA was unconstitutional because it was not narrowly tailored to achieve substantial gov’t purpose (1^st A requires fair use)
31	FAIR USE & THE DMCA Does fair use apply to DMCA rules? Authorities disagree: 1 theory: 1201 is not copyright, so no fair use (Corley decisions; Nimmer; but Boucher/Lofgren seek change) 2^nd theory: 1201(c)(1) preserves it (Jane Ginsburg, me) 3^rd theory: DMCA anti-circumvention rules are unconstitutional unless some fair use hacking OK (e.g., Jane Ginsburg, Neil Netanel, Glynn Lunney, EFF) Is it also fair use to build a tool to enable fair use circumvention? (Boucher/Lofgren would allow)
32	OTHER DeCSS CHALLENGES DVD CCA v. Bunner: challenge to posting of DeCSS on state trade secrecy grounds (DVD CCA’s appeal now pending before California Supreme Court) Prosecution vs. Jon Johansen in Norway for unauthorized access to data because he allegedly RE’d CSS & developed DeCSS (acquitted but prosecutor has appealed)
33	DVD CCA v. BUNNER DVD CCA requires installation of CSS & anti-RE clauses in licenses for DVD players Claim is that Johansen misappropriated TS when reverse engineered CSS in violation of anti-RE clause of click-license, & developed DeCSS which embodies or is substantially derived from stolen TS Bunner et al. knew or should have known DeCSS embodied stolen TS when he posted it on Internet Suit vs. Bunner, 20 others, & 500 “John Does”
34	MORE ON BUNNER Superior Court found reasonable probability of success on merits & issued preliminary injunction vs. posting DeCSS in source or object code form Court of Appeal reversed on 1^st A grounds DeCSS in source code form = 1^st A speech preliminary injunction was unconstitutional prior restraint Cal. Supreme Court took DVD CCA’s appeal; argument not yet scheduled
35	JOHANSEN CASE JJ was indicted under Norwegian penal law forbidding unauthorized access to data Court ruled: Lawful to access contents of legally purchased movies, also to reverse engineer program Not a violation of this law to make personal use copies of own DVD movie Disclosure of CSS keys did not violate this law No contributory liability because program had legal uses
36	FAILED DMCA CLAIMS (#1,2) Sony v. Connectix & Bleem: Sony sued makers of emulation programs that allowed purchasers of PlayStation games to play them on other platforms for copyright infringement because of intermediate copying in the course of reverse engineering for DMCA violations because bypassed TMs in games 9^th Circuit ruled reverse en’g was fair use; did not address DMCA claim, but likely to win under 1201(f) because done to enable interoperability or 1201(c)(3) (“no mandate” rule)
37	FAILED DMCA CLAIMS (#3) RealNetworks v. Streambox: claim vs. “Ripper” software under 1201(b)(1)(B) Ripper enables users to convert .RMA files to MP3 or .WMA format RN alleged that the .RMA format for digital information was an effective technical measure protecting vs. unauthorized derivative works Ripper bypasses this TPM so violates anti-circumvention rules
38	FAILED DMCA CLAIMS (#3) Court rejected RN’s claims: Little evidence .RMA = effective TPM Commercially significant legitimate uses of Ripper exist Content owner may want to convert own files Users might want to convert content they have paid for from one format to another No evidence of injury to RN So no preliminary injunction on this
39	FAILED DMCA CLAIMS (#4) U.S. v. Elcom: criminal case brought vs. Russian firm that sold Advanced Adobe e-book Reader software on the Internet (software written by Dmitri Sklyarov whom FBI arrested in Las Vegas) AAEBR bypassed a TPM embedded in Adobe’s e-book reader Elcom argued this software wasn’t a piracy tool, but an enabler of backup copies, fair uses, and transfers of legitimate copies to new computers Jury acquitted Elcom after trial
40	DMCA CHALLENGE Secure Digital Music Initiative issued a “hacker challenge,” offering $10K for defeat of proposed digital watermarks (if agreed not to publish result, to disclose results & to assign IPRs in results to SDMI & RIAA) Felten et al. took the challenge, defeated TPMs, but wrote paper for scientific conference instead of seeking $$$ RIAA & SDMI threatened suit: detailed discussion about how to defeat watermarks in paper = distribution of circumvention technology under 1201 (Liu paper) Encryption research exception was seemingly inapplicable because SDMI watermarks did not use encryption
41	FELTEN v. RIAA Felten et al. sought a declaratory judgment that: Presenting & publishing the paper did not violate 1201 1^st A right to publish results of research After RIAA, SDMI, & Verance announced they had no objection to presentation of Felten paper at USENIX, court dismissed lawsuit Ashcroft brief: Felten’s intent was to improve security so didn’t violate 1201 (reading words of limitation into DMCA)
42	OTHER DMCA CASES Edelman v. N2D2: affirmative challenge to DMCA as applied to circumvention of encryption used to protect list of blocked sites embedded in mass-marketed filtering software Edelman wants to study effectiveness of filters N2D2 has moved to dismiss; pending 321 Studios v. MGM: seeking declaration that OK to make & sell software to allow backup copying of DVDs; defendant’s motion for SJ pending
43	OTHER DMCA CLAIMS Davidson v. Internet Gateway: open source sw enabled users to form private game network; RE as circumvention; program as circumvention tool Lexmark v. Static Controls: maker of printers and toner cartridges installed software access control to protect toner cartridges; Static Control “spoofs” the printer so that SC’s cartridge will operate Chamberlain v. Skylink: universal garage door opener is circumvention tool because it bypasses plaintiff’s access control software
44	LOC RULEMAKING Static Control has asked for exemption of Computer programs embedded in computer printers and toner cartridges Computer programs embedded in a machine or product which cannot be copied in ordinary use Computer programs embedded in a machine or product that control operation of a machine and do not otherwise control performance, display, or reproduction of copyrighted works Argues that Congress did not intend for anti-circumvention rules to extend to such works/situations
45	MORE PROPOSALS TO LOC Edward Felten: requests exemption for music & audiovisual works protected by access controls whose circumvention is reasonably necessary to carry out a legitimate research project EFF/Public Knowledge requests exemption for: (1) Copy-protected CDs (2) DVD Region Coding (3) Unskippable DVD Advertising (4) Public Domain Film on DVD
46	EU COPYRIGHT DIRECTIVE In most respects, it’s more restrictive than DMCA (March 1 session) Bans all acts of circumvention, not just of access controls Broad ban on circumvention technologies very similar to DMCA (but reaches possession as well) No exceptions, not even for encryption research No LOC-like rule-making processes But requires member states to ensure that copyright owners enable users to exercise some copyright exceptions, although doesn’t say how
47	OTHER NATIONS Many countries have yet to develop implementing legislation (even in EU) But some countries have anti-circumvention laws: Japan: crime to make/distribute circumvention technologies or offer circumvention services as a business (tools but not acts) China: illegal to intentionally circumvent technical measures protecting copyrighted works unless permission of copyright owner or the law (acts but not tools)
48	AUSTRALIA Illegal to make, import, or distribute circumvention device that the person knew, or ought reasonably to have known, would be used to circumvent an effective technical measure protecting copyrighted works Exception if user signs statement of intent to use device for legitimate purpose
49	MOD CHIP CASES Kabushiki Kaisha Sony Computer Entertainment v Stevens: Federal Court of Australia decided that region-coding was not a technological protection measure and that mod chips were not illegal circumvention devices Sony v. Channel Technology: High Court in UK ruled vs. sale of mod chips to allow PlayStations to play imported games, thereby defeating region-coding, as violation of anti-circumvention rule
50	U.S. LEGISLATIVE/POLICY INITIATIVES Consumer Broadband & Digital Television Promotion Act (aka the “Hollings bill”) Broadcast flag initiative (March 1 session) Other standard-setting processes Consumer protection initiatives Boucher/Doolittle bill (March 1 session) Lofgren/Honda bill (March 1 session) Compulsory license proposals (Sobel paper)
51	HOLLINGS BILL (S. 2048) Consumer Broadband & Digital Television Promotion Act Makers of digital media devices, copyright owners, & consumer groups would have 12 mo. to reach agreement on standard security measures to be installed in devices FCC to issue rule to require installation in all devices If no agreement, FCC will choose security standard anyway & mandate it in digital media devices Illegal to make or provide digital media device w/o SSM Also illegal to remove/alter SSM Criminal as well as civil penalties (same as DMCA)
52	ARGUMENTS FOR Digital content (e.g., music, movies) won’t really be secure until DRMs in all digital media systems (including general purpose computers) Computer/software industry has resisted “voluntary” standards on DRMs Standards are essential to ensure interoperability Mandating DRMs is the only way to ensure they won’t be competed away Broadband deployment arguably hindered by threat of “piracy,” so stronger legal protection is necessary
53	ARGUMENTS VS. Would prevent many beneficial uses of IT Would add expense to IT systems Would undermine system performance Would retard innovation & investment in IT May make systems more vulnerable to hacking (if DRM = “break once, break everywhere” system) Biddle et al.: DRM will not prevent “Darknet” distribution of content (may increase it) The government & content industry shouldn’t dictate how the IT industry builds its products
54	BROADCAST FLAG Content owners/broadcasters/5C firms propose a standard way to embed BF in broadcast signal to be “read” by digital TV tuners (Sobel discusses) Goal: To ensure that DTV tuners won’t pass content that shows the appropriate “flag” to any device, unless the device supports a secure transmission format (DTCP or HDCP) and a secure copying format (CPRM or similar). Broadcast Protection Discussion Group within CPTWG issued report to endorse BF standard Voluntary standard won’t achieve goal, so proponents seeking FCC action, or legislation (Tauzin interested)
55	BROADCAST FLAG AT FCC FCC is conducting a rule-making about whether to require technologies to give effect to BF Issues: Whether necessary to ensure quality content Whether BF would enable control of “piracy” Impact of tech mandate on consumer electronics and computer industries (impact goes beyond TV to demodulators, modulators, downstream devices) Impact of tech mandate on consumers Whether FCC has jurisdiction to mandate this
56	OTHER STANDARD EFFORTS SDMI: failed consortium for digital watermarks for music and players (variance in interests; proposed watermarks quickly proven defeatable) CPTWG (Copy Protection Technical Working Group) does more than BF Electronic Book Exchange (EBX) Working Group Various standard-settings efforts underway to standardize on DRM languages e.g., OASIS Rights Language Technical Committee considering XrML as standard
57	CONSUMER PROTECTION DMCA has modest consumer protections non-profit “shopping” privilege protection of personal data privilege parental control privilege LOC rulemaking added two others broken access control study of filtering software Cohen paper discusses DRM privacy issues
58	HR 107 (Boucher/Doolittle bill) Would require adequate labeling of copy-protected CDs (e.g., warning that disk may not play on device of your choice or allow space-shifting onto your hard drive) Reforms to DMCA: OK to circumvent if no infringement occurs OK to make tool to enable fair and other significant non-infringing uses OK to circumvent and make tools for scientific research (not just for encryption research)
59	HR 5522 (Lofgren-Honda bill) Introduced in 107^th Cong; intends to reintroduce Fair use applies to analog or digital transmissions Right to make backup copies, display copies Mass-market licenses for digital content can’t override user rights Allow first sale rights for digital copies Reforms of DMCA: OK to circumvent DRM to make fair uses OK to make tools necessary to enable lawful circumventions
60	COMPULSORY LICENSES Recall that AHRA allowed 1^st generation personal use copying but taxed DATs New proposals (discussed by Sobel) for compulsory licensing of digital works Netanel’s noncommercial use levy (would allow copying, dissemination, & adaptation) Fisher’s tax and royalty system (tax bandwidth & devices, but allow copying & distribution)
61	DRM {AND/OR/VS.} LAW DRM as copyright enforcement mechanism (and) DRM as an alternative mechanism to copyright law (or) code as code standard-setting processes as alternative to law DRM as a means to override the law (vs.) way to override fair use, 1^st sale, public domain Law can be a means to control DRM (e.g., require privacy protection) (a different species of vs.)