REVERSE NOTICE & TAKEDOWN OF DRM TO ENABLE FAIR USES Pamela Samuelson CRCS Workshop Oct. 3, 2007

LAW & TECHNOLOGY Many intersections of law & technology as competing or complementary strategies for dealing with troublesome phenomena: Privacy laws & privacy enabling technologies Anti-spam laws & anti-spam technologies Anti-phishing laws & anti-spam technologies Anti-spyware laws & anti-spyware technologies Anti-pornography laws & filtering technologies Anti-circumvention laws & circumvention technologies: this is where I will focus today

Many intersections of law & technology as competing or complementary strategies for dealing with troublesome phenomena:

Privacy laws & privacy enabling technologies

Anti-spam laws & anti-spam technologies

Anti-phishing laws & anti-spam technologies

Anti-spyware laws & anti-spyware technologies

Anti-pornography laws & filtering technologies

Anti-circumvention laws & circumvention technologies: this is where I will focus today

TPMs NOTHING NEW There’s nothing particularly new about using access controls and other technical measures to protect information assets Often illegal to bypass access controls CFAA: unauthorized access to federally protected computers; exceeding authorized access But when © industry groups began using or planning to use TPMs, they insisted that new legislation was needed to outlaw technologies designed to circumvent their TPMs

There’s nothing particularly new about using access controls and other technical measures to protect information assets

Often illegal to bypass access controls

CFAA: unauthorized access to federally protected computers; exceeding authorized access

But when © industry groups began using or planning to use TPMs, they insisted that new legislation was needed to outlaw technologies designed to circumvent their TPMs

NII & IP WHITE PAPER (1995) ©’d works in digital form are vulnerable to market-destructive appropriations in global digital networked environments © owners want to use TPMs to protect digital works “ Answer to the machine is the machine” Circumvention tools undermine, so need to outlaw WP recommended legislation to outlaw technologies, the primary purpose or effect of which was to bypass or circumvent technical protection measures (TPMs) used by © owners to protect their works

©’d works in digital form are vulnerable to market-destructive appropriations in global digital networked environments

© owners want to use TPMs to protect digital works

“ Answer to the machine is the machine”

Circumvention tools undermine, so need to outlaw

WP recommended legislation to outlaw technologies, the primary purpose or effect of which was to bypass or circumvent technical protection measures (TPMs) used by © owners to protect their works

WIPO © TREATY (1996) US proposed very similar rule for the WIPO © Treaty (WCT) as necessary to enable global markets in digital content Anti-circumvention provision was controversial at diplomatic conference Concern about impacts on innovation, access to information, fair uses Final treaty required “adequate legal protection” and “effective legal remedies” vs. circumvention Seemingly left to nations how to implement

US proposed very similar rule for the WIPO © Treaty (WCT) as necessary to enable global markets in digital content

Anti-circumvention provision was controversial at diplomatic conference

Concern about impacts on innovation, access to information, fair uses

Final treaty required “adequate legal protection” and “effective legal remedies” vs. circumvention

Seemingly left to nations how to implement

HOW TO IMPLEMENT WCT? Minimalist way to implement WCT was to outlaw acts of circumvention intended to facilitate © infringement Not clear it was necessary to outlaw circumvention technologies Sony Betamax default rule: © owners can’t control technologies if they have or are capable of substantial non-infringing uses Many circumvention technologies have lawful uses (e.g., enable backup copying, fair uses) © industry: we need a stronger rule!

Minimalist way to implement WCT was to outlaw acts of circumvention intended to facilitate © infringement

Not clear it was necessary to outlaw circumvention technologies

Sony Betamax default rule: © owners can’t control technologies if they have or are capable of substantial non-infringing uses

Many circumvention technologies have lawful uses (e.g., enable backup copying, fair uses)

© industry: we need a stronger rule!

STRUCTURE OF 1201 1201(a)(1)(A): illegal to bypass TPM used by © owner to control access to work 1201(a)(2): illegal to make or traffic in technologies or services primarily designed or produced to bypass access controls 1201(b)(1): illegal to make or traffic in technologies or services primarily designed or produced to bypass TPMs used to protect ©’d works

1201(a)(1)(A): illegal to bypass TPM used by © owner to control access to work

1201(a)(2): illegal to make or traffic in technologies or services primarily designed or produced to bypass access controls

1201(b)(1): illegal to make or traffic in technologies or services primarily designed or produced to bypass TPMs used to protect ©’d works

DMCA “ACT” RULE 1201(a)(1)(A): Illegal after 10/00 to circumvent an effective TPM used by © owners to control access to ©’d works 7 specific exceptions: Law enforcement/national security Reverse eng’g necessary for interoperability Legitimate encryption research Computer security testing Nonprofit “shopping” privilege Parental control-related Personal privacy protection

1201(a)(1)(A): Illegal after 10/00 to circumvent an effective TPM used by © owners to control access to ©’d works

7 specific exceptions:

Law enforcement/national security

Reverse eng’g necessary for interoperability

Legitimate encryption research

Computer security testing

Nonprofit “shopping” privilege

Parental control-related

Personal privacy protection

1201(c) No effect on rights, limits or defences, including fair use, under this title (2) No effect on contributory/vicarious liability (3) No requirement to respond to technical measures in computer/consumer products (4) No effect on free speech/press Latter 3 added during legislative struggle; much contested what (1) and (4) mean

No effect on rights, limits or defences, including fair use, under this title

(2) No effect on contributory/vicarious liability

(3) No requirement to respond to technical measures in computer/consumer products

(4) No effect on free speech/press

Latter 3 added during legislative struggle; much contested what (1) and (4) mean

OTHER LIMITS Circumvention of other TPMs, such as copy- or use-controls, left unregulated Was this intended to leave room for fair uses? Library of Congress conducts triennial rulemaking to consider proposed exemptions from this rule for some classes of works or uses 6 granted last year 1 was for film studies teachers to make fair use clips of DVD movies to prepare teaching materials for class

Circumvention of other TPMs, such as copy- or use-controls, left unregulated

Was this intended to leave room for fair uses?

Library of Congress conducts triennial rulemaking to consider proposed exemptions from this rule for some classes of works or uses

6 granted last year

1 was for film studies teachers to make fair use clips of DVD movies to prepare teaching materials for class

ANTI-DEVICE RULES 1201(a)(2): outlaws technologies that bypass effective access controls used by copyright owners to protect their works 1202(b)(1): outlaws technologies that bypass other effective technical measures used by copyright owners to protect rights 1201(k): illegal to make video cassette recorders that don’t accommodate automatic gain control technology

1201(a)(2): outlaws technologies that bypass effective access controls used by copyright owners to protect their works

1202(b)(1): outlaws technologies that bypass other effective technical measures used by copyright owners to protect rights

1201(k): illegal to make video cassette recorders that don’t accommodate automatic gain control technology

ANTI-DEVICE RULES Illegal to manufacture, import, offer to the public, provide, or otherwise traffic in If primarily designed or produced to circumvent, Lacks commercially significant use other than circumvention, or Marketed as a circumvention device Only 3 of the exceptions to 1201(a)(1)(A) are also exempt from the anti-device rules, only 1 (1201(f)) is exempt from both anti-device rules Is there an implied right to make a tool to engage in privileged circumventions?

Illegal to manufacture, import, offer to the public, provide, or otherwise traffic in

If primarily designed or produced to circumvent,

Lacks commercially significant use other than circumvention, or

Marketed as a circumvention device

Only 3 of the exceptions to 1201(a)(1)(A) are also exempt from the anti-device rules, only 1 (1201(f)) is exempt from both anti-device rules

Is there an implied right to make a tool to engage in privileged circumventions?

DEBATE re TPM & FAIR USES Congress decided vs. allowing fair use circumventions David Nimmer; Judge Kaplan in Corley 1201(c)(1) + no regulation of other TPMs = intent to enable fair uses many scholars /Judge Gasarja in Chamberlain 3. Without some fair use-like limitation, anti-circumvention rules may be unconstitutional: Jane Ginsburg/ACLU in Corley

Congress decided vs. allowing fair use circumventions

David Nimmer; Judge Kaplan in Corley

1201(c)(1) + no regulation of other TPMs = intent to enable fair uses

many scholars /Judge Gasarja in Chamberlain

3. Without some fair use-like limitation, anti-circumvention rules may be unconstitutional:

Jane Ginsburg/ACLU in Corley

FAIR USE CIRCUMVENTIONS? Linguist bypasses CSS to take clips from movies to show as expert witness derogatory uses of “redskins” in litigation challenging TM Firm bypasses encryption to discern whether another firm has infringed its patents or © Researcher reverse engineers TPMs in Sony BMG copy-protected CDs, leading to discovery of rootkit sw Purchaser of Aibo dogs reverse engineers sw to develop software to make the dogs do new tricks Technologist reverse engineers filtering sw to find out what it blocks Computer Museum reverse engineers TPM to preserve sw

Linguist bypasses CSS to take clips from movies to show as expert witness derogatory uses of “redskins” in litigation challenging TM

Firm bypasses encryption to discern whether another firm has infringed its patents or ©

Researcher reverse engineers TPMs in Sony BMG copy-protected CDs, leading to discovery of rootkit sw

Purchaser of Aibo dogs reverse engineers sw to develop software to make the dogs do new tricks

Technologist reverse engineers filtering sw to find out what it blocks

Computer Museum reverse engineers TPM to preserve sw

HOW TO ACCOMMODATE FU? Ginsburg: allow fair users to make use of circumvention services to bypass TPMs Very risky in view of Corley decision Burk & Cohen: require © owners to provide keys to DRM to fair use infrastructure provider as precondition to qualifying for anti-circ protection In your dreams Lipton: CO should have administrative process to adjudicate fair use circumventions Political economy problems would plague it Reichman/Dinwoodie/Samuelson: judicially created reverse notice & takedown procedure to enable fair uses

Ginsburg: allow fair users to make use of circumvention services to bypass TPMs

Very risky in view of Corley decision

Burk & Cohen: require © owners to provide keys to DRM to fair use infrastructure provider as precondition to qualifying for anti-circ protection

In your dreams

Lipton: CO should have administrative process to adjudicate fair use circumventions

Political economy problems would plague it

Reichman/Dinwoodie/Samuelson: judicially created reverse notice & takedown procedure to enable fair uses

ORIGINS OF N&TD Notice & takedown principle was a judicial adaptation in RTC v. Netcom Automated copying in RAM by servers in course of transmission not infringement ISP is not strictly liable for infringing copies on its site, on its servers But if ISP gets notice of infringing materials, has a duty to investigate and take it down if charges are correct Notice & takedown later codified in 512

Notice & takedown principle was a judicial adaptation in RTC v. Netcom

Automated copying in RAM by servers in course of transmission not infringement

ISP is not strictly liable for infringing copies on its site, on its servers

But if ISP gets notice of infringing materials, has a duty to investigate and take it down if charges are correct

Notice & takedown later codified in 512

REVERSE NOTICE REGIME Prospective fair user notifies © owner of intent to make fair use of TPM’d content © owner has an obligation then to either take down the TPM or explain why not If no response within a reasonable time, fair user can hack the TPM & engage in fair use If © owner says no, fair user can seek declaratory judgment to enable fair use

Prospective fair user notifies © owner of intent to make fair use of TPM’d content

© owner has an obligation then to either take down the TPM or explain why not

If no response within a reasonable time, fair user can hack the TPM & engage in fair use

If © owner says no, fair user can seek declaratory judgment to enable fair use

OBJECTIONS? Corley forecloses; would need legislation Rights holders won’t find acceptable If can’t get access to a tool to enable the fair use, then theoretical fair use can’t happen Generally able to make fair uses without seeking permissions, burdensome Costly, many fair users will be deterred

Corley forecloses; would need legislation

Rights holders won’t find acceptable

If can’t get access to a tool to enable the fair use, then theoretical fair use can’t happen

Generally able to make fair uses without seeking permissions, burdensome

Costly, many fair users will be deterred

RESPONSES Netcom shows that judicial innovations such as notice & takedown feasible Chamberlain provides groundwork Content owners might be more responsive than we’d expect But Sklansky got permission from Disney! Movie studios not suing remixers who obviously bypassed CSS

Netcom shows that judicial innovations such as notice & takedown feasible

Chamberlain provides groundwork

Content owners might be more responsive than we’d expect

But Sklansky got permission from Disney!

Movie studios not suing remixers who obviously bypassed CSS

CHAMBERLAIN Maker of universal GDO not liable for 1201 Fed. Cir’s decision provides intellectual infrastructure for judicial innovation as to reverse notice & takedown: By requiring a showing of a nexus between acts of circumvention & infringement for 1201 liability; no infringement = no 1201 liability By endorsing 1201(c)(1) as fair use savings clause; any other interpretation “irrational” Balance = a “bedrock principle” of intellectual property law, 1201 included

Maker of universal GDO not liable for 1201

Fed. Cir’s decision provides intellectual infrastructure for judicial innovation as to reverse notice & takedown:

By requiring a showing of a nexus between acts of circumvention & infringement for 1201 liability; no infringement = no 1201 liability

By endorsing 1201(c)(1) as fair use savings clause; any other interpretation “irrational”

Balance = a “bedrock principle” of intellectual property law, 1201 included

BURDEN Yes, it’s better when fair uses can be done anonymously 1201(c)(1) defense may succeed if © owner sues for 1201 Our backs are vs. the wall: need to find way for FU Congress has been persuaded to ban circumvention technologies because of the high risk they will be used for infringement But Congress expected fair uses to continue, but did not think through how this could be accomplished Reverse notice regime is a plausible way to get there Case by case adjudication could develop basic principles for enabling fair uses of TPM content Might eventually be codified, as 512 was EFF, LS clinics can represent prospective fair users

Yes, it’s better when fair uses can be done anonymously

1201(c)(1) defense may succeed if © owner sues for 1201

Our backs are vs. the wall: need to find way for FU

Congress has been persuaded to ban circumvention technologies because of the high risk they will be used for infringement

But Congress expected fair uses to continue, but did not think through how this could be accomplished

Reverse notice regime is a plausible way to get there

Case by case adjudication could develop basic principles for enabling fair uses of TPM content

Might eventually be codified, as 512 was

EFF, LS clinics can represent prospective fair users

CONCLUSION WCT recognizes the need for a balance of © owner and public interests DMCA anti-circumvention rules do not fully accomplish a balanced solution Reverse notice & takedown would enable public interest uses, while leaving intact the ban on infringement-enabling circumvention technologies Over time, norms would evolve & standardized procedures could develop, eventually codified Our proposal is the most feasible of those proposed thus far to accommodate fair & other privileged uses of TPM’d content under the anti-circumvention rules

WCT recognizes the need for a balance of © owner and public interests

DMCA anti-circumvention rules do not fully accomplish a balanced solution

Reverse notice & takedown would enable public interest uses, while leaving intact the ban on infringement-enabling circumvention technologies

Over time, norms would evolve & standardized procedures could develop, eventually codified

Our proposal is the most feasible of those proposed thus far to accommodate fair & other privileged uses of TPM’d content under the anti-circumvention rules

ACLU AMICUS BRIEF IN CORLEY If 1201 is to be constitutional under Art. I, sec. 8, cl. 8 and 1 st A, it has to include limiting principles Fair use has constitutional dimensions that don’t go away just because a copyright owner uses technical measures to protect access or a copy So court has two choices: It must either read limiting principles into 1201 (e.g., fair use) or rule that 1201 is unconstitutional on its face

If 1201 is to be constitutional under Art. I, sec. 8, cl. 8 and 1 st A, it has to include limiting principles

Fair use has constitutional dimensions that don’t go away just because a copyright owner uses technical measures to protect access or a copy

So court has two choices:

It must either read limiting principles into 1201 (e.g., fair use)

or rule that 1201 is unconstitutional on its face

CONCENTRIC RINGS Center of ring: direct © liability requires proof of infringement, but fair use limits 2 nd ring: vicarious/contributory requires proof of underlying infringement; fair use still limits 3 rd ring: acts of circumvention which is subject to 7 exceptions (e.g., encryption res., interoperability) + 1201(c) 4 th ring: anti-device rules; no FU limit 5 th ring: contributory circumvention liability, newly invented by Kaplan, J., because linking does not directly “provide” DeCSS; no FU limit

Center of ring: direct © liability requires proof of infringement, but fair use limits

2 nd ring: vicarious/contributory requires proof of underlying infringement; fair use still limits

3 rd ring: acts of circumvention which is subject to 7 exceptions (e.g., encryption res., interoperability) + 1201(c)

4 th ring: anti-device rules; no FU limit

5 th ring: contributory circumvention liability, newly invented by Kaplan, J., because linking does not directly “provide” DeCSS; no FU limit

ACLU BRIEF Need for limiting principles at every ring of potential liability or constitutional problems Shouldn’t there be some proof of underlying infringement or at least grave risk? Shouldn’t there be some relationship between the infringer & person charged under 1201? Shouldn’t there be some fair use-like principles? Touretsky “gallery” of CSS descramblers Felten’s publication of results of SDMI hack, study of Sony rootkit software Jane Ginsburg’s links to sites where DeCSS can be found for her © course

Need for limiting principles at every ring of potential liability or constitutional problems

Shouldn’t there be some proof of underlying infringement or at least grave risk?

Shouldn’t there be some relationship between the infringer & person charged under 1201?

Shouldn’t there be some fair use-like principles?

Touretsky “gallery” of CSS descramblers

Felten’s publication of results of SDMI hack, study of Sony rootkit software

Jane Ginsburg’s links to sites where DeCSS can be found for her © course