LWN.net Weekly Edition for January 16, 2003 [LWN.net]

Mickey Mouse 1, intellectual commons 0

The U.S. Supreme Court has ruled, 7-2, that the Sonny Bono copyright extension act is not unconstitutional. All challenges to that law have been rejected, and the law is allowed to stand. Mickey Mouse need not fear being pushed into the public domain anytime soon.

The majority opinion (available in PDF format) was written by Justice Ginsberg. The majority found that the phrase "limited time" in the U.S. Constitution doesn't mean that the time has to be reasonable; the vision of "forever minus one day" copyright terms is just fine with these people. The interpretation of "limited time" is left entirely to the discretion of Congress; the courts have nothing to add.

In sum, we find that the CTEA is a rational enactment; we are not at liberty to second-guess congressinoal determinations and policy judgement of this order, however debatable or arguably unwise they may be.

There was also, according to the majority, no restraint to free expression to be concerned about. End of case.

Justice Stevens wrote a dissent arguing that the extension of existing copyrights can not be constitutional. He pointedly does not look at the more general issue of copyright extension, arguing that is not the case that the plaintiffs brought forward. He also points out that, in the last eighty years, the only work to enter the public domain is that which was copyrighted in 1923. He concludes:

By failing to protect the public interest in free access to the products of inventive and artistic genius - indeed, by virtually ignoring the central purpose of the Copyright/Patent Clause - the Court has quitclaimed to Congress its principal responsibility in this area of the law. Fairly read, the Court has stated that Congress' actions under the Copyright/Patent Clause are, for all intents and purposes, judicially unreviewable. That result cannot be squared with the basic tenets of our constitutional structure.

A separate dissent was written by Justice Breyer, who took a much greater interest in the issue of whether copyright extension actually serves to "promote the progress of science" as specified in the Constitution. He doesn't believe that copyright extension will cause more works to be created:

The extension will not act as an economic spur encouraging authors to create new works.... No potential author can reasonably believe that he has more than a tiny chance of writing a classic that will survive commercially long enough for the copyright extension to matter....What monitarily motivated Melville would not realize that he could do better for his grandchildren by putting a few dollars into an interest-bearing bank account?

Justice Breyer also takes a look at the first amendment (freedom of expression) arguments, and finds them worthy of rather more consideration than they got from the Court majority.

His conclusion is clear and straightforward:

This statute will cause serious expression-related harm. It will likely restrict traditional dissemination of copyrighted works. It will likely inhibit new forms of dissemination through the use of new technology.... It is easy to understand how the statute might benefit the private financial interests of corporations or heirs who own existing copyrights. But I cannot find any constitutionally legitimate, copyright-related way in which the statute will benefit the public. Indeed, with respect to existing works, the serious public harm and the virtually nonexistent public benefit could not be more clear.

Unfortunately, two voices of relative reason were not sufficient to sway the Supreme Court, and copyright extension remains the law of the land. There can be no doubt that those behind this law (and various other expansions of intellectual property rights) will push for more in the future. It also seems clear that there will be no help from the courts in fighting this push. As far as the courts are concerned, Congress can do what it wants in this area.

That leaves only one option open for those who would fight for the intellectual commons - trying to talk some sense into the legislative branch. There are signs that the general awareness of the problematic side of copyright expansion is growing. This case, even in defeat, has been a step in the right direction. Lawrence Lessig did an outstanding job in arguing the case before the Supreme Court; as a result, far more people know (and care) about copyright issues now than before. With a redoubled effort, it should yet be possible to put an end to the unending expansion of copyright power. It will not be easy, though, to say the least.

Comments (6 posted)

The RIAA and BSA make a deal

The word is out: the music industry and "technology companies" have come to an agreement on anti-piracy legislation. Could it be that the determination of the technology industry to serve the needs of its customers has brought the copyright fights to a reasonable conclusion? We know better than that.

The "technology companies" in this case are made up of the Business Software Alliance (best known for its software licensing raids on companies) and the Computer Systems Policy Project, a lobbying group made up of IBM, Intel, HP, and others. The agreement between these groups and the RIAA says, essentially:

The groups involved will oppose any governmental mandates requiring digital rights management features in digital devices. The CBDTPA, thus, has lost the support of the RIAA.
These groups will also oppose any governmental expansion of the rights of users of copyrighted materials. According to the CSPP release, "Both industries stated their support for private and federal enforcement against copyright infringers as well as unilateral technical protection measures and they agreed that legislation should not limit the effectiveness of such measures."

In other words, the RIAA has come to the conclusion that the status quo is good enough, that whatever DRM schemes it has in mind will work, and the best thing to do is to get the government out of the picture before any pesky ideas about fair use, first sale, and other longstanding aspects of copyright law make any more headway. The technology companies, with luck, are freed from having to be the industry's policeman, and are thus happy to sign on. It's a nice, smoke-filled-room deal; nobody felt any real need to consult with the people who actually buy and use copyrighted materials. This, of course, is how copyright law has been made in the U.S. for a long time.

This deal is not entirely bad; it isolates the motion picture industry and makes unpleasant legislation like the CBDTPA more unlikely to pass. But it also makes things harder for DMCA reform and other useful measures. The truly interesting thing with this agreement, though, is that it seems that the RIAA has concluded that it has more to lose than to gain from increased legislative attention to copyright issues. The increasing copyright backlash, perhaps, has given them a bit of a scare. What we should really conclude from this "historic" agreement is that, Supreme Court disappointments notwithstanding, the copyright message is beginning to get through.

Comments (2 posted)

The DMCA and interoperability

A couple of new Digital Millennium Copyright Act cases have come up over the last week. Neither one involves Linux or free software, but both show the broad reach of this law, and how the DMCA could be used against Linux in the future.

The first case is a lawsuit by Lexmark against Static Control Components. Lexmark printers talk to installed toner cartridges via a proprietary protocol; the printer will refuse to use cartridges which do not speak this protocol. According to Lexmarks's complaint (PDF format), this mechanism "protects consumers to ensure that they are using genuine Lexmark toner cartridges." It also, of course, protects Lexmark's revenue stream by ensuring that consumers are "protected" from buying cheaper toner cartridges from another manufacturer.

A company called SMARTEK sells chips which can successfully perform the handshake with Lexmark printers, and thus allow "unauthorized" toner cartridges to be used. Lexmark has two distinct gripes with this product. First, they claim, the SMARTEK chip contains a copy of code from Lexmark's own chip; this, if true, would be a straightforward copyright violation. But Lexmark also claims that, regardless of the provenance of the code, the SMARTEK chip circumvents Lexmark's technical measures which control access to the software running in the printer itself. And that, of course, is a DMCA violation.

This claim may seem like a bit of a stretch, but Ed Felten's remarks on the case are worth a read:

Clearly, Lexmark is being creative in their interpretation of the DMCA. But their arguments are not ridiculous. The purpose of the DMCA was to ban certain types of interoperation. And the DMCA intentionally did more than just to strengthen the traditional rights of copyright holders -- it created new categories of rights. Lexmark will not be laughed out of court.

A similar case has been brought forward (late last year) by the Chamberlain Group, a manufacturer of automatic garage door openers. Chamberlain's remote openers use a sort of one-time password scheme to defend against playback attacks, which is certainly a worthwhile goal. Of course, this scheme also makes it difficult for competitors to make and sell remotes which will work with Chamberlain's openers.

Unfortunately for Chamberlain, a company called Skylink figured out how to do it. Chamberlain's complaint (PDF format), "the Skylink transmitter circumvents the protective measure of Chamberlain's copyrighted rolling code computer program in the receiver wherein the homeowner can gain unauthorized access to such computer program." The owner, in other words, is gaining unauthorized access to his garage door opener, which he thought he had bought, to (without authorization) open his own door, which he thought was part of his house.

This case, too, will probably not be laughed out of court.

One of the nice features of Linux, of course, is interoperability. Developers of the Linux kernel and applications have, over the years, put a great deal of effort into making Linux work with just about any other system - hardware or software - that they could. Interoperability is one of the big selling points of the Linux system. It is increasingly clear, however, that the DMCA allows vendors to make interoperability a crime simply by saying so. There can be no doubt that this "feature" of the DMCA will see increasing use in the future, and that Linux users will feel its bite.

LWN.net Weekly Edition for January 16, 2003

ethereal - Various security issues in Ethereal

IMP - SQL injection vulnerability

mod_php - buffer overflow

Heap corruption vulnerability in at

BIND8: Multiple vulnerabilities

bind buffer overflow vulnerability in DNS resolver libraries

Canna server: exploitable buffer overrun

cups - multiple vulnerabilities

dhcpcd: Character expansion vulnerability

dvips: command execution vulnerability

Filename disclosure vulnerability in fam

fetchmail: buffer overflow

GNU fileutils race condition

geneweb - information exposure

Potential remote root exploit in glibc

glibc: DNS stub resolvers contain buffer overflow vulnerability

http-fetcher - buffer overflow

IM: creates temporary files insecurely

KDE - command parameter quoting problems

kdelibs: Vulnerabilities in KIO subsystem support

kernel: local denial of service vulnerability

krb5: Buffer Overflow in Kerberos Administration Daemon

lcdproc - buffer overflows

leafnode: denial of service

libmcrypt: buffer overflows and memory exhaustion

libpng, libpng3: buffer overflow

lynx: CRLF injection vulnerability

perl-MailTools: remote command execution

micq: Denial of service

PHP Remote Compromise/DOS Vulnerability

monopd - buffer overflow

Mozilla: Privacy leak and other vulnerabilities

MySQL: multiple vulnerabilities

net-snmp: denial of service vulnerability

OpenLDAP2: remote command execution

PHP: vulnerability in mail function

Buffer overflow vulnerabilities in PostgreSQL

Local arbitrary code execution vulnerability in Python

Multiple-use vulnerability in Safe.pm

File overwrite vulnerability in tar and unzip

Multiple vendor telnetd vulnerability

Tomcat 4.x JSP source code exposure vulnerability

traceroute-nanog: buffer overflow and root exploit

typespeed: buffer overflow

webalizer: reverse DNS buffer overflow vulnerability

Webmin/Usermin vulnerabilities

wget:directory traversal bug

wmaker: buffer overflow in Window Maker image handling code

Multiple vulnerabilities in wordtrans

Problems with libgtop_daemon

Wwwoffle remote privilege escalation vulnerability

xpdf: integer overflow