Copyright Office Realizes The DMCA Fucks With Security Research While The W3C Still Doesn't See It

from the what-a-world dept

Last week, the Copyright Office finally released a report that it had been working on for some time, looking specifically at Section 1201 of the DMCA. In case you're new around here, or have somehow missed all the times we've spoken about DMCA 1201 before, that's the "anti-circumvention" part of the DMCA. It's the part that says it's against copyright law to circumvent (or provide tools to circumvent) any kind of "technological protection measures," by which it means DRM. In short: getting around DRM or selling a tool that gets around DRM -- even if it's not for the purpose of infringing on any copyrights -- is seen as automatically infringing copyright law. This is dumb for a whole host of reasons, many of which we've explored in the past. Not only is the law dumb, it's so dumb that Congress knew that it would create a massive mess for tons of legitimate uses. So it built in an even dumber procedure to try to deal with the fact it passed a dumb law (have you noticed I have opinions on Section 1201?).

Specifically, every three years, people and companies can petition the Copyright Office/Librarian of Congress to "exempt" certain technologies or uses from 1201, saying that it is legal to circumvent the technological protection measures in that case, for the succeeding three years (yes, after three years, the original exemption expires, unless it is renewed). This triennial review process has historically been an (annoying) joke, where people basically have to beg the Copyright Office to let them, say, get around DVD DRM, in order to make documentaries. Or, famously, that time in 2012 when the Librarian of Congress refused to renew the phone unlocking exemption, magically making it illegal to unlock your phone for no clear reason at all. The whole thing is fairly described as a hot mess.

And, it really harms our own security the most.

That's because security researchers often need these exemptions the most, because they don't want to be accused of violating copyright law for doing their jobs in figuring out where there are weaknesses and vulnerabilities in various technologies. So, many of the applied for exemptions tend to come from the security community -- and sometimes they're granted, and other times they are not. A year ago, some security researchers (along with the EFF) sued the US government, arguing that 1201 violates the First Amendment, scaring off security researchers, and providing none of the usual defenses against infringement, such as fair use (which the Supreme Court has argued is a necessary First Amendment valve on copyright). That case is still waiting for a judge to rule on early motions (and it's waiting a long time).

Given all that as background, it's somewhat fascinating (and marginally surprising) to see that the Copyright Office officially agrees that the 1201 setup totally sucks for security researchers, and it would actually like Congress to fix that. The report specifically recommends expanding the existing "permanent exemption" for certain types of "security testing" to make it more applicable to a wider set of security practices:

... the Office recommends that Congress consider expanding the exemption for security testing under section 1201(j). This could include expanding the definition of security testing, easing the requirement that researchers obtain authorization, and abandoning or clarifying the exemption’s multifactor test for eligibility.

There's another section in the law for "encryption research" and, again, the Copyright Office recognizes that should be expanded:

The exemption for encryption research under section 1201(g) may benefit from similar revision, including removal of the requirement to seek authorization and clarification or removal of the multifactor test.

For what it's worth, the report (obviously remembering how it got basically mocked and burned by everyone for removing the cell phone unlocking exemption in 2012) now asks for phone unlocking to be designated a permanent exemption under the law.

These are fairly small changes being sought by the Copyright Office, but it strikes me as somewhat incredible (and very disappointing) that this small bit of enlightenment goes much further than the World Wide Web Consortium's (W3C) view on DRM and security research. As you may recall, there's this ongoing battle over DRM in HTML 5. When the W3C refused to block it outright, some members came up with a fairly straightforward no-brainer rule: all members had to agree not to go after security researchers for circumventing the DRM in HTML 5. And the W3C rejected that proposal.

In other words, the Copyright Office -- famous for its historically expansionist view of copyright, as well as its general tilt towards supporting Hollywood over everyone else -- is now recognizing that it's obvious that security researchers should have the right to circumvent DRM without violating copyright law, while the W3C -- famous for promoting an open web -- is against this. This is "up is down, night is day, cats & dogs living together" kind of stuff. Maybe someone should let the W3C know that it's position on security researchers and DRM is now more extremist than the Copyright Offices?

Either way, at the very least, Congress should follow up on this report and expand the exemptions for security research. It doesn't just help out those researchers, it helps all of us when security researchers are able to do their jobs and help to protect us all.

Filed Under: anti-circumvention, copyright office, dmca, dmca 1201, drm, research, security, triennial review
Companies: w3c

Canadian Court Chips Away At Anti-Circumvention Exceptions In Massive Win For Nintendo

from the shifting-more-power-to-the-powerful dept

The first major ruling [PDF] by a Canadian court applying the country's anti-circumvention laws has been handed down and it's not good news. The law provides for a few exceptions to its broad restrictions on bypassing technological protection mechanisms (TPMs), but as the court sees it, any anti-circumvention process that might lead to infringement violates the statute.

Not that the courts have done a great job interpreting the law to this point. In 2015, a Canadian judge ruled that simply asking for a copy of a paywalled article was illegal circumvention. The lawsuit at hand -- reported by Michael Geist -- isn't a great test case for exploring the outer limits of the anti-circumvention law. But the conclusions reached have severely negative implications for others not quite so entangled in facilitating infringement.

Go Cyber Shopping made mod chips for Nintendo products that allowed users to bypass built-in protections to play "homebrew" games and, of course, pirated carts. Go Cyber defended its products by attempting to highlight the "homebrew" aspect, rather than the chip's ability to defeat Nintendo's copyright protection schemes. As is to be expected, Nintendo's lawyers did a far better job presenting their case than Go Cyber's did.

Go Cyber Shopping offered a wide range of products that allow users to circumvent the digital lock controls on the Nintendo gaming console (such as the Wii) and play unauthorized games including “homebrew” games. Go Cyber Shopping argued that it provided other services but the court says that it did not tender any evidence in that regard.

Even if Go Cyber had done a better job presenting its case, it's unlikely the court would have sided with it. As Geist points out, the court went out of its way to address arguments not even raised by the defendant in order to bolster anti-circumvention laws.

It adopted a broad interpretation of a technological protection measure – rejecting a UK case that used a narrower interpretation – in favour of an approach that covers access controls that go beyond restrictions on copying. It states:

having regard to Parliament’s express intent to give copyright owners the power to control access to works, the principle of technological neutrality, the scheme of the Act, and the plain meaning of the definitions for TPM and “circumvent”, it is clear that access control TPMs do not need to employ any barrier to copying in order to be “effective”.

In other words, Canadian copyright law is no longer just about copying as the digital lock rules create legal rights to limit access even without any actual copying.

Going beyond that, the court basically declares that interoperability efforts should be left to manufacturers only. Third parties who bypass circumvention for these purposes are likely to end up in Go Cyber's incredibly expensive shoes. But that's a concerning conclusion to reach, because it could end up doing damage to existing anti-circumvention exceptions.

[T]here are currently anti-circumvention exceptions for access to materials for the visually impaired, to protect personal information, and for security research. Those exceptions should not be dismissed simply because there may be alternate ways to safeguard privacy or conduct security research. Indeed, the use of circumvention may be a necessity given the possibility that companies could offer opportunities for third-party security research but subject to restrictions or conditions that limit the effectiveness of the research activity.

But that's how the law is interpreted in the Federal Court of Canada. Lawful anti-circumvention efforts took some collateral damage, but Go Cyber Shopping is headed to a burial in a pauper's grave. The court awarded Nintendo the maximum amount ($11,000) per infringement, and another $1 million for its pain. Go Cyber now has to come up with $12.7 million it certainly doesn't have.

As for the Canadian public, it's suffered a loss. The determinations made in this opinion make it that much more difficult to truly own what they've purchased. Anti-circumvention statutes have been bolstered and anything that could be construed as leading to possible infringement is now a plausible litigation target.

Filed Under: anti-circumvention, copyright, homebrew, modchips
Companies: go cyber shopping, nintendo

Hey, You Can Hack Your Car Without Violating Copyright Law (For A Little While)

from the and-you-may-still-violate-other-laws dept

In my talk last week at Wikimedia, one of the examples I gave of "copyright creep" where copyright law is being shoved into areas where it obviously doesn't belong was that time when John Deere and GM argued that you didn't really own parts of the vehicles you bought from them, because of copyright. The underlying issue was that these companies didn't want the Librarian of Congress to exempt hacking cars and tractors from section 1201 of the DMCA. 1201 is the anti-circumvention provision that says that getting around technological protection measures (even if not for the purpose of infringing on copyright) is still infringement. Ridiculously, even the EPA sided with these companies arguing that hacking cars could override environmental protections. However, as we pointed out at the time, there are other laws to handle that kind of thing. Don't abuse copyright for that purpose.

When the exemptions came out from the Librarian of Congress, we noted that the whole thing was a hot mess, in which it sort of granted the exemption on vehicle hacking... but with a bunch of weird limitations and caveats. One of those was a bizarre delay of 12 months:

Computer programs that are contained in and control the functioning of a motorized land vehicle such as a personal automobile, commercial motor vehicle or mechanized agricultural vehicle, except for computer programs primarily designed for the control of telematics or entertainment systems for such vehicle, when circumvention is a necessary step undertaken by the authorized owner of the vehicle to allow the diagnosis, repair or lawful modification of a vehicle function; and where such circumvention does not constitute a violation of applicable law, including without limitation regulations promulgated by the Department of Transportation or the Environmental Protection Agency; and provided, however, that such circumvention is initiated no earlier than 12 months after the effective date of this regulation.

It was never entirely clear why there was such a delay, but it was there. And last week the delay was finally over. Twelve months had passed, and you can now hack parts of your car without violating copyright law. But, of course, this exemption only lasts two more years and then everyone has to go through the whole stupid process again. There are also odd things like that you can only do this kind of hacking on your own vehicles, and you can't hire someone to do it for you (again, this makes no sense). There is an effort underway to make the exemption permanent, but who knows how that will go. And, of course, as some have noted, those hacking their cars may still run into some legal issues -- such as potentially violating the Computer Fraud and Abuse Act (CFAA), though that would require quite a strained reading of the law.

In the short term, the fact that you won't be dinged for copyright infringement for merely tinkering with your car is a good thing.

Filed Under: 1201, anti-circumvention, car hacking, copyright, dmca 1201, exemptions, triennial review

EFF Asks Court To Block The DOJ From Prosecuting Researcher For DMCA Violations

from the jumping-ahead-of-the-threat dept

A few more wrinkles have appeared in the EFF's attempted legal destruction of the DMCA's anti-circumvention clause. Back in July, the EFF -- along with researchers Bunny Huang and Matthew Green -- sued the government, challenging the constitutionality of Section 1201 of the DMCA. As it stands now, researchers are restricted by the limitations built into the anti-circumvention clause. The Library of Congress can grant exceptions, but these are only temporary, lasting three years and generally vanishing at the end of that term.

Projects and research efforts continue to be thwarted by this provision, opening up those who circumvent DRM and other protective measures to the possibility of prosecution. And their options when facing charges are severely limited. There is no "fair use" exception to Section 1201 of the DMCA -- something the EFF would like to see changed.

The threat of prosecution may be mostly existential, but it's still far from nonexistent. This is why the EFF has requested a preliminary injunction that would prevent the DOJ from trying to put its client in jail.

The Electronic Frontier Foundation (EFF) asked a court Thursday for an order that would prevent the government from prosecuting its client, security researcher Matthew Green, for publishing a book about making computer systems more secure.

[...]

But publishing the book, tentatively entitled Practical Cryptographic Engineering, could land Green in jail under an onerous and unconstitutional provision of copyright law. To identify security vulnerabilities in a device he has purchased, Green must work directly with copyrighted computer code, bypassing control measures meant to prevent the code from being accessed.

The injunction request [PDF] points out that -- in addition to the anti-circumvention clause being a form a prior restraint -- Green will be performing the sort of actions the DOJ has prosecuted people for in the past.

A rigorous and effective audit of a computer system’s security requires that Dr. Green analyze the software controlling the system. Often, secure computer systems prevent access to their software code through technological protection measures (“TPMs”) such as encryption, username/password combinations, or physical memory restrictions preventing a user from accessing certain stored information. An adversary seeking to extract information about the software code or about the system’s user, or to install their own malicious software, would seek to bypass these measures in order to maximize their ability to locate and exploit vulnerabilities.

To identify security flaws, Dr. Green must do the same; indeed, finding and reporting on the vulnerability of these access controls is a critical part of auditing the security of the system. If he does not bypass access controls in a computer system, Dr. Green’s research is significantly limited. While he may be able to discover some vulnerabilities, he cannot determine with confidence whether devices are secure against an adversary willing to circumvent access controls.

The DOJ has already responded (sort of) to some of the claims raised in the EFF's injunction request. Its motion to dismiss [PDF] -- filed the same day as the EFF's injunction request -- claims the EFF and Matthew Green have no standing to challenge Section 1201 of the DMCA. Not only that, but they cannot provide any evidence prosecution is likely if Green continues with his research work.

Plaintiffs’ claims should be dismissed in their entirety. As an initial matter, Plaintiffs lack standing to raise their First Amendment claims on a pre-enforcement basis because the assertions in their Complaint fail to establish a credible threat of prosecution, under the DMCA’s criminal enforcement provision, for engaging in constitutionally-protected activity. None of the Plaintiffs claims to have been threatened with criminal prosecution. Plaintiffs’ conclusory assertion that others have been prosecuted under the DMCA in the past, for unidentified reasons, is insufficient to establish that Plaintiffs face a credible threat, as is their assertion that third parties might bring suit against them under a separate civil private right of action. Moreover, Plaintiffs fail plausibly to assert that the acts of circumvention and trafficking that they wish to undertake qualify as speech or expressive conduct that is entitled to First Amendment protection but prohibited by the DMCA.

The DOJ's arguments roughly align with the assertions made in its motion to dismiss in a lawsuit brought by security researchers and the ACLU against the much-hated CFAA. Once again, the DOJ recognizes that Green's book may be covered by the First Amendment, but actions taken during its compilation may not be.

In both cases, though, the statutes lend themselves to punishing security researchers for performing security research. While the DOJ may have no intention of prosecuting Green for his work, the anti-circumvention clause allows it to hold onto that option for as long as it wants to. The only way to guarantee this won't happen is to obtain an injunction, but chances are the court won't be as interested in staving off the theoretical as it will be in examining the First Amendment claims.

Filed Under: anti-circumvention, copyright, dmca, dmca 1201, doj, matthew green, research
Companies: eff

Can Someone Explain To The RIAA That SOPA Didn't Actually Pass?

from the let's-try-this-again dept

Earlier this week, basically all of the major record labels filed a lawsuit against YouTube-mp3.org, which as you may have guessed from the URL, helps people get audio downloads from YouTube videos. There have been a number of similar sites over the years, and they tend to disappear relatively quickly. Apparently this one lasted long enough that the major labels decided to sue.

There are many, many, many problems with the lawsuit which we'll be discussing, but let's start with the big one. The RIAA and the labels seem to believe that SOPA became law back in 2012, rather than being soundly rejected. That's because, as the EFF notes in a blog post, the real target of the lawsuit does not appear to be Youtube-mp3.org, but a bunch of third party service providers. Specifically, the lawsuit asks for two highly questionable remedies targeting non-parties to the lawsuit:

enjoining Defendants and all third parties with notice of the Order, including any Web hosts, domain-name registrars, domain name registries, and proxy or reverse proxy services, and their administrators, from facilitating access to any or all domain names, URLs and websites (including, without limitation, www.youtube-mp3.org) through which Defendants infringe Plaintiffs’ copyrights;

and

enjoining all third parties with notice of the Order from maintaining, operating, or providing advertising, financial, technical, or other support to YTMP3 and any other domain names, URLs, or websites through which Defendants infringe Plaintiffs’ copyrights, including without limitation www.youtubemp3.org; and enjoining all third-party distributors of applications, toolbars or similar software with notice of the Order from distributing any applications, toolbars, or similar software applications that interoperate with any domain names, URLs, or websites through which Defendants infringe Plaintiffs’ copyrights, including without limitation www.youtube-mp3.org.

Again, this was the kind of remedy SOPA was designed to enable. But SOPA did not become law. As the EFF points out:

As we’ve explained before in other cases, this request is a gross overreach. Federal court rules have a narrow provision that lets successful plaintiffs request a court order against a defendant and people in “active concert and participation” with them, meaning a close associate or co-conspirator. That provision doesn’t allow for orders that bind every vendor providing services to a defendant, especially those with no direct business relationship. So the litany of intermediaries listed in the labels’ complaint are not within the court’s power to bind.

What the complaint asks for is also far broader than the law allows. By asking all of those intermediaries to block all “websites through which Defendants infringe Plaintiffs’ copyrights,” without specifying the URLs, the labels are seeking to conscript all of these companies as investigators who must chase down the defendants and block every website they use, under any name. Neither copyright nor trademark law allows courts to put this burden on Internet intermediaries, and for good reason: it’s prohibitively expensive for many, it inevitably leads to blocking of lawful speech, and it gives a big advantage to established players.

Finally, and perhaps worst of all, the record labels want to ban “any applications” that might “interoperate” with with youtube-mp3.org and any other websites owned by the defendants. That would seem to require every Web browser, mobile app, and Internet-connected device to block an ever-changing list of websites. Left unchecked, these kinds of orders could become a mechanism whereby the content industry gets veto power over online innovation.

Also, according to the lawsuit, which was filed in California, the site is owned by a guy in Germany, Philip Matesanz. An RIAA press release notes that the IFPI has also indicated it's going to file a similar case in the UK. Considering that there's a decently high chance that the guy in Germany won't bother responding to a lawsuit halfway around the world, the RIAA and its labels may simply be hoping for a default judgment, which they can then use to force all those third parties into blocking a website, despite a lack of a full trial over the issues with the case.

And, oh boy, does this lawsuit have serious issues. On a conceptual level, how is what this site is doing really all that different from a VCR in recording a TV show? In this case, it's just recording an audio file from a video file. And such recordings for personal time shifting uses are considered fair use and not infringing. It's also quite a useful tool for other fair use activities too — we've used a similar site to grab audio quotes from videos for discussion in our podcast. The "stream ripping" site is just a tool for making such fair use recordings, meaning it has substantial non-infringing uses. So why do the RIAA and these labels insist that it's infringing?

The lawsuit notes that this service likely violates YouTube's terms of service, but YouTube/Google are not the plaintiff. They're not the ones arguing over the terms of service being violated (in fact, you could argue that Google is a target of the lawsuit via the third party injunction attempts discussed above).

Part of the lawsuit alleges that YTMP3 violates the DMCA by "circumventing" YouTube's "technological measures" designed to block access to the actual video file, but it's not clear how this kind of thing is really a technological protection measure under the DMCA. All it does is obscure the full URL, but still make it accessible. Is it really circumvention to figure out how to get to a publicly accessible URL? That seems like a big leap by the RIAA:

Plaintiffs are informed and believe, and on that basis allege as follows: YouTube has adopted and implemented technological measures to control access to content maintained on its site and to prevent or inhibit downloading, copying, or illicit distribution of that content. YouTube maintains two separate URLs for any given video file: one URL, which is visible to the user, is for the webpage where the video playback occurs, and one URL, which is not visible to the user, is for the video file itself. The second URL is generated using a complex (and periodically changing) algorithm – known as a “rolling cipher” – that is intended to inhibit direct access to the underlying YouTube video files, thereby preventing or inhibiting the downloading, copying, or distribution of the video files.

That second URL is not "protected" in any real way. It's a publicly accessible URL -- it's just that YouTube doesn't make it easy to find. So does that really count as circumvention? That seems like a big question here as well.

Either way, as noted above, these important questions may not get answered if YTMP3 simply decides to ignore the lawsuit -- and the RIAA may very well be counting on that. It really does seem like the labels deliberately picked a site that is likely not interested in defending this lawsuit, no matter how questionable, allowing it to really go after a ton of 3rd party sites and services, as if SOPA were the law.

Filed Under: anti-circumvention, copyright, dmca, sopa, stream ripping, third party injunctions

Techdirt Reading List: Wired Shut: Copyright And The Shape Of Digital Culture

from the digital-locks dept

We're back again with another in our weekly reading list posts of books we think our community will find interesting and thought provoking. Once again, buying the book via the Amazon links in this story also helps support Techdirt.

I've been going back through various books from the past and came across Tarleton Gillespie's amazing Wired Shut: Copyright and the Shape of Digital Culture from almost a decade ago. However, it's still very, very relevant today, especially as we're constantly discussing how DRM is impacting the way physical products are built and while there is a big debate happening about Section 1201 of the DMCA.

Gillespie saw all of this pretty early on, using many of the early examples of how 1201 basically enabled companies to force certain product design decisions that really had nothing to do with stopping "piracy," but were very much about locking out competition or holding back innovation. The book pulls together the thread on three of the biggest fights from the 2000s around these issues: (1) The silly fight over SDMI, the RIAA's preferred DRM that was so bad that they had to threaten professor Ed Felten for showing how bad it was. (2) The similarly stupid freakout over DeCSS encryption for DVDs. (3) And the attempt to lock down television with a needless broadcast flag. While the specific technologies may have changed, the fights are pretty damn similar a decade later, and it's worth reading (or rereading) Wired Shut to remind you of the past as we prepare to fight for the future.

Filed Under: anti-circumvention, broadcast flag, copyright, decss, dmca, dmca 1201, drm, sdmi, tarleton gillespie

EFF Lawsuit Challenges DMCA's Digital Locks Provision As First Amendment Violation

from the well,-that's-interesting dept

Computer security professor Matthew Green and famed hardware hacker Bunnie Huang have teamed up with the EFF to sue the US government, challenging the constitutionality of Section 1201 of the DMCA, also known as the "anti-circumvention" clause. As we've discussed for many years, 1201 makes it against the law to "manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof" that is designed to "circumvent" DRM or other "technological protection measures." There are all sorts of problems with this part of the law, including the fact that it doesn't matter why you have that tool or why you're circumventing the DRM. For example, it would still be considered infringement if you cracked DRM on a public domain work. That's... insane.

The only "safety valve" on this is the ridiculous triennial review process, whereby people can beg and plead with the Librarian of Congress to "exempt" certain scenarios from being covered by 1201. The process is something of a joke, and even if you get an exemption one time, it automatically expires after three years, and the Library of Congress might not renew it.

The lawsuit, filed by EFF and some excellent lawyers from Wilson Sonsini, points out that the Supreme Court has long stated that fair use is the "safety valve" that stops copyright law from violating the First Amendment in regulating speech. But fair use isn't an allowable defense under 1201, leading to a question of whether or not 1201 itself violates the First Amendment:

Enacted in 1998, these provisions broadly restrict the public’s ability to access, speak about, and use copyrighted materials, without the traditional safeguards—such as the fair use doctrine—that are necessary to protect free speech and allow copyright law to coexist with the First Amendment. The threat of enforcement of these provisions chills protected and noninfringing speech that relies on copyrighted works, including independent technical research into computer security systems and the discussion of that research, and accessing copyrighted works in order to shift the content to a different format, space, or time. The triennial rulemaking process by which the public may seek exemptions pursuant to 17 U.S.C. § 1201(a)(1)(C) does not alleviate these problems. To the contrary, the rulemaking is itself an unconstitutional speech-licensing regime.

The complaint highlights how both Green and Huang have been scared away from working on various projects that have nothing to do with copyright-covered content, but both of which involve circumventing technological protection measures. In Green's case, it's about his security research, finding computer security problems in various devices. For Huang it's his work on a NeTVCR, an advancement on the NeTV device he created in the past. For it to work, however, he needs to get around HDCP and that, of course, would violate 1201. This presents a problem:

To the extent that the purpose of Section 1201 is “to promote the progress of science and the useful arts,” see U.S. Const. Art I, Sec. 8, cl. 8, its restrictions are not narrowly tailored to this purpose. Rather, they sweep up a vast amount of protected speech. This includes the speech that Green, Huang, Alphamax, and users of NeTVCR would undertake, but for the fear or criminal and other penalties. It also includes the many forms of speech that have been the subjects of exemption requests, and many additional forms of speech that have not yet been the subject of an exemption request. The means chosen in Section 1201 specifically targets the communicative impact of uses of copyrighted works and speech about the circumvention of TPMs that restrict such works.

Separately, as noted in the quote above, the case argues that the triennial review process itself violates the First Amendment.

The rulemaking contemplated by Section 1201(a)(1) is a licensing regime that lacks the safeguards the First Amendment requires. The combined ban and exemption process grants excessive power to a government official to make discretionary case-by-case decisions absent sufficient controlling standards.

Section 1201 does not provide for timely review of requests for permission to speak. Applicants must wait up to three years for an opportunity to participate in the triennial rulemaking, and the Rulemaking Defendants have no deadlines governing when they must issue a rule granting or denying exemption requests.

As Huang notes in his blog post about the case, this is a really big issue. It's both about free speech and what it means to "own" something.

Before Section 1201, the ownership of ideas was tempered by constitutional protections. Under this law, we had the right to tinker with gadgets that we bought, we had the right to record TV shows on our VCRs, and we had the right to remix songs. Section 1201 built an extra barrier around copyrightable works, restricting our prior ability to explore and create. In order to repair a gadget, we may have to decrypt its firmware; in order to remix a video, we may have to strip HDCP. Whereas we once readily expressed feelings and new ideas through remixes and hardware modifications, now we must first pause and ask: does this violate Section 1201? Especially now that cryptography pervades every aspect of modern life, every creative spark is likewise dampened by the chill of Section 1201.

The act of creation is no longer spontaneous.

Our recent generation of Makers, hackers, and entrepreneurs have developed under the shadow of Section 1201. Like the parable of the frog in the well, their creativity has been confined to a small patch, not realizing how big and blue the sky could be if they could step outside that well. Nascent 1201-free ecosystems outside the US are leading indicators of how far behind the next generation of Americans will be if we keep with the status quo.

Our children deserve better.

The argument here is compelling. 1201 has all sorts of problems, but no one has tested this First Amendment argument before. Unfortunately, our courts have been incredibly (and unfortunately) reluctant to seriously consider constitutional challenges to copyright law. The cases that have made it up through the court system have ended unfortunately badly -- cases like the Eldred case challenging copyright term extension, for example. I hope that this one turns out differently, and it may become a case to watch. Again, the arguments are quite compelling to me, but I'm unfortunately skeptical that the judicial system will agree. I hope I'm wrong.

Filed Under: 1201, anti-circumvention, bunnie huang, dmca, dmca 1201, fair use, first amendment, free speech, hacking, matthew green, research, security research, triennial review
Companies: eff

Dismantling The Repair Monopoly Created By The DMCA's Anti-Circumvention Rules

from the tractor-liberation-front dept

One of the biggest victories of the copyright maximalists was the successful adoption of the 1996 WIPO Copyright Treaty, implemented by the DMCA in the US, and the Copyright Directive in the EU. Its key innovation was to criminalize the circumvention of copyright protection mechanisms. That strengthens copyright enormously by introducing yet another level of legal lockdown, and thus yet another powerful weapon for copyright holders to wield against their customers. But as Techdirt has reported, the anti-circumvention laws are now being used to prevent people from exploring or modifying physical objects that they own.

The DMCA's anti-circumvention rules not only strengthen an old monopoly -- copyright -- they create a new one. Because it is forbidden to circumvent protection measures, only the original manufacturer or approved agents can legally repair a device that employs such technologies. Motherboard has an interesting profile of efforts by the wider repair industry to dismantle that new monopoly before it spreads further and becomes accepted as the norm:

Repair groups from across the industry announced that they have formed The Repair Coalition, a lobbying and advocacy group that will focus on reforming the Digital Millennium Copyright Act to preserve the “right to repair” anything from cell phones and computers to tractors, watches, refrigerators, and cars. It will also focus on passing state-level legislation that will require manufacturers to sell repair parts to independent repair shops and to consumers and will prevent them from artificially locking down their products to would-be repairers.

The advocacy group is not exactly new, more of a re-branding and re-launching of "The Digital Right to Repair Coalition", which was formed in 2013. Its aims are ambitious:

The Repair Coalition will primarily work at a federal level to repeal Section 1201 of the DMCA, which states that it's illegal to "circumvent a technological measure that effectively controls access to a work protected under [the DMCA]." Thus far, activists have tried to gain "exemptions" to this section -- it's why you're allowed to repair a John Deere tractor or a smartphone that has software in it. But the exemption process is grueling and has to be done every three years.

Given the power of the industries that support Section 1201, it's hard to see it being repealed any time soon. However, the other part of the Repair Association's strategy looks more hopeful:

On a state level, the group will push for laws such as one being proposed in New York that would require manufacturers to provide repair manuals and sell parts to anyone -- not just licensed repair people -- for their products. The thought is that, if enough states pass similar legislation, it will become burdensome for manufacturers to continue along with the status quo. At some point, it will become easier to simply allow people to fix the things they own.

As software is routinely added to yet more categories of everyday physical objects, so the issue of the repair monopoly created as a by-product of the DMCA will become more pressing. It's good that there is now an advocacy group focussed on solving this problem. Let's hope it succeeds.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: anti-circumvention, copyright, dmca, dmca 1201, repair monopoly, right to repair
Companies: eff, ifixit

Warner Brothers, Intel Begin Futile Legal Assault To Defend Ultra HD And 4K DRM

from the let-the-whac-a-mole-commence! dept

If you've recently decided to jump on board the ultra-high-definition (UHD) and 4K TV craze and bought a shiny new UHD set, you've probably run into HDCP (High-Bandwidth Digital Content Protection) 2.2 by now. It's the latest version of the entertainment industry's video copy protection standard designed to secure UHD content. Unfortunately for consumers who rushed out to buy a new 4KTV set, they soon realized that every device in your home theater chain needs to support HDCP 2.2 in order to enjoy UHD.

That means that anybody with a new HDCP 2.2 compliant set also needs to spend money to upgrade their home audio receiver to one that's HDCP 2.2 compliant, just so the entertainment industry can be provided with a false sense of security for a standard everybody knows will be bypassed in months.

And bypassed it quickly was. Last November copies of most major UHD/4K movies started showing up on BitTorrent. It's believed that most of these copies were thanks to a Chinese company by the name of LegendSky, which has been selling HDCP 2.2 stripping hardware under the HDFury brand. Variations of these sleek-looking devices start at $200 and sit between HDCP 2.2 compliant devices:Believing it can keep the lid on HDCP 2.2 stripping technology, Warner Brothers and Intel's daughter-company Digital Content Protection have filed suit (pdf) against LegendSky. According to the lawsuit, the company's technology violates not only the DMCA’s anti-circumvention provisions, but also the Lanham Act by falsely claiming that its HDFury hardware complies with HDCP’s license requirements. The suit, as you might expect, spends countless calories praising HDCP as an essential part of the video delivery ecosystem despite its long history of causing confusion and frustration:

"HDCP plays a critical role in linking consumer electronics devices, personal computers, cable and satellite set-top boxes, and other Digital Devices to allow consumers to access and enjoy digital audiovisual content across a wide array of products, all while effectively protecting the rights of copyright owners and controlling access to copyrighted digital content.

Of course, the only thing HDCP 2.2 "links" is the consumer's wallet to companies making new HDCP 2.2 compliant home theater components they may or may not actually need. Warner Brothers hopes that it can get HDFury's gear off the market before the company releases 35 movies on Ultra HD Blu-ray for the first time later this year. But the damage has been done, and it's only a matter of time before countless more HDCP 2.2 bypassing solutions flood the market, once again highlighting DRM's incredible ability to do little more than eat money and annoy paying consumers.

Filed Under: 4k tv, anti-circumvention, copy protection, dmca, dmca 1201, drm, hd, hdcp, hdfury, uhd
Companies: digital content protection, intel, legendsky, warner brothers

The DMCA Has Delivered Us Into The Hands Of The Proprietary Internet Of Disconnected Things

from the a-William-Gibson-novel-where-a-guy-who-buys-a-light-bulb-is-the-protagonist dept

The phrase "Internet of Things" suggests connection. The problem is there's nothing financially motivating about interconnectedness. Manufacturers of connected devices would prefer homogeneity, which leads to actions like Philips' which recently pushed a firmware update that locked competitors' bulbs out of its Hue "smart" lighting fixtures. Sure, it rolled back the update and (mostly) allowed owners to use bulbs they had already purchased, but it was also suggested in the same quasi-apology that the company would rather limit the options available to its purchasers in the future, funneling them through its "friends of Hue" program.

Those of us who've watched the DMCA help turn "purchases" into "licenses" saw this sort of thing as the inevitable result. The desire to limit consumer choice dates back to inkjet printers, and the DMCA is the legal stick used to justify the elimination of competition.

Bruce Schneier, writing for the Atlantic, points out the particular clause in the law that allows companies to sell products promising flexibility while simultaneously giving them the option to take it all away at a moment's notice.

To stop competitors just reverse-engineering the proprietary standard and making compatible peripherals (for example, another coffee manufacturer putting Keurig’s codes on their own pods), these companies rely on a 1998 law called the Digital Millennium Copyright Act (DCMA). The law was originally passed to prevent people from pirating music and movies; while it hasn't done a lot of good in that regard (as anyone who uses BitTorrent can attest), it has done a lot to inhibit security and compatibility research.

Specifically, the DMCA includes an anti-circumvention provision, which prohibits companies from circumventing “technological protection measures” that “effectively control access” to copyrighted works. That means it’s illegal for someone to create a Hue-compatible lightbulb without Philips’ permission, a K-cup-compatible coffee pod without Keurigs’, or an HP-printer compatible cartridge without HP’s.

The old adage about building a better mousetrap still applies, only this time, the better mousetrap won't allow you to reset the trap without using the manufacturer's proprietary Smart Trap Bait-N-Reset Cartridge™ (sugg. ret. $8.99). It's not just printers and connected lighting rigs and coffee makers refusing to perform their functions without manufacturer-approved "refills." It's also stuff that's probably better off remaining "stupid," like cat litter boxes.

Contained within the SmartCartridge is an RFID chip that tracks fluid levels and turns the automatic litter box into a useless stinkhole once the fluid runs out. It can't be tricked into believing you've refilled it. It can only be replaced with a new one. Like any number of printers that won't let you print/scan/copy without replacing an ink cartridge, the wonderful, self-cleaning litter box refuses to do anything but collect cat excrement until new cartridges are installed.

That's a $200+ litter box that becomes indiscernible from the $6.99 non-auto version once the proprietary cleaning fluid runs out. You'll need a $20+ cartridge to get up and running again.

While a non-functional high-end litter box tends to prompt comments about fools and their spending habits, the same thought process -- aided and abetted by the DMCA (the litter box company has issued cease-and-desist orders to those "jailbreaking" their litter boxes) -- is everywhere. The end result is innovations that promise great things, but purposefully underdeliver, thanks to the innate desire of companies everywhere to eliminate possible competitors.

Because companies can enforce anti-competitive behavior this way, there’s a litany of things that just don’t exist, even though they would make life easier for consumers in significant ways. You can’t have custom software for your cochlear implant, or your programmable thermostat, or your computer-enabled Barbie doll. An auto-repair shop can’t design a better diagnostic system that interfaces with a car’s computers. And John Deere has claimed that it owns the software on all of its tractors, meaning the farmers that purchase them are prohibited from repairing or modifying their property.

Not only is the phrase "Internet of Things" proving to be deceptive, but it's bringing with it more bad than good. Customers are often unaware of the limitations of their products at the point of purchase. Others are more aware of the limits (early adopters) but frequently find themselves stuck with less product than they purchased after companies like Philips (or Sony, etc.) arbitrarily decide to remove previously-available functionality.

Add to that the problem innate to the "Internet" part of the "Internet of Things" -- an increased number of attack vectors for miscreants seeking access to email accounts, banking/credit card info, etc. -- and the future of connected products seems like a long slide into dystopia. There are ways this could turn into a better, smarter world, but the law that allows manufacturers to eliminate competition also frequently prevents security researchers from fully examining the underlying software for flaws.

This is not to say there are no positive aspects to the "Internet of Things." There are, but the premise has been sabotaged by the execution. And a restrictive law, supposedly meant to target copyright infringement, is being used to eliminate competition and lock purchasers into to higher-priced, purposefully-underperforming products. For now, the future is a walled garden. And the supposed "Internet of Things" is little more than a series of underattended LAN parties thrown by manufacturers.

Filed Under: anti-circumvention, bruce schneier, competition, dmca, dmca 1201, internet of things, smart products