Archived Content

Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards.




Documents received have been posted in the official language in which they were submitted. All are posted as received by the departments, however all address information has been removed.

Submission from Adam Shostack received on August 31, 2001 1:51 PM via e-mail

Subject: Comments - Government of Canada Copyright Reform

Comments on Digital Copyright Issues

Adam Shostack
29 August 2001

I am an American cryptographer and security expert, working and living in Canada. I have been involved in public policy issues surrounding cryptography and information security for many years, and I appreciate the opportunity to comment on the the June 22, 2001 Consultation Paper on Copyright Issues.

Comments on the Framework Document

I am pleased to see in the Framework document recognition of some of the risks and problems that the DMCA has created in the United States, especially the call for "specific exemptions to aid users such as libraries, schools, and archives to fulfill their vital institutional role." Many librarians and archivists are justifiably concerned about issues surrounding digital content, especially when that content is only viewable by a single player. The risks associated with this can be seen with the DivX competitor to the DVD. The DivX players need to connect to the parent company, and will no longer play DivX content. Thus, any library which had invested in Divx is no longer able to access that bit of their collection, unless they break the security of the Divx system.

I am also pleased to see that Canada intends to "favour the circulation of information and cultural content for and by Canadians." One of the flaws of the DMCA has been that it is as much about controlling the flow of information as encouraging it. While these controls are being challenged now (Felten v. RIAA, and US vs. Sklyarov), Canada would do better to not criminalize computer security research. This hands-off approach is needed to meet the "priority considerations" listed in the Framework, especially the goals of "maintaining the responsiveness of the act to technological innovation and new business models" and "clarifying the law where it will reduce the risk of unnecessary litigation."

Unnecessary litigation has begun to hurt the United States in the eyes of many computer professionals. Alan Cox, widely seen as "Number 2" in the Linux world, has publicly resigned from USENIX, a leading US based association, over concerns about the DMCA. ( Niels Ferguson, a well known and respected professional cryptographer, has chosen to not publish new research on the HDCP protocol, due to uncertainty about the law. See

Term of Protection

As an author of original works, including scientific papers, I do not believe that I would be any more motivated to write or publish my works by an extension of the term of copyright. I would urge Industry Canada and Canadian Heritage to hold the term of copyright to fifty years after the death of the author. If it is seen as appropriate to extend the term, I would strongly urge you to maintain the copyright expiry dates on works already created. No one can possibly be encouraged to better create a work which is already completed. Such a change is simply a tax, charged to all Canadians, for content already created, and paid directly into the coffers of the large content owning companies. A Canadian author, Mr. Spider Robinson, has made this point well, in a short story entitled "Melancholy Elephants," centered around a bill, ironicly in the United States, to extend copyright forever. He points out that a great many works are re-workings of old originals. "West Side Story" is a re-telling of Romeo and Juliet (copyright expired). Extending copyright for dead authors serves very few, at the expense of a great many.

Comments on the Consultation Paper

I offer some comments first on the questions as they are phrased on pages 5-7, and then on the issues as they are raised in section 4.
  • the Act should be amended to allow a specific right for on-demand communication

    I have no opinion on this issue.
  • legislative measures are needed to deter the circumvention of technological measures that are used by rights holders to protect their rights

    The circumvention of a technological measure should not be a crime, the circumvention of the legally granted right is already a crime.

    I believe that extreme caution is needed in crafting deterrence to circumvention. It is important to start from the understanding that circumvention is not a crime; it is the violation of the copyright information which is a crime. It may well be that the creator of the technology overly restricts the rights of the user, and circumvention is a means of claiming back fair uses. If circumvention itself is criminalized, then those fair uses become criminal acts. The history of case law around copyright has been one of push/pull, where users and owners have, from time to time, come to the courts to resolve what is acceptable. If circumvention of a programmer's ideas of what is allowable is a crime, then the law of copyright and fair use will become fixed and sclerotic.

    Further, circumvention of security measures is a needed component of their evolution and strengthening. Security is a young field, and the advances that we make are made by a system being put forth, and that system being analyzed and attacked. Ideally, the attacks are published, and everyone learns a little bit more. If circumvention is made a crime, then publication may be admitting to a crime. In this case, the advancement of security suffers. This may or may not be an acceptable infringement on the right of free expression enshrined in the Charter of Rights and Freedoms. It is clearly an infringement on the advancement of the science of security, and as a consequence, its engineering into a secure society.

    I take this issue quite seriously; my first scientific publication was "Apparent Weaknesses in the Security Dynamics Client Server Protocol" and its publication may well have been delayed or denied by legislation to "deter the circumvention of technological measures."

    Lastly, as mentioned above, such circumvention tools are likely to be needed by archivists and librarians in the event that the company chooses to make its content unavailable or goes out of business. Examples of a company choosing to make its content unavailable include Disney, which has removed several cartoons featuring Nazis from circulation and academic study, and Warner Brothers, which chose to pull fours Bugs Bunny cartoons from its otherwise complete broadcast of short cartoons, as those four cartoons contained racist imagery. Archivists and librarians should not be at the mercy or whim of a copyright holder who chooses to re-write their history.

    Again, the circumvention of a technological measure should not be a crime, the circumvention of the legally granted right is, and should remain, the crime.

  • legislative measures are needed to deter tampering with rights management information; and

    Rights management information is no different from information which exists on a document today, like my name on the front page. To remove my name, and republish this document would be a violation of my copyright. As such, I believe that no change to the law is needed.
  • legislative measures are needed to address the liability of network intermediaries in relation to copyright protected materials over digital networks.

    It is important that network intermediaries not be asked or encouraged to do anything other than transmit bits. Canada is justifiably proud of its low cost and ease of access. To burden ISPs or other intermediaries with a requirement that they police traffic would be wrong for a number of reasons. Those reasons include, but are not limited to, it would be an imposition on the privacy of their users, in violation of the spirit and letter of PIPEDA. ISPs do not collect or use information for the purpose of policing third party copyright, and if they start to do this they must state this as a purpose of collection and use. Is this what we want in a free society? It it would be an unreasonable cost for them to bear. (A useful analogy here might be the case of broadcasters being liable to verify that rights holders of film footage have been duly paid and accredited for everything they screen. Broadcasters have a much higher duty of care than common carriers, but even they are not liable to check that every foot of stock shot has been paid for, the big house pay people to screen the channels to check.

    Furthermore, if Canada is interested in "favour(ing) the circulation of information and cultural content for and by Canadians." It would be best to promote local ISPS and service providers. Burdening them with this kind of liability and expense will only serve to disfavour them in the marketplace.

    It would also be wrong to have ISPs impose costs, such as SOCAN seems to be asking, on their users. Not all Internet users download large digital files. Of those who do, many may be downloading files for which no fees are due, such as home video. Unless an ISP is going to open those files, and judge which ones are in need of paying royalties, then they are in no position to impose a fee.

The Copyright Act has evolved over time to reflect a balance between the various categories of rights holders, intermediaries and users:

I want to comment that this balance is of extreme importance, and I sincerely hope that it can be maintained better than it was in the United States. For example, as I write this, I am reading news reports of the Associated Press forbidding use of single sentences from their news reports. (See, and Malla Pollack, The Right to Know?, 17 Cardozo Arts & Ent. L.J. 47 (1999)

  • What are the appropriate balances in the digitally networked environment?

  • Does the environment created by the new ICTs upset these balances?

  • If so, does it do so in such a way as to impede the legitimate dissemination of content on-line?

  • If so, what intervention, if any, is required to restore the balances?

  • Do the challenges to copyright truly represent challenges to core copyright principles or are they primarily challenges to existing business and distribution models?

    These questions are difficult and complex, and I suspect that they will take many years to answer. However, I do believe that a great deal of the answer is contained in the last words above; much of the concern over digital content has come from large copyright consolidators, as have the proposed solutions. (To be fair, much concern has also come from authors, such as Harlan Ellison, and the aforementioned Spider Robinson.) However, the solutions proposed rarely suggest that the Internet's power to dis-intermediate could remove the need for archived content to be sold through aggregators.
  • Given that legislative intervention could potentially impede the emergence of new models of content creation and dissemination, and given the unpredictable manner and rate at which technology is evolving, when is legislative intervention an appropriate response?

    As the intent of the act is to encourage the creation and dissemination of works, I would suggest that legislative intervention is appropriate when Canadians start to reduce the amount of copyrighted work that they create.

4.1, Making Available

I have no comments on the questions raised here.

4.2, Legal Protection of Technological Measures

I would like to begin by stressing that copyright violation is already a crime. There is, however, a fair use defense to a claim of copyright violation. If the circumvention of a technological protection measure is itself a crime, then the character of fair use is irrevocably changed, because to be able to engage in fair use, one must have committed a crime. Pamela Samuelson, of the University of California at Berkeley, ( has written on these issues. See, for example, "Towards More Sensible Anti-Circumvention Regulations", ( or "Intellectual Property And The Digital Economy: Why The Anti-Circumvention Regulations Need To Be Revised" ( ).

Further, the act of circumvention, as mentioned above, may be a requirement for archivists and librarians to perform their important functions. If it is illegal to circumvent, or if special licensing is needed, then the cost of such action will be driven upwards, putting additional stress on already stretched budgets. Circumvention technology may also be needed to allow digital technologies to fulfill their promise of handicapped access. If media are stored in simple digital formats, such as text, then any text-to-speech converter may be used. If the information is stored in a special format, the handicapped may be forced to rely on specialized and expensive technology to access it. Such reversal of this promise of digital media would be highly unfortunate.

The consultation paper says "advances in technology will continue to increase their effectiveness." This statement is only true if circumvention remains legal. If circumvention is illegal or regulated, then the ability to test and improve the quality of anti-circumvention measures is damaged. Security improvements depend on a cycle of building, breaking, and repairing. By criminalizing breaking, this cycle will be broken.

The consultation paper next claims that "once a technological measure is defeated, control is [...] effectively lost." This is a straw man. Effective dissemination can be controlled without technological means, as developments in the Napster case are showing, through use of existing laws.

Lastly, new technologies to control circulation may well require encoding information about the buyer in the data. Such information is not available to the copyright owner today, when I walk into a bookstore and buy a book for cash. To legally protect a nascent technology which will have these, or perhaps other, privacy invading aspects, would be wrong. The right to read anonymously is a protected right, both in Canada and the United States. Not enough attention has been paid to the sweeping way these rights, and the right of freedom of assembly, are being swept away by the widespread use of surveillance technologies. I urge Industry Canada to examine these issues.

To the specific questions posed, I do not believe that legislative intervention is appropriate now. If legislation is considered to be appropriate, I urge you to make careful study of the issues of handicapped access, fair use, technological advancement, and freedom of speech that such legislation has created in the United States and elsewhere.

4.3, Rights Management Information

My comments here are brief; I wish to remind you that the "authority" to alter rights management information may be needed in the course of fair use. For example, if the rights management information says "This information may only be displayed on a computer running Microsoft Windows 3.1," then it may well be that fair use will allow someone running a different (and currently commercially available) operating system to view the information. The simplest way to achieve this may be to alter the rights management information in line with fair use principles, and the law should be clear that such modifications are allowable.

4.4, Liability of Network Intermediaries

With regards to "proper notice," I would like to point out that such provisions have been used in a chilling fashion in the United States, for example, in the matter of the DeCSS code. I urge you to include liability for knowing misuse or abuse of these provisions by copyright holders. These copyright holders are being given the power to control the speech of others. When they knowingly abuse that power, they should be held responsible. Regarding the ability of an ISP to contract with rights holders, I would urge you to carefully limit the obligations that this may carry over to the users of the ISP. In many parts of Canada, choice in ISPs may be limited, and the contract which an ISP enters into may unavoidably control the ability of Canadians to exercise their rights under the law.


I believe that there are strong reasons to be cautious about revision of copyright laws. Many of these reasons have been raised in your consultation paper. However, some were not, and as such, it may be appropriate to move cautiously, and learn from the mistakes of other countries before changing the laws.

Thank you for the opportunity to comment on the proposed changes,

Adam Shostack
Last modified: Fri Aug 31 13:44:54 EDT 2001

Email to a Friend

Your email address has not been added to any list, and has not been retained on our site.

Share this page

To share this page, select the social network of your choice:

No endorsement of any products or services is expressed or implied.