Microsoft's war waged with FairUse4WM

Legal analysis courtesy of Scott McMillan, Zachary Sharpe, and Trevor Adler of The Columbia Science and Technology Law Review.

The press and blogosphere have recently been abuzz over programs that remove copyright protections technologies known as Digital Rights Management (DRM) from purchased or rented media files. These DRMs restrict a consumer's use of the media – morality notwithstanding, they are the only thing preventing you from copying your music or video files onto all of your friends' computers. DRM-stripping programs remove such restrictions from the file (and typically violate your terms of service agreement, to say the least). In September, Microsoft filed suit against the hacker(s) responsible for one such DRM-stripping program, FairUse4WM, purportedly created by the now notorious Viodentia. Other such programs reportedly target the DRM protections of the iTunes Music Store and AllOfMP3, among others. What will become of Microsoft's lawsuit? What does this have to do with "fair use" and the Digital Millennium Copyright Act (DMCA)? What follows is a brief overview in two parts. In the first, we'll discuss current issues surrounding fair use with regard to the DMCA, and in the second we'll approach Microsoft's legal actions against Viodentia for FairUse4WM.

What fair use is, and how it works alongside the DMCA

"Fair use" is a doctrine under US copyright law that permits certain acts that might otherwise be considered copyright infringement. Copyright law gives authors the right to exclude others from their work, and can sometimes get in the way of the ultimate goal of copyright, which is to promote progress in art and science. The theory here is that without copyright protections, many artists and authors would be discouraged from distributing their work. The fair use exception allows copyright protections to remain in place while enabling consumers some degree of freedom in their use of purchased media. For example, it was generally understood that ripping CDs for personal use was legal because it fell under the fair use exception. However, fair use was dealt a serious blow with the enactment of the DMCA in 1998 and the widespread use of DRM protections. Indeed, fair use is not a defense to a DMCA claim.

The DMCA specifically prevents someone from "circumvent[ing] a technological measure that effectively controls access to [copyrighted works]" without permission from the copyright owner (17 U.S.C.A. § 1201(a)(1)(A) & (3)(A)). It also prohibits a person from, among other things, making such a tool or offering it to the public (17 U.S.C.A. § 1201(b)(1)). This provision has given content providers the power to take legal action against virtually anyone who tampers with their DRM protections, even those who would have otherwise been protected under the fair use doctrine -- often times consumers like you.

A prime example of how courts have used this DMCA provision to strike down a DRM-removing technology involves DeCSS. As you might know, DeCSS removes the DVD content protection, or Content Scrambling System (CSS), essentially enabling anyone with a computer and a little know-how to rip DVDs. In the frequently cited case of Universal City Studios v. Corley 273 F.3d, 429 (2d Cir. 2001), the Second Circuit Court of Appeals affirmed a district court's ruling that barred Eric Corley -- aka Emmanuel Goldstein, publisher of the infamous 2600 hacker quarterly -- from making DeCSS available for download on 2600.com, or posting links to other websites offering the program for download. Among other things, the court rejected the idea that DeCSS could be protected under the fair use doctrine, reasoning that fair use is concerned with how one uses a copyrighted work, not how someone obtains the work in the first place. Thus, the court concluded that the right to view a DVD does not create a right to decrypt the DVD.

Because the DMCA doesn't distinguish between types of media involved or how protections are circumvented, the Corley case will most likely play a role in any future legal battle over DRM-stripping software. So far as FairUse4WM is concerned, the fair use doctrine would appear not give Viodentia (or users or distributors of the program) any protection against alleged DMCA violations, and FairUse4WM could suffer the same defeat in a US court as DeCSS. The European Union has enacted similar legislation to the DMCA, namely the 2001 EU Copyright Directive (EUCD). But Microsoft has admitted that it doesn't know Viodentia's location and has recently initiated action with Yahoo and Google to investigate. Legal defeat, however, has not at all magically eliminated the availability of DeCSS on the web. This may give some insight as to how effective current legal relief in the US will be once internet users take hold of a desirable new technology.

Have we seen the end of fair use? Current law still leaves a little wiggle room. While programs specifically designed to circumvent copyright protections have little chance of overcoming the DMCA, manual workarounds may still be legal. For example, most downloadable music services (begrudgingly) allow users to burn audio CDs from the music they buy. Doing so also strips the files of their DRM, but because users have permission to copy to CD, this use is acceptable under the DMCA. Re-ripping the CD back into unprotected audio files for personal use is probably acceptable under fair use or by some other right (the RIAA allows copying of CDs for personal use but not because of fair use). Whether courts would view this multi-step process as DRM "circumvention" under the DMCA has yet to be seen.

So where will the line between fair and illicit use eventually be drawn? The current legal incongruity between manual DRM workarounds and blatant DRM hacks reflects the questionable post-DMCA state of the fair use doctrine. Will this be enough to encourage lawmakers and courts to rethink their position on the DMCA? Only time will tell.

Microsoft takes legal action

On September 22, Microsoft filed a complaint against "John Does 1-10, a/k/a 'Viodentia'," alleging that Viodentia created and distributed software, FairUse4WM, that incorporates code from Microsoft's Windows Media Format SDK v. 9.5. Microsoft argues that Viodentia should therefore be held liable for copyright infringement. Filing an action against a John Doe is somewhat tricky in the American legal system; we have an adversarial legal system, and when you file against a John Doe, you're suing somebody whose identity you don't know and who's therefore not represented in court. One of the first steps, then, when suing a John Doe is to find out just exactly who you're suing. This is done through a third party discovery motion, which needs to be approved by the court. Accordingly, Microsoft filed a Motion for Leave to Conduct Third Party Discovery on September 26.

In granting the motion for third party discovery to identify Viodentia, Judge John Coughenour set explicit limits on who can be subpoenaed and what can be requested. Judge Coughenour allowed discovery against two named e-mail providers, Yahoo! and Google. Microsoft may only look for information that is reasonably likely to lead them to identify the user of the targeted IP address(es). Judge Coughenour also authorized a limited second level of discovery that works as follows: if Microsoft's Google and Yahoo! discovery uncovers an IP address relevant to the identification of Viodentia, Microsoft is permitted to issue subpoenas to the ISP that operates or issued that IP address in order to determine the identity of the user.

If Microsoft is unable to procure useful information from Google or Yahoo!, or if they run into a dead end at the ISP level, it will need to find some other means of identifying Viodentia. To expand the scope of its search, Microsoft would need to seek and receive further permission from the court. The present order gives Microsoft only 120 days to discover Viodentia's identity. Although Microsoft can seek a time extension, if it cannot name an actual person in its suit before Judge Coughenour's patience wears out, the case will likely be thrown out.

If Microsoft does identify Viodentia, the case can proceed. This would entail service of process and would involve thorny jurisdictional questions if Viodentia does not reside in or have sufficient ties to the US. In that case, even if the infringing acts alleged in the lawsuit occurred in the US, unless Viodentia can be prevailed upon to come to the US and be properly served, the case would likely be dismissed on grounds of forum non conveniens (inconvenient forum).

The critical importance of the subpoena power to Microsoft's case against Viodentia explains the otherwise-mysterious question of why Microsoft has filed a suit for copyright infringement rather than for circumvention of DRM. The subpoena power is a little-noticed feature that the DMCA added to copyright law. In the old days, ISPs often refused to disclose the identities of their users. Then along came the DMCA's 17 U.S.C. 512(h)(1), which enables a content owner to subpoena an ISP and demand user identities. This is crucial because ultimately, it is the only way to maintain a lawsuit and force a user like Viodentia to stop. But here's the problem: 512(h)(1) applies only to copyright violation and not to DRM circumvention. If it were only a matter of hacking WM, Microsoft would not be able to use a subpoena to identify Viodentia. Therefore, Microsoft must claim copyright infringement, whether or not that actually is the case.

In the meantime, Microsoft is issuing cease-and-desist letters to websites hosting FairUse4WM, alleging the same copyright infringement as alleged against Viodentia. It remains to be seen if Microsoft will attempt to advance its copyright argument against these websites by filing suit, or whether it will focus its efforts on Viodentia. Since websites hosting FairUse4WM cannot hide behind the fair use doctrine as noted above, those that are within Microsoft's legal reach will likely heed Microsoft's threats rather than be ensnarled in a costly legal battle. However, it is important to note that legal defeat has not magically eliminated the availability of similar DRM-stripping programs like DeCSS on the web. This may give some insight as to how effective current legal relief in the US and abroad will be once internet users take hold of a desirable new technology.

Is all of this still relevant if Microsoft intends to turn its back on PlaysForSure? Absolutely. Zune or no Zune, PlaysForSure is supposed to live on for its current partners. What's more, Microsoft's case against Viodentia will likely establish important legal precedent for actions against the creators of other current and future DRM-stripping programs. If you thought Microsoft's lawyers were scary, wait until you see Apple's.

FairUse4WM followup

We've received scattered reports that the final version of Windows Media Player 11 "fixes" FairUse4WM by not recovering the previous, broken keys; 11 now apparently AES encrypts keys, but fortunately that too has apparently been circumvented -- though not by Viodentia. Windows Media Player 10 users are still unaffected, and can technically feasibly continue use of the application, still at version 1.3. -Ed.

This piece by the STLR Engadget Team was led by Columbia STLR contributors Scott McMillan, Zachary Sharpe, and Trevor Adler.