The Censorware Project

III.

Discussion A. The Four Exempted Classes

1.

Compilations consisting of lists of Internet locations blocked by commercially marketed filtering software applications that are intended to prevent access to domains, websites or portions of websites, but not including lists of Internet locations blocked by software applications that operate exclusively to protect against damage to a computer or computer network or lists of Internet locations blocked by software applications that operate exclusively to prevent receipt of email. For purposes of this exemption,"Internet locations" are defined to include "domains, uniform resource locators (URLs), numeric IP addresses or any combination thereof."

http://www.copyright.gov/1201/2003/post-hearing/index.html http://www.copyright.gov/1201/index.html In referring to the comments and hearing materials, the Register will use the following abbreviations and conventions: C - Initial Comment, R - Reply Comment, TTranscript, and PHR - Post Hearing Response. When comments or reply comments include a parenthetical number, e.g., C25(2), this refers to the number of the proposal referenced within the comment (e.g., Proposed Class No. 2 in Comment 25). Citations to page numbers of the transcript refer to the pages of the official transcript that is currently posted on the Copyright Office website. References to post hearing responses will include the date only if there are multiple responses from the same individual or organization.

Recommendation of the Register of Copyrights October 27, 2003 Page 24

As in the previous rulemaking, initial comments proposed an exemption to the prohibition on circumvention in order to access the lists of blocked websites that are used in various filtering software programs sometimes referred to as "censorware." These programs are intended to prevent children and other Internet users from viewing objectionable material while online. It was alleged that although the software is intended to serve a useful societal purpose, the emphasis of the programs is on blocking rather than accuracy. Critics contend that the result of this focus is that filtering software used to prevent access to objectionable material tends to over-block, thereby preventing access to legitimate information resources.

Unlike the last rulemaking, where there was no opposition to the proposed exemption, in the current rulemaking the proposed exemption drew some objections. Opponents to the exemption argued that filtering software companies serve a critical societal purpose and that an exemption would undermine the integrity of filtering software. They also argued that filtering software companies have responded to the concerns that led to the exemption in the previous rulemaking and now provide reasonable means for ascertaining the material or sites that a particular filtering software blocks. Opponents also argued that the proponents have not met their burden of showing substantial harm and that exemptions cannot be "renewed" in the absence of evidence that the conditions leading to a previous exemption have not been corrected. Such a "renewal," it was argued, would shift the burden of proof to the opponents and undermine the de novo review intended by Congress in this triennial rulemaking.48 Opponents also stated that even if the Register found that an exemption was warranted, the particular class articulated in the previous rulemaking was overly

48 R33, pp. 6, 11; R34, p. 9.

Recommendation of the Register of Copyrights October 27, 2003 Page 25

broad and that repeating an exemption for that class could create adverse consequences for other types of software, such as antivirus and spam software.49

At the outset, the Register disagrees with the commenters who suggested that an exemption can be "renewed" if the opponents of an exemption do not prove that adverse effects identified in a previous rulemaking have not been cured. The burden of proof for an exemption rests with its proponents, and the fact that an exemption was granted in the previous rulemaking creates no presumptions. The exemptions in each rulemaking are considered de novo.50 Congress anticipated that market conditions would be constantly changing and that the market would be viewed anew in each triennial proceeding.

While the Register rejects the argument that the previous exemption should be "renewed" in the absence of evidence that the adverse effects which led to the previous exemption have been cured in the marketplace, the Register finds that the record in the current rulemaking warrants a new exemption. The previous exemption covered "Compilations consisting of lists of websites blocked by filtering software applications." For the reasons specified below, the Register recommends that the new class exempted should be designated as "compilations consisting of lists of Internet locations blocked by commercially marketed filtering software applications that are intended to prevent access to domains, websites or portions of websites, but not including lists of Internet locations blocked by software applications that operate exclusively to protect against damage to a computer or computer network or lists of Internet locations blocked by software applications that operate exclusively to prevent receipt of email." For purposes of this exemption,"Internet locations"

49 See, e.g., R23, p. 13; T Steve Metalitz, May 14, 2003, p. 29; PHR Steve Metalitz, Joint Reply Commenters, June 30, 2003, p. 3-4; PHR David Burt, N2H2, Inc., et al., p. 4-7.

50 Commerce Comm. Report at 37. Accord, NTIA letter.

Recommendation of the Register of Copyrights October 27, 2003 Page 26

are defined to include "domains, uniform resource locators (URLs), numeric IP addresses or any combination thereof."

The Register's recommendation in favor of this exemption is based primarily on the evidence introduced in the comments and testimony by one person, Seth Finkelstein, a non-lawyer participating on his own behalf. In addition to identifying a class of works that related to the specific facts presented, he identified the qualitative nature of the noninfringing uses for which circumvention was necessary and generally identified the technological measure which controlled access to this class. There was no dispute that the lists of Internet locations blocked by filtering software are generally encrypted or otherwise protected by an access control measure. The remedy sought was causally related to the noninfringing uses that are necessary to conduct research, comment and criticism on the filtering software at issue. Mr. Finkelstein also anticipated objections to the exemption and proved that available alternatives to the exemption were insufficient to remedy the adverse effect caused by the prohibition. The insufficiency of alternatives was supported by testimony and demonstrative evidence at the hearing in California by James Tyre. Finally, Mr. Finkelstein's succinct initial comment addressed the statutory requirements and thoughtfully analyzed each of the statutory factors required to be considered in this rulemaking.

The case made by Mr. Finkelstein for this exemption is also instructive for the manner in which it met the requisite showing. The evidence produced did not prove that a substantial number of people have utilized or were likely to utilize an exemption. On the contrary, the evidence tended to prove that very few people have had the motivation or technological ability to circumvent this technological measure, to investigate the lists of blocked sites in filtering software or to report on, comment on or criticize such lists. Although there was little need for an exemption in quantitative terms (i.e., in terms of the number of persons likely to take advantage of it directly), it was the qualitative need for an exemption that was controlling in this case; absent the ability of a few to

Recommendation of the Register of Copyrights October 27, 2003 Page 27

carry out their noninfringing efforts notwithstanding the prohibition set forth in section 1201, the many would not reap the fruits of such efforts ­ the information, analysis, criticism and comment enabled by the quantitatively small number of acts of circumvention. The fact that the act of circumvention was unlikely to be widespread rebutted copyright owners' concerns of abuse and further supported the conclusion that the potential adverse effects to copyright owners would be minimal. The showing that the particular noninfringing use prevented was a result of the prohibition on circumvention and that these uses were necessary to criticism, comment, news reporting, teaching, scholarship, or research, further strengthened the argument.

Opponents argued that circumvention is not necessary because other alternative sources for the information sought to be obtained are available, but the proponents of the exemption successfully discredited this assertion. While it is true that limited "querying" of the databases is available on some of the filtering software companies' sites, the circumscribed nature of this querying foreclosed comprehensive or meaningful results. Opponents produced evidence that many reviews of filtering software platforms reached conclusions based on these querying capabilities or by utilizing various sampling techniques, yet this evidence only proved that some parties were willing to settle for the results produced by such superficial tests. In light of the millions (or more) of potential URLs, it is indisputable that actually viewing the entire list of blocked Internet locations will produce data much more comprehensive than querying about one hundred URLs.

Had opponents been able to prove that the likely harm of an exemption would have outweighed the benefit of comprehensive testing, particularly given the availability of limited testing, a balancing of the interests might have favored opponents. Where, however, there is no indication of likely harm that would result from an exemption and where proponents have proven the inadequacy of existing alternatives (the limited queries that some filtering software providers permit) and the societal benefit of more extensive access that is available only through circumvention, the

Recommendation of the Register of Copyrights October 27, 2003 Page 28

balance favors the proponents of the exemption. The opponents' arguments that circumvention would undermine the integrity of the filtering software or that an exemption could have an adverse effect on other types of protective software are unpersuasive. The societal benefit of preventing children or others from viewing objectionable sites is likely to be unaffected or even assisted by an exemption. A computer which has filtering software installed will continue to block sites within its blocking list even if one knows the URLs for the sites. Proponents of an exemption pointed out that in the fiercely competitive filtering software market, one filtering software company has actually posted the URLs of blocked sites on its company website as a form of comparative advertising, in order to reveal that it was blocking objectionable sites which another competitor was failing to block. Thus, exposing what filtering software does not block or exposing over-blocking or questionable blocking does not undermine the goal of protecting children and others from harmful or objectionable material. In fact, the evidence tended to show that the results only obtainable by means of circumvention may in fact improve under- or over-blocking flaws in filtering software, thus furthering the potential benefit of such software. Since the end result of the circumvention is criticism, comment, and possibly news reporting on existing problems, filtering software companies may utilize the research to address problems revealed by such publicity. Given the competition in the filtering software market for market share, robust blocking currently appears to be more important than precision. The evidence tended to show that the incentive to continually verify the objectionable nature of the blocked sites appears lackluster at best ­ an important concern given the rapid pace and dynamic nature of the Internet ­ and is of less concern to filtering companies than is the concern for comprehensiveness.51 This may be understandable, but this focus on comprehensiveness does not alter the societal benefit of learning about over-blocking that may occur. Taken to an extreme, moreover, an obsession with comprehensiveness could lead to unnecessary or even harmful censorship of legitimate information that would adversely affect the usefulness of Internet research. While the marketplace might, in theory, limit excesses in the over-

51 T David Burt and Seth Finkelstein, April 11, 2003, p. 81-84.

Recommendation of the Register of Copyrights October 27, 2003 Page 29

blocking of legitimate information, the market can only correct problems that participants in the marketplace are aware of. That is at the heart of this exemption ­ allowing information to be made available to the public in a lawful manner. The exposure of alleged flaws by those with an incentive to learn about them can be utilized by the filtering companies themselves, if they so choose, to make their software more accurate. The exemption is likely to have the effect of encouraging legitimate public debate based on the information obtained through circumvention.

The ability to engage in legitimate research, criticism and comment about filtering software is even more compelling as a result of the recent Supreme Court decision upholding the constitutionality of the Children's Internet Protection Act (CIPA).52 Since CIPA requires libraries to install "filtering software" in order to block access to objectionable material as a condition of receiving federal funds, it becomes all the more important for the public to understand potential problems in particular filtering programs that may be installed in public facilities. Since the Court found that an important safety valve within CIPA was the ability of a library patron to request the disabling of such software, it appears all the more important that the public be able to obtain objective information about the performance or potential limitations of such software in order to make the determination whether to request such disabling.

In contrast to the strength of the case in favor of an exemption, there was virtually no plausible evidence that such an exemption would have any relevant adverse effects on the market for or value of these copyrighted works.53 While it is obviously true that the exposure of substantial flaws in a program will adversely affect the filtering software's value by affecting market demand,

52 United States v. American Library Association, Inc., ___ U.S. ___, 123 S.Ct. 2297, 156 L.Ed.2d 221 (2003).

53 See e.g., T David Burt, Seth Finkelstein and Jonathan Band, April 11, 2003 p. 66- 72.

Recommendation of the Register of Copyrights October 27, 2003 Page 30

such an adverse market effect is not a relevant concern in this rulemaking.54 In assessing the likelihood of harm to filtering software that would result from an exemption, the absence of any identifiable harm that resulted from the previous exemption is informative. While there is no burden on the opponents of exemption to show that a similar preexisting exemption has caused harm, silence on the issue may raise inferences. While opponents raised the possibility that the lack of use of the prior exemption may have minimized the harm, they also claimed that such minimal or nonexistent use obviated the need for an exemption. As previously noted, however, this proposed exemption is not grounded on the need for widespread circumvention. In this factual setting, enabling the efforts of the few who will find sanctuary in the exemption will have the effect of remedying the adverse effects of the prohibition on the public generally by allowing those who circumvent measures that protect lists of blocked websites to comment publicly on their findings.

In response to the concern that the designation of this class in the previous rulemaking was overbroad and had the capacity to create unintended consequences for other types of software, such as antivirus or spam filtering software, the Copyright Office posed a post-hearing question to seek further clarification from the witnesses who testified on this subject. After considering these responses in conjunction with the comments and the testimony, the Register finds that rather than being too broad, the class of works previously exempted may be too narrow to encompass the facts introduced in this rulemaking.

In the previous rulemaking, the class was designated as "compilations consisting of lists of websites blocked by filtering software applications." Despite the asserted concern that an unintended consequence of such a class designation could be that other forms of filtering software would be

54 Cf. Campbell v. Acuff-Rose, 510 U.S. 569, 591-592 (1994) ("We do not, of course, suggest that a parody may not harm the market at all, but when a lethal parody, like a scathing theater review, kills demand for the original, it does not produce a harm cognizable under the Copyright Act.")

Recommendation of the Register of Copyrights October 27, 2003 Page 31

compromised by this class, the Register is skeptical of this argument. The prior exemption was narrowly tailored to allow circumvention of "lists of websites blocked by filtering software." Since it seems unlikely that spam filtering software which filters email or antivirus software which protects against malicious or suspicious file types necessarily contain "lists of websites," it is unclear how such a class could affect such other types of filtering software. Unfortunately, there was little evidence produced on this issue. The Joint Reply Commenters' response to the specific post-hearing question posed by the Copyright Office stated "[i]t is important to note the broad array of critical network security tools that may employ lists of websites protected by access controls. These include for example, firewalls (which in effect filter traffic based on defined parameters contained in a compilation or database) and antivirus products (which perform a similar function using compilations or databases of virus definitions or characteristics)."55 The Register agrees that the proposed exemption is intended to be limited to the type of filtering software known as "censorware" and that there is no intention to affect spam filtering software, virus protection software or other security software such as firewalls.

A representative of a number of the filtering software companies suggested that filtering software is often marketed in security "suites," which are bundled packages of security software applications together with filtering software that provide a "layered" security approach. Filtering software companies attempted to create a circular argument that it would be unfair to exempt filtering software applications but then exclude such suites from the exemption, since this would provide the largest software companies with a market advantage; at the same time these same companies appear to argue that the Register could not recommend exempting the filtering software bundled in these suites, since such an exemption would compromise the integrity of the overall security suite. While the Register agrees that an exemption from the prohibition on circumvention for filtering software applications cannot distinguish between stand-alone programs and filtering

55 PHR Steve Metalitz, Joint Reply Commenters, June 30, 2003, p. 3-4.

Recommendation of the Register of Copyrights October 27, 2003 Page 32

software incorporated into a suite, an exemption need not compromise the integrity of an entire suite in order to allow circumvention of the list of websites utilized by the filtering software program. The present exemption has existed for the past three years and would allow any person to circumvent any access control that bars access to the list of blocked websites, but no evidence has been introduced that there have been adverse effects on the filtering software market or the market for security software suites. Many of these suites have undergone development while the present exemption has been in place, thus making it implausible that such security suites relied primarily on the legal prohibitions of § 1201(a)(1) rather than robust technological protections. In addition, there appears to be no technological reason why the creators of suites must bundle their information behind only a single, omnibus access control measure. Since it could be expected that a security software suite should be a technologically robust system, the lists of Internet locations related to the filtering software could be a segregated database or the access controls could be layered to provide independent security to various components of the suites. Not only would such redundancy appear to make technological sense, but it would appear to be prudent under the law since an exemption for one part of a suite would not necessarily adversely affect other parts of the suite.

In an abundance of caution, however, the Register finds that some modification of the language of the previous exemption is compatible with the present record. The Register recommends exemption of "compilations consisting of lists of Internet locations blocked by commercially marketed filtering software applications that are intended to prevent access to domains, websites or portions of websites, but not including lists of Internet locations blocked by software applications that operate exclusively to protect against damage to a computer or computer network or lists of Internet locations blocked by software applications that operate exclusively to prevent receipt of email." For purposes of this exemption, "Internet locations" are defined to include "domains, uniform resource locators (URLs), numeric IP addresses or any combination thereof." The changes in the wording are the result of two refinements in the record. First, the term "lists of websites" used in the previous exemption has been changed to "list of Internet locations" including domains, URLs,

Recommendation of the Register of Copyrights October 27, 2003 Page 33

numeric IP addresses. The record revealed that filtering software applications vary on how they block access ­ e.g., by blocking specific URLs, or IP addresses, or some combination ­ and on what they block ­ e.g., entire websites or individual pages, or some combination.56 It therefore is appropriate to broaden the scope of that particular term.

Second, "filtering" is a term that may be used broadly, including filters for email or viruses. While there is no evidence in the record regarding how exempting lists of Internet addresses could implicate anti-virus filters or email addresses, the record created by proponents is limited to the need to circumvent filtering software that is commercially marketed to prevent access to Internet content. Using the term "commercially marketed filtering software" is an effort to limit the scope of the class of works to this particular type of filtering software without opening the door to other filtering systems. Although proponents have offered the term "censorware," the Register finds that term pejorative and ambiguous. "Commercially marketed filtering software" is a more objective description of the particular class.

The analysis of the statutory factors in relation to this proposed exemption reveals: (1) The availability for use of the lists of blocked Internet locations is currently limited. While some querying and sampling is available, these methods do not allow a comprehensive means of determining what is being blocked and why these locations are being blocked. In addition, the market for filtering software has generally grown despite the fact that an exemption has been in place since the prohibition went into effect. There is no reason to believe that continuing the exemption will have an adverse effect on the availability of the software itself. (2) The availability for use for archival, preservation or educational purposes has not been addressed in this rulemaking. (3) The impact of the prohibition on criticism, comment, news reporting, teaching, scholarship, or

56 T David Burt, April 11, 2003, p. 80.

Recommendation of the Register of Copyrights October 27, 2003 Page 34

research in relation to these lists of blocked Internet locations is significant. If the prohibition were in effect for these works, the only criticism, comment, news reporting or research on these works that would be available would be the limited querying and sampling that was shown to be generally inadequate for more than superficial analysis. Given the broad use of such filtering software in schools and libraries, over-blocking could adversely affect scholarship and research performed on the Internet. (4) The effect of circumvention on the market for or value of these works appears to be minimal. The evidence of the past three years is instructive for the likelihood of future harm. The lack of harm is in part due to the fact that few took advantage of the exemption and in part due to the narrow scope of the exemption. While a new exemption requires taking into account of the present realities of the data assembled in these lists, e.g., IP addresses, URLs and combinations of these forms of addresses, it also requires limiting unintended consequences. Therefore, the new exemption exempts circumvention of lists of "Internet addresses" in commercially marketed filtering software rather than "lists of websites," while at the same time excluding circumvention of lists of Internet addresses blocked by software applications that operate exclusively to protect against damage to a computer or computer network, e.g., antivirus or firewall applications, or lists of Internet addresses blocked by software application that operate exclusively to prevent receipt of email, e.g., spam filters.