Ed Felton v. RIAA Fredrik Lundberg Matt Gong Sung Noh

Introduction n Ed Felton is an Associate Professor of Computer Science at Princeton University

The Contest n n Ed Felten and his team of researchers accepted a public challenge by the Secure Digital Music Initiative (SDMI) to break new watermark technologies. n n Verance developed these watermark technologies used for copyrighting music. n n Ed Felton successfully cracked the code but instead of collecting the prize money from the contest, he decided to publish the bug in a paper at a Pittsburgh conference.

The Threats n n Ed Felton was threatened by SDMI and the Recording Industry Association of America (RIAA) to keep silent or face litigation under the Digital Millennium Copyright Act (DMCA). n n The threats stated that Ed Felton violated the anti- circumvention provisions of the DMCA. n n Ed Felton decided not to publish the paper at the Pittsburgh conference.

The Publication n Later the RIAA and SDMI claim they had no intention of suing Ed Felton n Still, Ed Felton filed a lawsuit asking a federal court to rule that the publication of the paper, and future papers, would be legal n The case was dismissed by the federal court because it was perceived as conjectural or hypothetical, since the RIAA stated they had “no objection whatsoever”. n Ed Felton finally published the paper at the Usenix Security Conference.

Timeline n n September, 2000: SDMI Challenge introduced n n November 8, 2000: Ed Felton successfully breaks code and intends to publish paper n n April 9, 2001: RIAA/SDMI Legally threats Ed Felton n n April 26, 2001: Ed Felton publicly announces not to publish paper. n n May 3, 2001: RIAA/SDMI claim they never intended to sue n n June 6, 2001: Ed Felton files lawsuit against RIAA/SDMI n n July 12, 2001: The case is dismissed by the court n n August 15, 2001: Paper is published

Stakeholders n RIAA – Record Industry Association of America n Academics – professors, students, etc. n Musicians n Verance and other watermark companies n Music Listeners –Legitimate Buyers –Those who illegally copy

Getting More Abstract n Ed Felton v. RIAA is a specific case of Freedom of Speech v. copyright laws and a company’s rights n It can be reduced to the conflict between a discloser (I.e. Ed Felton) and a company (I.e. RIAA/SDMI)

Company’s Arguments n Protecting the Customers –The publication of the bug will most likely cause an increase in illegal distribution of music –Musicians will be upset that their music is not being purchased –Music listeners will not buy music anymore, and the ones that do will be upset that others are getting music for free. –Verance’s watermark technology devalued

Company’s Arguments n Protection of Intellectual Property –Copyrights protect musician’s rights n Illegal copying devalues music –Copyrights preserve the progress of science and art (I.e. Music) n Preserving the innovative spirit that drives creation of music

Company’s Arguments n Protection of Reputation –Reputation may be damaged by flaws being known to the public n Criticism may aid in providing fixes for bugs, but may allow customers to lose trust in the company –Company desires security by obscurity n Phase II products will replace Phase I products

Company’s Arguments n Watermark technology already in use –(I.e. DVD-Audio, SDMI Phase I products) n Ed Felton was violating the “spirit and terms” of the “Click-Through Agreement” n Ed Felton misinterpreted the conflict - –the conflict is between two competing group of scientists (I.e. Verance and Ed Felton)

Discloser’s Arguments n Protecting the Users –Inform the users about problems The users has the right to know about problems and decide if it is ok to use the program or not. It is not more than fair to know about a programs shortcomings before buying it.

Discloser’s Arguments n protecting the users –Put pressure on manufacturer Letting the public know about the problem gives the manufacturer a greater incentive to solve the problem.

Discloser’s Arguments n Protection of intellectual properties value –The product we buy is not only a program When we buys a program we buy more than just a cd, we expect updates and service such as updates. We also pay more for a reliable product from a company that we trust. Announcing known problem can increase our trust and confidence in the company. Good service can be a strong marketing argument.

Discloser’s Arguments n Protection of reputation –Will hiding problem improve or decrease a company's reputation? Instead of lower the company’s reputation a policy characterized by openness might be considered an advantage and increase the company’s reputation.

Discloser’s Arguments n Different program owners –Is there a different conflict if the program is open source compared to owned by a company?

Laws n Copyright Act & DMCA –Intended to restore the balance between users and copyright holders New technology changed the balance between required effort quality of the copies. The new laws were supposed to restore the balance but some argue they did more than just restore the old balance

Laws n Result from DMCA –Less research n Some researchers has not published their findings n Some conferences has been held in other countries –Less fair use n Some techniques used to protect the copyright has stopped the user from some usages traditionally considered to be fair use.

Laws n Ed Felten vs RIAA case –Ed feltens team participated in open challenge –The participants were encouraged to ‘crack’ the watermark schemes –They did not promise to keep their findings secret –RIAA attempts to stop the paper from publication

Laws n Ed Felten vs RIAA case –Felten & team asks court to declare it legal for them to publish the paper without fearing legal consequences –Never settled in court, RIAA declare that they will not take legal actions –In their declaration RIAA says that they consider reviews to be necessary

Ethical Issues n Is publishing a bug in a company’s code acceptable if it is for research and academics? n What is the right thing to do if we break code? –Release to the public –Contact the company – What if they do not fix it? –Fix it yourself – What if you are not allowed to? n Can publishing a bug be illegal yet ethical? –Example: A bug is dangerous to the public, it would be ethical to publish it

Ethical Issues n Is the discloser (I.e. Ed Felton) liable for the damages caused by the publication? n Does the fact that the RIAA was holding a contest to break their code a factor?

Ethical Issues n Are there potential damages to the public if it were illegal to publish bugs? –Bugs never get fixed –Technology not properly verified n The Future: How will the outcome of this conflict affect everyone? –Transparent Society? Higher level of confidence?

Conclusion n There is no easy answer – someone will be damaged no matter what we do n Fair use v.s. strong copyright law –Copyright owners have a stronger position by law n We must be able to preserve copyrights but still give room for research and academics.

References n ACM Submits Declaration in Felten v. RIAA – ml mlhttp:// ml n Electric Frontier Foundation – n Slashdot – n Public Right To Know Conference 2001 – n Science Online –