Web Security, Privacy and Commerce, 2nd Edition

26.1 Copyright

Copyright is intended to cover the expression of ideas rather than the ideas themselves. Copyright covers text (including programs), pictures, typefaces, and combinations of these items once they are assembled in some fixed form.^[1] Or, as the law phrases it, "A copyright exists in original works of authorship fixed in any tangible medium of expression from which they can be perceived, reproduced, or otherwise communicated, either directly or with the aid of a machine or device."^[2]

^[1] Copyright can also cover performances of music, plays, and movies.

^[2] 17 U.S.C. 102

This definition clearly covers any material entered into a computer and stored on disk, CD-ROM, or tape for display via a web browser. Once it is fixed in form (e.g., saved to disk) it is protected by copyright. Under current law, there is no need to mark such material with a copyright symbol or register the copyright for it to be protected; however, registration and marking of copyright may increase statutory penalties awarded if an infringement occurs.

Let's repeat that point it is very important. Images in your web pages, sound clips played through your web servers, and documents you copied from other sites to pad your own collection all have copyrights associated with them. Online databases, computer programs, and electronic mail are copyrighted as well. The law states that as soon as any of these things are expressed in a tangible form, they have a copyright associated with them. Thus, as soon as the bits are on your disk, they are copyrighted, whether a formal notice exists or not. If you reuse one of these items without appropriate permission, you could be opening yourself up to trouble.

26.1.1 Copyright Infringement

Standard practice on the Internet has been that something exported from a public access server is for public use, unless otherwise noted. However, this practice is not in keeping with the way the copyright law is currently phrased. Furthermore, some items that you obtain from an intermediate party may have had owner and copyright information removed. This does not absolve you of any copyright liability if you use that material.

In particular, rulings in various courts have found that under certain circumstances, system operators can be sued as contributing parties, and thus held partially liable, for copyright infringement committed by users of their systems. Types of infringement include:

• Posting pictures, artwork, and images on FTP sites and web sites without appropriate permission, even if the original items are not clearly identified regarding owner, subject, or copyright.

• Posting excerpts from books, reports, and other copyrighted materials via email, the Web, FTP, or Usenet postings.

• Posting sound clips from films, TV shows, or other recorded media without approval of the copyright holders. This includes adding those sounds to your web pages in any form.

• Posting scanned-in cartoons from newspapers or magazines.

• Reposting news articles from copyrighted sources.

• Reposting of email. As with paper mail, email has a copyright held by the author of the email as soon as it is put in tangible form. The act of sending the email to someone does not give the recipient copyright interest in the email. Standard practice on the Net is not in keeping with the way the law is written. Thus, forwarding email may technically be a violation of the copyright law.

The best defense against possible lawsuits is to carefully screen everything you post or make available on your web site to be certain that you know its copyright status. Furthermore, if you are an ISP or you host web pages for others, make all your users aware of the policy you set in this regard, and then periodically audit to ensure that the policy is being followed. Having an unenforced policy will likely serve you as well as no policy that is, not at all.

Also, beware of "amateur lawyers" who tell you that reuse of an image or article is fair use under the law. There is a formal definition of fair use, and you should get the opinion from a real lawyer who knows the issues. After all, if you get sued, do you think that a reference to an anonymous post in the alt.erotica.lawyers.briefs Usenet newsgroup is going to convince the judge that you took due diligence to adhere to the law?

If anyone notifies you that you are violating her copyright with something you have on your system, investigate immediately. Any delay could cause additional problems. However, we are not necessarily advocating that you pull possibly offending or infringing material from the network any time you get a complaint. Each case must be separately evaluated.

26.1.2 Software Piracy and the SPA

The Software Publishers Association ( SPA) is one of several organizations funded by major software publishers. One of its primary goals is to cut down on the huge amount of software piracy that is regularly conducted worldwide. Although each individual act of unauthorized software copying and use may only deprive the vendor of a few hundred dollars at most, the sheer number of software pirates in operation makes the aggregate losses staggering: worldwide losses are estimated in the billions of dollars per year. Figures from various sources indicate that worldwide losses from software piracy alone may be more than $15 billion per year.

Although there are criminal penalties for unauthorized copying, these penalties are only employed against organized software piracy organizations. In contrast, the SPA and others rely on civil law remedies. In particular, the SPA can obtain a court order to examine your computer systems for evidence of unlicensed copies of software. Should such copies be found without supporting documentation to show valid licenses, you may be subject to a lawsuit resulting in substantial damages. Many companies and universities have settled with the SPA in regard to these issues with fines totaling many hundreds of thousands of dollars. This amount is in addition to the many thousands of dollars paid to vendors for any unlicensed software that is found.

26.1.3 Warez

A further danger involves your users if you are an ISP. Warez are pirated software programs or activation codes that are made available for other software "pirates" to download without proper license or payment to the legitimate copyright holder.

If some of an ISP's users are running a warez site from its FTP or web server, the SPA or copyright holders might conceivably seek financial redress from the ISP to help cover the loss even if it does not know about the pirated items and otherwise does not condone the behavior.^[3] The SPA has filed lawsuits against ISPs that appeared to be less than immediately responsive to complaints about customer-run warez servers.

^[3] Whether they would succeed in such an action is something we cannot know. However, almost anything is possible if a talented attorney presses the case.

The ISP's best defense in these circumstances is to clearly state to their users that no unlicensed use or possession of software is allowed under any circumstances. ISPs should have this written into their service agreements so they have an explicit statement of intent, and an explicit course of action to follow if there is a violation. Although ISPs don't want to be involved in undue meddling with customers' uses of their services, it is also important they don't become a haven for violators of the law.