Section 702 of the Foreign Intelligence Surveillance Act (FISA): Its Illegal and Unconstitutional

Minnesota Legislators Go Crazy, Pushing Dangerous PRINCE Act

ust a few weeks after his death, some Minnesota legislators are using Prince’s name to ram through a dangerous publicity rights law that will give his heirs – and the heirs of any other Minnesotan – broad and indefinite rights to shut down all kind of legitimate speech and activities in perpetuity.

Defenders of the law will insist that there’s nothing to see here. After all, publicity rights laws aren’t new. The right of publicity is a recent offshoot of privacy law that gives a (human) person the right to limit the public use of her name, likeness and/or identity for commercial purposes like an advertisement. The original idea makes sense: using someone's face to sell soap or gum, for example, might be embarrassing for that person and she should have the right to prevent it.

But states have expanded the law well beyond its original boundaries. For example, the right was once understood to be limited to a person’s name and likeness, but now it can mean just about anything that “evokes” a person’s identity, such as a phrase associated with a celebrity (like “Here’s Johnny,”) or even a cartoonish robot dressed like a celebrity. And in some states, your heirs can invoke the right long after you are dead and, presumably, in no position to be embarrassed by any sordid commercial associations. In other words, it’s become a money-making machine that can be targeted at all kinds of activities.

What is worse, some courts have abandoned traditional tests that helped make sure that publicity rights claims couldn’t be used to shut down legitimate speech that happened to refer to a celebrity or use her likeness in reasonable ways (in biopics, for example).

Publicity rights are an increasingly dangerous weapon against legitimate speech. But this rushed Minnesota proposal is the worst we’ve seen so far. For one thing, rather than setting a maximum term, it actually sets a minimum term (50 years) and will allow an estate to keep asserting the right to control uses of a celebrity’s name and likeness forever, unless and until someone can prove that they’ve abandoned it. As a practical matter, that means heirs could use this right to control many uses of a work created by a celebrity even after the copyright has long since expired. Suppose that when Prince’s works finally enter the public domain in 2086, a group of fans wants to throw a benefit concert featuring Prince songs. Under copyright law, that would be fine. But under the proposed Minnesota law, they couldn’t use Prince’s name.

The proposed bill would also allow a celebrity’s estate to seek more than financial compensation: it can also get a court order taking content offline. In the internet context, this kind of seizure almost always sweeps up perfectly legitimate speech – it is difficult to “seize” just part of a website.

There are a lot of other problems with the bill, such as vague and limited protections for fair uses (watch out, fan sites!), and a misguided characterization of the right of publicity as a “property” right. As we’ve seen with copyrights and trademarks, treating limited monopolies in certain expression as a "property" leads people to embrace broad and dangerous new forms of protection for that "property."

This is a bad idea, badly executed. We disagreed with Prince on copyright issues more than once, but there's no question that he was a musical genius that deserves to be widely celebrated. We hate to see his passing used an excuse to manufacture yet another legal club against such celebrations. Minnesotans, act now to tell your legislators that this is going much too fast.

What You Won't Find in the U.S. Special 301 Report

Every year, the United States publishes a report on countries that, in the opinion of the U.S. Trade Representative (USTR), fail to give “adequate and effective” protection to U.S. holders of intellectual property rights. This Special 301 Report names and shames nations that do not meet a vague and impossibly high standard of IP enforcement, and implies that the U.S. and its trade partners should punish them for failing to enact more draconian copyright, patent, and trademark restrictions. The Special 301 Report is the result of an opaque process that directly manifests the desires of private industry, like Hollywood studios. It is used as a bullying tactic to push countries into adopting stronger IP laws, regardless of whether such laws are in the best interests of the citizens of that country.

But the Special 301 Report fails to tell the whole story about copyright across the modern online world. It doesn’t talk about the damage that restrictive copyright can do to artists and researchers in the digital era. It ignores how innovators have benefited from a more balanced enforcement system and generous exceptions—most famously in the United States itself.

On the Web, the error code 404 shows browsers that something is missing. EFF believes that in the Internet era, the Special 301 Report is missing real stories from the countries that the Special 301 condemns. Our intention for this report is to show what’s missing from Special 301 and give some balance to the USTR’s biased review of global intellectual property laws by highlighting the arguments for balanced copyright, patent, and trademark law worldwide.

EFF’s Special 404 Report includes a selection of case studies from across the globe showing how overly broad intellectual property laws stifle access to cultural artifacts, artistry, and innovation. Our report also showcases examples in which flexible fair use interpretations have benefited the community, culture, and economy of a country. This report is not an exhaustive analysis of each country listed in the Special 301 Report. Rather, our report is designed to provide insightful case studies that will inform a larger conversation about how the USTR’s report is fundamentally defective.

Our report concludes by outlining some of the flaws of the Special 301 Report, including issues around transparency, balance, and legality.

Many people look to the USTR’s Special 301 Report when analyzing business relationships in a new country or when analyzing the intellectual property laws of a country for other purposes. Our report is designed as a counterpoint—ensuring that the one-sided narrative of the USTR is challenged with examples that prioritize access to culture and new forms of innovation over the financial interests of a handful of U.S. corporate rights holders.

Stakes Are High in Oracle v. Google, But the Public Has Already Lost Big

Attorneys for the Oracle and Google companies presented opening statements this week in a high-stakes copyright case about the use of application-programming interfaces, or APIs. As Oracle eagerly noted, there are potentially billions of dollars on the line; accordingly, each side has brought “world-class attorneys,” as Judge William Alsup noted to the jury. And while each company would prefer to spend their money elsewhere, these are businesses that can afford to spend years and untold resources in the courtroom.

Unfortunately, the same can’t be said for the overwhelming majority of developers in the computer industry, whether they’re hobbyist free software creators or even large companies. Regardless of the outcome of this fair use case, the fact that it proceeded to this stage at all casts a long legal shadow over the entire world of software development.

At issue is Google’s use in its Android mobile operating system of Java API labels—a category of code Google (and EFF) previously argued was not eligible for copyright. Judge Alsup, who demonstrated some proficiency with programming Java in the first leg of the case, came to the same conclusion. But then the Federal Circuit reversed that position two years ago, and when the Supreme Court declined to hear the issue, there was nowhere left to appeal. With this new decision on copyrightability handed down from above, Google and Oracle now proceed to litigate the question of whether Android’s inclusion of the labels is a fair use.

If Google wins at this stage, it’s tempting to declare the nightmare of that Federal Circuit opinion behind us. After all, fair use is a right—and even if API labels are subject to copyright restrictions, those restrictions are not absolute. Google prevailing on fair use grounds would set a good precedent for the next developer of API-compatible software to argue that their use too is fair.

Tempting, but not quite right. After all, there is a real cost to defending fair use. It takes time, money, lawyers, and thanks to the outrageous penalties associated with copyright infringement, comes with a substantial risk. Beyond all those known costs, wedging a layer of copyright permissions culture into API compatibility comes with serious unknowable costs, too: how many developers will abandon ideas for competitive software because the legal risks are too great?

There’s a reason people say that if you love fair use, you should give it a day off once in a while. Even the vital doctrine of fair use shouldn’t be the only outlet for free speech. In many areas, an absence of copyright, or the use of permissive public licenses, can foster more creativity than fair use alone could. Sadly for now, in the world of software development it’s the paradigm we have.

An Open Letter to Members of the W3C Advisory Committee

Dear member of the World Wide Web Consortium's Advisory Committee,

You may have heard that over the past year we've been trying to insert legal safeguards into the Encrypted Media Extensions project at the W3C, which standardizes streaming video DRM. We've previously been opposed to the W3C adopting EME, because of the legal issues around DRM, and  because DRM requires user agents to obey third parties, rather than their owners.

However, we think that there's a compromise that both DRM advocates and opponents should be able to live with.

I'm writing today to see if you will support us in an upcoming W3C vote on the charter of the Media Extensions Group, where we will be proposing this compromise.

This letter briefly describes briefly the problem, our proposed solution, and what you can do to help.

The Problem

Our major problem with DRM is legal, not technical. In the USA, section 1201 of the Digital Millennium Copyright Act (DMCA) forbids breaking DRM, even for lawful purposes, and gives companies the legal tools to threaten and silence security researchers who discover defects in their products (because disclosure of a defect might help people break the DRM).

Neither of these legal effects are good for open standards (you don't have to take our word for it).

Giving vendors the power to silence security researchers doesn't make users safer -- it just makes vulns last longer in the wild, exploitable by bad guys (from autocratic state security services to organized crime).

Equally significant in the world of open standards is protecting interoperability. The normal course of things in technology is that one company may make a product that interoperates with another company's products, provided that they don't violate a patent or engage in some other illegal conduct. But once DRM is in the mix, interoperability is only legal with permission.

Here's an example: if the W3C defines a data-type, anyone can make a user-agent that can receive and render that data. The people designing user agents might do things that the people running the servers disapprove of (for example, blocking pop-up ads), but that's not illegal -- so long as you don't break the law, the company serving the data can't dictate how the companies making the clients must handle it.

With EME, and for the first time in W3C history, a protocol is being designed explicitly to allow companies who serve data to use the law to shut down companies that render it, even if they do not infringe copyright. Features as simple as a pause button, or time-shifting, or even changing the gamut to adapt to color blindness can't be undertaken without permission from the companies serving the video, without falling afoul of the DMCA.

Not just the DMCA, either. The US Trade Representative has made adopting DMCA-like anticircumvention rules a condition of trade with the USA in most of the world.

Our Solution

We've proposed a simple solution, patterned after the existing W3C patent policy. The patent policy doesn't take a position on whether patents are good or bad, but it does hold that standards are more open if you don't have to license a patent to implement them, so W3C members are required to promise not to sue others for practicing their patents when implementing W3C recommendations.

Our proposal does the same thing, except for anti-circumvention rights (rather than patents). Members who participate in the Media Extensions Working Group will have to make a legally binding promise not to use anti-circumvention laws to aggress against security researchers or implementers.

All other rights and causes of action -- trade secrecy, copyright, tortious interference, breach of contract -- are intact. We did a survey of US case-law on anti-circumvention and all the cases in our survey could have proceeded even if the private plaintiff was a party to our covenant -- so we're not proposing to take away any of the legal rights businesses are depending on for legitimate business, only for threats and chilling effects.

What We Want From You

The Media Extensions Working Group has had its charter renewed until September, and it's unlikely that EME will be ready to be a recommendation by then. The last charter renewal was controversial, with a diverse group of members objecting to the renewal unless the covenant was made a condition of participation.

For the next extension, we're building a coalition of W3C members who will ask that the charter only be renewed with a mutually agreed-upon covenant as an exit condition.

Will your organization commit to objecting to the renewal in September, unless a nonaggression covenant is added as an exit-condition?

Defend your rights in the digital world

Once upon a time, there were two major browsers that virtually everyone used: Netscape and Internet Explorer, locked in a death-battle for the future of the Web. They went to enormous lengths to tempt Web publishers to optimize their sites to work best inside their windows, and hoped that users would follow.

Then, a game-changer: the open, nonprofit Mozilla browser spun out of Netscape, with the mission of putting users, not publishers, in charge. Mozilla defaulted to blocking pop-up ads, the scourge of the early Web. It was a step none of the major browsers could afford to take, because publishers were convinced they would go broke without them, and any company whose browser blocked pop-ups by default would alienate the publishers, who'd throw their lot in with the competition.

A little over a decade later, and the world of browsers is unrecognizable: Mozilla turned into Firefox; Internet Explorer turned into Edge, Apple launched Safari, and Google launched Chrome. Every one of them blocks pop-ups by default! Literally none of the dominant browsers from a decade ago are in widespread use today.

Which is not to say that there isn't competition. There is, and its as fierce as ever, and as ever, it's a strategic fight to please both publishers and users, whose interests are not always the same. Publishers want to gather more information on users; users want to keep their information private. Publishers want to control users' browsing and viewing experience; users want to sit in the driver's seat.

We need competition; we also need diversity. We need the possibility that young, game-changing market entrants might come along. We need that idea to be kept alive, to make sure that all the browsers don't shift from keeping users happy to just keeping a few giant corporations that dominate the Web happy. Because there's always pressure to do that, and if all the browsers end up playing that same old game, the users will always lose.

We need more Firefoxes.

We need more browsers that treat their users, rather than publishers, as their customers. It's the natural cycle of concentration-disruption-renewal that has kept the Web vibrant for nearly 20 years (eons, in web-years).

We may never get another one, though.

The World Wide Web Consortium (W3C), once the force for open standards that kept browsers from locking publishers to their proprietary capabilities, has changed its mission. Since 2013, the organization has provided a forum where today's dominant browser companies and the dominant entertainment companies can collaborate on a system to let our browsers control our behavior, rather than the other way.

This system, "Encrypted Media Extensions" (EME) uses standards-defined code to funnel video into a proprietary container called a "Content Decryption Module." For a new browser to support this new video streaming standard -- which major studios and cable operators are pushing for -- it would have to convince those entertainment companies or one of their partners to let them have a CDM, or this part of the "open" Web would not display in their new browser.

This is the opposite of every W3C standard to date: once, all you needed to do to render content sent by a server was follow the standard, not get permission. If browsers had needed permission to render a page at the launch of Mozilla, the publishers would have frozen out this new, pop-up-blocking upstart. Kiss Firefox goodbye, in other words.

The W3C didn't have to do this. No copyright law says that making a video gives you the right to tell people who legally watch it how they must configure their equipment. But because of the design of EME, copyright holders will be able to use the law to shut down any new browser that tries to render the video without their permission.

That's because EME is designed to trigger liability under section 1201 of the Digital Millennium Copyright Act (DMCA), which says that removing a digital lock that controls access to a copyrighted work without permission is an offense, even if the person removing the lock has the right to the content it restricts. In other words, once a video is sent with EME, a new company that unlocks it for its users can be sued, even if the users do nothing illegal with that video.

We proposed that the W3C could protect new browsers by making their members promise not to use the DMCA to attack new entrants in the market, an idea supported by a diverse group of W3C members, but the W3C executive overruled us saying the work would go forward with no safeguards for future competition.

It's even worse than at first glance. The DMCA isn't limited to the USA: the US Trade Representative has spread DMCA-like rules to virtually every country that does business with America. Worse still: the DMCA is also routinely used by companies to threaten and silence security researchers who reveal embarrassing defects in their products. The W3C also declined to require its members to protect security researchers who discover flaws in EME, leaving every Web user vulnerable to vulnerabilities whose disclosure can only safely take place if the affected company decides to permit it.

The W3C needs credibility with people who care about the open Web and innovation in order to be viable. They are sensitive to this kind of criticism. We empathize. There are lots of good people working there, people who genuinely, passionately want the Web to stay open to everyone, and to be safe for its users. But the organization made a terrible decision when it opted to provide a home for EME, and an even worse one when it overruled its own members and declined protection for security research and new competitors.

It needs to hear from you now. Please share this post, and spread the word. Help the W3C be the organization it is meant to be.