using technology to protect copyright works

364

Significant changes were made to copyright and

neighbouring rights by the Copyright and Related

Rights Regulations 2003, implementing Directive

2001/29/EC of the European Parliament and of

the Council of 22 May 2001 on the harmonisation

of certain aspects of copyright and related rights

in the information society.1 The main thrust of the

Directive (itself a response to the WIPO Copyright

and Performances and Phonograms Treaties) was

to bring copyright and other rights up to date to

reflect technological change in particular, though

not limited to, the use of the internet as a means

of disseminating and exploiting copyright works

and other subject matter. Although the Directive

should have been implemented by 22 December

2002, the Regulations did not come into force until

31 October 2003. This was largely a reflection of

the scale and complexity of the changes brought

about by the Directive. This article reviews the

implementation that has occurred.

Of the provisions in the Directive, the most

controversial are those concerning the protection of

technological measures designed to prevent or restrict

unauthorised acts in relation to copyright works and

other subject matter, protected by the database right,

the publication rights and rights in performances.

Equivalent measures in the United States, introduced

by the Digital Millennium Copyright Act 1998, have

also proved controversial and have been subject to

challenge on the basis that they run counter to the

First Amendment, as discussed below.

Before the changes implemented by the

Regulations, section 296 of the Copyright, Designs

and Patents Act 1988 treated the making,

importing, sale, hire, offering, exposing or

advertising for sale or hire, devices designed or

adapted to overcome copy-protection (or

publishing information to enable or assist persons

doing this) as an infringement of copyright. The

protection afforded by section 296 applied where

copies of a copyright work were issued to the

public in an electronic form which was copy-

protected. Now, for works of copyright other than

computer programs, these provisions have been

substantially modified and extended to other

subject matter such as performances and the

database right. Criminal penalties have also been

introduced for the first time in relation to

circumvention of protection measures.

A. The Directive on copyright inthe information societyArticle 6 of the Directive concerns the legal

protection against the circumvention of effective

technological measures designed to prevent or restrict

unauthorised acts. Article 6(2) requires Member

States to provide adequate legal protection against:

the manufacture, import, distribution, sale,

rental, advertisement for sale or rental, or

possession for commercial purposes of devices,

products or components or the provision of

services which:

� are promoted, advertised or marketed for the

purpose of circumvention of, or

� have only a limited commercially significant

purpose or use other than to circumvent, or

� are primarily designed, produced, adapted or

performed for the purpose of enabling or

facilitating the circumvention of,

any effective technological measures.

A clue to what adequate legal protection might be

is given by Article 8 of the Directive which requires

Member States to provide appropriate sanctions

and remedies in respect of infringements of the

rights and obligations set out in the Directive, such

sanctions to be effective, proportionate and

dissuasive (the ‘three-step’ test).

The position as regards computer programs is

little changed as the Directive on copyright in the

information society is expressed to be without

prejudice to the Directive on the legal protection of

computer programs.2 This fact introduces some

complexity into the equation and, consequently,

computer programs have to be treated differently

to other forms of works of copyright and other

subject matter. Article 7(1)(c) of the Directive on

the legal protection of computer programs

requires Member States to provide appropriate

remedies against a person in respect of:

any act of putting into circulation, or the

possession for commercial purposes of, any means

the sole intended purpose of which is to facilitate

the unauthorized removal or circumvention of

any technical device which may have been applied

to protect a computer program.

Copyright law and technology

Using technology to protect copyright worksProfessor David Bainbridge, Aston Business School

Computer Law & Security Report Vol. 20 no. 5 2004 ISSN 0267 3649/04 © 2004 Elsevier Science Ltd. All rights reserved

Of the provisions

in the Directive,

the most

controversial are

those concerning

the protection of

technological

measures

designed to

prevent or restrict

unauthorised acts

365


One difference to note is that for computer

programs the protection applies in relation to

technical devices but for other works of copyright

and other subject matter, the protection applies to

effective technological measures.

Before looking at the position with other

copyright works and other subject matter, the

current position for computer programs is

considered: although the provisions are much the

same as before, there have been some changes,

primarily in the language of the provision and in

respect of who may have a right of action. Old

section 296 gave a right of action only to the

person who issued copies of the work to the

public being either the copyright owner or

someone doing so with the licence of the

copyright owner.

B. Computer programsSection 296 previously applied to all copyright

works issued to the public in electronic form and

copy-protected. It is now substituted by a new

section 296 which applies only to computer

programs to which a technical device has been

applied which is intended to prevent or restrict

unauthorised acts that would otherwise infringe

the copyright. In this context a technical device is

any device intended to prevent or restrict acts that

are not authorised by the copyright owner of that

computer program and are restricted by copyright.

Liability under the section is similar to the

position before and covers the acts of making for

sale or hire, importing, distributing, selling, hiring,

offering, exposing or advertising for sale or hire or

being in possession for commercial purposes, the

means of removing or circumventing the technical

device. The sole intended purpose of the means

must be to facilitate the unauthorised removal or

circumvention of the technical device applied to the

computer program. Liability also applies where a

person publishes information intended to enable or

assist persons to remove or circumvent the technical

device. As before, to be liable, a form of knowledge

is required; being knowing or having reason to

believe that the means or information, as the case

may be, will be used to make infringing copies.

A right of action (equivalent to the right of

action of the copyright owner in respect of an

infringement of the copyright) under the new

section is given to the person issuing copies to the

pubic or communicating to the public the

computer program to which the technical device

has been applied. The copyright owner and

exclusive licensee, if there is one, also have the right

to bring an action as does the owner (or exclusive

licensee) of any intellectual property right in the

technical device. An example of the latter could be

the owner of a patent relating to cryptography.

These provisions mean that it is possible for a non-

exclusive licensee to bring an action.

All the persons having the right to bring an

action have concurrent rights and, as usual, the

others should be joined in any legal action unless

the court gives leave otherwise. All have the same

rights as regards delivery up or seizure as regards

any means intended to remove or circumvent the

technical device. The normal presumptions apply,

for example, with respect to the name of the

author or owner and date of publication and the

privilege against self-incrimination in intellectual

property matters is also withdrawn as is usual.

C. Circumvention of effectivetechnical measuresWorks of copyright other than computer programs

to which effective technological measures have

been applied are covered by new sections 296ZA to

296ZF inserted into the Copyright, Designs and

Patents Act 1988. Effective technological measures

are defined in section 296ZF. A technological

measure is any technology, device or component

designed, in the normal course of its operation, to

protect a copyright work other than a computer

program. Such a measure is effective if the use of

the work in question is controlled by the copyright

owner, through an access control or protection

process such as encryption, scrambling or other

transformation of the work, or by a copy control

mechanism which achieves the intended protection.

In this context protection is the prevention or

restriction of acts not authorised by the copyright

owner that are restricted by copyright and use of a

work does not extend to any use outside the scope

of the acts restricted by copyright.

Under section 296ZA, a person who

circumvents effective technological measures

applied to a copyright work other than a computer

program, knowing, or with reasonable grounds to

know, that he is pursuing the objective of

circumventing the measures is liable as if he had

infringed copyright. Liability is owed to the person

issuing copies to the public or communicating the

work to the public and, if not the same person or

persons, to the copyright owner or exclusive

licensee. The rights to bring an action are

concurrent and the usual copyright presumptions

366

apply under sections 104 to 106 as does the

removal of the privilege against self-incrimination

in intellectual property matters. These provisions

apply, apart from sections 104 to 106, mutatis

mutandis, to rights in performances, the

publication right and the database right. With

respect to the latter right, the presumptions as to

the name of the maker and the year of publication

under regulation 22 of the Copyright and Rights

in Databases Regulations 1997 apply.

D. Cryptography researchexceptionAn important exception to the right to bring an

action under section 296ZA is contained in

subsection (2). This is where a person does anything

circumventing effective technological measures for

the purposes of research into cryptography unless

by doing so, or in issuing information derived from

that research, the rights of the copyright owner are

prejudicially affected. Presumably, this means

economic detriment caused to the copyright owner

(note it is the copyright owner’s rights and not those

of any other party having a right of action, such as

a licensee issuing copies of the work to the public).

An example could be where the person carrying out

the research publishes information enabling others

to circumvent the protection afforded by the

measures. In effect, the exception is a new form of

permitted act but it is not expressly limited to non-

commercial research unlike the case now with many

of the traditional permitted acts under copyright

law, such as fair dealing for the purposes of research

or private study. However, the exception only

applies in relation to circumvention of the

technological measures and does not extend to

other acts restricted by neither the copyright nor,

indeed, any acts restricted by other intellectual

property rights.

The simple test for the exception is not

whether the research is ‘fair’ but whether the

copyright owner is prejudicially affected. It derives

from recital 48 of the Directive on copyright in the

information society which states that the

protection of technological measures ‘… should

not hinder research into cryptography’.

The equivalent exception in the United States

is far more detailed and is provided for under

§1201 of the Digital Millennium Copyright Act

1998 which applies to copyright protection

systems. Research into encryption is allowed

provided it is done by a person who has lawfully

obtained the encrypted copy, the act is necessary

for the research, good faith efforts to obtain

authorisation have been made and the act does not

otherwise infringe copyright. Factors to be taken

into account in determining if the exception

applies include:

� whether the information obtained was

disseminated and, if so, under what

circumstances;

� whether the person is engaged in a legitimate

course of study, is employed, or is

appropriately trained or experienced, in the

field of encryption technology; and

� whether the person provides the copyright

owner with notice of the findings and

documentation of the research, and the time

when such notice is provided.

E. Criminal liabilityThe act of circumventing protection measures does

not, per se, give rise to criminal liability but, under

section 296ZB, an offence is committed by a

person who:

(a) manufactures for sale or hire; or

(b) imports otherwise than for his private and

domestic use; or

(c) in the course of a business –

(i) sells or lets for hire; or (ii) offers or

exposes for sale or hire; or (iii) advertises for

sale or hire; or (iv) possesses; or (v) distributes;

or

(d) distributes otherwise than in the course ofa business to such an extent as to affectprejudicially the copyright owner,

any device, product or component which isprimarily designed, produced, or adapted for thepurpose of enabling or facilitating thecircumvention of effective technological

measures.

A person also commits an offence if heprovides, promotes, advertises or markets:

(a) in the course of a business; or

(b) otherwise than in the course of a business to such an extent as to affect prejudicially the copyright owner;

a service, the purpose of which is to enable or

facilitate the circumvention of effectivetechnological measures.

The maximum penalty for these offences is, on

summary conviction, a fine not exceeding the

statutory maximum and/or imprisonment for a

period not exceeding three months. On conviction


The act of

circumventing

protection

measures does

not, per se, give

rise to criminal

liability

367

on indictment, the maximum penalty is a fine

and/or imprisonment not exceeding two years.

Although most of the offences require the act

to be in the course of a business, in two cases, all

that is required is that the distribution or service,

as the case may be, is such as to prejudicially affect

the copyright owner. Arguably, this could apply in

a situation where academics seek to publish the

results of their research into encryption

technologies, if this could be described as

providing a service.3 If so, this could attract both

civil and criminal liability, subject to a defence

based on the right of freedom of expression under

Article 10(1) of the Council of Europe Convention

for the Protection of Human Rights and

Fundamental Freedoms (the ‘Human Rights

Convention’). However, this right is potentially

subject to restriction, inter alia, for the protection

of the rights of others and this could include the

intellectual property rights of those who apply

technological measures to prevent unauthorised

access to or use of their works.

Even more worrying in the United Kingdom is

that the prosecution does not have to prove mens

rea. However, strict liability is balanced by the

presence of a defence that the accused did not

know and had no reasonable grounds for believing

that the device, product, component or service

enabled or facilitated the circumvention of

effective technological measures. As a result of the

House of Lords decision in R v Johnstone [2003]

FSR 42 (a case on the criminal offences under the

Trade Marks Act 1994) it appears that placing

such a persuasive burden on the defence does not

breach the right to a fair trial under Article 6 of

the Human Rights Convention and does not

conflict with the presumption of innocence.

Justification for derogation from the presumption

of innocence must be justified and, in Johnstone,

the House of Lords found compelling reasons for

this including the serious effects of counterfeiting.

It is likely that a similar justification could be

found in relation to the offences under section

296ZB, especially as the maximum term of

imprisonment is considerably less than that for the

trade mark offences.4

There is no equivalent offence in relation to

circumvention of copy protection of computer

programs or in respect of the database right,

publication right and rights in performances. As it

has been accepted that an entire suite of computer

programs is a compilation for copyright purposes,5

this is a curious omission as sections 296ZA to

296ZF apply to compilations though not to

computer programs. This is even more perplexing

when one considers that the distinction between

computer programs, preparatory design material for

computer programs, copyright databases and

databases protected by the database right only is ill-

defined and immensely difficult to predict.

As far as the offences under section 296ZB are

concerned, the activities of law enforcement

agencies and intelligence services in the interests of

national security or for the prevention or detection

of crime, the investigation of offences or the

conduct of prosecutions are excluded from

criminal liability. There are provisions for search

warrants and forfeiture as applies to unauthorised

decoders under sections 297B to 297D.

To date there have been no prosecutions under

section 296ZB, as far as the author is aware.

However, it is instructive to look at the United

States experience under the Digital Millennium

Copyright Act (‘DMCA’). Criminal liability is

provided for under §1204 for any violation of

§1201 (circumvention of technical control

measures).6 However, mens rea is required and the

act must be done willfully and for commercial

advantage or private financial gain. The maximum

penalty for a first offence is five years

imprisonment and/or a fine not exceeding

$500,000. For subsequent offences, these become

imprisonment for up to ten years and/or a fine not

exceeding $1m.

It is the potential imposition of serious criminal

liability for any violation of the provisions on the

circumvention of protection measures, including the

act of circumvention, that has drawn considerable

criticism of the United States Act as being contrary

to the right of freedom of expression enshrined in

the First Amendment to the United States

Constitution.7 For example, Dmitri Sklyarov, a

Russian author of a software package that overcame

e-book encryption developed by Adobe Systems,

was arrested in 2001 after giving a presentation to a

convention of computer hackers.8 In Felten v

Recording Industry Association of America Inc,9

the plaintiffs sought declaratory relief to confirm

that presenting a peer-reviewed academic conference

paper on how they overcame encryption techniques

following a public challenge to do so from the

Secure Digital Music Initiative Foundation did not

infringe the DMCA. The judge said (at para 69):

By imposing civil and criminal liability forpublishing speech (including computer code) about

technologies of access and copy control measures


368

and copyright management information systems,the challenged DMCA provisions impermissiblyrestrict freedom of speech and of the press,academic freedom and other rights secured by theFirst Amendment to the United States Constitution.

1. ‘Secondary circumvention’ The acts falling within the ambit of the offences

under section 296ZB may also bring civil liability,

under section 296ZD, though with some

differences. Where effective technological measures

have been applied to a copyright work other than a

computer program, a person who manufactures,

imports, distributes, sells or lets for hire, offers or

exposes for sale or hire, advertises for sale or hire,

or has in his possession for commercial purposes

any device, product or component, or provides

services which:

� are promoted, advertised or marketed for the

purpose of the circumvention of, or

� have only a limited commercially significant

purpose or use other than to circumvent, or

� are primarily designed, produced, adapted or

performed for the purpose of enabling or

facilitating the circumvention of those

measures is liable to the person issuing copies

to the public or communicating the work to

the public, the copyright owner or exclusive

licensee or the owner or exclusive licensee of

any intellectual property right in the effective

technological measures applied to the work.

These acts are all in a commercial context and

there is no infringement if the act is done

otherwise in the course of business even if the

copyright owner is prejudicially affected (in which

case, of course, the criminal offences may apply

instead).

Concurrent rights are provided for as are rights

of delivery up or seizure. The presumptions apply

and liability also extends, mutatis mutandis, to the

database right, publication right and rights in

performance. The privilege against self-

incrimination is withdrawn as expected with

certain intellectual property proceedings. Unlike

the liability for circumvention under section

296ZA is that section 97(1) of the Copyright,

Designs and Patents Act 1988 applies with

modification to the effect that damages are not

available for innocent infringement where the

defendant did not know and had reason to believe

that his acts enabled or facilitated an infringement

of copyright. This is without prejudice to other

remedies.

2. Remedy where effectivetechnological measures preventpermitted actsThe rights of copyright owners must be balanced

with a general public interest in having at least a

limited amount of access and use of publicly

available copyright material without requiring the

authorisation of the owner. The Berne Copyright

Convention sets the scene for this and provides for

certain permitted acts not requiring the consent of

the copyright owner. With encryption and other

technological measures it is now possible to

effectively restrict access to copyright works made

available to the public. For example, an electronic

book available in or through an educational library

might have protection that prevents the permitted

acts that apply to educational establishments and

libraries. This could compromise or even negate the

scope of the permitted acts under copyright law

which have, over time, become tolerably well settled.

The dangers of this happening were noted some

time ago.11

Section 31A of the Copyright, Designs and

Patents Act 198812 sets an example of resolving such

conflicts. This permits the making of an accessible

copy of a copy of a literary, dramatic, musical or

artistic work or a typographical arrangement in

circumstances where a person cannot access the

original copy because of his visual impairment,

providing the ‘master copy’ is in the lawful possession

or use of that person. However, technological

measures applied to the master copy may prevent or

hinder the making of an accessible copy.

Section 296ZE attempts to provide a solution

to such potential conflicts and sets out a scheme

for voluntary measures or agreements to enable a

person to carry out a permitted act. Where the

permitted act in question cannot be performed

because of technological measures, a person or a

representative of a class of such persons, may issue

a notice of complaint to the Secretary of State who

may give directions to the copyright owner or

exclusive licensee. The purpose of the directions

may be to establish whether a relevant voluntary

measure or agreement exists. In the absence of an

appropriate measure or agreement, the direction

may require the copyright owner or exclusive

licensee, as appropriate, to make available the

means of carrying out the relevant permitted act.

In such cases, a duty will be imposed on the owner

or exclusive licensee and failure to make the means

available to carry out the permitted act will fall to

be treated as a breach of statutory duty.


The rights of

copyright owners

must be balanced

with a general

public interest in

having at least a

limited amount of

access

369


Not all the permitted acts fall within the

protection of section 296ZE. New Schedule 5A to

the Act lists the permitted acts covered by the

section. A significant omission is fair dealing for

criticism or review or for reporting current events

and incidental inclusion.

An exception to these provisions is where a

copyright work is made available to the public on

agreed contractual terms such that members of the

public can access the work at a place and time

individually chosen by them. This closely follows

Article 6(4) of the Directive on copyright in the

information society and will apply, for example,

where the work is made available on-line under a

contractual arrangement, such as in respect of an

on-line database available by subscription. Recital

53 to the Directive is couched in terms of on-

demand interactive services.

Again, these provisions apply, mutatis

mutandis, to rights in performances, the database

right and the publication right. They do not apply

to computer programs. Hence, it is possible for the

permitted act of decompilation of a computer

program under section 50B, in practice, to be

prevented altogether by the application of effective

technological measures.

In the United States, it is for the Librarian of

Congress, upon the recommendation of the

Register of Copyrights who shall consult with the

Assistant Secretary for Communications and

Information of the Department of Commerce to

determine works or classes of works for which the

provisions relating to protection systems should be

disapplied.

F. SummaryThe new provisions relating to technological

measures are complex and may prove difficult to

apply in practice. In particular, the system for

intervention by the Secretary of State to act where

the permitted acts appear to have been prejudiced

looks clumsy and could prove unworkable in

practice. The power is unlikely to be used to any

great extent and it may be that voluntary agreements

or licensing schemes provide the best solution.

It may seem reasonable to impose criminal

liability on persons who, with objective knowledge

and for financial gain, manufacture or make

available devices to overcome protection from

unauthorised acts in relation to copyright works

and other subject matter. However, it is another

thing if the criminal offences or, indeed, civil

liability restrict the ability of bona fide researchers

to publish the results of their research. This danger

was taken very seriously in the United States. In

the United Kingdom, it will be interesting to see

how the offences and the encryption research

exception to civil liability for circumvention are

interpreted by the courts. There is a potential

serious conflict between those provisions and the

Convention rights of freedom of expression and,

in respect of the criminal offences, the

presumption of innocence.

Professor David Bainbridge, Report

correspondent, Aston Business School.

[email protected]

FOOTNOTES

1 OJ L 167, 22.06.2001, p.10.

2 Council Directive 91/250/EEC of 14 May 1991, OJ L 122,17.05.1991, p.42.

3 The Supply of Goods and Services Act 1982 does notattempt to define what a service is.

4 A maximum of 10 years imprisonment and/or a fine;section 92 Trade Marks Act 1994. Similar considerationsapply in respect of the copyright offences under section107 of the Copyright, Designs and Patents Act 1988,recently increased to match the trade mark offences.However, the new form of infringement bycommunicating to the public under section 107(2A) onlycarries a maximum of two years imprisonment and/or afine.

5 IBCOS Computers Ltd v Barclays Highland MercantileFinance Ltd [1994] FSR 275.

6 §1204 also imposed criminal liability for any violationof the protection afforded to electronic rightsmanagement information under §1202.

7 See, for example, Seville, C. ‘Current Developments –European Union Law’, (2004) International andComparative Law Quarterly, Vol 53(2), p.487.

8 New York Times, 18 July 2001.

9 No CV-01-2669 (D NJ 6 June 2001).

10 The wording of section 296ZD is not as clear as itmight be and it is arguable that the acts of manufacture,import or distribution do not have to be for the purposeof sale or hire. However, application of the esjudemgeneris rule might overcome that ambiguity.

11 Bainbridge, D I, ‘Copyright in Relation to ElectronicPublishing in the Humanities’, in Kenna, S. & Ross, S.(eds.) Networking in the Humanities, (London: BowkerSaur, 1995) pp.173-190.

12 Inserted by the Copyright (Visually Impaired Persons)Act 2002, which came into force on 31 October 2003.

mailto:[email protected]

using technology to protect copyright works

Documents