, like many other broadcasters, (co)produces or acquires a variety of television shows through various licensing agreements. During my internship at TVO, I learned about the behind the scenes work that goes into making and acquiring the TVO shows and content that Ontarians love. I specifically learned about Canadian Content (“CanCon”). For viewers, CanCon is likely a background issue, but for broadcasters, it is an important fact of business. CanCon refers to content that is produced in Canada by Canadians. Canadian Radio-Television and Telecommunications Commission licenses and production funding (like the Canadian Media Fund) are often dependent on establishing where the content is produced. Working at TVO brought this illusory issue to light for me, which as a viewer I never really considered.

Under the supervision of the general counsel, I reviewed various co-production and acquisition contracts and had the experience to draft several of my own. I learned about the importance of interdepartmental cooperation and coordination to ensure relevant departments know what their contracts entail and to be surveyed for changes. Through this consultation process, user experience should be emphasized. If personnel within the organization cannot understand what their contract says what hope do others have?

Working in-house, there was a significant emphasis on the need for lay-language in contracts. Generally, lay language improves contract readability and minimizes risks by ensuring that both parties understand the specific rights of the contract. Lay language is especially important for “template” or “precedent” contracts that are often relied upon and reused by organizations. Often it is impracticable to draft each and every contract from scratch because of the unnecessary consumption of time and resources. When dealing with repeat similar issues, a general bank of clauses is important to expedite and simplify contract drafting. A template with a generic set of rights ensures consistency of interactions with producers, rights obtained, and minimizes the need for extraneous involvement of legal counsel. Moreover, issue spotting can become simplified with the use of templates. If one contract highlights issues with a clause, one can reasonably assume that it will be an issue with others and the organization can prepare a response or modify the contract to resolve the issue for future contracts.

Interestingly, TVO was not all that I anticipated or remembered – it was not the simple public broadcaster I remembered from my childhood. TVO, like the entertainment industry in general, is ever-changing. The ability to watch videos on handheld devices was a pipe dream 50 years ago, but it is now commonplace. New contracts emphasize the importance of digital media through videos on demand (VODs) and streaming, in addition to traditional interpretations of broadcast right through cable television. TVO now boasts several Youtube channels that host its content in addition to TVO hosting content on its own website.

Beyond the familiar polka dot door of television content, TVO also offers digital education content. TVO’s digital education portfolio includes the Independent Learning Centre (distance learning for high school students), Mathify (student-to-teacher video mentoring), and mPower (math-focused games for children in elementary school). My time at TVO taught me the importance for public broadcasters and government organizations to adapt to new technologies to stay relevant.

Written by Christopher Tsuji, Osgoode JD Candidate, enrolled in Professors D’Agostino and Vaver 2019/2020 IP & Technology Law Intensive Program at Osgoode Hall Law School. As part of the program requirements, students were asked to write a reflective blog on their internship experience.

The post TVO, Not Your Average Broadcaster appeared first on IPOsgoode.

In 2012, Parliament amended the and updated it to address the realities of the new internet environment and new technologies. Among the changes was the introduction of technological protection measures (TPMs), sometimes known as digital rights management (DRMs). The defines TPMs as “any effective technology, device or component that, in the ordinary course of its operation… controls access…or…restricts access.”[1] In some instances, TPMs may be a copyright-protected work itself – a computer program, which is the focus of this post. I argue that the ’s narrow exceptions for TPM circumvention are detrimental for both privacy and copyright and propose a new “bug hunt” exception.

 The Act’s TPM Exceptions

The recognizes for circumventing TPMs:

(1) to permit law enforcement to circumvent TPMs if related to the “enforcement of any Act of Parliament.”[2] This carves out a wide scope for the state in the context of criminal investigations to access information on electronic devices, such as phones or computers, and also raises significant privacy concerns.[3]

(2) to permit the interoperability of computer programs, where the user has a licence.[4]

(3) to allow for encryption research, where the copyright owner has consented.[5]

(4) to prevent the collection or dissemination of personal information.[6]

(5) to allow for security testing on a computer or a network, where the hardware owner has provided consent.[7]

The last three exceptions discuss the importance of research, privacy, and security but offer imperfect protections for parties who wish to research security matters without the owner’s consent.

Hacking & Bug Bounties

Despite the bad publicity surrounding hacking, it is not always a cloak and dagger endeavour done for personal gain or out of malice. Some hackers (called white hat hackers) engage in security testing, often unbeknownst to the developers they test, and notify organizations of security flaws that they identify. Technology organizations like Google and Facebook, and even the Pentagon, recognize the valuable work that white hat hackers do and reward them through .[8] A bug bounty is a cash bounty awarded to individuals who bypass TPMs or DRMs and alert organizations of their security flaws – effectively crowdsourcing security testing. In addition to cash, hackers receive notoriety in the community and sometimes recognition by the organizations they test. Many organizations benefit from white hat hackers, who may have the consent of the organizations they hack; however, not all organizations may offer their consent. White hat hackers may be discouraged from hacking these organizations or alerting them of security flaws because they fear legal reprisal.

The Bug Hunt Exception

The existing TPM specific exceptions are of little use to white hat hackers who hack without authorization. Unauthorized hacks may be more advantageous than authorized ones; a thief rarely tells their victims that they will steal from them in advance. A bug hunt exception would mitigate some of the uneasiness that white hat hackers may have with hacking organizations and protect them from liability. Reliance on broad defences of fair dealing and public interest may produce uncertain results. An Ontario court perplexingly found that circumventing a TPM (a paywall) to rectify factual errors in a news article and sharing it did not fall within an education fair dealing exception. Conversely, the Federal Court found that a similar scenario would fall within the research exception.[9] Bug hunting, at its core, is about rectifying factual issues – faulty computer code. A bug hunt exception would also accord with the Act’s other exceptions for TPM circumvention with research, privacy, and security. Of course, a necessary precondition for immunity would be the hacker’s lack of criminal intent to abuse or withhold security vulnerabilities.

Conclusion

A bug hunt exception for hacking TPMs is advantageous for everyone. From a copyright perspective, it alerts owners to vulnerabilities in their program and gives them a chance to improve their work without consequence. For users, it improves the end product that they licence from programmers. In a privacy sense, bug hunts improve privacy because it creates an option for white hat hackers to inform owners of security flaws before they are taken advantage of by hackers with more nefarious intent (black hat hackers). One can wonder whether the , and others like it, could have been avoided if there was a bug bounty program (like it has now) or a bug hunt exception that insulated and incentivized white hat hackers to come forward with security flaws.[10]

Written by Christopher Tsuji, Osgoode JD Candidate, enrolled in Professors D’Agostino and Vaver 2019/2020 IP & Technology Law Intensive Program at Osgoode Hall Law School. As part of the course requirements, students were asked to write a blog on a topic of their choice.

[1] Copyright Act, RSC 1985, c C-42, s.41 [Act].  

[2] Ibid, s.41.11.  

[3] See general evidentiary rules of admissibility concerning seized and accessed cell phones during criminal investigations with R. v. Artis, 2016 ONSC 2050; R v. Marakah, 2017 SCC 59. See also jurisprudence surrounding s.8 of the Charter, unreasonable search and seizure.  

[4] Act, supra note 1 s.41.12.  

[5] Ibid s.41.13.  

[6] Ibid s.41.14.  

[7] Ibid s.41.15.  

[8] See Google “Google Vulnerability Reward Program Rules” online at: https://www.google.com/about/appsecurity/reward-program/; see also Facebook “Facebook White Hat Information” online at: https://www.facebook.com/whitehat; see also the Department of Defense “Department of Defense Expands ‘Hack the Pentagon ‘ Crowdsourced Digital Defence Program” published October 24 2018, online at: https://www.defense.gov/Newsroom/Releases/Release/Article/1671231/department-of-defense-expands-hack-the-pentagon-crowdsourced-digital-defense-pr/  

[9] Compare the unsuccessful facts of fair dealing in 1395804 Ontario Limited (Blacklock’s Reporter) v Canadian Vintners Association, 2015 CanLII 65885 (ON SCSM) with the successful facts of 1395804 Ontario Ltd. (Blacklock's Reporter) v. Canada (Attorney General), [2017] 2 FCR 256, 2016 FC 1255 (CanLII).  

[10] See Braga, Matthew “100,000 Canadian Victims: What We Know About the Equifax Breach – and What We Don’t” CBC News, published September 19, 2017 online at: https://www.cbc.ca/news/technology/equifax-canada-breach-sin-cybersecurity-what-we-know-1.4297532 and HackerOne, “Equifax Vulnerability Disclosure Program Policy” published July 9, 2019 online at: https://hackerone.com/equifax/  

The post Breaking the Lock: A Proposed ‘Bug Hunt’ Exception for TPMs appeared first on IPOsgoode.