Legal Issues. 2 Readings Pamela Samuelson, “Anticircumvention Rules: Threat to Science,” 293 Science 2028, Sept. 14, 2001. .

Legal Issues

2

Readings

• Pamela Samuelson, “Anticircumvention Rules: Threat to Science,” 293 Science 2028, Sept. 14, 2001.http://www.sciencemag.org/cgi/reprint/293/5537/2028

3

Topics

• Privacy

• Copyright, Patent, Trade Secrets, and the DMCA

• Laws and Regulations

4

Right to Privacy

• Implicitly granted through the fourth amendment (The right of the people to be secure in their persons, houses, papers and effects against unreasonable searches and seizures …)

• In June 2000, the FTC found that 97% of web sites studied collected personal information but only 62% of those sites indicated this to the consumer. 57% of the studied sites contained third party tracking devices.

5

Copyright, Patent, Trade Secret

• These are legal devices to protect the rights of artists, inventors, developers and owners of programs and data.

• Why you should understand these:– Know what protection the law provides for computers

and data.– Appreciate laws protecting the rights of others and

understanding how that restricts behavior.– Understand existing laws as a basis for recommending

new laws.

6

What the Needs Protection?

• Protection of code and data through copyright, patent and trade secret.

• Protect programmers and people who employ them (from each other)

• Protect private data from public eyes.

• What is the best way to protect it?

7

Copyright

• Copyrights are designed to protect expressions of ideas. Ideas are free, however, when an artist expresses those ideas in a work of art, that can be copyrighted. Thus, a copyright applies to a creative work such as a story, painting, or song. Copyright gives the author the exclusive right to make copies of the expression and sell them to the public. Copyright laws exist so that artists can earn a living at their art.

8

What Can Be Copyrighted

• U.S. copyright law of 1978 says that copyright can be registered for “original works of authorship fixed in any tangible medium of expression … from which they can be perceived, reproduced, or otherwise communicated either directly or with the aid of a machine or device.”

• It must be expressed in a tangible medium.• It must be original with an identifiable author

9

Copyright: Fair Use

• All copyrighted material is subject to “fair use”. This allows reproduction for “purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use) scholarship or research.”

• Be careful when you leave the University!

10

Registration: Mark

• Before 1978, each copy had to be marked with the copyright symbol ©, the word copyright, the year and the authors name. Either the word copyright or the symbol © could be omitted but not both.

• This was to make any potential user aware that the work is copyrighted.

• Since 1978, no mark is necessary.

11

Copyright Registration: Filing

• The copyright must be officially filed. That is, a form is completed and submitted to the U.S. Copyright Office along with a small fee and a copy of the work. If the work is longer than 50 pages, only the first and last 25 pages need to be submitted.

• No infringements can be prosecuted before the time of filing. In practice, filing is often not done unless prosecution is planned.

12

Copyright Duration

• A copyright lasts for 70 years beyond the death of its author or last living co-author or a total of 75 years in the case of work done for hire (that is, work being copyrighted by a business instead of one or more individuals). Can be extended.

• Trend: length is increasing

13

Copyright Infringement

• The holder of the copyright must go to court to prove that someone has infringed on the copyright. The infringement must be substantial for the courts to allow a prosecution.

14

Copyrights and Computer Works

• In 1980, the copyright law was amended to include an explicit definition of computer software. Still, copyright may not be the best form of protection for computer software.

• Code not algorithms: Computer algorithms are the ideas behind the code which is the expression, so the code is copyrighted and cannot be copied, but the algorithm cannot be protected.

15

Copyrights and Computer Works

• Copyright protects the expression of ideas. Protects the intangible “sequence of words, bits, or colors”, not the copy itself.

• It is not clear what can and cannot be copyrighted. Courts have ruled that a menu can be copyrighted but “look and feel” as in Microsoft Windows, cannot be copyrighted.

16

Copyrights and Computers

• Copyright does not limit how a work is used, only the distribution of copies. Suppose a single host on a network legally acquires a copy of a piece of software. That host can allow any user on the network to access the software as long as a new copy is not created. Copyright controls copying; it is not clear that distributed access is a form of distribution.

17

Software Licenses

• A software license is permission to use copyrighted material under certain circumstances.

• Some click-through licenses are enforceable. Some are not. Most are considered contracts between you and the manufacturer.

18

Patents• Patents protect inventions. The difference

between patents and copyrights is that patents were intended to apply to the results of science, technology and engineering, whereas copyrights were meant to cover works of art, literature and written scholarship. A patent can protect a “new and useful process, machine, manufacture, or composition of matter.” A patent is valid for 20 years.

19

Patents

• Patents cannot cover “newly discovered laws of nature … and mental processes”. “2+2=4” is not patentable because it is a law of nature. It is not copyrightable because it is in the public domain. The patent protects the device or process for carrying out an idea, but not the idea itself.

20

Patent: Novelty Requirement

• A patent is valid for something that is truly novel or unique.

• The object or device must be novel and non-obvious to a person considered skilled in that area.

21

Patent: Novelty Requirement

• If two composers happen to write the same song independently, they can both be given a copyright for it. If two inventors invent substantially the same device, the patent goes to the one who invented it first, regardless of who filed a patent application first. (Of course, you have to prove you invented it first).

• There can be only one patent for a given invention.

22

Patents: Registration

• Obtaining a patent is much more difficult than getting a copyright. The inventor must convince the Patent Office that he deserves a patent. A patent attorney can research the patents already issued for similar inventions to: – determine that the invention has not been previously

patented.

– identify similar patents that can be useful in describing the unique features of the invention to be patented.

23

Patents: Registration• The Patent Office compares the application to

similar patented inventions and decides if it is novel and non-obvious. If so, the patent is granted.

• The patent applicant must disclose how his invention works and what is novel in sufficient detail to convince the Patent Office that it is worthy of a patent. This detail, however, which becomes public record, makes the possibility of infringement more likely. Patented objects are usually marked with the patent number to discourage potential infringers.

24

Patent Infringement

• With a copyright, the holder can choose which cases to prosecute, ignoring small infringements, and the copyright will remain valid. The holder of a patent must prosecute all infringements. Failing to sue for patent infringement, even if it is small or unknown to the patent holder, can result in loss of patent rights.

25

Patent Infringement

• An infringement has occurred if another inventor independently invents the patented device (unlike copyright - copyright infringements occurs only if it was a copy and not an independent invention).

26

Drawbacks to Patents• Infringement prosecution is expensive and time

consuming. Prosecution is dangerous in that it could cause the patent holder to lose or limit the patent if the person charged with infringement successfully argues:– This isn’t infringement because the 2 inventions are

sufficiently different.– The patent is invalid because a prior infringement was

not opposed– The invention is not sufficiently novel so that the patent

should not have been granted in the first place.– The infringer invented the object first.

27

The result is..

• Getting and maintaining a patent is very expensive and usually done by large companies with big research (and legal) budgets.

28

Patents and Computers

• Computer hardware can be patented.• The Patent Office recently started granting patents

for computer software. The courts consider algorithms not patentable if they are ideas instead of processes. The underlying algorithm is what many software writers would like to protect. Some software has been patented, but there have not been enough court challenges to clearly establish this form of protection.

29

Trade Secrets

• The key characteristic of a trade secret is that it must be kept secret. The information has value only as a secret and the infringer is one who divulges the secret.

• Typically, it is some information that gives a company a competitive edge over other companies - the formula for a soft drink, a mailing list of customers, or information about a product to be announced soon.

30

Trade Secret

• The owner must take precautions to protect the secret - storing it in a safe, encrypting it in a computer file or having non-disclosure agreements with employees.

• If someone steals a trade secret, the owner can sue and recover damages, lost revenues and legal costs. If someone discovers or invents the secret independently, there is no protection.

31

Should not Be Easy to Reverse Engineer

• A telephone can be taken apart and analyzed so it is apparent how it works. This is not protected as a trade secret. A better mechanism for a telephone is a patent.

• It is more difficult to determine the manufacturing process of a soft drink from the final product - time, temperature and ingredients all combine to produce the drink in a way that is not obvious from an analysis of the final product. Hence, the recipe of a soft drink is an example of a trade secret.

• Trade secret protection works when the secret is not apparent in the product.

32

Trade Secrets and Software

• Trade secret protection can be used for computer software. The design or underlying algorithm of the program is novel and it’s value depends on it’s being a secret.

• Trade secret protection allows distribution of the result of the secret (soft drink, executable code) while keeping the secret hidden.

33

Trade Secrets and Software

• Trade secret protection does not cover copying a product, so that it cannot protect against a software pirate who sells or distributes someone else’s program without permission.

• Trade secret protection makes it illegal to steal a secret algorithm and use it in another product.

34

Trade Secrets

• Trade secret protection does not help against reverse engineering or code disassembly - both cause the secret to be revealed and thus the protection to disappear.

• No filing is necessary and the protection has no time limit. In practice, once there is an infringement, the secret is out and there is no longer a secret to protect.

35

Protecting Computer Hardware

• The legal system was not designed for computer objects, so existing protection mechanisms must be used as best as they can.

• Hardware such as chips, disk drives and storage media can all be patented. The objects themselves and also the manufacturing process are suitable for patents.

36

Protecting Firmware

• In the case of firmware, it is a little less obvious. The storage media can be patented, but the data and instructions contained in them are probably not patentable.

• Copyright doesn’t really work here, either. This is not the expression of an idea in a form that promotes dissemination of the idea. And besides, what would be a copy that is an infringement?

• Trade secret is probably the best form of protection for firmware, although there is the possibility of reverse engineering.

37

Protecting Software• Software object code is usually copied so that it can be

distributed for profit. The code is a work of creativity and most people accept object code distribution as “publication”. Thus copyright protection is appropriate for object code.

• Not clear what needs to be filed with the Copyright Office - a source code listing or some form of the object code (does a single copyright cover CD and diskette distribution? Is a new and different distribution form/media an infringement?)

• Software source code has some aspects of a trade secret and some of a copyrightable work.

38

DMCA (1998)

• The “anti-circumvention” provisions of the Digital Millennium Copyright Act (“DMCA”), are sometimes not used according to the original intent. Original intent was to stop copyright pirates from defeating anti-piracy protections added to copyrighted works, and to ban “black box” devices intended for that purpose.

• DMCA has been used to stifle a wide array of legitimate activities, rather than to stop copyright piracy.

• Note: DMCA has been amended

39

DMCA Section 1201

• Section 1201 can be used to stifle free speech and scientific research. Princeton Professor Edward Felten’s team of researchers succeeded in removing a digital watermark in response to a public challenge by Secure Digital Music Initiative.

• When the team tried to present their results at an academic conference, SDMI threatened the researchers with liability under the DMCA.

40

DMCA Section 1201

• By banning all acts of circumvention, and all technologies and tools that can be used for circumvention, section 1201 grants to copyright owners the power to unilaterally eliminate the public’s fair use rights. Already, the music industry has begun deploying “copy-protected CDs” that promise to curtail consumers’ ability to make legitimate, personal copies of music they have purchased.

41

Rationale for Laws and Regulations

• When anything goes wrong, we all ask, “Why didn’t the government do something?”

• You can sue to defend your enterprise or recover damages

• You can be sued for your acts or failures

• Trend towards increased regulation

42

Sarbanes-Oxley Act

• CEOs and CFOs of public companies must certify to the SEC that their financial info is accurate

• Public companies must certify that they have maintained adequate “internal controls” to ensure accurate info

• “Internal controls” cannot be achieved without information security

• No explicit infosec requirements; SOX is the “stealth information security law”

43

More Laws: HIPAA

• HIPAA: Health Insurance Portability and Accountability Act of 1996. Regulates handling of computerized records and patient privacy.

• Privacy rule in effect in 2003• Security rule in effect 2005• Regulation authority is Dept of Health and

Human Services

44

Privacy and Security Rule

• Information regarding medical condition or diagnosis must be kept separately from hiring/firing information

• Series of administrative, technical, and physical security procedures for covered entities to use to assure the confidentiality of electronic protected health information

45

More Laws: GLB

• Gramm-Leach-Bliley: GLB Act, includes provisions to protect consumers’ personal financial information held by financial institutions (banking, insurance, etc)

• Regulated by many agencies -- the Federal Trade Commission is the umbrella agency

46

GLB Act Goals

• Tighten customer protection and give people more control

• Provide ‘Opt out’ rule• Companies in the financial sector have to

let customers or consumers know what information it has on people who use its’ services, who has access in terms of other companies, and how it protects the information.

47

For More Info

• The Electronic Frontier Foundation http://www.eff.org

• The Center for Democracy and Technology http://www.cdt.org

• The Privacy Rights Clearinghouse http://www.privacyrights.org