Monday, 28 December 2009

Home copying of e-books and digital rights management

A frequently asked question that seems appropriate this time of year (given the number of e-books that are likely to appear in people's Christmas stockings) concerns what one is legally allowed to do with documents on one's own e-book, particularly one that is protected by some form of digital rights management.

Let us consider John, a keen adopter of technology. John has a number of different e-book reader platforms and numerous e-books in a variety of formats. He'd like to be able to make back up copies of the books and transfer them from one device to another — known as "format shifting". He is interested in what the law has to say about it. To keep things simple I'm not going to think about what he ought to be able to do or what he might get away with: working through the law will be enough for one post. Let us also assume that someone owns the copyright in the book being read.


John's first difficulty is that if he "bought" the e-book he may well be bound by a contract with the distributor. For example the mobipockets terms of trade (which are written in appallingly broken English) appear to prevent him format shifting since they say, under section 5 "Terms of Product or Service Use/Loadings":

You admit and you accept that the product or the service bought is exclusively readable on the PDA corresponding to the PID you registered on the Site at the inscription moment.
and further under section 9 "Property Rights":
Every elements you will find on the Site in particular the texts, the information, the images, the softwares, the logos and other distinctive signs etc. may be protected by property rights in particular copyrights. By the way you promise not to reproduce, copy, sell, resell, rent or exploit etc. whole or part of these elements in a commercial or other purpose, unless you have allowed to do it by the beneficiary.
These terms appear to prohibit John from copying an e-book to another device. If he does so he will be in breach of contract.

But at Christmas many of John's e-books were probably bought for him by his friends and family. Most legal systems won't enforce a contract against someone who was not a party to it (except in certain exceptional circumstances). In particular I think this is true in French law — the law selected by the mobipockets terms of service. John would therefore not be bound by the e-book's terms of service.


John's second difficulty occurs if the book is subject to copyright. As a general rule John may only copy it with the permission (direct or indirect) of the copyright owner. The exceptions to the rule, most of which fall under the heading of "fair dealing" (a poor, stunted relation of the United States concept of "fair use"), are few and far between and most certainly don't include format shifting and backup.

That permission, or as we lawyers prefer to say licence, will usually come with strings attached restricting John to certain kinds of copying. For most e-books this will not include format shifting, though backup may be permitted. If John format shifts he risks doing so without a licence and thus infringing copyright.

Digital Rights Management

In practice this is all rather theoretical: no-one seems to take a blind bit of notice and format shifting particularly of recorded music in breach of its owner's copyright is the rule rather than the exception. Publishers have responded by adopting an asortment of technical measures to try to control what their customers are able to do with works that they have "bought". For example by adding region codes to DVD's so as to partition the world market, or in the case of e-books by adopting various format restrictions such as Amazon's AZW file format.

If reading E. E. "doc" Smith taught us anything it was that, given time, pretty much any technology can be beaten. The other side will invariably find a way around it. This appears to be true with DRM as with anything else. John will almost certainly be aware that the DRM used by the Amazon kindle has been hacked.

Legal protection of DRM

The next round in this rather sorry conflict between the desire of publishers to control the use of their works after they have been sold and their customers' understandable wish to be able to freely use what they have "bought" comes with the signing of the WIPO Copyright Treaty (a.k.a the WCT) on December 20 1996. Article 11 specifically requires parties to the treaty to take steps to prevent John getting around the DRM on his e-books:

Article 11
Obligations concerning Technological Measures
Contracting Parties shall provide adequate legal protection and effective legal remedies against the circumvention of effective technological measures that are used by authors in connection with the exercise of their rights under this Treaty or the Berne Convention and that restrict acts, in respect of their works, which are not authorized by the authors concerned or permitted by law.

If you read this carefully you will see that there is no need to protect against the circumvention of a technological measure where that measure is being used to restrict an act that is permitted by law. In other words the states that are parties to the WCT do not need to enact laws that prohibit John from getting around DRM which is stopping him from doing something he is otherwise allowed to do: for instance if the e-book is not subject to copyright; or if he lives in a country (like France) where there is a private copying exemption or (if he lived in the US) where what he is doing would be fair use and so on.

The European Union legislative response to the WCT came on 22 May 2001 with Directive 2001/29/EC sometimes known as the Copyright Directive or the Information Society Directive. The directive is much less generous than the WCT. The definition of "technical measure" found in article 6(3) is even less easy to read than article 11 of the WCT, for reference (though feel free to skim over it):

For the purposes of this Directive, the expression "technological measures" means any technology, device or component that, in the normal course of its operation, is designed to prevent or restrict acts, in respect of works or other subject-matter, which are not authorised by the rightholder of any copyright or any right related to copyright as provided for by law or the sui generis right provided for in Chapter III of Directive 96/9/EC.

So, a "technological measure" is anything which prevents an act not authorised by the owner of copyright (or some similar right) even if that act would otherwise be permitted by law. In this way the directive is going much further than the WCT. Article 6(4) does permit members states of the EU to incorporate some relief for anyone who is prevented from some otherwise lawful uses of their work by technological measures, but as we shall see article 6(4) does not sweeten things nearly as much as one might hope.

The directive enters English law on 31 October 2003 as a number of new sections in the Copyright Designs and Patents Act 1998. Section 296ZA attempts to prevent the circumvention of DRM ("technological measures"). It does this by making the circumvention of DRM the equivalent of copyright infringement. It permits not only the copyright owner, but also the publisher (strictly speaking the person who issues to or communicates to the public the protected work) to sue the person circumventing the DRM. Amazon could pursue John, alongside the owners of any copyright in any e-book he format shifts.

What if John wants to do something he would otherwise be permitted to do (for example that would be fair dealing for the purposes of private study)? In other words how has the UK tried to prevent DRM being used in an overly powerful way? Answer: they can complain about it. Section 296ZE permits them to issue a notice to the Secretary of State. The Secretary of State may then (but is entirely free not to) order the copyright owner or any exclusive licensee of the work to do something about it. As far as I know, the Secretary of State has never done so.

The real target of section 296ZA will not be John who after all is doing things in the privacy of his own home.Anyone who works out how to get around (say) Amazon's DRM and publishes that information on the web will also have circumvented a technological measure and will make a much more attractive target, not least because Amazon et al will have a much easier time in proving that they have suffered significant damages as a result of the circumvention.

Two small brighter points appear: first s.296ZF, defining a "technological measure", makes it clear that they only apply to a "copyright work". There should be no pentalty for getting around DRM attached to an out of copyright work. Second, only "effective" technological measures are protected. It would be marvellous, though I think unlikely, if the European Court of Justice accepts the literal meaning of that word so that once there is a widely known exploit that will crack any particular DRM we are all free to use it.

In conclusion: if John wants to avoid infringing any legal rights, he will only be able to format shift, take backups or otherwise copy material if permitted to do so by the copyright owner. Whether a company that digitised (say) the Complete Works of Shakespeare could claim that in doing so it gained a new copyright over the digitised version is another (and much more complicated) story. For now, Happy Christmas.

Thursday, 10 December 2009

Government wants new powers to block wikileaks and squeeze web tv

Just over a week ago I wrote a fairly dry legal analysis of the Digital Economy Bill. I spotted an extremely serious provision — clause 11 — in the version being discussed in the House of Lords. Having looked at the amendments (which you can find on the Bill's document page) I am worried that no-one in Parliament appears to be taking the problem seriously.

What is the problem with clause 11 that I am getting so alarmed about it? It amends the Communications Act 2003 to insert a new section 124H which would, if passed, give sweeping powers to the Secretary of State. It begins:

(1) The Secretary of State may at any time by order impose a technical obligation on internet service providers if the Secretary of State considers it appropriate in view of—

Pausing there. Note that this says nothing at all about copyright infringement. For example the power could be used to:

  • order ISP's to block any web page found on the Internet Watch Foundation's list
  • block specific undesireable sites (such as wikileaks)
  • block specific kinds of traffic or protocols, such as any form of peer-to-peer
  • throttle the bandwidth for particular kinds of serivce or to or from particular websites.
In short, pretty much anything.

I do not exagerrate. The definition of a "technical obligation" and "technical measure" are inserted by clause 10:

A "technical obligation", in relation to an internet service provider, is an obligation for the provider to take a technical measure against particular subscribers to its service.
A "technical measure" is a measure that— (a) limits the speed or other capacity of the service provided to a subscriber; (b) prevents a subscriber from using the service to gain access to particular material, or limits such use; (c) suspends the service provided to a subscriber; or (d) limits the service provided to a subscriber in another way.
As you can see blocking wikileaks is simply a matter of applying a technical measure against all subscribers of any ISP.

Surely something must limit this power you ask? It seems not. The Secretary of State may make an order if "he considers it appropriate" in view of:

(a) an assessment carried out or steps taken by OFCOM under section 124G; or (b) any other consideration.
Where "any other consideration" could be anything. To their credit the Tories do seem to have realised that this particular alternative is overly permissive. Lord Howard of Rising and Lord de Mauley have proposed (in the first tranche of amendments proposed that the "or" be replaced by an "and".

What astonishes me is that there is no obligation for the Secretary of STate to even publish such an order, let alone subject it to the scrutiny of Parliament, yet he could fundamentally change the way the internet operates using it. Other orders made under other parts of the Bill will have to be made by statutory instrument and most will require Parliamentary approval. Not this one.

The only other amendment that has so far been tabled that might restrict the powers of the Secretary of State under clause 11 appears in a third tranche proposed by the liberal democrat Baroness Miller of Chilthorne Domer which deletes the paragraph (b) from the definition of a technical measure (i.e. "limits the service provided to a subscriber in another way") which does put some bounds, although not very tight bounds on what an imaginative Secretary of State might do.

The government is not at all imaginative. In their explanatory notes they envisage:

The government envisages that the criteria for taking a technical measure against a particular subscriber would be the same as the criteria used to determine whether the subscriber' s alleged infringements are included in a copyright infringement list under the initial obligations. So a technical measure would be applied if a subscriber had been linked to a number of CIRs sufficient to place them on a serious infringers list.
Note very well: they expect to use the power against the guilty and the innocent (of copyright infringement) equally.

The problem, I think, is that people are skim-reading the Bill and thinking that this part has to do with copyright infringement. Clause 11 is nestled between provisions about notifications of copyright infringement (the "strikes" idea) and the technical obligations code. People seem to be assuming that the Clause 11 power will only get used in that context but there is nothing in the Bill to make that so. As fellow blogger Julian Todd pointed out the government froze the funds in the Landsbanki bank using powers contained in the Anti-terrorism, Crime and Security Act 2001. A future government might well think "that's a useful power" and use it for almost anything. Let us hope that the Lords wake up to this fast. I have much less hope of the Commons.