On trial: Digital copyright law

The suit asks a federal judge to rule that the Digital Millennium Copyright Act (DMCA) is so sweeping that it unconstitutionally interferes with researchers' ability to evaluate the effectiveness of Internet filtering software.

By suing on behalf of a 22-year-old programmer who's researching the oft-buggy products, the civil liberties group hopes to prompt the first ruling that would curtail the DMCA's wide reach.

After the DMCA was used to intimidate Princeton professor Ed Felten and his colleagues into self-censoring a presentation last year, the law became an instant magnet for criticism. But so far, every judge has upheld the DMCA's broad restrictions on the "circumvention of copyright protection systems."

This case will be different, the ACLU hopes, because it features a sympathetic plaintiff, Ben Edelman, and because it involves the socially beneficial act of critiquing software that is frequently used in public schools and libraries. Edelman had testified as an expert witness in a case the ACLU brought against a federal law that compelled public libraries to install filters.

"I did considerable work for them in preparation for the (Children's Internet Protection Act) lawsuit, and remained interested in the software," Edelman said. "I started thinking about how to make my research that much better. What became clear to me was that what I really needed, one way or another, was a way to get the entire block list."

In the library-filtering lawsuit, which is now before the Supreme Court, Edelman reviewed software sold by Surfcontrol, N2H2, Websense and Secure Computing, and concluded that "blocking programs are fundamentally unable" to do a consistent job of blocking only pornographic Web sites.

Companies that make filtering software typically include an encrypted list of sexually explicit or otherwise banned Web sites. Inventing and distributing a utility that circumvents that copy protection, which Edelman says he would like to do, would run afoul of the DMCA's legal prohibitions.

"I don't want to go to jail," said Edelman, who graduated from Harvard in June, and who plans to study law there this fall. "I want to go to law school."

Using Microsoft's Visual Basic environment, Edelman also has published a series of reports on domain names, including a study of how 4,525 domains point to one porn site and a report on widespread errors in the "whois" database.

A long shot
Some legal experts applauded the ACLU's case, while cautioning that it was a long shot.

"They're hoping to get a statement from the court on the constitutionality of the DMCA," said Dan Burk, a professor at the University of Minnesota who specializes in intellectual property law. "I would be very surprised if the court agreed that the First Amendment overrides Congress' ability to create this sort of act. I don't think courts are very amenable to First Amendment arguments right now."

Burk noted that the suit also asks for Edelman to be immunized from lawsuits based on copyright, trade secret and breach-of-contract grounds. "This is going to be a long process," Burk said. "There are a lot of claims here that the court has to sort through before they get to the DMCA claim."

In the suit, which was filed Thursday morning in Massachusetts under the title Edelman v. N2H2, the ACLU will ask for an injunction that bars Seattle-based N2H2 from suing its client.

N2H2 and many other blocking software companies have a long history of aggressively using the law to defend the secrecy of their encrypted lists.

CyberSitter once threatened journalists with criminal prosecution for quoting from its encrypted blacklist, and the owner of CyberPatrol sued two programmers for distributing a cphack.exe utility that decoded the software's blacklist. The cphack.exe authors agreed to settle the case.

During the trial over the Children's Internet Protection Act this year in Philadelphia, N2H2's attorneys convinced a three-judge panel to eject the public from the courtroom before hearing testimony about the company's confidential blocking techniques.

David Burt, a spokesman for N2H2, said he did not know if his employer would sue someone who released a blacklist-decryption utility. "I couldn't make that decision, although I will say on the record it's not something we would rule out," Burt said. "We'd have to look at the circumstances. We'd have to talk to our lawyers about that."

"People have published examples of wrongfully blocked sites, and we didn't threaten to sue them over that," Burt said. "That's not the kind of thing we'd threaten to sue over. There's nothing illegal in publishing a list."

The ACLU's lawsuit seeks permission for Edelman to do three things: Decrypt N2H2's blacklist, publish the decrypted blacklist and distribute the decoding utility.

Burt also said that his company's lawyers would decide how to respond to the ACLU's lawsuit. But Burt added that he doubted that N2H2 would agree to the publication of the complete contents of its decrypted list of off-limits Web sites.

Like many other software companies, N2H2 has been hit hard by the downturn in the technology sector. On Wednesday, its shares closed at 14 cents, down from a high of about $33 in late 1999.

Overturning N2H2's license
The ACLU is also asking a federal judge to declare that the license agreement accompanying N2H2's software is unenforceable because it is an "unconscionable" misuse of copyright and contrary to federal and state public policy. N2H2's license says: "You shall not copy or make any changes or modifications to the software, and you shall not decrypt, decode, translate, decompile, disassemble, or otherwise reverse engineer the software."

"The contract section was one of the causes of action I thought was pretty dicey," said Tom Bell, a professor of law at Chapman University. "That's a hook shot from center court."

Bell says that courts generally have viewed license agreements for computer software as binding. "Some of the claims are pretty clearly not going to fly," Bell said. "I'd say the best of the claims have a 60 percent shot of prevailing. There are a lot more weak claims that only have a 10 percent shot of prevailing. But if you add it all up, it's still worth trying."

So far, every lawsuit challenging the DMCA has failed.

Probably the best-known case was one brought by the eight largest movie studios against 2600 magazine for publishing the DeCSS.exe DVD-decryption utility.

In a decision last November, the U.S. Second Circuit Court of Appeals flatly rejected both First Amendment and "fair use" challenges to the DMCA.

"Our task is to determine whether the legislative solution adopted by Congress, as applied to (the magazine) by the district court's injunction, is consistent with the limitations of the First Amendment, and we are satisfied that it is," the three-judge panel wrote.

The Electronic Frontier Foundation, which represented the hacker zine, chose not to appeal its defeat to the Supreme Court.

Ed Felten, the Princeton University computer scientist, said he's "happy to see people challenging the DMCA, because I think it's a harmful law."

But Felten said he learned firsthand that it's difficult to do. "Based on my experience, the most difficult aspect of challenging a law like this is convincing the court that you have standing to challenge the law or that there is an immediate case or controversy that the court needs to take up," Felten said.

After the recording industry briefly threatened Felten and his co-authors with a DMCA lawsuit last year, the scientists sued to seek an injunction allowing them to present their paper on security vulnerabilities in a copy-protection scheme.

A federal judge tossed out the suit, ruling that the Recording Industry Association of America had long since abandoned any pretense at a threat. "The plaintiffs liken themselves to modern Galileos persecuted by authorities," said U.S. District Judge Garrett Brown. "I fear that a more apt analogy would be to modern-day Don Quixotes feeling threatened by windmills which they perceive as giants. There is no real controversy here."

Filter-hacking protections

There is some legal immunization for blocking-software researchers. When enacting the DMCA in 1998, Congress ordered the Library of Congress to weigh exemptions to the law's broad prohibition against circumventing copy-protection techniques.

In October 2000, the Library of Congress ruled that "the case has been made for an exemption for compilations consisting of lists of websites blocked by filtering software applications."

But that exemption explicitly does not permit a researcher to write and distribute software that decodes the encrypted blacklists. Because Edelman wants to do just that, the ACLU argues, the Library of Congress' decision is insufficient.

The DMCA's limited exemption for some forms of reverse-engineering also does not apply, the lawsuit claims. According to the DMCA, reverse-engineering must be done for "the sole purpose of identifying and analyzing those elements of the program" necessary to create similar software.

Because Edelman's purpose is instead to critique filtering software, the ACLU says, he could be liable under the DMCA unless the court intervenes.