15

What is the significance of this? The digital revolution makes it easier to copy copyrighted content. It also makes it easier to protect that content, and to do so in a more granular and precisely calibrated way. Imagine being able to sell a paperback book that could only be read by the original purchaser or a song that could only be listened to by a particular person in a particular room. Digital rights management technology makes it a lot easier to do these things. Suddenly the copyright owners have considerable physical control over their songs, e-books, and software, even after they have sold them. It is as if the recording industry or the publishers had a representative in your living room. They can use that control not merely to prevent illicit copying but to control and limit usage in ways that go far beyond their exclusive rights under copyright. All of this happens without the law or the state doing anything.

Like barbed wire, this is a technological protection measure.

16

Like the farmers, the content companies were not content with their barbed wire alone. They wanted legally protected barbed wire in addition to their existing legal rights under copyright.

Under the Digital Millennium Copyright Act, it became illegal to circ.u.mvent a technical protection measure such as encryption--the digital barbed wire behind which content companies secrete their work--even if what you did with the content when you got past the barbed wire was a fair use; excerpting a fragment of a film for a school presentation, for example, or making a copy of an encrypted audio file for personal use in another device. In other words, by using digital barbed wire, the content companies could prevent citizens from making the "fair uses" the copyright law allowed. This undermines some of the limitations on their exclusive rights that the Copyright Act explicitly carves out in Section 107, and thus shifts the balance of power that the Copyright Act establishes. Cutting barbed wire became a civil wrong, and perhaps a crime, even if the wire blocked a public road. Under most circ.u.mstances, making wire cutters was also now against the law.

17

The ranchers--whose digital equivalents are communications companies and hardware manufacturers--chafed under these new rules. The most powerful groups managed to get special dispensations. Internet service providers, for example, got a qualified immunity from copyright infringement that occurs over their networks. But ordinary citizens, librarians, and civil libertarians also complained, and they were not as well represented in the legislature. It is true that the new rules may help to prevent illicit copying, but they also strike a blow against the exercise of fair use rights--rights that are important both to free speech and compet.i.tion. Even if the content companies were absolutely right about the threats from digital piracy, this consequence should make us pause. But critics of the DMCA say that there is little evidence that the content companies are right. They quote some of the empirical studies I mentioned in the last chapter, particularly the ones that show no net negative effect from unauthorized music downloading on CD sales. They claim--and they are on strong ground here--that even if there are some losses from the new copying technologies, there are also benefits. Like the farmers, the critics would argue, the content companies take the benefits of the new technology for granted, but wish the law to step in to ameliorate the harms it also creates. And like the farmers, they are not yet satisfied. Their new proposals go even further--scarily further. Thus runs the critics' argument.

18

The critics of the DMCA conjure up a world in which it will be illegal to lend each other books or songs, where it will be impossible for us to copy even small fragments of digital work for criticism or parody, where encryption research will be severely "chilled," and where large quant.i.ties of the public domain will be enclosed together with the copyrighted content that the DMCA is supposed to protect. (The Electronic Frontier Foundation's "Unintended Consequences" studies give concrete examples.)2 They think the DMCA undoes the balance at the heart of copyright law, that it can be used to entrench existing businesses and their business methods, that it threatens speech, compet.i.tion, privacy, and innovation itself. In short, they think the DMCA is the worst intellectual property law Congress has ever pa.s.sed and view the adoption of similar laws around the world with a reaction little short of horror.

19

Those who supported the DMCA disagree, of course, and do so honestly. They see rampant piracy as a reality and the threat to fair use as some kind of academic hypothetical rarely encountered in reality. What's more, many of them do not think fair use is that important economically or culturally. If markets work well, users could be made to pay for the rights that fair use gives--but only if they wanted them. One could buy expensive digital books which one was allowed to share, quote, or copy for cla.s.sroom use, and cheaper ones which one had to keep to oneself. Remember that for many of the people who supported the DMCA, fair use is something of a "loophole"; certainly not an affirmative right of the public or a reserved limitation on the original property grant from the state.

(Remember the Sony Axiom from Chapter 4?) They find the a.n.a.logy of fair use to a public road ludicrous. This film, or book, or song, is mine; anything you do with it, or to it, you do at my sufferance. (Remember the Jefferson Warning from Chapter 2?) 20

How has the DMCA worked in reality? Which group's att.i.tudes were vindicated? Two case studies may help us to answer these questions.

21

Infectious Speech: The DMCA and Freedom of Expression 22

Jon Johansen, a 16-year-old Norwegian, was the unwitting catalyst for one of the most important cases interpreting the DMCA. He and two anonymous helpers wrote a program called DeCSS.

Depending on whom you listen to, DeCSS is described either as a way of allowing people who use Linux or other open source operating systems to play DVDs on their computers, or as a tool for piracy that threatened the entire movie industry and violated the DMCA.

23

A little background is in order. When you play a commercial DVD, your actions are partly controlled by a simple encryption scheme called CSS, or the Content Scramble System. The DVD Copy Control a.s.sociation licenses the keys to this encryption system to the manufacturers of DVD players. Without a key, most DVDs could not be played. The manufacturer then embeds this key in its hardware design in such a way that it is easy for your player to decode and play the movie but hard, at least for a person of average technical competence, to copy the decoded "stream."

24

Because the DVD Copy Control a.s.sociation will only license keys to manufacturers whose DVD players conform exactly to their specifications, the CSS scheme can also be used to control viewers in other ways. For example, DVD players are required to have one of six "region codes," depending on where in the world they are sold. Region 1 is the United States and Canada. Region 2 is j.a.pan, Europe, South Africa, the Middle East, and--bizarrely--Greenland. Region 3 is South Korea, Taiwan, and Hong Kong; and so on. The CSS scheme can be used to restrict a movie to a player with the appropriate region code. If you try to play a movie coded for region 6 (China) in a DVD player from region 1, it will not play. This allows filmmakers to distribute different versions of films to different regions at different times based on sequential release in cinemas, or simply to distribute DVDs with different prices to different regions without worrying about whether the cheaper DVDs will "leak" into the more lucrative markets. CSS and the hardware scheme that unlocks it can also be used to prevent you from fast-forwarding through the commercials at the beginning of the movie if the copyright owner does not want you to, or from skipping the FBI notice. The machine will not do it. In fact, it is deliberately built so that it cannot do it.

25

What we have here is a digital fence that is partly used to prevent copying. Movie studios are understandably worried about the worldwide circulation of perfect digital copies of their movies. CSS was supposed to help to prevent that, or at least make it much harder. But because almost all movies are encrypted with CSS and access to the keys comes with conditions, CSS also allows a more fine-grained control over consumers. Manufacturers are not allowed to make players which can view movies from all region codes or skip portions of the DVD that the owners do not want you to skip. The licensing body puts it this way on its Web site: "Q. Under the terms of the CSS licensing agreement, is it legal for a licensed manufacturer to produce and sell a product which allows a user to disable any CSS protections? A. No. Such products are not allowed under the terms of the CSS license.

They are illegal."3 A technology introduced to protect intellectual property rights allows control in ways that those rights alone do not.

26

Before the DMCA, the movie companies could have done exactly this. They could have wrapped their movies in a digital fence.

The consumer electronics companies that wanted to could license a key and be allowed to use a trademark that indicated that they were approved by the DVD Copy Control a.s.sociation. But what if a manufacturer of DVD players felt that American consumers wanted to be able to play their j.a.panese anime movies without buying another DVD player to do so? Or what if they thought people were antsy and did not want to watch the FBI notice before every film? The manufacturer could have tried to "reverse engineer"

the CSS system, to figure out how it worked. If they succeeded, they could make a player that was free of the restrictions that the CSS licensing authority imposed.

27

Of course there were some legal limitations even before the DMCA. Our hypothetical manufacturer could not break into the safe where the CSS code was being held or bribe an employee to provide it. (That would be a trespa.s.s or a violation of trade secret law.) It could not violate copyright laws over the various types of software that controlled DVD players. It could not use the trademarks of any of the ent.i.ties involved, including any seal of approval granted by the DVD Copy Control a.s.sociation. But it could--at least in the United States--try to reverse engineer the product so as to make a competing product with features that the customers liked more. It would be no more illegal than a company making a cheaper generic razor cartridge that fits my expensive Gillette Mach 3 razor, a generic printer cartridge to replace the expensive one in my Lexmark printer, or, for that matter, a generic remote control for my garage door opener. In each case, of course, the original manufacturer would prefer that I use their products rather than the unlicensed ones. They can design their product to make it hard to use a generic replacement or even tell me that my warranty will be void if I use one. But they cannot say that the unlicensed product is illegal. We are back in option one of the Farmers'

Tale, before the legislature acted. The farmers can put up their wire, and even use it to block pa.s.sage that would be otherwise legal, but it is not a crime to figure out a way through the fence unless the fence cutter is also a trespa.s.ser. The DMCA, however, might have changed all of that.

28

Let us return to Mr. Johansen, the 16-year-old Norwegian. He and his two anonymous collaborators claimed that they were affected by another limitation imposed by the CSS licensing body. At that time, there was no way to play DVDs on a computer running Linux, or any other free or open source operating system. (I will talk more about free and open source software later.) Let's say you buy a laptop. A Sony Vaio running Windows, for example. It has a slot in the side for DVDs to slide in and software that comes along with it which allows the DVD reader to decode and play the disk. The people who wrote the software have been licensed by the DVD Copy Control a.s.sociation and provided with a CSS key.

But at the time Mr. Johansen set out to create DeCSS, the licensing body had not licensed keys to any free or open source software developers. Say Mr. Johansen buys the Sony Vaio, but with the Linux operating system on it instead of Windows. The computer is the same. The little slot is still there. Writing an open source program to control the DVD player is trivial. But without the CSS key, there is no way for the player to decode and play the movie. (The licensing authority later did license an open source player, perhaps because they realized its unavailability gave Mr. Johansen a strong defense, perhaps because they feared an ant.i.trust suit, or perhaps because they just got around to it.) 29

Mr. Johansen and his supporters claimed strenuously that DeCSS was not in fact an aid to illicit copying. In fact, they argued that CSS was not really designed to protect DVDs against illicit copying. Commercial DVD "pirates" do not need to crack the CSS encryption. Quite the contrary: they produce exact copies of the DVD, CSS encryption and all, and the buyer's player dutifully decodes it and plays it. Mr. Johansen claimed that his goals were very different from those of the pirates.

30

The motivation was being able to play DVDs the way we want to. I don't like being forced to use a specific operating system or a specific player to watch movies (or listen to music). Nor do I like being forced to watch commercials. When your DVD player tells you "This operation is not allowed" when you try to skip commercials, it becomes pretty clear that DRM really stands for Digital Restrictions Management.4 31

In Mr. Johansen's view, CSS was simply an attempt to control consumers, an attempt which should be a valid target for legal reverse engineering. He has a point. There were indeed other ways to copy DVDs which did not require DeCSS and which gave you files of more manageable size. CSS was indeed more than a simple anticopying device. The entire scheme--the keys, the licenses, the hardware requirements--was designed to give movie studios greater control over their movies in a number of ways, some of them unrelated to copying. On the other hand, he overstated the point. One function of CSS was indeed to make it harder for the average person playing a DVD on a computer to copy the file from the DVD to her hard disk and give it to a friend. It is very easy for the average 14-year-old to take a commercial music CD, change the songs into smaller files in the MP3 format, and share them with a friend. It is not as easy to do the same thing to a DVD--not impossible, just harder--and CSS is one of the reasons why.

32

Mr. Johansen's program, DeCSS, was quickly made available worldwide. Mirror sites provided copies of the program and lists of such locations were easy to find using standard search tools.

One such list was provided by the online site run by a magazine called 2600: The Hacker Quarterly. The magazine features everything from pictures of pay phones from around the world to tips on how to hack into computer or telephone systems. Its publisher is one Eric Corley, who goes by the name Emmanuel Goldstein--the resistance leader in George Orwell's 1984.

33

In 1999, Universal City Studios brought suit against a number of individuals for distributing DeCSS. The case was called Universal City Studios v. Reimerdes et al. Corley was among the defendants. The suit prominently included a claim that the defendants were violating the DMCA. It was in this case that the DMCA received its first major legal challenge.

34

Depending on the characterization of the facts, the case seems to be about very different things. It could seem a cla.s.sic First Amendment fight. ("Plucky magazine publisher told copyright law forbids him from linking to other sites on the Internet!") Or it could seem the very essence of illegal activity. ("Shadowy site which unashamedly caters to computer 'hackers' tries to spread access to the burglar's tools of cybers.p.a.ce!") 35

Of course, most lawsuits involve conflicts over facts. Much of what lawyers do is put the same facts into different conceptual boxes. But here, merely describing what Corley does, what hackers are, or what 2600 magazine is all about involves one in a profound culture clash. The best way to capture the clash may be to quote from an early entry about Corley in Wikipedia, the remarkable online encyclopedia.

36

The encyclopedia first quotes the description of 2600 magazine from Judge Lewis A. Kaplan, the federal district court judge who decided the Reimerdes case.

37

"2600: The Hacker Quarterly has included articles on such topics as how to steal an Internet domain name, how to write more secure ASP code, access other people's e-mail, secure your Linux box, intercept cellular phone calls, how to put Linux on an Xbox, how to remove spyware, and break into the computer systems at Costco stores and Federal Express. One issue contains a guide to the federal criminal justice system for readers charged with computer hacking. In addition, 2600 operates a web site located at 2600.com (http://www.2600.com), which is managed primarily by Mr. Corley and has been in existence since 1995."

38

The Wikipedia article then continues as follows: 39

While the judge's tone is clearly disapproving, others would point out that bookstores, movies and television channels are filled with material on how to commit murder . . . and that without the efforts of the hacker community, however illintentioned, computer insecurity would be even more of a problem than it already is.5 40

In fact, Judge Kaplan was not entirely disapproving. He mentions articles in 2600 that cover laudable or innocuous tasks, as well as others about tasks that most readers would find objectionable and rightly think to be illegal. But the anonymous volunteer who wrote this version of Corley's Wikipedia entry clearly saw the issue differently. Wikipedia does not portray the hacker community as universally benevolent ("however ill-intentioned"), but that community is also seen as providing a useful service rather than merely a set of how-to guides for would-be digital burglars.

41

To most people, pointing out vulnerabilities in computer security systems seemed, at least in 1999, like telling the world that your neighbor has forgotten to lock his door and all his possessions are there for the taking. But to the online community, it is by no means so clear. From the perspective of those who are knowledgeable in the field, there is a moral continuum. There is clearly legitimate computer security and cryptography research, which includes attempts to break into computer systems to test their defenses--that is how one finds out they are secure, after all. Then there are "hackers." This term could be used to describe those who merely like to program.

Richard Stallman, for example, the originator of the free software movement, describes himself thus. But the term could also be used for those who are interested in security or interoperability--making two systems work together. That was Mr.

Johansen's declared goal, after all. But some self-described hackers go further. They believe that exploring and disclosing the weaknesses of supposedly secure systems is intellectually fulfilling, practically important, and protected by the First Amendment. They disclaim both moral and legal responsibility for the consequences of their disclosures. (Or at least the negative consequences; they frequently take credit for the positive consequences, such as improved security.) Finally, there are "crackers," whose interest in gaining entry to computer systems is malicious or for financial gain. At what point on this continuum does the activity become legally, or morally, unacceptable? As the Reimerdes trial went on, it became clear that the answer the DMCA gave might not be the same as the one given even by undeniably legitimate computer scientists.

42

A large number of legal arguments were involved in the Reimerdes case, but for our purposes here the most important ones dealt with the relationship between copyright and the First Amendment.

What is that relationship?

43

In one obvious sense copyright actually aids free speech. By providing an incentive to create works, copyright "add[s] the fuel of interest to the fire of genius,"6 and thus helps to create the system of decentralized creative production and distribution I described in Chapter 1. But copyright also restrains speech. At its base, it allows an individual to call upon the state to prevent someone from speaking or expressing themselves in a particular way. This may involve a simple refusal to let the speaker use some text, picture, verse, or story in their message, or it may involve a refusal to let them transform it in some way.

44

Neither copyright law nor the American Const.i.tution is blind to these dangers. Copyright has a number of built-in safeguards.

The most important of these is that copyright only covers "original expression"--both the ideas and facts in this book can be used by anyone without my permission. Thus, goes the theory, the speaker's freedom of expression is never truly restrained.

The only thing I am barred from is using your words, your exact plot, your photograph, your music--not your facts, your ideas, your genre, the events you describe.

45