ARCHIVED — Terry Stewart

Copyright Reform Process

SUBMISSIONS RECEIVED REGARDING THE CONSULTATION PAPERS

---

Documents received have been posted in the official language in which they were submitted. All are posted as received by the departments, however all address information has been removed.

---

Submission from Terry Stewart received on September 16, 2001 via e-mail

Subject: RE: Comments

Greetings,

I would first like to thank you for this opportunity to comment on Canada's digital copyright laws. This is the first time I have contributed to a forum such as this. The reason I have been moved to contribute these comments is that I strongly believe that the decisions made on this topic at this time will have a profound impact on a wide cross-section of Canadian life.

I am a doctoral student at Carleton University. I intend to continue my career in academia, becoming a professor at a Canadian university. My livelihood is thus going to be intimately related with the production of intellectual property, and this brings the topic into a certain focus. More importantly, however, I am also a consumer of the products of intellectual effort on the part of others. This is true both in my academic life and in my personal life, and it is this aspect which is most causing me to be concerned about the legalities of digital copyright.

There are a number of issues that I feel have been neglected in much of the debate surrounding intellectual property. I will summarize them here, and then go into them in more depth.

1. We cannot allow corporate products to set public policy.

2. Copyright law is meant to balance the rights of the creators and the general public.

3. Halting scientific inquiry into encryption technologies is highly counter-productive.

Once I have covered these topics in more detail, I will present some specific suggestions for dealing with this issue.

We cannot allow corporate products to set public policy

This is, in fact, my major concern at this time. When I look south of our border, I am aghast at the disparity between what citizens can legally due with intellectual property and what they can actually do. I am, of course, referring to the recent Digital Millennium Copyright Act. I was heartened to see that your Consultation Paper made specific mention of this issue:

"The US and Japan currently protect rights management information, but both jurisdictions have gone somewhat beyond the bare WIPO treaty requirements by including provisions that create sanctions for knowingly providing false rights management information. These jurisdictions also provide certain exemptions from liability. In the US, there is a general exemption for tampering for law enforcement, intelligence and other governmental activities. In Japan, there are exclusions from the prohibitions against alteration and removal (for instance, where certain recording or transmission technologies are involved), and where these acts are necessary to lawfully use the copyrighted material. (Section 4.3, Consultation Paper on Digital Copyright Issues, Issued by the Intellectual Property Policy Directorate, Industry Canada)"

I find it appalling that the DMCA specifically allows exemptions for government activities, but does not provide exemptions for lawful use of the copyrighted material. This results in a situation where our legal system says that we have certain rights (i.e. the fair use rights), but we cannot legally exercise those rights. Furthermore, the specific details of our effective rights (i.e. what we are physically allowed to do with copyrighted material, due to the rights management system) are decided by the corporation in charge of producing the copyrighted work. As an example, Microsoft is currently producing electronic books with rights-management software (Microsoft Reader). If you have purchased a book, it allows you to view it on no more than two different computers. Why two? How was this number chosen? Certainly not through public debate. The software furthermore prevents any number of other uses that would be considered fair-use. For example, you cannot take the text and input it into a text-to-speech program (allowing blind owners of the book to hear the text).

The reason given for this limiting approach is fairly clear: there is no way of having the software itself distinguish between infringing uses of the information from non-infringing uses. (Again, I was very glad to see mention of this issue as well, in section 4.2 of the consultation paper). So, what can we do about this? Well, for now, I simply want to highlight the fact that passing a law that removes rights that have been specifically recognized by the courts is not something that one can do lightly, no matter how convenient it may be. At the end of this letter, I will return to this issue when I discuss my specific recommendations.

Copyright law is meant to balance the rights of the creators and the general public Intellectual "property" is a very strange thing. It is not like other forms of property: I can give it to someone else and yet still have it. It requires effort to create, but very little effort to duplicate. I can take the same creation, convert it into a completely different format, and yet it is still the same thing (for example, I can take a book, type it into a computer so that the text is in electronic form, compress the text into a mess of ones and zeros, and then encrypt the result so that it looks completely random, and yet it is still the same "property").

This makes one wonder why it was that we started calling ideas "property" in the first place. There is, of course, a very simple reason to create special "ownership" rights for intellectual property: we want to encourage people to create more. Who would write novels if anyone could just make copies? Who would invest time into inventing something, just to have the results duplicated by anyone who saw the final design? We clearly need some way of compensating the creator for the initial investment of their effort.

So, the government steps in here and grants the creator of the intellectual property a temporary monopoly on certain uses of that property. This monopoly stops certain uses of the information by the people, but on the whole they benefit from it. The goal of the system is to provide benefit for all in this manner.

It must be noted here that we cannot take the word "ownership" as meaning what it means in other situations. The "owner" of intellectual "property" has very specific, limited rights granted to them by the state. They do not have the right to, say, stop anyone from quoting a small bit out of "their" book. Nor do not have the right to destroy all existing copies of "their" "property". These are very important differences.

My point here is that we have to make very sure that these ideals are still present. We have to be wary of extending the rights of the owners of the intellectual property so that they stop benefiting the users.

The clearest example of the dangers of this situation come from the resent issues in the music industry, where the publishers (and a certain few musicians) got rather upset at wide-spread electronic duplication of musical works. Now, the interesting thing about this situation is that there was absolutely no evidence that less music was being sold due to this unauthorized duplication. In other words, this duplication was not affecting the income of the owners of the music. This is a very important point. We should not be saying "all those people using Napster are violating the rights of the music producers". We should be asking "okay, are there still sufficient incentives for people to continue to produce music?" If there are, then we have to question why it is we are disallowing this duplication.

It should also be noted that we have three distinct groups of people involved here: the creators, the consumers, and the distributors. In the case of Napster, it is particularly telling that the people who most vocally complained were the distributors of the music. Only a very few musicians complained (Metallica being the notable exception). The reason? Very few musicians make any money off of CD sales: they make money from concert performances.

In fact, the entertainment industry as a whole has a history of rallying against any new technology. When VCRs appeared, Hollywood complained that everyone would just duplicate all the movies and they wouldn't be able to make any money. Well, that didn't happen. The same situation happened with the appearance of audio tapes. Both of these technologies allow the same easy duplication that the industry is currently complaining about. Both of these technologies have been help to be legitimate both by the courts and by the test of time. To repeat myself, the only time we should be restricting the rights of the consumers is when not restricting those rights would lead to a worse situation. Until there is strong evidence presented that we need highly restrictive copyright technologies, it seems strange to legally enforce them.

Halting scientific inquiry into encryption technologies is highly counter-productive

The particular approach that is being taken to arrive at digital content protection confuses me. If it is, eventually, determined that it is necessary to create some sort of software control over access to information, then it seems to me that we would want the best software possible. And yet, the laws that are being drafted seem to cripple themselves in this regard.

I am referring here to the provision in the DMCA regarding the publication of information about content protection technologies. This has caused a number of encryption professionals to find themselves in a situation where it is actually illegal for them to do their job. Here is an excerpt from the web page of one of these researchers:

"HDCP [High-bandwidth Digital Content Protection] is a cryptographic system developed by Intel that encrypts video on the DVI bus. The DVI bus is used to connect digital video cameras and DVD players with digital TVs, etc. The aim of HDCP is to prevent illegal copying of video contents by encrypting the signal.

HDCP is fatally flawed. My results show that an experienced IT person can recover the HDCP master key in about 2 weeks using four computers and 50 HDCP displays. Once you know the master key, you can decrypt any movie, impersonate any HDCP device, and even create new HDCP devices that will work with the 'official' ones. This is really, really bad news for a security system. If this master key is ever published, HDCP will provide no protection whatsoever. The flaws in HDCP are not hard to find. As I like to say: "I was just reading it and it broke."

What do you do when you find a result like this? First, you have to write it down and explain it. Then you publish your paper so that the mistakes can be fixed, and others can learn from it. That is how all science works. I wrote a paper on HDCP, but I cannot publish it." (From The Chilling Effect of the DMCA, by Niels Ferguson, available at http://www.macfergus.com/niels/dmca/index.html)

The reason he cannot publish it is that he can then be charged under the DMCA. Now, it is important to note that the content protection system mentioned here, the HDCP, is not yet in wide-spread use. If research like this is unavailable, then it is quite conceivable that the HDCP will go ahead as it currently stands. This would mean that a flawed encryption system would be in place. Billions of dollars would have been spent instituting a system that does not work.

Of course, the easy response is to say that it doesn't matter how "flawed" the encryption system is. As long as it's still illegal to break the encryption, we can go ahead and use it anyway. The problem with this theory is that it leaves consumers ignorant and vulnerable.

To explain why it does this, we can consider a similar approach taken in the physical world. Let us suppose that a law was passed making it illegal for anyone to discuss how a lock worked. After all, (say the lock manufacturers), if we made public how a lock worked, people could discover how to pick the lock, and thus gain entrance to someone's house. And what would the result of this situation be? First of all, there would be no way for consumers to compare locks, and so could not arrived at informed decisions. Secondly, by continuing to work with locks that do have easily identified flaws, we make it easier for people to pick the locks. The consumers end up with a very false sense of security.

Now, you might think that this is a far-fetched possibility. Unfortunately, it has already happened. The electronic book format created by Adobe allows for various different companies to produce their own rights management technologies that work with the e-book. Recently, a researcher in Russia by the name of Dimitry Sklyarov examined the various different encryption systems, and discovered that some of them were much better than others. In fact, he did manage to find flaws in all of them, eventually, but some were clearly more secure than others. One in particular was the worst encryption system possible: ROT-13. This encryption system is the very first one taught in encryption textbooks. It consists of changing each letter in a document into the letter that is 13 letters after it in the alphabet. This is equivalent to making and selling a lock made out of paper. This company (New Paradigm Research Group) was able to sell this completely inadequate security system for US$3000 per protected document. Does it seem reasonable to pass a law that forces us to turn a blind eye to this sort of behaviour? Without the ability to examine encryption systems, we cannot improve them.

It should be noted that this researcher is currently awaiting trial in the US for doing this work. He is charged under the DMCA for producing software that could be used to violate copyright. His presentation is available at http://www.boycottadobe.com/pages/defcon.htm

If we are going to have encryption, then it makes sense that we should have good encryption. In order to have good encryption, we need to be able to publically examine it. This is especially true given the quickly changing nature of modern technologies: new approaches to encryption are appearing rapidly. Furthermore, we know that it is possible to produce good encryption systems: there exist freely available systems for sending encrypted email that no one has been able to find serious flaws in. With these systems, it would take all the computers in the world 10,000 years to crack the encryption. But this sort of reliability is only available with full public disclosure and discussion about the algorithms used.

Suggestions

In light of the above discussion, I have the following suggestions for Canadian policy on digital copyright issues.

1. If products are made available with content protection, then they must also be made available without content protection once the copyright term has expired. This is to prevent situations where all copies of a certain piece of intellectual property are controlled by software that does not recognize the expiration date of the owner's exclusive copyright laws. It should be remembered that the cost to the producer to provide this is negligible, given today's data storage and data transfer technology.

2. Content should not be allowed to go "out of print". If a producer is no longer selling the content, then it should be possible and legal for duplicates to be made of existing purchased copies of the content, since this is not impacting the income of the creator of the content. In this way, information is never lost to the society as a whole. Currently, there are untold numbers of books that are simply unavailable. There is no reason for this situation to continue.

3. The extent of time during which we give the copyright owner certain exclusive rights should be closely examined.

4. If a person has purchased a copy of content in one particular format, there should be no extra cost to also have the content in another digital format. For example, if I purchase a textbook, it should be legal and possible for me to get an electronic copy as well. This also means that it should be legal to covert CD music into digital music files. This allows people to make the most efficient use out of content that they have purchased. Digital music files are much more convenient than CDs. Digital copies of documents allow for useful functions such as searching.

5. There needs to be recognition of the difference between the medium the content is presented on and the content itself. When I purchase the CD, I am partly paying for the music, and am partly paying for the physical creation of the medium itself (and the shipping of the CD to the store, the storage at the store itself, the packaging, and so on). This recognition would shed a different light on such things as the Napster issue: a large number of the music files shared on Napster were received by people that had already purchased that same music in CD format.

6. Copyright laws should not be used to protect the profits of content distribution companies. They are there to protect the creator's ability to continue to create. Just because certain companies have made a large amount of money in the past with certain business models, that does not mean the laws should be modified to make sure they can continue to do things the old way.

7. There are a number of privacy concerns surrounding rights management issues. Some approaches have been presented where a company (or the government) maintains a large database of who has purchased the right to view what content. The privacy concerns of such a system are staggering. Interfering with individual privacy has to be justified by an argument much stronger than "companies think they'll lose money".

8. Cryptography research and the investigation of the techniques used by various companies should be encouraged, not made illegal.

9. Care should be taken that content protection technologies do what it is claimed they do. For example, the CSS encryption system for DVDs does not prevent the duplication of DVDs. It merely prevents the DVD from being shown on any unlicensed system. It is perfectly possible to duplicate the DVD without decrypting it: the duplicated DVD is still encrypted. The CSS encryption system does nothing about the large-scale piracy that it was purported to stop. Its only effect is to make sure that all DVD players must license the decryption technology.

10. The technology should never be allowed to stop people from doing something with the content that they have a legal right to do.

11. If the technology does not allow someone to do something that is perfectly legal, then it should definitely be legal for that person to bypass the encryption.

12. When faced with a choice between allowing possible illegal actions and stopping perfectly legal actions, we have to do the former. Canadian law does not make it illegal to own a lock-pick. Canadian law does not make it illegal to own bolt-cutters. Canadian law does not even make it illegal to be outside a deserted warehouse at 4 am with a balaclava and a crowbar (although in this case the onus is on the individual to provide a reasonable explanation as to what legal activity they were doing there). I do not see why the standards should be different within the realm of intellectual property.

We need to be able to figure out how to deal with intellectual property. Currently, a number of corporate interests are trying as hard as they can to make intellectual property act like real property. They are trying to defeat something very fundamental to the whole ideal of ideas: they are hard to create, but easy to duplicate. It is the fact that they are easy to duplicate that has allowed people to build on each other's ideas, and to create the modern world.

I am certainly not advocating the elimination of copyright law. What I want is to make sure that its purpose remains what it should be: a special set of laws that are in place for the general public good. This ideal has lasted for a long period of time, and I cannot support upsetting that balance. The industries that are calling for these changes have not given evidence that the changes are required to allow artists to continue to create. The changes they are calling for are unnecessary and severely restrict fair-use rights.

Thank you for your time, and I look forward with interest to following the rest of this process. If you have any questions or want more information on anything I've said here, please don't hesitate to ask. Also, I would highly recommend reading an article by John Gilmore of the Electronic Frontier Foundation entitled "What's Wrong with Copy Protection" (available at http://www.toad.com/gnu/whatswrong.html).

Terry Stewart
(Address removed)