One of the federal government’s main stated objectives in enacting Bill C-32, the Copyright Modernization Act,[1] is to implement the rights and protections for authors, performers and sound recording makers found in the WIPO Internet Treaties[2].[3] Bill C-32 would amend the Canadian Copyright Act in several significant ways pursuant to the obligations set out in the WIPO Internet Treaties, which Canada signed in December 1997. Of these amendments, the aspect of implementing the treaties into Canadian copyright law that has attracted the most attention from commentators since the Bill’s tabling in June has been the contracting parties’ obligation to implement legal protection for technological measures.[4]

The argument is sometimes made that legal protection for TPMs is unnecessary since liability should only lie with the underlying acts of infringement the devices are intended to prevent. Creating an additional cause of action for “protecting the protection”, it is said, is redundant. However, a survey of existing Canadian law regarding computer protections and encryption finds that this notion of “protecting the protection” has ample precedent in Canadian law, both in the civil and criminal contexts. For whatever reason, lawmakers in the recent past have often concluded that prohibiting the circumvention of protection technologies is an effective method of providing legal protection to the underlying data.

One of the first countries to ratify the WIPO Internet Treaties was the United States. The Digital Millennium Copyright Act (DMCA) was signed into law by President Bill Clinton on October 28, 1998, and amended the US Copyright Act to prohibit TPM circumvention. At the time of the enactment of the DMCA, circumventing a TPM (or a “digital lock”) was often analogized at Congressional hearings to breaking a physical lock. In arguing that the fair use defense allows limited copying of a work but does not grant the right to legal access to that work, the US Register of Copyrights noted:

Section 1201 [of the DMCA] has therefore been analogized to the equivalent of a law against breaking and entering. Under existing law, it is not permissible to break into a locked room in order to make fair use of a manuscript kept inside.[5]

The analogies between protection for “digital locks” and physical locks would continue in DMCA jurisprudence dealing with TPM circumvention. In 321 Studios v. MGM Studios, Inc.,[6] the respondent 321 Studios argued that due to the ubiquitous availability of the DeCSS circumvention program, the CSS encryption that it was designed to bypass could no longer effectively be called a “protection measure” under the DMCA. In rejecting this line of argument, the US District Court ruled:

321, in a footnote, questions whether CSS is an effective control or protection of DVDs, since the CSS access keys are widely available on the internet. However, this is equivalent to a claim that, since it is easy to find skeleton keys on the black market, a deadbolt is not an effective lock to a door.[7]

Interestingly, Canadian criminal law requires the commission of an indictable offense, or at least the intent to commit, in order for a defendant to be found guilty of breaking and entering.[8] However, the related offense of “Being unlawfully in a dwelling house” creates a rebuttable presumption that someone who breaks into a home had the requisite intent to commit an offense therein.[9] A similar presumption exists against anyone caught with a “break-in instrument”,[10] analogous to the prohibitions found in Bill C-32 against possession or distribution of circumvention technologies.[11]

Other criminal provisions create similar presumptions of guilt for circumventing protection devices without having to prove an underlying offense. Under the computer hacking provision of the Criminal Code, a defendant is guilty if they are found to have accessed a computer system “fraudulently and without colour of right”.[12] There is no requirement to prove that any of the computer system’s data was damages, deleted or copied; the liability is attached to the act of hacking the computer’s protection itself. Similarly, under the Criminal Code prohibition against “Theft of a telecommunication service”, the simple act of obtaining unauthorized access to a telecommunication service suffices to give rise to criminal liability.[13] There is no need to prove a disruption or other tampering with the telecommunication service. And, as with physical breaking and entering, both the computer and telecommunication hacking prohibitions also have rebuttable liabilities for possession of circumvention or hacking devices.[14]

Instances where the law protects the protection, in addition to misappropriation of protected entity itself, are also found under Canadian federal regulatory law. Under the Radiocommunication Act, the act of decrypting a network signal without authorization is an offence punishable upon summary conviction:

9. (1) No person shall (…)

(c) decode an encrypted subscription programming signal or encrypted network feed otherwise than under and in accordance with an authorization from the lawful distributor of the signal or feed;[15]

Unlike the criminal code provisions, the presumption against lawful intent for circumventing or decrypting the protective device cannot be rebutted under the Radiocommunication Act. As long as the content is decrypted without the lawful distributor’s permission, the act of decryption itself is sufficient to entail punitive liability. Similar prohibitions are found for manufacturing, importing or distributing decryption devices.[16]

As these examples show, the notion of legal protection for protection technologies finds a number of incarnations in Canadian law. The current drafting of Bill C-32 would extend this concept to protecting the devices that are increasingly relied-upon in the artistic, entertainment and software industries to safeguard their products against unauthorized access and copying. Canadian law currently defends the locks, firewalls and encryptions we use to protect our homes, computers and broadcast signals (as well as outlawing the devices used to circumvent these protections). There is no reason why we ought not to extend this logic to devices used to protect our valuable creative works as well.

[2] The pair of treaties commonly referred to as the “WIPO Internet Treaties” are the World Intellectual Property Organization’s (WIPO) Copyright Treaty (WCT) and Performance and Phonograms Treaty (WPPT).

[3] See, Government of Canada, “Copyright Modernization Act – Backgrounder”, available at

[4] “Technological measures” are software or hardware devices often called “Technological Protection Measures” (TPMs) or “Digital Rights Management” (DRM). Their goal is generally to enforce existing copy and access rights to digital works through technological means.

[5] WIPO Copyright Treaties Implementation Act and Online Copyright Liability Limitation Act: Hearing on H.R. 2281 and H.R. 2280 (1997), statement of Hon. Marybeth Peters at para 49

[6] 307 F. Supp. 2d 1085 (N.D. Cal. 2004)

[7] Ibid., at 1075

[8] Criminal Code, R.S., 1985, c. C-46, s.348

[9] Criminal Code, s.349(2)

[10] Criminal Code, s.351(1)

[11] Bill C-32, supra note 1, s.41.1(b) and (c)

[12] Criminal Code, s.342.1(1)

[13] Criminal Code, s.326(1)(b)

[14] Criminal Code, s.327 and 342.2

[15] Radiocommunication Act, R.S., 1985, c. R-2, s.9(1)(c)

[16] Radiocommunications Act, s.10(1)(b)

The post Protecting Protection is Nothing New appeared first on IPOsgoode.

Much attention has recently been paid to proposed legislation that would require Internet Service Providers (ISPs) to step up their efforts to prevent subscribers from downloading copyright-protected content through the Internet connections they provide. These initiatives are often described as "three-strikes" laws, although the term is misleading since the nature of sanctions imposed on repeat infringers varies to a great extent between the different schemes proposed. A better term to describe these initiatives is a "graduated response" system. Essentially, the ISP issues a series of escalating warnings and sanctions to subscribers who persist in pirating content over the Internet, culminating in the termination of the subscriber's account with the ISP after a number of warnings have been ignored.

What these proposals represent is a fundamental shift in the content industry's approach to tackling the serious issue of mass online piracy. Back in December 2008, the Recording Industry Association of America (RIAA) formally announced that it would end individual-level lawsuits and concentrate instead on working with leading American ISPs to implement graduated response policies. In his 2009 Digital Music Report, International Federation of the Phonographic Industry (IFPI) President John Kennedy stated that the future for commercial digital content depends specifically on "engaging ISPs in protecting intellectual property rights".[1]

The industries most affected by Internet piracy have begun to recognize that online infringement is best dealt with by collaborating and partnering with online intermediaries. These entities include not only ISPs and web hosting companies, but also websites such as Google and user-generated content sites that are abused by a small number of their user-base to make copyright-protected works available online. Websites such as YouTube have generally been open to working with content creators to prevent the use of their services to pirate protected works, including taking measures to terminate repeat violators' accounts. The content industry is optimistic that this model of cooperation can extend to other online entities such as ISPs in a similar manner.

Admittedly, graduated response initiatives have had mixed success thus far. For example, last month, the government of New Zealand postponed the implementation of its graduated response bill. Although there was vocal opposition to the measures, serious debate over the proposed copyright amendments was mired due in part to misunderstandings pertaining to key provisions of the new law (for instance, opponents took advantage of the confusion surrounding the term "three-strikes" to international observers unfamiliar with the baseball analogy). Elsewhere, similar proposals have experienced a much more positive response. Lawmakers in South Korea recently passed a bill that would call for ISPs to implement sanctions against subscribers found to be repeatedly infringing copyright works.

A variety of cooperation models between rights-holders and intermediaries have been proposed at many levels, in both the public and private sectors. Some models, such as the one recently approved by the Korean legislature, have placed the responsibility of supervising subscriber activity directly on the ISPs. Others, such as the EU IPRED directive that was recently implemented in Sweden, simply requires ISPs to pass on information of infringing activity to the appropriate rights-holder organization. Whether or not any particular model of graduated response receives widespread international adoption, it is becoming increasingly clear that cooperation with online intermediaries is emerging as the predominant strategy in the fight against pervasive online piracy.

[1] IFPI, Digital Music Report 2009, available at

The post Graduated Response Systems appeared first on IPOsgoode.

Here the chorus of user-rights advocates will usually respond by saying that such a comparison does not properly apply: the Internet changes everything, digital resources are not finite. However, online rights supporters often forget that while content on the Internet is infinitely copyable, the generation of that content (especially of high quality, useful content) is very much finite. If one user "maximizes" her consumption of Internet content by blocking ads, little harm is done to other users or to the content generators. Yet if all users were to follow this behavior, the content generators would no longer have reason to publish on the Internet, and these users then all suffer from a lack of content. It's the same situation as when every shepherd maximizes his flock in the village commons, resulting in a lack of sufficient grazing land for any given flock. 

There is no doubt that ads are now big business on the Internet. Google posted 2006 revenues of over $10 billion almost exclusively from ads. Last year, American television stations charged YouTube with copyright infringement for showing free clips of their shows, only to then show the same clips for free on their own websites (with their own ads). The New 91��ɫ Times recently eliminated the subscription requirement to read op-eds from their website, calculating that more revenue was generated from ads on the site than from subscription fees. While there's obviously a business interest in banning ad-blocking technologies, could such a law be passed?

The obvious parallel here is to the anti-circumvention measures in the Digital Millennium Copyright Act. Just as it is illegal to create or possess a program that circumvents copyright protection in media and software, one could easily imagine a similar restriction on ad-circumvention technologies. The problem is that copyright infringement is a well-recognized offense; there even exists criminal penalties for the more egregious cases. Conversely, there exists neither civil nor criminal sanctions for "not viewing a commercial". The American Betamax case serves as an appropriate reminder of this proposition. Furthermore, Justice Posner's derivative works argument, rejected in the Betamax case, is even less applicable to Internet banner ads: arguing that a randomly-selected 1"x6" banner-ad forms an integral part of the "work" that is an Internet website seems to me a tenuous proposition at best. Of course there is always the contractual option for content generators: restricting access to your website until users click "I Agree" on a clickwrap agreement that prohibits ad-blocking technologies. We know from Rudder v. Microsoft that such agreements are legally enforceable in Canada, but the question remains of how to enforce them.

As the music and movie industries can attest to, enforcing any laws or agreements against technologies available on the Internet is next-to-impossible. In this case, there are three parties against whom action could be taken: the developers of such programs, the users and the ISPs. We know from the Tariff 22 decision that Canadian ISPs are not de facto liable or responsible for the conduct of subscribers on their pipes. The developers of ad-blocking technologies most likely do not reside in Canada or the US and, in the case of open source-developed programs, these developers are both anonymous and number in the thousands. Finally, attempts at suing users of ad-blocking software will run into the same problem encountered by the file-sharing opponents: what damage does an individual cause by not viewing one, or even a thousand, banner ads?

The battle over ad-blocking technologies is not one that will be fought in courts or in legislature but rather online, pitting technology against technology. If content providers truly want to protect their revenue stream, they should design website in such a way as to block ad-blocking programs. Any pleas to users to stop using such programs will be met with one of the file-sharing movement's favorite slogans: "Your failed business model is not my problem".

The post Web Ad-Blocking - Self-Cannibalizing But Here to Stay appeared first on IPOsgoode.