It's Time To End The Anti-Circumvention Exemption Circus

from the pleading-for-your-rights dept

Copyright as we know it goes back to the Statute of Anne of 1710. A law that old is clearly going to struggle to cope with the enormous changes in technology that have taken place since then – notably the Internet. But even relatively recent copyright laws were framed in ways that have become unworkable for the digital world we live in.

For example, arguably one of the most important pieces of recent legislation in this area is the Digital Millennium Copyright Act (DMCA) in the US, and its sibling, the EU's Copyright Directive (EUCD). Both are wide-ranging, affecting many aspects of copyright, and a particularly problematic aspect of both concerns anti-circumvention. The DMCA and EUCD prohibit the bypassing of any "technical protection measure" (TPM) used to protect works under copyright. That typically means the much-hated Digital Rights Management (DRM), which aims to control who can do what with copyright material, and thus often gets in the way of people enjoying material that they have paid for.

The DMCA and EUCD introduced severe penalties for circumventing any such TPM, no matter how weak it is, and no matter how reasonable the need to do so may be. As a tiny recognition of this lack of proportion, the DMCA includes Section 1201, which provides a mechanism for giving people permission to circumvent protection:

The Digital Millennium Copyright Act (DMCA), codified in part in Title 17, section 1201, of the United States Code, generally makes it unlawful to circumvent technological measures used to prevent unauthorized access to copyrighted works, including copyrighted books, movies, videos, video games, and computer software. Section 1201, however, also directs the Librarian of Congress, upon the recommendation of the Register of Copyrights following a rulemaking proceeding, to determine whether the prohibition on circumvention is having, or is likely to have, an adverse effect on users' ability to make noninfringing uses of particular classes of copyrighted works. Upon such a determination, the Librarian may adopt limited temporary exemptions waiving the general prohibition against circumvention for such users for the ensuing three-year period.

The new temporary exemptions have just been announced. One of them is to allow copy protections on ebooks to be circumvented so that the visually impaired can use technology to help them access the texts. Wired reports:

The victory is tainted somewhat by the struggle it represents. Although the exemption protects people who circumvent digital copyright protections for the sake of accessibility – by using third-party programs to lift text and save it in a different file format, for example – that it's even necessary strikes many as a fundamental injustice.

Another exemption concerns text and data mining (TDM) – using automated techniques to analyze typically large quantities of text and data in order to find patterns and trends there. This kind of work allows existing facts to generate new ones, but often requires circumventing publishers' TPMs. The Authors Alliance reported on a new exemption to section 1201 of the DMCA that would permit TDM by researchers affiliated with academic institutions. But even here, there were restrictions that made it less useful than it could have been:

In the recommendation, Register Perlmutter also recommended adding a limitation that "circumvention be permitted only on copies of the copyrighted works that were lawfully acquired and that the institution owns or for which it has a non-time-limited license," and should not be permitted on works the institution had "rented or borrowed." This limitation has the potential to complicate the usability of the exemption with regards to TDM research on e-books: because e-books are generally licensed rather than owned, whether the exemption will permit TDM research on a certain e-book will depend on the terms of the license for that e-book.

Finally, there is an example of how outdated copyright laws are seriously hampering what is manifestly a legal activity: repairing digital equipment. Because software is involved, and that code is often protected, it has hitherto been illegal in the US to repair many digital devices. The new exemption will now allow circumvention for the purpose of repair, but with a major restriction, as explained by the iFixit site. The new exemption does not allow you to distribute repair tools that circumvent manufacturers' TPMs:

Without access to shared tools, the exemptions are largely academic. Right now, if you want to use this new exemption to repair your Xbox, you're going to have to whittle your own optical drive unlocking app or device from scratch. That just doesn't scale – most gamers are not security engineers.

It should not be necessary to beg every three years for limited and flawed exemptions, like the ones above, to overly-strong copyright laws; instead, people should have a right to carry out these perfectly reasonable activities. The DMCA and EUCD need to be amended, and their logic inverted, so that circumventing a TPM is always permitted, except when it is for an illegal purpose.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Originally published to the Walled Culture blog.

Filed Under: dmca, dmca 1201, drm, exemptions, research, tdm, technical protection measures, triennial review

Senator Tillis Plans Major Copyright Overhaul: Recognizes Legit Problems, But Current Solutions Are Lacking

from the pandora's-box? dept

We've criticized Senator Thom Tillis for his patent and copyright reform ideas that seemed to take a strong "maximalist" line in its approach. He's also taken the Hollywood line on things like the Internet Archive that was troubling. He's been promising a copyright reform bill for a while, and many thought it wasn't going to matter much, since polls indicated that he was very, very likely to lose his re-election campaign in North Carolina (even after his opponent's bizarrely chaste sex scandal made the news). However, Tillis pulled out a surprise victory, and that means that his plan to reform copyright is something worth watching.

Earlier this month, he sent around a a letter to "stakeholders" asking for thoughts on a wide variety of issues related to the DMCA -- which actually suggests that he might be open to some good changes, and not just the terribly awful ones we've been hearing from Hollywood over the last few years. There are still many horrific ideas in the letter, but the fact that so many broad ideas are in there at least (hopefully?) suggests that Tillis' office is willing to look at the entire DMCA structure, and not just pasting on another favor to Hollywood (which had been Congress's traditional approach to copyright law for decades). The letter even states this upfront:

Rather, than tinker around the edges of existing provisions, I believe Congress should reform copyright law’s framework to better encourage the creation of copyrightable works and to protect users and consumers making lawful uses of copyrighted goods and software-enabled products, respectively.

The very fact that it states upfront that the law should protect users and consumers is a surprisingly good start. Many of the questions in the letter could lead to good, bad (or neutral) results depending on how the eventual bill answers the question. One good aspect is that it appears that Tillis is skeptical of DMCA 1201, which is the "anti-circumvention" or "digital locks" provision in the DMCA that says circumventing "technological measures" to lock down content is infringement, even if the circumvention is not done to infringe on anyone's copyright. This has been a mess in practice, and has resulted in fairly widespread abuse of the law to lockdown products and effectively take away ownership rights from buyers. It's also been hell on security researchers who risk tremendous liability for just doing their jobs.

1201 has this incredibly messy "triennial review" process by which the Copyright Office and Librarian of Congress decide to "exempt" certain applied for use-cases from 1201's rules for the next three years. But as we've seen time and time again this whole process is very sketchy and can even lead to rights being taken away at a later date. Also, frankly, if your law needs a review with new exemptions every 3 years, that seems to suggest the law is the problem. Tillis' questions seem to recognize some of the problems with 1201 and the triennial review process:

Section 1201 currently allows for temporary exemptions to be granted from the circumvention prohibition, but those exemptions do not extend to third-party assistance. This means that when the Librarian of Congress grants an exemption for circumvention of technological protection measures (TPMs) over software for a tractor to allow for repair, the tractor owner must perform the software repair themselves. The Copyright Office has recommended amending the statute to grant the Librarian authority to adopt temporary exemptions permitting third-party assistance “at the direction of” an intended user, and this may be the right way to address this problem. Do you agree with the Copyright Office? If so, how should this provision be drafted to avoid unintended consequences, and to what extent is the Unlocking Consumer Choice and Wireless Competition Act a helpful model? If not, please explain why you do not agree and provide specific recommendations as to how you think this problem should be addressed?

The Copyright Office has recommended revising some of the permanent exemptions so that they are better tailored to the types of uses sought today. In particular, the exemptions for security testing and encryption research should be revised to expand the types of activities permitted, ease the requirements to seek authorization from the owner of the relevant system or technology, and eliminate or clarify the multifactor tests for eligibility. What thoughts do you have about revising these existing permanent exemptions, and how would you recommend that be done?

Congress should adopt new permanent exemptions for noninfringing activities that have repeatedly received exemptions in recent triennial rulemakings, or where there is a particularly broad-based need, including to enable blind or visually impaired persons to utilize assistive technologies and to allow diagnosis, repair, or maintenance of a computer program, including to circumvent obsolete access controls. What other temporary exemptions should be made permanent?

There are various ways that the triennial rulemaking process could be streamlined to be more efficient and so that section 1201 better accounts for user concerns. These include establishing presumptive renewal of exemptions adopted in the previous rulemaking cycle, shifting the burden to those who want to oppose an exemption from the previous rulemaking, and authorizing the Librarian, upon recommendation of the Register, to make permanent a temporary exemption that has been renewed twice without opposition and without modification. How ought section 1201 be revised to reflect the stakeholder desire for a less burdensome triennial rulemaking process and consumer interests, and what other means should be adopted to make the rulemaking process more efficient?

It's good that Tillis recognizes the problems of the triennial review, though I wish that the office was more open to the fact that all of 1201 is outdated and not useful (and open to widespread abuse). Rather than just looking at fixing the triennial review process, it would be even nicer if Tillis was open to just dumping 1201 altogether. He noted in the opening that he's not interested in tinkering around the edges -- but many of these questions indicate that is what's happening. A real review would question the entire premise of 1201 itself. Is it actually needed? Is it useful? Is it promoting the progress of knowledge? Or is it simply a tool for taking away user rights and harming innovation?

Most of the rest of the questions focus on the more well known parts of the DMCA, Section 512, which is the "notice-and-takedown" part of the DMCA, or the "safe harbor" part. 512 has always been problematic, and there's a long history of it being abused for massive censorship. I still think there's a decently strong argument that 512 itself violates the 1st Amendment, in that it uses state pressure to remove 1st Amendment protected content.

Tillis seems to recognize that 512 is outdated, but it's a very mixed bag in how outdated it is. Some of his suggestions are very much needed, but a few suggest he's considering making 512 even worse and even more censorial. Again, starting with the positive, the letter recognizes that 512's classifications of service providers is weird and no longer in-step with reality. Currently it has different rules for conduits, caching services, hosting services, and location tools. But in many 512 cases, it's not always clear which category sites fit into, and it's not always clear how the different rules apply to different types of services. Clarification on that would certainly be useful -- though, again, what that clarification looks like will matter a lot.

OSPs eligible for the safe harbor under section 512 are divided into four categories (conduits, caching services, hosting services, and web location tools) that can be both under-inclusive and over-inclusive. First, what types of OSPs should be covered to account for technological advances and business practice changes that have occurred during the past twenty-two years? Second, how should the categories be revised to better cover the types of OSPs that need—rather than just appreciate—the safe harbor’s benefit? Among the possibilities would be to either increase the number of statutory categories to more explicitly cover specific types of service providers or to reduce the number of statutory categories, possibly to only one, and delegate authority to the Copyright Office to identify, by regulation, the covered types of service providers. If Congress were to take the latter approach, would this raise concerns about such authority being delegated to a non-presidentially-appointed Register?

Of course, neither suggested approach seems likely to be that useful. Simply increasing the categories is going to lead to the same problem down the road (and could impact future innovations as companies "choose" which category to go into). And having the Copyright Office pick and choose would also be a disaster (and arguably unconstitutional). A better approach would be to go in the other direction, and stop trying to fully distinguish types of services but to focus on types of uses. Indeed, the best fix to the 512 safe harbors is actually to align it with Section 230's immunities. That is, rather than put in place a series of specific conditions you have to meet to "earn" the protections (which has been a mess in practice), just set up an immunity that makes it clear that service providers are not liable for the actions of their users. Simplify the situation and let innovation bloom.

Another potentially good thing in the questions is that Tillis recognizes the counternotice situation for many users is not good, and is leading to non-infringing works that are being taken down remaining down because users do not wish to poke the bear. A counternotice under existing law is effectively daring the copyright holder to sue. And even if you believe strongly that your use is non-infringing, going through a federal lawsuit to prove that would bankrupt many people. That's correct, though Tillis' proposed solution of a "small claims" court creates many other problems that we've discussed in the past. There needs to be a better way, but the small claims proposals we've seen to date will lead to more trolling.

The questions also recognize problems in automated takedowns, and potential privacy issues with notice-and-counternotice situations (in which abusive individuals file bogus notices in order to try to dox someone by receiving their counternotice, including contact info). Again, it's good to recognize these problems, even if the suggested solutions leave much to be desired.

It is clear from the record established across my hearings that one major shortcoming of section 512 is that users who have had their content removed may decide to not file a counter-notice because they fear subjecting themselves to federal litigation if the copyright owner objects to the putback. At the same time, the requirement that a copyright owner pursue federal litigation to keep a user from having content put back up following a counter-notice is a heavy burden. Congress might consider improving dispute resolution by directing disputes between notice and counter-notice filers to a small claims court rather than federal court. What is the best way to accomplish this? Would the copyright small claims court as envisioned by the CASE Act be the proper forum? If not, how should such a tribunal be designed? Related, what should be the time period for putbacks? There is broad agreement that the current 10-14 day window works poorly for both copyright owners and users. How would you amend this?

More generally, the notice- and counter-notice sending process have many shortcomings. These could be improved by clarifying when automation is appropriate and that OSPs cannot erect requirements beyond those in section 512(c)(3); by authorizing the Copyright Office to develop standardized web forms for notices and counter-notices and to set regulations for the communications that OSPs must deliver to a user when their content is taken down or had access disabled (including offering information about the fair use doctrine as codified in section 107 and as illustrated in the Copyright Office’s Fair Use Index); and by increasing privacy protections for notice and counter-notice senders by masking certain personally identifiable information, including address and phone number. How could this best be done? Please provide specific provisions for accomplishing these

Tillis also seems to recognize that one of the big problems of copyright law has long been the fact that it was designed in an era when the only real infringement and copying was done for commercial reasons, and that we've moved to an era when we all have super powerful copying machines in front of us (and in our pockets) all the time -- and that every single person with a computing device likely incidentally infringes thousands of times per day, based on a strict reading of the law. There's also the fact that copyright law treats a website run by a single user the same as a giant company like Google or Facebook. Tillis' suggested approach to dealing with this is to classify service providers by different markets or sizes:

The record established in my DMCA reform hearings indicated that an overarching principle of any reform should be making digital copyright less one-size-fits-all. The law needs to account for the fact that small copyright owners and small online services providers (OSPs) may have more in common with each other than they do with big copyright owners and big OSPs, respectively. Accordingly, I think we should consider whether copyright law should be revised to account for such differences among stakeholders. In particular, could copyright law borrow from employment law, or other relevant fields, to establish different thresholds for copyright owners and OSPs of different size, market share, or other relevant metric? If so, what is the best way to accomplish this? Is there a particular area of law, or existing section of the U.S. Code, that provides crucial guidance? As with all questions where it is relevant, please include in your response specific recommended legislative

Similar to the other questions mentioned, he's actually looking at the right issue, but approaching it with the wrong solution. This approach is almost certain to lead to weird incentives, potential regulatory capture to design specific rules, and a significant amount of gaming, as companies employ copyright lawyers to figure out how to stretch and twist around the rules' definitions to comply with the law as a technicality, but not in spirit. We've seen enough of that, and it leads to wacky scenarios like Aereo, in which a technically insane setup is put in place in the belief that it has to be built that way to comply with copyright law (even if the Supreme Court then stepped in with its weird "looks like a duck" precedent that made a mess of things).

Again, rather than trying to just craft a bunch of specific rules that will be gamed, shouldn't the focus be on setting an appropriate rules that actually makes sense across the board?

Where the Tillis questions get much more problematic is the suggestion that we should import some very dangerous, censorial and likely unconstitutional ideas like "notice-and-staydown" and full site blocking.

Section 512 places the burden on copyright owners to identify infringing materials and affirmatively ask the OSP to remove the material or disable access to it. This burden appears to strike the correct balance, but the burden that the notice-and-takedown system itself places on copyright owners is too heavy; the system is also woefully inefficient for both copyright owners and service providers. I believe U.S. copyright law should move towards some type of a notice-and-staydown system—in other words, once a copyright owner notifies a service provider that a use of a copyrighted work is infringing, the service provider must, without further prompting, remove subsequent infringing uses absent a statement from the user (whether the copyright owner or not) that they believe the use is licensed or otherwise authorized by law (e.g., fair use). What are your thoughts on such a system, and how could it best be implemented?

The injunctions available under section 512(j) have been narrowly interpreted by courts and thus little-used by copyright owners. Is it worthwhile for Congress to consider revising this provision to make injunctions more readily available for website-blocking in special circumstances (with an eye toward article 8(3) of the Information Society Directive)? Such injunctions could be issued by a special tribunal and appealed to federal district court, or, out of concern for user protections, the law could require that injunction orders come from the district court alone. If warranted, what would be the best way to enact limited website-blocking via such injunctions? Again, please provide suggested legislative text. If you do not think the law should be amended to expand the availability of injunctions, please be specific about any ways you think section 512(j) could be improved.

Yikes on both of these. Notice-and-staydown is a horrifically bad idea. We're already dealing with a situation in which the notice-and-takedown process is regularly and consistently filed for non-infringing reasons, with an effort to suppress or silence speech. Notice-and-staydown would make that problem much worse.

Furthermore, notice-and-staydown ignores the fact that it's not the content that is infringing, but the use. That is, the very same content may be infringing in some use cases, but not in others. The very same content could be fair use in certain contexts, but not in others. Notice-and-staydown ignores that.

Site blocking has massive 1st Amendment implications as well. Taking down an entire site because of some infringing material would violate the general principle as set by the Supreme Court that any regulation impacting speech must be narrowly tailored to only impact speech that is not protected by the 1st Amendment. Full site blocking does not do that.

There are other big reform ideas that seem to be missing entirely. A full (non-tinkering on the edges) reform bill should look at issues like false takedowns, copyright terms, digital 1st sale rights, and statutory damages. But those don't appear to be mentioned. There is one question that touches on the fact that a ton of takedown notices are bogus, but only loosely:

At the same time that Congress should revise section 512 to ensure that infringing material stays down once identified, it should also discourage the over-sending of notices as a counter-balance to the more significant action that an OSP must take after receiving a notice. This could be done, for example, by heightening the requirements for accuracy in notice sending, possibly with stricter requirements and heavier penalties. As noted above, the standard may be more lenient for small entities and individuals. How might the requirements be heightened in a meaningful way while not unduly burdening copyright owners trying to protect their work against infringement?

It seems odd that they don't even name the totally toothless 512(f) in this section, even though other questions focus on specific parts of the law. The idea that stronger penalties for false notices would "unduly burden copyright holders" is kind of laughable when you look at the current "balance" in copyright law, in which purely incidental infringement of a single thing could bankrupt most Americans.

In the end, while there are a bunch of bad ideas presented in the questions, I'm still somewhat pleasantly surprised that many of the questions raised indicate an awareness of the actual problems in current copyright law. That's better than we've seen in the past. That said, most of the proposed "solutions" will not help and may make things worse.

That is why it's important for people to weigh in with thoughtful ideas on how to actually fix copyright law. That said, there's an insanely short time frame for this. The letter asks for any comments to be sent in by December 1st (next week!) and says that Tillis intends to release a draft bill by December 18th. That seems like an astoundingly short time frame (1) for people to organize and submit their ideas and (2) for Tillis' staff to incorporate them into legislative text.

There's still a very strong chance that the bill that Tillis proposes will be a dangerous disaster towards free speech and innovation online. Certainly, some of the questions strongly hint at that. However, the very fact that the questions also indicate at least some legitimate recognition of the problems of today's copyright law is nice to see. Hopefully, Tillis and his staff recognize that the answers to these problems is not to make copyright law even more draconian, but to recognize that there are better solutions.

Filed Under: abusive takedowns, copyright, copyright reform, dmca, dmca 1201, dmca 512, dmca reform, free speech, innovation, notice and staydown, takedown notices, takedowns, thom tillis, triennial review

Copyright Office Extends Anti-Circumvention DMCA Exemptions To All Filmmakers, Not Just Documentarians

from the victory dept

Earlier this year, we wrote a bunch of posts on the Copyright Office's request for comment on changes needed to the DMCA's anti-circumvention exemption list. There were lots of interesting submissions, but one that caught my attention was a whole bunch of film association groups, most of them for documentarians, advocating that the anti-circumvention they enjoyed to be able to use clips from other films and content be expanded to include filmmakers generally. This would address the copyright industries' cynical attempt to route around Fair Use usage by filmmakers by simply locking up their content behind all kinds of DRM that, unless you're a documentarian, you can't circumvent. The MPAA, as you would expect, said that allowing for this would kick off "widespread hacking" of all the DVDs on the planet, while all it was really concerned about was the licensing agreements it was able to secure by filmmakers who didn't want to violate the DMCA to get the Fair Use clips they wanted.

Well, the Copyright Office made its decision and the exemption will now be offered to filmmakers en masse.

Digital Millennium Copyright Act (DMCA) exemptions aren’t just for documentary filmmakers any more. The U.S. Copyright Office and Library of Congress last week broadened a DMCA exception to now allow more filmmakers to circumvent anti-copying technology and rip short video clips for purposes of commentary and criticism.

“This is huge for the independent film industry,” said Michael Donaldson, an attorney who argued for expanding the exemption before the Copyright Office, in a written statement. “The use of fair use material by narrative filmmakers has exponentially increased to the point where expanding the exemption to fiction films was absolutely necessary.”

What this means is that more filmmakers will now be able to simply rip clips from protected DVDs to use in their own creative works, as long as the purpose of the clip is used for parody or to demonstrate biographical or historically significant information. This opens up all kinds of uses, of course, but all of them will still be subject to being truly Fair Use cases. That, of course, is a defense, so you can expect lawsuits to be filed before we settle into some kind of a norm here.

Still, this is a good decision by the Copyright Office. The idea that the MPAA and others could lock up content that could otherwise be fairly used behind DRM obviously doesn't comport with the purpose of the law.

Filed Under: circumvention, copyright, copyright office, dmca, dmca exemptions, drm, fair use, filmmakers, library of congress, parody, triennial review

Shocker: DOJ's Computer Crimes And Intellectual Property Section Supports Security Researchers DMCA Exemptions

from the say-what-now? dept

Well here's a surprise for you. The DOJ's Computer Crime and Intellectual Property Section (CCIPS) has weighed in to support DMCA 1201 exemptions proposed by computer security researchers. This is... flabbergasting.

In case you don't know, Section 1201 of the Digital Millennium Copyright Act (DMCA) is the "anti-circumvention" part of the law. It's the part of the law that makes it infringement to get around any "technological measure" to lock down copyright covered material, even if breaking those locks has nothing whatsoever to do with copyright infringement. It's a horrible law that has created all sorts of negative consequences, including costly and ridiculous lawsuits about things having nothing to do with copyright -- including garage door openers and printer ink cartridges. In fact, Congress knew the law was dumb from the beginning, but rather than dump it entirely as it should have done, a really silly "safety valve" was added in the form of the "triennial review" process.

The triennial review is a process that happens every three years (obviously, per the name), in which anyone can basically beg the Copyright Office and the Librarian of Congress to create exemptions for cracking DRM for the next three years (an exemption -- stupidly -- only lasts those three years, meaning people have to keep reapplying). Over the years, this has resulted in lots of silliness, including the famous decision by the Librarian of Congress to not renew an exemption to unlock mobile phones a few years back. Many of the exemption requests come from security researchers who want to be able to crack systems without being accused of copyright infringement -- which happens more frequently than you might think.

Historically, law enforcement has often been against these exemptions, because (in general) they often appear to dislike the fact that security researchers find security flaws. This is, of course, silly, but many like to take a "blame the messenger" approach to security research. That's why this new comment from the DOJ's CCIPS is so... unexpected.

Many of the changes sought in the petition appear likely to promote productive cybersecurity research, and CCIPS supports them, subject to the limitations discussed below.

Incredibly, CCIPS even points out that those who are opposed to these cybersecurity research exemptions are misunderstanding the purpose of 1201, and that it should only be used to stop activity that impacts copyright directly. This is the kind of thing we've been arguing for years, but many companies and government agencies have argued that because 1201 helps them, no exemptions should be granted. But here, the DOJ explains that's not how it works:

Some comments opposing removal of any existing limitation on the security research exemption suggest, implicitly or explicitly, that the DMCA’s security research exemption itself poses a danger merely because it fails to prohibit a type of research to which the commenter objects. However, the purpose of the DMCA is to provide legal protection for technological protection measures, ultimately to protect the exclusive rights protected by copyright. As critically important as the integrity of voting machines or the safety of motorized land vehicles are the American public, the DMCA was not created to protect either interest, and is ill-suited to do so. To the extent such devices now contain copyrighted works protected by technological protection measures, the DMCA serves to protect those embedded works. However, the DMCA is not the sole nor even the primary legal protection preventing malicious tampering with such devices, or otherwise defining the contours of appropriate research. The fact that malicious tampering with certain devices or works could cause serious harm is reason to maintain legal prohibitions against such tampering, but not necessarily to try to mirror all such legal prohibitions within the DMCA’s exemptions.

There's a lot more in the comment, but... I'm actually impressed. Of course, the letter does note that part of the reason it wants this exemption is to enable security researchers to figure out how to crack into encrypted phones, but that's actually a reasonable position for the DOJ to take. Far better than seeking to backdoor encryption. Finding flaws is fair game.

All in all, this is a welcome development, having the DOJ's CCIPS recognize that security research is useful, and that it shouldn't be blocked by nonsense copyright anti-circumvention rules.

Filed Under: 1201, ccips, computer crimes, copyright, dmca 1201, doj, exemptions, security research, triennial review

ESA Comes Out Against Allowing Museums To Curate Online Video Games For Posterity

from the disappear-that-art dept

A week or so back, we discussed the Museum of Art and Digital Entertainment (MADE) calling on the Copyright Office to extend exemptions to anti-circumvention in the DMCA to organizations looking to curate and preserve online games. Any reading of stories covering this idea needs to be grounded in the understanding that the Librarian of Congress has already extended these same exemptions to video games that are not online multiplayer games. Games of this sort are art, after all, and exemptions to the anti-circumvention laws allow museums, libraries, and others to preserve and display older games that may not natively run on current technology, or those that have been largely lost in terms of physical product. MADE's argument is that online multiplayer games are every bit the art that these single-player games are and deserve preservation as well.

Well, the Entertainment Software Association, an industry group that largely stumps for the largest gaming studios and publishers in the industry, has come out in opposition to preserving online games, arguing that such preservation is a threat to the industry.

“The proponents characterize these as ‘slight modifications’ to the existing exemption. However they are nothing of the sort. The proponents request permission to engage in forms of circumvention that will enable the complete recreation of a hosted video game-service environment and make the video game available for play by a public audience.”

“Worse yet, proponents seek permission to deputize a legion of ‘affiliates’ to assist in their activities,” ESA adds.

The proposed changes would enable and facilitate infringing use, the game companies warn. They fear that outsiders such as MADE will replicate the game servers and allow the public to play these abandoned games, something games companies would generally charge for. This could be seen as direct competition.

There is a ton of wrong in there to unpack. To start, complaining that MADE's request would allow them to replicate the gaming experience of an online multiplayer game does nothing beyond essentially repeating what MADE is requesting. The whole idea is that these games should be preserved for posterity so that later generations can experience them, gaining an understanding of the evolution of the industry. How could this be accomplished without libraries and museums making the online game playable? And how is that different than what these folks do for non-online games? With that in mind, further complaining that museums might ask for help from others to accomplish this task doesn't make a great deal of sense.

As for the final complaint about these museums making these games playable when gaming companies normally charge for them is nearly enough to make one's head explode. Museums like MADE wouldn't be preserving these games except for the fact that these games are no longer operated by the gaming studios, for a fee or otherwise. What ESA's opposition actually says is that making older online games playable will compete in the market with its constituent studios' new online games. To that, there seems to be a simple solution: the game companies should keep these older online games viable themselves, then. After all, if a decade-old MMORPG can still compete with newer releases, then clearly there is money in keeping that older game up and running. Notably, game publishers aren't doing that. Were ESA's concerns valid, they surely would, unless they hate money, which they do not.

What's ultimately missing from ESA's opposition is what exactly is different about these online games compared with non-online games that already have these anti-circumvention exemptions. The closest it gets is complaining that preserving these online games would require server content that game companies haven't made public in the past. Why exemptions for that should be different than the code for localized games so that emulators can run them is a question never answered. That ESA chose not to offer up a more substantive answer to that question is telling.

Filed Under: abandoned games, copyright, dmca, dmca 1201, exceptions, multiplayer games, triennial review
Companies: esa

The Museum Of Art And Digital Entertainment Calls For Anti-Circumvention Exemptions To Be Extended To Online Game Archives

from the preserve-and-protect dept

Now that we've covered a couple of stories about game companies, notably Blizzard, bullying the fans that run antiquated versions of MMO games on their own servers to shut down, it's as good a time as any to discuss a recent call for the DMCA anti-circumvention exemptions to include the curation of abandoned MMO games. A few weeks back, during the triennial public consultation period in which the U.S. Copyright Office gathers public commentary on potential exemptions to the DMCA's anti-circumvention provisions, a bunch of public comments came in on the topic of abandoned video games. Importantly, the Librarian of Congress already has granted exemptions for the purpose of preserving the art of video games so that libraries and museums can use emulators to revive classic games for the public.

But what do you do if you're looking to preserve a massive multiplayer online game, or even single-player games, that rely on server connections with the company that made those games in order to operate? Those servers don't last forever, obviously. Hundreds of such games have been shut down in recent years, lost forever as the companies behind them no longer support the games or those that play them.

Well, one non-profit in California, The Museum of Art and Digital Entertainment, wants anti-circumvention exemptions for running servers for these games to keep them alive as well.

“Although the Current Exemption does not cover it, preservation of online video games is now critical,” MADE writes in its comment to the Copyright Office. “Online games have become ubiquitous and are only growing in popularity. For example, an estimated fifty-three percent of gamers play multiplayer games at least once a week, and spend, on average, six hours a week playing with others online.”

“Today, however, local multiplayer options are increasingly rare, and many games no longer support LAN connected multiplayer capability,” MADE counters, adding that nowadays even some single-player games require an online connection. “More troubling still to archivists, many video games rely on server connectivity to function in single-player mode and become unplayable when servers shut down.”

Due to that, MADE is asking the Copyright Office (and the Librarian of Congress) to allow libraries and museums exemptions to run their own servers to display these games as well. Frankly, it's difficult to conjure an argument against the request. If games are art, and they are, then they ought to be preserved. The Copyright Office has already agreed with this line of thinking for the category of games that don't require an online connection, so it's difficult to see how it could punt on the issue of online games.

And, yet, we have examples of fan-run servers of abandoned games, or versions of games, getting bullied by companies like Blizzard. These fan-servers are essentially filling the same role that groups like MADE would like to do: preserving old gaming content that has been made otherwise unavailable by companies that have turned down online game servers.

It's enough to make one wonder why a group of fans of a game shouldn't get the same protections afforded to a library or museum, if the end result is nearly identical.

Filed Under: anti-circumvention, archiving, copyright office, dmca, dmca 1201, drm, librarian of congress, museums, triennial review, video games
Companies: made, museum of art and digital entertainment

Copyright Office Will Renew Previous DMCA Exemptions Without Much Fuss -- But Why Is This Even Necessary?

from the about-freaking-time dept

For years we've written about the idiocy of the DMCA's 1201 triennial review. If you don't recall, Section 1201 of the DMCA is the "anti-circumvention" part of the law, saying that anything that gets around DRM is, itself, copyright infringement. This was so obviously stupid and counterproductive when it passed, and Congress knew it was so obviously stupid and counterproductive, that it included an even stupider "safety valve" to deal with the obviously bad results of the law. That safety valve, known as the "triennial review" is that every three years, people need to beg and plead with the Copyright Office and the Librarian of Congress to make explicit exemptions from the law, where circumventing DRM won't be considered infringing. Over the years, this lengthy and costly process has at least allowed certain key exemptions for security and academic research. Though, of course, even when exemptions are granted, it's often a hot mess.

But, astoundingly, the exemptions only last until the following triennial review, meaning that every few years, everyone has to waste their time and go through the whole damn process again. This blew up in everyone's face in 2012 when the Librarian of Congress rejected an exemption for phone unlocking that had been in place for the previous round. Lots of people got angry, and even the White House weighed in to say it was a mistake that should be fixed. Of course, rather than fixing Section 1201, they just passed a separate law specific to phone unblocking.

However, the whole issue got so much attention and so much interest (both from the public and politicians) that I'd be surprised if the Copyright Office ever decided to drop an exemption after it had been issued. And, indeed in the newly released notice of proposed rulemaking (NPRM) on the latest exemptions, the Copyright Office easily renews all of the old exemptions:

As detailed below, after reviewing the petitions for renewal and comments in response, the Office concludes that it has received a sufficient petition to renew each existing exemption and it does not find any meaningful opposition to renewal. Accordingly, the Register intends to recommend readoption of all existing exemptions in their current form.

That's great, though it's crazy that this process even needs to happen each year, wasting everyone's time, energy and money.

Unfortunately, the Copyright Office had a chance to go further, but declined. In the Notice of Inquiry about this, the Copyright Office asked for input on regulatory language that could ease the situation for renewing existing exemptions, but in a footnote, the Copyright Office declines to make any suggestions:

Although the Office’s Notice of Inquiry stated that this NPRM would set forth proposed regulatory language for any existing exemptions the Office intends to recommend for readoption, because many of the new petitions seek to expand existing exemptions, the Office concludes that proposing regulatory language at this time would be premature; the Register may propose altering current regulatory language to expand the scope of an existing exemption, where the record suggests such a change is appropriate.

Of course, all of this still leaves open the much wider question of why do we need Section 1201 in the first place? If someone infringes on someone's copyright, go after them for that. The whole focus on circumventing DRM is a distraction that has created numerous problems for lots and lots of people -- especially security and academic researchers. 1201 was never useful and it's time to just do away with it entirely.

Filed Under: 1201, copyright, copyright office, dmca, library of congress, security research, triennial review

Copyright Office Realizes The DMCA Fucks With Security Research While The W3C Still Doesn't See It

from the what-a-world dept

Last week, the Copyright Office finally released a report that it had been working on for some time, looking specifically at Section 1201 of the DMCA. In case you're new around here, or have somehow missed all the times we've spoken about DMCA 1201 before, that's the "anti-circumvention" part of the DMCA. It's the part that says it's against copyright law to circumvent (or provide tools to circumvent) any kind of "technological protection measures," by which it means DRM. In short: getting around DRM or selling a tool that gets around DRM -- even if it's not for the purpose of infringing on any copyrights -- is seen as automatically infringing copyright law. This is dumb for a whole host of reasons, many of which we've explored in the past. Not only is the law dumb, it's so dumb that Congress knew that it would create a massive mess for tons of legitimate uses. So it built in an even dumber procedure to try to deal with the fact it passed a dumb law (have you noticed I have opinions on Section 1201?).

Specifically, every three years, people and companies can petition the Copyright Office/Librarian of Congress to "exempt" certain technologies or uses from 1201, saying that it is legal to circumvent the technological protection measures in that case, for the succeeding three years (yes, after three years, the original exemption expires, unless it is renewed). This triennial review process has historically been an (annoying) joke, where people basically have to beg the Copyright Office to let them, say, get around DVD DRM, in order to make documentaries. Or, famously, that time in 2012 when the Librarian of Congress refused to renew the phone unlocking exemption, magically making it illegal to unlock your phone for no clear reason at all. The whole thing is fairly described as a hot mess.

And, it really harms our own security the most.

That's because security researchers often need these exemptions the most, because they don't want to be accused of violating copyright law for doing their jobs in figuring out where there are weaknesses and vulnerabilities in various technologies. So, many of the applied for exemptions tend to come from the security community -- and sometimes they're granted, and other times they are not. A year ago, some security researchers (along with the EFF) sued the US government, arguing that 1201 violates the First Amendment, scaring off security researchers, and providing none of the usual defenses against infringement, such as fair use (which the Supreme Court has argued is a necessary First Amendment valve on copyright). That case is still waiting for a judge to rule on early motions (and it's waiting a long time).

Given all that as background, it's somewhat fascinating (and marginally surprising) to see that the Copyright Office officially agrees that the 1201 setup totally sucks for security researchers, and it would actually like Congress to fix that. The report specifically recommends expanding the existing "permanent exemption" for certain types of "security testing" to make it more applicable to a wider set of security practices:

... the Office recommends that Congress consider expanding the exemption for security testing under section 1201(j). This could include expanding the definition of security testing, easing the requirement that researchers obtain authorization, and abandoning or clarifying the exemption’s multifactor test for eligibility.

There's another section in the law for "encryption research" and, again, the Copyright Office recognizes that should be expanded:

The exemption for encryption research under section 1201(g) may benefit from similar revision, including removal of the requirement to seek authorization and clarification or removal of the multifactor test.

For what it's worth, the report (obviously remembering how it got basically mocked and burned by everyone for removing the cell phone unlocking exemption in 2012) now asks for phone unlocking to be designated a permanent exemption under the law.

These are fairly small changes being sought by the Copyright Office, but it strikes me as somewhat incredible (and very disappointing) that this small bit of enlightenment goes much further than the World Wide Web Consortium's (W3C) view on DRM and security research. As you may recall, there's this ongoing battle over DRM in HTML 5. When the W3C refused to block it outright, some members came up with a fairly straightforward no-brainer rule: all members had to agree not to go after security researchers for circumventing the DRM in HTML 5. And the W3C rejected that proposal.

In other words, the Copyright Office -- famous for its historically expansionist view of copyright, as well as its general tilt towards supporting Hollywood over everyone else -- is now recognizing that it's obvious that security researchers should have the right to circumvent DRM without violating copyright law, while the W3C -- famous for promoting an open web -- is against this. This is "up is down, night is day, cats & dogs living together" kind of stuff. Maybe someone should let the W3C know that it's position on security researchers and DRM is now more extremist than the Copyright Offices?

Either way, at the very least, Congress should follow up on this report and expand the exemptions for security research. It doesn't just help out those researchers, it helps all of us when security researchers are able to do their jobs and help to protect us all.

Filed Under: anti-circumvention, copyright office, dmca, dmca 1201, drm, research, security, triennial review
Companies: w3c

Hey, You Can Hack Your Car Without Violating Copyright Law (For A Little While)

from the and-you-may-still-violate-other-laws dept

In my talk last week at Wikimedia, one of the examples I gave of "copyright creep" where copyright law is being shoved into areas where it obviously doesn't belong was that time when John Deere and GM argued that you didn't really own parts of the vehicles you bought from them, because of copyright. The underlying issue was that these companies didn't want the Librarian of Congress to exempt hacking cars and tractors from section 1201 of the DMCA. 1201 is the anti-circumvention provision that says that getting around technological protection measures (even if not for the purpose of infringing on copyright) is still infringement. Ridiculously, even the EPA sided with these companies arguing that hacking cars could override environmental protections. However, as we pointed out at the time, there are other laws to handle that kind of thing. Don't abuse copyright for that purpose.

When the exemptions came out from the Librarian of Congress, we noted that the whole thing was a hot mess, in which it sort of granted the exemption on vehicle hacking... but with a bunch of weird limitations and caveats. One of those was a bizarre delay of 12 months:

Computer programs that are contained in and control the functioning of a motorized land vehicle such as a personal automobile, commercial motor vehicle or mechanized agricultural vehicle, except for computer programs primarily designed for the control of telematics or entertainment systems for such vehicle, when circumvention is a necessary step undertaken by the authorized owner of the vehicle to allow the diagnosis, repair or lawful modification of a vehicle function; and where such circumvention does not constitute a violation of applicable law, including without limitation regulations promulgated by the Department of Transportation or the Environmental Protection Agency; and provided, however, that such circumvention is initiated no earlier than 12 months after the effective date of this regulation.

It was never entirely clear why there was such a delay, but it was there. And last week the delay was finally over. Twelve months had passed, and you can now hack parts of your car without violating copyright law. But, of course, this exemption only lasts two more years and then everyone has to go through the whole stupid process again. There are also odd things like that you can only do this kind of hacking on your own vehicles, and you can't hire someone to do it for you (again, this makes no sense). There is an effort underway to make the exemption permanent, but who knows how that will go. And, of course, as some have noted, those hacking their cars may still run into some legal issues -- such as potentially violating the Computer Fraud and Abuse Act (CFAA), though that would require quite a strained reading of the law.

In the short term, the fact that you won't be dinged for copyright infringement for merely tinkering with your car is a good thing.

Filed Under: 1201, anti-circumvention, car hacking, copyright, dmca 1201, exemptions, triennial review

EFF Lawsuit Challenges DMCA's Digital Locks Provision As First Amendment Violation

from the well,-that's-interesting dept

Computer security professor Matthew Green and famed hardware hacker Bunnie Huang have teamed up with the EFF to sue the US government, challenging the constitutionality of Section 1201 of the DMCA, also known as the "anti-circumvention" clause. As we've discussed for many years, 1201 makes it against the law to "manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof" that is designed to "circumvent" DRM or other "technological protection measures." There are all sorts of problems with this part of the law, including the fact that it doesn't matter why you have that tool or why you're circumventing the DRM. For example, it would still be considered infringement if you cracked DRM on a public domain work. That's... insane.

The only "safety valve" on this is the ridiculous triennial review process, whereby people can beg and plead with the Librarian of Congress to "exempt" certain scenarios from being covered by 1201. The process is something of a joke, and even if you get an exemption one time, it automatically expires after three years, and the Library of Congress might not renew it.

The lawsuit, filed by EFF and some excellent lawyers from Wilson Sonsini, points out that the Supreme Court has long stated that fair use is the "safety valve" that stops copyright law from violating the First Amendment in regulating speech. But fair use isn't an allowable defense under 1201, leading to a question of whether or not 1201 itself violates the First Amendment:

Enacted in 1998, these provisions broadly restrict the public’s ability to access, speak about, and use copyrighted materials, without the traditional safeguards—such as the fair use doctrine—that are necessary to protect free speech and allow copyright law to coexist with the First Amendment. The threat of enforcement of these provisions chills protected and noninfringing speech that relies on copyrighted works, including independent technical research into computer security systems and the discussion of that research, and accessing copyrighted works in order to shift the content to a different format, space, or time. The triennial rulemaking process by which the public may seek exemptions pursuant to 17 U.S.C. § 1201(a)(1)(C) does not alleviate these problems. To the contrary, the rulemaking is itself an unconstitutional speech-licensing regime.

The complaint highlights how both Green and Huang have been scared away from working on various projects that have nothing to do with copyright-covered content, but both of which involve circumventing technological protection measures. In Green's case, it's about his security research, finding computer security problems in various devices. For Huang it's his work on a NeTVCR, an advancement on the NeTV device he created in the past. For it to work, however, he needs to get around HDCP and that, of course, would violate 1201. This presents a problem:

To the extent that the purpose of Section 1201 is “to promote the progress of science and the useful arts,” see U.S. Const. Art I, Sec. 8, cl. 8, its restrictions are not narrowly tailored to this purpose. Rather, they sweep up a vast amount of protected speech. This includes the speech that Green, Huang, Alphamax, and users of NeTVCR would undertake, but for the fear or criminal and other penalties. It also includes the many forms of speech that have been the subjects of exemption requests, and many additional forms of speech that have not yet been the subject of an exemption request. The means chosen in Section 1201 specifically targets the communicative impact of uses of copyrighted works and speech about the circumvention of TPMs that restrict such works.

Separately, as noted in the quote above, the case argues that the triennial review process itself violates the First Amendment.

The rulemaking contemplated by Section 1201(a)(1) is a licensing regime that lacks the safeguards the First Amendment requires. The combined ban and exemption process grants excessive power to a government official to make discretionary case-by-case decisions absent sufficient controlling standards.

Section 1201 does not provide for timely review of requests for permission to speak. Applicants must wait up to three years for an opportunity to participate in the triennial rulemaking, and the Rulemaking Defendants have no deadlines governing when they must issue a rule granting or denying exemption requests.

As Huang notes in his blog post about the case, this is a really big issue. It's both about free speech and what it means to "own" something.

Before Section 1201, the ownership of ideas was tempered by constitutional protections. Under this law, we had the right to tinker with gadgets that we bought, we had the right to record TV shows on our VCRs, and we had the right to remix songs. Section 1201 built an extra barrier around copyrightable works, restricting our prior ability to explore and create. In order to repair a gadget, we may have to decrypt its firmware; in order to remix a video, we may have to strip HDCP. Whereas we once readily expressed feelings and new ideas through remixes and hardware modifications, now we must first pause and ask: does this violate Section 1201? Especially now that cryptography pervades every aspect of modern life, every creative spark is likewise dampened by the chill of Section 1201.

The act of creation is no longer spontaneous.

Our recent generation of Makers, hackers, and entrepreneurs have developed under the shadow of Section 1201. Like the parable of the frog in the well, their creativity has been confined to a small patch, not realizing how big and blue the sky could be if they could step outside that well. Nascent 1201-free ecosystems outside the US are leading indicators of how far behind the next generation of Americans will be if we keep with the status quo.

Our children deserve better.

The argument here is compelling. 1201 has all sorts of problems, but no one has tested this First Amendment argument before. Unfortunately, our courts have been incredibly (and unfortunately) reluctant to seriously consider constitutional challenges to copyright law. The cases that have made it up through the court system have ended unfortunately badly -- cases like the Eldred case challenging copyright term extension, for example. I hope that this one turns out differently, and it may become a case to watch. Again, the arguments are quite compelling to me, but I'm unfortunately skeptical that the judicial system will agree. I hope I'm wrong.

Filed Under: 1201, anti-circumvention, bunnie huang, dmca, dmca 1201, fair use, first amendment, free speech, hacking, matthew green, research, security research, triennial review
Companies: eff