webcoder.info(copyfight); //

RealNetworks just screwed us all by settling lawsuits in which it might have lost--but which might also have given some new life to fair use for digital media. The post-RealDVD world means that unless there's a major change to the law surrounding copy protection, there will never be a legal way to perform legal acts of copying or shifting protected movies, music, and games. Take it from a guy who has a special E Ticket. The major movie studios can never sue me nor four other individuals ever for a variety of media-moving activities that you and 300 million other Americans could be subject to. It's like a superpower. More on how we got this pass later. The suits in question revolve around RealDVD, software Real introduced in September 2008 that would copy the full contents of a video DVD to a file that could be played back on a Windows system. RealDVD is not a DVD ripper: those programs use one of many methods to strip the Content Scramble System (CSS), the DRM that wraps up DVD content, and other defensive techniques.

CSS and its ilk aren't precisely defended by technology--the standards are too weak or poorly executed--but by law. The much-excoriated Digital Millennium Copyright Act (DMCA) prohibits "circumvention" of software that's designed to prevent copying. Breaking DRM encryption breaks the law.

But Real went through the steps to obtain a license from the DVD Copy Control Association (DCCA), which controls CSS on behalf of the movie industry. RealDVD decrypted the DVD, copied it, and then locked it tight. Up to five PCs licensed by the same person could play back the discs. (Real also broke through a couple of unrelated protection efforts.)

RealNetworks must have calculated that as a company with a large war chest, it could succeed where others didn't dare to tread. As soon as it released RealDVD, it preemptively sued the DCCA and several studios to establish that it had the right to use CSS in the way RealDVD did. The studios and DCCA sued in return, and got software sales halted. The studios won in August 2009; Real appealed.

The settlement on Monday clears all the suits by RealNetworks agreeing to never sell the software again, refund the money to about 2,700 RealDVD purchasers, disable an associated metadata service, and pay $4.5 million to several movie studios, its Rhapsody partner Viacom, and the DCCA to cover legal and other expenses.

Some people may truly hate RealNetworks for its mediocre RealPlayer software (once a technical miracle) that was bundled with poorly disclosed third-party adware programs. But RealDVD was a thin blade trying to shimmy open the door of fair use.

Fair use is a maddeningly ambiguous set of rules enshrined in copyright law that mention nothing whatsoever about personal use and copying. Court decisions have shaped fair-use exemptions to copyright laws. Congress has passed extremely narrow copyright exclusions for personal use as well.

Without testing specific ideas about fair use or copyright scope in court, there's no sure way to know whether your particular software program, Web site, tweet, or steampunk-based laser decrypter isn't in violation. When the MPAA or a studio sues you, you could potentially plow through millions of dollars with no idea of the outcome.

You can always be sued, but you want to make sure that you have some basis on which to defend yourself, especially if the law and court decisions firmly back you up.

As BoingBoing recently reported about its battle with MagicJack, a group without crazily deep pockets can win and recover costs when it has a strong idea it is in the right. (BoingBoing benefitted from the California strategic lawsuit against public participation or SLAPP, which wouldn't apply to software and hardware.)

That what was made the RealDVD suits so exciting, because Real has hundreds of millions of dollars in the bank, and had a pugnacious CEO, Rob Glaser. Glaser faced down Microsoft over unfair competition and got nearly $800 million from the Windows maker. (Glaser was forced out as head of Real a few weeks ago, although he intended to move on after an executive search; he remains chairman of the board and owns nearly 40 percent of the firm.)

Even better, Real wasn't promoting piracy, or the broad right to rip DVDs into an unprotected format and then move them onto all kinds of devices for playback. RealDVD was very very narrow in purpose: can individuals buy software that converts one kind of protected content on a specific physical medium into another, with even stronger encryption?

Back in 2002, I joined a model lawsuit brought by the Electronic Frontier Foundation, what became known as Newmark v Turner (after Craig Newmark of craigslist, one of four other co-plaintiffs). The EFF wanted Newmark v to be joined to a lawsuit originated in 2001 by 28 movie studios, TV production firms, and cable operators against SonicBlue, which made ReplayTV, a digital video recorder that was at one point mildly superior to TiVo.

You may recall the ReplayTV suit, which begat the statement in a magazine interview from then chief executive of Turner Broadcasting that skipping ads was "theft," and that not watching ads was breaking a contract. He said, "There's a certain amount of tolerance for going to the bathroom." The industry later tried to backpedal from these statements.

Our suit was a way to try to establish that consumers had rights in this fight among firms: that time-shifting (recording for later consumption) and space-shifting (moving among devices under our control for personal use) were perfectly acceptable, and that we were in danger of losing such rights. Ad skipping was also part of the suit.

Remarkably, a judge agreed to join us in the fight, to the surprise, we think, of the 28 media firms. That would have been ugly had we gone to trial. We faced some potential (though unlikely) penalties were it to be proved that we had violated copyright in our efforts to establish we had used media fairly.

The media firms had a big problem, though, in that it would have been an ugly public-relations battle to try to paint Craig Newmark, your humble reporter, and three other mild-mannered individuals as horrible scofflaws.

Had we won, we would have enshrined a judicial opinion that would have perhaps emboldened consumer-electronics firms and software makers to create products that put much more control over recorded programs in the hands of consumers.

Instead, SonicBlue went bankrupt and sold its assets to another firm that removed the features in question in 2003. The media firms then dismissed its lawsuit against the companies involved.

Here's where it gets interesting. I had completely forgotten until researching the case to write this editorial that the 28 firms gave Craig, me, and our three fellow plaintiffs a "covenant not to sue" for the acts in question. That essentially nullified the suit because we had no more fear of litigation. (The EFF tried to get the same rights for all ReplayTV owners, just 5,000 people, but failed when the judge wouldn't move the case into class-action status.)

So we are copyright superheroes, with the ability to advance ads in a single click, shift content among hardware, and watch at our leisure! Behold us, and despair, for you will not see our like again.

RealNetworks needs to work with studios, so it settled and paid less than 1 percent of its still-giant cash horde--last year, the company's cash was of greater value than its market capitalization for several months--to be able to move forward on content licensing.

I can understand why they did it, but it resembles the Google Book Settlement, a massive effort by Google to get a special judicial and settlement right to not be sued for selling works to which the owner cannot be found and to which it does not have assigned rights (so-called orphan works).

If Google succeeds, then no other firm will go through the expensive litigation that allowed Google to reach the point where it can settle and win in cooperation with the Authors Guild and the Association of American Publishers. Google will have a de facto monopoly.

It's unlikely that any other firm with the resources to challenge the media industry will release software or hardware that would allow DVD conversion in a manner that a court could find legal. Real was the last, great hope, because any other similar firm already has multi-million to multi-billion-dollar deals in play. Apple, Microsoft, and others aren't going to release anything that jeopardized how they work with giant copyright holders.

That leads to the conclusion that in order to make legal copies, you are obliged to be a pirate. Media companies failure to accommodate the notion that people may have legitimate purposes for making digital copies for their own use dooms them to eternal piracy.

We're all screwed. Well, I'm not, probably. But you are.

(Disclosure: About a decade ago, a company I helped incubate was bought by RealNetworks, and I received a modest amount of stock, long sold.)

The entire family of devices built on the iPhone OS (iPhone, iPod Touch, iPad) have been designed to run only software that is approved by Apple—a major shift from the norms of the personal computer market. Software developers who want Apple's approval must first agree to the iPhone Developer Program License Agreement.

So today we're posting the "iPhone Developer Program License Agreement"—the contract that every developer who writes software for the iTunes App Store must "sign." Though more than 100,000 app developers have clicked "I agree," public copies of the agreement are scarce, perhaps thanks to the prohibition on making any "public statements regarding this Agreement, its terms and conditions, or the relationship of the parties without Apple's express prior written approval." But when we saw the NASA App for iPhone, we used the Freedom of Information Act (FOIA) to ask NASA for a copy, so that the general public could see what rules controlled the technology they could use with their phones. NASA responded with the Rev. 3-17-09 version of the agreement.

UPDATED: we are now also posting the most recent version of the agreement, dated January 2010.

This "license agreement" is particularly relevant right now, given the imminent launch of the iPad and anytime-now issuance of the U.S. Copyright Office's ruling regarding jailbreaking of the iPhone.

So what's in the Agreement? Here are a few troubling highlights:

Ban on Public Statements: As mentioned above, Section 10.4 prohibits developers, including government agencies such as NASA, from making any "public statements" about the terms of the Agreement. This is particularly strange, since the Agreement itself is not "Apple Confidential Information" as defined in Section 10.1. So the terms are not confidential, but developers are contractually forbidden from speaking "publicly" about them.

App Store Only: Section 7.2 makes it clear that any applications developed using Apple's SDK may only be publicly distributed through the App Store, and that Apple can reject an app for any reason, even if it meets all the formal requirements disclosed by Apple. So if you use the SDK and your app is rejected by Apple, you're prohibited from distributing it through competing app stores like Cydia or Rock Your Phone.

Ban on Reverse Engineering: Section 2.6 prohibits any reverse engineering (including the kinds of reverse engineering for interoperability that courts have recognized as a fair use under copyright law), as well as anything that would "enable others" to reverse engineer, the SDK or iPhone OS.

No Tinkering with Any Apple Products: Section 3.2(e) is the "ban on jailbreaking" provision that received some attention when it was introduced last year. Surprisingly, however, it appears to prohibit developers from tinkering with any Apple software or technology, not just the iPhone, or "enabling others to do so." For example, this could mean that iPhone app developers are forbidden from making iPods interoperate with open source software, for example.

You will not, through use of the Apple Software, services or otherwise create any Application or other program that would disable, hack, or otherwise interfere with the Security Solution, or any security, digital signing, digital rights management, verification or authentication mechanisms implemented in or by the iPhone operating system software, iPod Touch operating system software, this Apple Software, any services or other Apple software or technology, or enable others to do so

Kill Your App Any Time: Section 8 makes it clear that Apple can "revoke the digital certificate of any of Your Applications at any time." Steve Jobs has confirmed that Apple can remotely disable apps, even after they have been installed by users. This contract provision would appear to allow that.

We Never Owe You More than Fifty Bucks: Section 14 states that, no matter what, Apple will never be liable to any developer for more than $50 in damages. That's pretty remarkable, considering that Apple holds a developer's reputational and commercial value in its hands—it's not as though the developer can reach its existing customers anywhere else. So if Apple botches an update, accidentally kills your app, or leaks your entire customer list to a competitor, the Agreement tries to cap you at the cost of a nice dinner for one in Cupertino.

Overall, the Agreement is a very one-sided contract, favoring Apple at every turn. That's not unusual where end-user license agreements are concerned (and not all the terms may ultimately be enforceable), but it's a bit of a surprise as applied to the more than 100,000 developers for the iPhone, including many large public companies. How can Apple get away with it? Because it is the sole gateway to the more than 40 million iPhones that have been sold. In other words, it's only because Apple still "owns" the customer, long after each iPhone (and soon, iPad) is sold, that it is able to push these contractual terms on the entire universe of software developers for the platform.

In short, no competition among app stores means no competition for the license terms that apply to iPhone developers.

If Apple's mobile devices are the future of computing, you can expect that future to be one with more limits on innovation and competition (or "generativity," in the words of Prof. Jonathan Zittrain) than the PC era that came before. It's frustrating to see Apple, the original pioneer in generative computing, putting shackles on the market it (for now) leads. If Apple wants to be a real leader, it should be fostering innovation and competition, rather than acting as a jealous and arbitrary feudal lord. Developers should demand better terms and customers who love their iPhones should back them.

[This is the fourth post in a series on best practices for government datasets by Harlan Yu and me. (previous posts: 1, 2, 3)]

Even cautiously edited datasets sometimes contain errors, and even meticulously produced schemas require refinement as circumstances change. While errors or changes create inconvenience for developers, most developers appreciate and prepare for their inevitability. Agencies should strive to do the same. A well-developed strategy for fixes and changes can ease their burden on both developers and agencies.

When agencies release data, developers ideally will interact with it in creative new ways. Given datasets containing megabytes to gigabytes of data, novel uses will reveal previously unnoticed errors. Knowledge of these errors benefits the agency as well as other developers using the data, so agencies should take steps to encourage error reporting. Labels in a dataset allow developers to specify errors efficiently and unambiguously. An easy-to-find channel for reporting errors, such as a prominently provided email address or web form, is also critical. Tracking down the contact information of the person responsible for a dataset can be difficult, and a well-known channel reduces this barrier to feedback.

Upon learning of an issue in a dataset, an agency should correct the problem and release the corrected dataset in a timely manner. An important fact to keep in mind when correcting data is that numerous developers may have already downloaded and begun using the old flawed version. For these developers, even a minor modification can cause major issues if not done carefully. Agencies should think about two things: how they will make developers aware that the dataset has been modified and how they will change the dataset itself. The first point is sometimes ignored in spite of its importance. Not only should datasets contain version information, but agencies should also notify developers when the data that they rely on has changed. In particular, agencies should allow developers to subscribe to an email list or an RSS feed for specific datasets that details updates in a well-structured manner. These updates should clearly specify the dataset and version affected, a location where the updated dataset can be found, and a description of the changes to the dataset. When possible, these changes should be specified via a formal, structured description--for example, a diff output--as well as a brief prose explanation.

Correction of dataset contents should proceed cautiously. Suppose that an application allows user to comment on parts of a document. If labels are in a dataset are not maintained consistently across versions, the developer may need to painstakingly map comments from the old data to the corresponding parts of the new dataset. Issues like this can be mitigated through several practices. First, an agency should seek to preserve labels across versions of a dataset when possible (alternatively, in some cases an agency might wish to change the labels but provide a mapping to assist developers). For example, a dataset might aggregate numerous documents, and a minor change in one document should not necessarily change the labels for the other documents. Recall the side note from our previous post that labels should be separate from ordering information. Corrections to a dataset may add, remove, or reorder items. Detaching order from labels can help agencies ensure label consistency across dataset versions. In addition, the last post and its comments discussed whether agencies should provide a label that is separate from its internally used agency label. This separation allows labels to remain consistent even when Subsection X becomes Section Y based on the internal agency labels. Note that these points about consistent labeling can be useful whenever a dataset could have multiple versions: for example, consistent labeling might be beneficial across various versions of a bill.

Similarly, the structure that agencies use for datasets, the locations where the datasets are hosted, and other details of a dataset sometimes must change. Suppose that an agency releases various statistics each month. When the agency is asked to provide a new statistic, the new data may necessitate changes to the XML schema. Alternatively, the agency may decide to host data at the address "http://www.agency.gov/YEAR/MONTH/data.xml" rather than "http://www.agency.gov/MONTH-YEAR/data.xml," causing issues for automated tools that periodically check for and download new data. To reduce the adverse impact of these changes on developers, agencies should provide detailed notice of the changes as early as possible. Early notice gives developers time to modify their tools. These notifications can occur via an email list or RSS feed providing details of the changes in a clear, consistent format.

The possibility of changes and their impact on developers should be taken into account at all stages of the data production process. Suppose an agency adds an element to a schema that specifies a unique individual, but the schema may someday need to specify a corporation instead. Although the agency should not speculatively add unnecessary elements to the schema, it should be mindful of possible changes when designing the rest of the schema. Various design choices may minimize the impact of a change if necessary later. Agencies should also avoid the urge to alter a schema dramatically each time it requires a minor change. A major overhaul—even when done to clean up the schema—may require equally dramatic changes in tools utilizing the data. To ensure that developers notice changes to XML schemas, both schema files and datasets should contain a prominent schema version number. If an agency changes the location where data is hosted, it should consider temporarily using aliases so that requests using old addresses automatically take you to the correct data. Once the old addresses are phased out, agencies should use a standard HTTP 404 status code to indicate that the requested data was not found at the specified location. Simply supplying a "Not Found" page without this standard code could make life harder for developers whose automated tools must instead parse this page.

When making changes, agencies should consider soliciting input directly from developers. Because the preferences of developers might not be obvious, this input can lead to choices that help developers without increasing the burden on agencies. In fact, developers may even come up with ideas that make life easier for an agency.

Our next and final post in this series will discuss a handful of additional issues for agencies to consider.

The Obama Administration has been slowly ramping up its attention to intellectual property issues. Over the past few months, we've seen an IP "summit" at the White House. We've seen the successful nomination of a new cabinet-level "IP Czar" position. We've seen the announcement of a new DOJ task force for IP issues. What does it all portend?

Unfortunately, many signs suggest that the administration is paying far more attention to the interests of the entertainment industry than to the public good. At the same time, there are a few positive efforts and indications, so we're holding out hope that things could improve.

The first bad omen came last December, when Vice President Biden invited the RIAA, MPAA and other representatives of the mainstream entertainment industry to a closed-door "Piracy Summit" at the White House. Although Biden's office sold the summit as "bringing together all the stakeholders" in the piracy debate, it failed to invite a single representative of the public interest or the technology industry.

One outcome previewed at the summit was the formation of a new Department Of Justice "Intellectual Property Task Force", which was formally announced in February. Unfortunately, the Department of Justice already has a history of coming down disproportionately hard on victims of the copyright conflict. And while the task force's announcement stressed that IP crime "threatens not only our public safety but also our economic wellbeing," it didn't even pay lip-service to the harms to privacy, free speech, and innovation in the industry's long war on piracy.

Later in February, the government's new IP Enforcement Coordinator (IPEC), Victoria Espinel, announced that "the Federal Government is currently undertaking a landmark effort to develop an intellectual property enforcement strategy" and asked for public input into what this strategy should look like. A major component of the request seeks information about "the costs to the
U.S. economy resulting from intellectual property violations," which in the past has mainly been expressed through skewed, erroneous accounts of the supposed effects of piracy from entertainment industry lobbyists. However, the IPEC is also demanding an unprecedented level of rigor from these studies:

Submissions directed to the economic costs of violations of intellectual property rights must clearly identify the methodology used in calculating the estimated costs and any critical assumptions relied upon, identify the source of the data on which the cost estimates are based, and provide a copy of or a citation to each such source. [Emphasis mine.]

Since some of these poorly executed studies have appeared to successfully persuade members of Congress to change copyright law only in ways that favor the entertainment industry, it's refreshing to see the IPEC pushing for greater validity. To that end, we look forward to seeing the Obama Administration publicly debunk the empty rhetoric that circulates around questions of unauthorized file sharing and its economic effects.

There are other bright points. Late last year, the Administration supported looser international copyright protections for reading materials for the blind. Limitations and exceptions to copyright are a critical "safety valve" in copyright that helps preserve free expression, access to knowledge, and other human rights, and we hope to see them defended by the Administration in other contexts as well.

While IP enforcement appears to have center stage, there are other double-standards and unintended consequences in copyright and trademark law, all of which could benefit from some attention from the White House. The orphan works conundrum remains unsolved. Copyright term and licensing issues stymie creators and archivists. The anti-circumvention provisions of the DMCA still obstruct innovators.

But will the Obama Administration and Congress choose to face these tough, important issues? At the next IP summit, will advocates for questions like these have a seat at the table? Or will the public interest side of intellectual property law and policy continue to languish unaddressed? Time will tell.

25 potential Parliamentary candidates from the UK Liberal Democrats have signed an open letter opposing the LibDem Lords' web-censorship proposal to allow courts to ban web-lockers. (Thanks, Mark!)

Games maker Ubisoft drew global ire when it announced that all its new titles, starting with Silent Hunter 5 and Assassin's Creed 2, would henceforth be crippled with a DRM that would kick you off the game and wipe out your play if your Internet connection dropped for even a moment. From soldiers on forward-fire bases to people who just don't want to have to be online to play a single-player game, gamers all over the world treated Ubisoft's announcement as a declaration of war on the rights of game-buyers to enjoy their property in legitimate ways.

Now comes the news that Ubisoft's DRM was broken less than 24 hours after release, which isn't such a surprise, really. After all, these are gamers: Ubisoft set them a challenge. Solving challenges is what gamers do. And the bragging rights are monster.

ßßß  ° Û 1. Unpack release                                              Û Û
± Û 2. Mount image or burn it                                      Û Û
Û Û 3. Install                                                     Û Û
Û Û 4. Copy the content from the SKIDROW folder on the DVD to your Û Û
Û Û    installation directory and overwrite                        Û Û
Û Û 5. Play the game                                              Û Û

Ubisoft's New DRM Cracked in Under 24-Hours - Updated! (via /.)

We often criticize DMCA takedown abuse here at EFF, but last week's Cryptome snafu highlights another facet of the problem: how a DMCA takedown for one item can result in the removal of lots of lawful material.

To recap, Cryptome posted Microsoft’s global criminal compliance manual. Microsoft sent a DMCA takedown notice to Cryptome’s domain name registrar and web hosting provider, Network Solutions, alleging that the post infringed copyright. Under the DMCA, a web hosting provider is protected from copyright infringement liability if, among other things, it “expeditiously” disables access to material properly identified in a DMCA takedown notice. Network Solutions asked Cryptome to remove the Microsoft compliance manual. Cryptome refused explaining that the document was posted in order to help the public better understand Microsoft's practices, and followed up with a DMCA counternotice. Network Solutions promptly shut down the entire Cryptome website. Thus, a complaint about a single document caused significant collateral damage to the perfectly legal material on Cryptome.

This illustrates a basic problem built into the DMCA safe harbors. Microsoft’s notice targeted just one document. Network Solutions, however, couldn’t take down that single document, so opted to take down the entire site. Thus, although Cryptome's beef was with Microsoft, Cryptome also had to persuade Network Solutions to take a chance of losing safe harbor protection (although not much of a chance, because Cryptome’s posting was protected by the fair use doctrine). Because Network Solutions wasn't willing to take that small risk, a whole lot of speech was temporarily disappeared.

We’ve recently seen the same scenario with music bloggers, who may have their entire sites taken down as a result of complaints about a few links to music they’re reviewing.

And sometimes it's not even enough to find a courageous hosting provider. Last year a takedown notice targeting a single site parodying the U.S. Chamber of Commerce resulted in a takedown of the websites of over 300 activist organizations hosted by MayFirst/PeopleLink. The Chamber of Commerce went "upstream," targeting one of MayFirst's upstream service providers, Hurricane Electric. When MayFirst pushed back, Hurricane shut off service, thus pulling the plug on unrelated websites, email and other online tools.

In all of these cases, copyright owners reach out to a "weak link," the service provider with the least incentive to resist the takedown notice. Unless it has a free lawyer, the cost of doing a fair use analysis and defending a lawsuit—even if the service provider knows it will win—is almost certainly more than a service provider is charging any individual customer, or even a whole bunch of "innocent bystander" customers.

This unfortunate outcome is particularly ironic because Congress gave service providers protections in the DMCA. Service providers who care about free speech have better options:

• Remember, if your only relationship to the material targeted is that you provide connectivity to a downstream service, you should qualify for the 512(a) safe harbor, and, therefore don’t have an obligation to take the material down.
• Remember also that you don’t need the safe harbor if the material is a non-infringing fair use. In clear cases, you can bypass DMCA procedures.
• If thinking about fair use doesn’t make business sense, or you’re not sure, keep in mind that the DMCA requires only that you act “expeditiously” to respond to a takedown notice. Courts have found that providers should take down material within a few days of receiving a notice. So if you realize complying with a takedown notice will result in taking down much more material than the notice identifies, take the time to notify the person who sent the notice about the collateral damage it may cause. They may elect to withdraw it, especially where they are likely to face public criticism for causing an overbroad takedown.
• Give your customer a chance to re-jigger their service to avoid such collateral damage.
• Be sure to offer customers a clear counter-notice procedure—the DMCA provides protection for service providers that restore content in response to counter-notices.

Customers who also care about free speech should vote with their wallets and look for providers who will commit to following these suggestions. The safe harbors were supposed to help protect free speech, and they often do—but only if copyright owners, service providers, and internet users follow their common sense as well their business sense.