During last fall's U.S. presidential election, CBS News featured a controversial report on President George W. Bush's military service. The report, which relied on unverified documents, generated enormous media coverage, eventually leading to a public apology and the upcoming retirement of veteran news anchor Dan Rather.
Several weeks ago, an independent panel released a 234-page report on the incident as CBS News continued its efforts to abate the scandal. Two days after the freely available report was released, Internet users noticed that attempts to electronically copy and paste sentences from the lengthy report were rendered impossible as CBS's lawyers had inserted a technological feature into the document that prevented any form of electronic copying.
Although the use of the technological restriction was relatively unimportant — a speed bump rather than a full blocking mechanism — its use highlights the increasing reliance on technological protection measures (TPMs) to control access to, and use of, digital content. The proliferation of technological protection measures, alongside new legislative proposals designed to protect these digital locks, represent a perfect storm of danger to consumers, who may find themselves locked out of content they have already purchased, while sacrificing their privacy and free speech rights in the process.
Owners of online databases and other digital content deploy technological protection measures (sometimes referred to as Digital Rights Management or DRM) to establish a layer of technical protection that is designed to provide greater control over their content. The content industry has touted technological protection measures' promise for more than decade, maintaining that technological locks could prove far more effective in curtailing unauthorized copying than traditional laws.
While technological protection measures do not provide absolute protection — research suggests all technological protection measures can eventually be broken — companies continue to actively search for inventive new uses for these technological locks.
In certain instances their use is obvious to consumers. For example, DVDs contain a content scrambling system that limits the ability to copy even a small portion of a lawfully purchased DVD.
Similarly, purchasers of electronic books often find that their e-books contain limitations restricting copying, playback, or use of the e-book on multiple platforms. In fact, e-books are frequently saddled with far more restrictions than are found in the paper-based equivalent. Sometimes the use of a technological protection measure is far less obvious, manipulating markets to the detriment of consumers, rather than protecting content. DVDs also typically contain regional codes that limit the ability to play a DVD to a specific region. The consumer is often unaware of the regional code until they purchase a DVD while on vacation in one region only to find that they cannot play the disc on their DVD player when they return home.
Of even greater concern is the increasing use of technological protection measures in completely unexpected environments. For example, Hewlett-Packard has begun to install technological protection measures into their printer cartridges. The technology is used to block consumers from purchasing cartridges in one region and using them in another, thereby enabling the company to maintain different pricing structures for the same product in different global markets.
Despite the proliferation of technological protection measures, few consumers are aware of their existence and many manufacturers are loath to disclose their use. In fact, consumers may soon find that these technological limitations force them to incur significant new costs as they face little alternative but to re-purchase content so that it functions on their personal computer or other favourite device. The industry acknowledges as much, as according to Kevin Gage, a vice-president with the Warner Music Group, this year we will begin to see people with "large libraries of content that won't play with their devices."
The impact of technological protection measures also extends far beyond consumer fairness. The same technologies can function much like spyware by invading the personal privacy of users. For example, technological protection measures can be used to track consumer activity and report the personal information back to the parent company.
There is also concern that technological protection measures can be used to induce security breaches. Recent reports indicate that hackers are using these technologies in the Microsoft Windows Media Player to trick users into downloading massive amounts of spyware, adware, and viruses.
While the potential for technological protection measure abuse may appear obvious, Canadian policy makers have actually been racing toward increasing the use and legal protections afforded to technological protection measures. Canadian Heritage has provided funding to technological protection measure initiatives to help facilitate their development, while parliamentarians, led by Canadian Heritage Minister Liza Frulla and Industry Minister David Emerson, have been jointly working on a copyright reform package that would reportedly grant technological protection measures additional legal protections.
The experience with technological protection measure legal protection in the United States, which enacted anti-circumvention legislation as part of the Digital Millennium Copyright Act (DMCA) in 1998, demonstrates the detrimental impact of this policy approach — Americans have experienced numerous instances of abuse that implicate free speech, security, user rights under copyright, and fair competition.
From a free speech perspective, the CBS News case represents only the latest in a series of incidents where speech was chilled under the threat of legal action due to technological protection measure and anti-circumvention legislation. For example, several years ago Edward Felten, a Princeton researcher, sought to release an important study on encryption that included circumvention information. When he publicly disclosed his plans, he was served with a warning that he faced potential legal liability if he publicly disclosed his findings. The impact on security, particularly in the wake of 9/11, has been similarly disconcerting. Many computer science researchers have foregone working on sensitive security and encryption matters due to legal fears, pointing to the arrest and imprisonment of Dmitry Sklyarov, a Russian software programmer who spent several months in a California jail in 2001 after he traveled to the U.S. to discuss a circumvention software program at a conference. That incident led leading former Cyber-security Czar Richard Clarke to acknowledge that "a lot of people didn't realize that [the DMCA] would have this potential chilling effect on vulnerability research."
Companies have not shied away from using prohibitions on circumventing technological protection measures to limit competition. Lexmark, another leading printer company, sued a rival printer cartridge company for copyright infringement for circumventing technological protection measures designed to prevent consumers from using the rival company's printer cartridges in Lexmark printers. Similarly, Chamberlain, a garage door opener company, sued Skylink for creating a universal remote control that interoperated with its garage door opener by circumventing a technological protection measure. In both instances, appellate courts recently denied the suits, but fear of a potential lawsuit may be sufficient to stop competitive activity in its tracks.
From a traditional copyright perspective, anti-circumvention legislation, acting in concert with technological protection measures, has steadily eviscerated fair use rights such as the right to copy portions of work for research or study purposes, since the blunt instrument of technology can be used to prevent all copying, even that which copyright law currently permits. They also have the potential to limit the size of the public domain, since in the future work may enter public domain as its copyright expires, yet that content may be practically inaccessible as it sits locked behind a technological protection measure.
Notwithstanding the U.S. experience, there is every indication that adoption of these legal provisions is marching forward in Canada leading to a potential DMCCA — the Digital Millennium Copyright Canada Act. This despite the fact that the U.S. model need not be imitated in order to meet Canada's international obligations and the fact that important advocates, such as the Privacy Commissioner of Canada, who recently wrote to Industry Canada and Canadian Heritage to request future consultation on the privacy impact of copyright reform, have yet to be heard.
In fact, the time has come for all Canadians to speak out and to tell the responsible ministers along with their local MPs what is increasingly self-evident. Canada does not need protection for technological protection measures. In order to maintain our personal privacy, a vibrant security research community, a competitive marketplace, and a fair copyright balance, we need protection from them.
