Keep on Hacking: a Finnish court says technological measures are no longer “effective” when circumventing applications are widely available on the Internet
Mikko Välimäki*
|
Table of Contents: |
||||||
Cite as: M. Välimäki, "Keep on hacking: a Finnish court says technological measures are no longer “effective” when circumventing applications are widely available on the Internet", (2007) 4:2 SCRIPT-ed page @: <
http://www.law.ed.ac.uk/ahrc/script-ed/vol4-2/valimaki.asp >
|
||||||
|
© Mikko Välimäki 2007. This work is licensed through
SCRIPT-ed Open Licence (SOL).
Please click on the link to read the terms and conditions. |
||||||
1. Introduction
In a unanimous decision given 25 May 2007 Helsinki District Court ruled that Content Scrambling System (CSS) used in DVD movies is “ineffective”.1 The decision is probably the first in Europe to interpret new copyright law amendments that ban the circumvention of “effective technological measures”. The legislation is based on EU Copyright Directive from 2001.2 According to both the Finnish copyright law and the underlying directive, only such protection measure is effective, “which achieves the protection objective.”
For years, critics have argued that the use of technological protection measures render exceptions to copyright such as private use meaningless. If the circumvention is illegal, the balance between copyright owners and copyright users is fundamentally tipped for the benefit of the owners. It is well established that in Europe users do not have any fair use “rights” as their defense. As a case in point, a consumer group lost a case in France in 2005 where it was stated that end-users do not have any positive rights to make private copies of DVDs.3 As a result, an effective technical protection measure would make it illegal for example to make and then view back-up copies of DVDs on Linux-based media centers.4
None of this theory applies, however, if the technological measure in question is ineffective. If this is the case, then the copyright directive has no role. The analysis provided in the Finnish case provides one possible way to argue that any technological protection measure with widely available circumvention applications is actually ineffective.
This article has three sections. It starts with a brief summary of the statutory background, then moves into the details of the Finnish case, and finally discusses its implications and limitations.
2. Statutory background
WIPO
Copyright Treaty, article 11, introduced the term “effective
technological measure” in 1996 but without further
clarification:
Contracting parties shall provide adequate legal protection and effective legal remedies against the circumvention of effective technological measures that are used by authors in connection with the exercise of the rights…
In the United States, Digital Millennium Copyright (DMCA) Act, 17 U.S.C. § 1201, in 1998 further defined that a technological measure is “effective” if it “in the ordinary course of its operation” somehow restricts the access to or the exercise of copyright in the work. It seems to be enough that the copyright owner intends to protect the work with a technological measure, no matter if e.g. consumers can easily circumvent the measure. Approach is formal and for example CSS was subsequently found effective in US case law.5
EU Copyright Directive, article 6(3), starts with the same language as DMCA. It defines that a technological measure is “effective” if it “in the normal course of its operation” restricts the exercise of copyright in the work. However, then the directive adds a further requirement:
Technological measures shall be deemed ‘effective’ where the use of a protected work or other subject-matter is controlled by the rightholders through application of an access control or protection process, such as encryption, scrambling or other transformation of the work or other subject-matter or a copy control mechanism, which achieves the protection objective.
The major difference compared to DMCA is the last part of the definition: a technological protection measure must achieve its protection objective in order to be effective. Council of Ministers added the language to the Commission’s directive proposal at the end of a long drafting process in 2000.6 In practice, this addition seems to fundamentally limit the applicability of the circumvention prohibition.
First, the protection objective must be also one of the objectives of copyright such as the control of copying and distribution of protected works. One can identify a number of different uses of technological protection measures that fail to reach this objective. For example, DVD region codes are supposedly intended to restrict the watching of copyrighted works in certain geographical regions. This is not an objective of copyright law. Further, it should be clear that a player manufacturing monopoly is not the objective of copyright. Thus, it must be legal to circumvent a protection measure, which is in practice intended only to charge license fees from player manufacturers.
Second, the requirement to achieve the protection objective essentially makes the European definition depend on empirical facts. One must ask whether a given technological measure that seems to restrict something on paper also does that in practice, whether it really achieves what it is supposed to do. What kind of empirical test should be applied? If the measure must be objectively effective, one could establish that when a certain technological measure is no longer working for an average security expert, it would also become legally ineffective. If the measure must be subjectively effective, one could establish that when an average end-user can easily circumvent the measure, it is no longer effective. Since most technical protection measures are designed to achieve a protection objective against consumers, one could support the latter interpretation.
EU member states have subsequently implemented the language of the directive in the national laws. Finnish copyright act, among others, includes the exact language of the directive translated into the national language without further clarifications. In the preparatory materials, the Finnish government argued for the subjective interpretation.7 It said that all technological measures will be circumvented sooner or later and thus 100% effectivity is not required. However, the government also said that a technological measure has become ineffective at a point when one can circumvent it “by accident” without noticing that there was a technological measure with a given protection objective in the first place. The government left it to courts to interpret, which particular technologies could be considered effective.8
3. Finnish CSS Case
The background of the Finnish CSS case was that after the national copyright law amendment was accepted in late 2005, a group of Finnish computer hobbyists and activists opened a website where they posted information on how to circumvent CSS. They appeared in a police station and claimed to have potentially infringed copyright law. Most of the activists thought that either the police does not investigate the case in the first place or the prosecutor drops it if it goes any further.
To the surprise of many, the case ended in the Helsinki District Court. Defendants were Mikko Rauhala who opened the website, and a poster who published an own implementation of source code circumventing CSS.9 They were prosecuted for illegally manufacturing and distributing a circumventing product and providing a service to circumvent an effective technological measure. Of procedural note this was a criminal case argued without consulting the movie industry.
The decisive part of the process was the hearing of two technical expert witnesses. One was invited by the prosecutor and another was invited by the defense. Asked about the effectivity of CSS, they both held it ineffective from the perspectives of technical experts as well as average consumers. The court relied on the testimonies of the witnesses and concluded:10
...since a Norwegian hacker succeeded in circumventing CSS protection used in DVDs in 1999, end-users have been able to get with ease tens of similar circumventing software from the Internet even free of charge. Some operating systems come with this kind of software pre-installed…. CSS protection can no longer be held 'effective' as defined in law.
The defense also argued that the real protection objective of CSS is today a player manufacturing monopoly. At the time of introduction, in 1997, the system was probably intended to limit unauthorized copying by end-users as well. But since circumventing implementations have been widely available for years without enforcement attempts from DVD CCA, this can no longer be the case.11 Meanwhile, the battle for royalties from DVD player manufacturers continues in places like China.12 The court did not comment on this argument and evidently assumed that CSS has still something to do with the objectives of copyright law.
The defense also argued that the discussion and guidance on the website on how to circumvent CSS should be protected as free speech no matter whether it was text or source code. In addition, there were no conflicting constitutional rights at stake since the movie industry was not a party in the case. However, following a Finnish tradition, the court declined to comment on constitutional law issues in its judgment and made the decision relying only on the effectivity argument.
4. Implications
The Finnish CSS decision is not a legal precedent by any means. Helsinki District court is the entry-level court in the Finnish legal system. However, the decisive argument may be universally applicable all over Europe, where the exact language of the copyright directive has been implemented. Accordingly, a protection measure is no longer effective, when there is widely available end-user software implementing a circumvention method.
The argument is not technology-dependent. There are no reasons why it could not be applicable for example to the new movie formats Blu-Ray and HD-DVD if the required circumstances arise in the future. In fact, the technological protection measures in these formats have been already circumvented and a cat-and-mouse game is ongoing.13 It is only a matter of time when the circumvention methods find their way to popular end-user applications.
As a limitation, however, the argument seems to be applicable only for software available on the Internet. If circumvention requires for example the ordering and installation of a physical circumvention device, it seems clear that circumvention cannot happen “by accident” and without knowledge that there exists a protection measure. Thus, even if the argument would be universally accepted, prior hardware circumvention cases such as the recent UK decisions on Playstation mod chips remain valid.14
It is tempting to compare the argument to the protection of trade secrets. Accordingly, when a trade secret is accessible on the Internet, it is no longer any secret. However, this was not the approach taken by the court: it said the circumvention method (“secret”) must be both widely available and easy to use. The court specifically rejected the argument that it would be enough when security experts find out how to circumvent a given protection measure and then publish their results.
With these limitations in mind, the argument can still have major implications to the debate of the consequences of DRM. If they can be in many cases ineffective, they do not have that much meaning. One can actually make private decoded copies of DVD movies without breaching the law. The private use exception applies to the fullest. This probably was not the aim of those who prepared the directive. That said, it is highly unlikely that the directive could be changed anytime soon. If the movie industry, or any other branch of the copyright industry, tries to attack the argument, it is likely to happen at national level.
Finally, this case was much about technological protection measures in digital video. For digital music, the market has recently started to develop towards a new direction where copyright owners voluntarily drop technological protection measures.15 So instead of a legislative counterattack, it is also possible that the argument of the Finnish decision puts pressure on the movie industry to consider the same market direction and forget about DRM in the first place. Highly unlikely for the moment, one may say, but something consumers would definitely welcome.
* Researcher Fellow, Swedish School of Economics and Business Administration, Helsinki, Finland. The author of this article acted as the counsel for the defense in the district court arguing successfully that CSS is “ineffective”.
1 Helsingin käräjäoikeus, case R 07/1004, 5 May 2007. An English translation can be found at http://www.turre.com/css_helsinki_district_court.pdf. The prosecutor has appealed the decision and asked for an opinion from the Finnish Copyright Council about the interpretation of the word “effective”. A decision from Helsinki Court of Appeal is not expected until 2008. For background on CSS see e.g. Wikipedia and A Guadamuz, “Trouble with Prime Numbers: DeCSS, DVD and the Protection of Proprietary Encryption Tools” (2002), 3 The Journal of Information, Law and Technology
2 Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society OJ 2001 L167/10.
3 Cour de cassation, Première chambre civile, Arrêt n° 549.
4 Windows and Macintosh systems include licensed DVD players but most Linux systems rely on open source players, which utilize non-licensed CSS-circumvention methods.
5 Universal City Studios, Inc. v. Reimerdes, 111 F.Supp.2d 294 (S.D.N.Y. 2000) and 321 Studios v. MGM, 307 F. Supp. 2d 1085(N.D. Cal. 2004). The latter court rejected the argument that CSS is ineffective because circumvention methods and keys are widely available on the Internet: “...this is equivalent to a claim that, since it is easy to find skeleton keys on the black market, a deadbolt is not an effective lock to a door. Moreover, the statute itself defines "effectively protects a right of a copyright owner under this title" to mean "if the measure, in the ordinary course of its operation, prevents, restricts, or otherwise limits the exercise of a right of a copyright owner under this title." .. It is evident to this Court, as it has been to previous courts, that CSS is a technological measure that both effectively controls access to DVDs and effectively protects the right of a copyright holder.”
6 Commission’s original directive proposal from 1998 was similar to the DMCA. See OJ 1998 C108/6 An amended directive proposal from 1999 included the “achieves the protection objective” language for the first time but with an additional clarification restricting its possible interpretations. It said that the objective must be achieved “in an operational and reliable manner with the authority of the rightholders.” See OJ 1999 C180/6. In the Council’s Common position the “achieves the protection objective” language was moved to the end of the paragraph and stripped from additional clarifications. The only motivation one can find in the official documents is this: “The Council also adopted a number of technical changes to the wording of this paragraph with a view to simplifying it further.” See OJ 2000 C344/20.
7 Law proposal 28/2004. The law was prepared by the Finnish Ministry of Culture’s copyright office. Of note, the office is lead by Mr. Jukka Liedes, who was also the chairman of the WIPO meeting preparing the 1996 treaties and later had an active role in the preparation of the 2001 copyright directive.
8 Also other Nordic states took essentially the same approach. See e.g. V Still, DRM och upphovsraättens obalans (2007). IPR University Center Publications, Helsinki.
9 Rauhala discusses the case on his homepage at http://mjr.iki.fi/
10 Author’s translation.
11 DVD CCA dropped its last case against an individual in 2004. See “DVD Descrambling Code Not a Trade Secret. DVD CCA Surrenders in Bunner DVD Descrambling Case” EFF press release, 22 January 2004.
12 DVD format has also patents and other intellectual property that must be licensed. See e.g. S Schwankert: “China readies DVD rival format. Chinese DVD player makers plan to switch to EVD to avoid paying patent royalties on DVD format.” IDG News Service, 15 December 2006.
13 See e.g. R Paul “Latest AACS revision defeated a week before release” Ars Technica. 17 May 2007.
14 Sony v Owen 2002 ECDR 27 and Sony v. Ball 2004 EWHC 1738. To compare, in Stevens v. Sony 2005 HCA 58 High Court Australia ruled that Playstation mod chips were not circumventing devices because they allowed access to works, which is not under copyright.
15 See e.g. E Bangeman “EMI goes DRM-free on iTunes Store” Ars Technica, 2 April 2007.