Gregarius » Electronic Frontier Foundation

« Expand/Collapse

Electronic Frontier Foundation (10 unread)

August 19, 2008
14:44
Judge Lifts Unconstitutional Gag Order Against MIT Students
» ‎ Electronic Frontier Foundation

Boston - Today, a federal judge lifted an unconstitutional gag order that had prevented three Massachusetts Institute of Technology (MIT) students from disclosing academic research regarding vulnerabilities in Boston's transit fare payment system. The court found that the Massachusetts Bay Transportation Agency (MBTA) had no likelihood of success on the merits of its claim under the federal computer intrusion law and denied the transit agency's request for a five-month injunction. In papers filed yesterday, the MBTA acknowledged for the first time that their Charlie Ticket system had vulnerabilities and estimated that it would take five months to fix.

Tuesday's ruling lifts the restriction preventing the student researchers from talking about their findings regarding the security vulnerabilities of Boston's Charlie Card and Charlie Ticket -- a project that earned them an "A" from renowned computer scientist and MIT professor Dr. Ron Rivest. The Electronic Frontier Foundation (EFF) represents the students as part of its Coders' Rights Project.

"We're very pleased that the court recognized that the MBTA's legal arguments were meritless," said EFF Legal Director Cindy Cohn, who argued at the hearing. "The MBTA's attempts to silence these students were not only misguided, but blatantly unconstitutional."

The students had planned to present their findings earlier this month at DEFCON, a security conference held in Las Vegas, while leaving out key details that would let others exploit the vulnerability. The students met with the MBTA about a week before the conference and voluntarily provided a confidential vulnerability report to the transit agency. However, the MBTA subsequently sued the students and MIT in United States District Court in Massachusetts less than 48 hours before the scheduled presentation, without providing any advance notice to the students. The lawsuit claimed that the students' planned presentation would violate the Computer Fraud and Abuse Act (CFAA) by enabling others to defraud the MBTA of transit fares. A different federal judge, meeting in a special Saturday session, ordered the trio not to disclose for ten days any information that could be used by others to get free subway rides.

"The judge today correctly found that it was unlikely that the CFAA would apply to security researchers giving an academic talk," said EFF Staff Attorney Marcia Hofmann. "A presentation at a security conference is not some sort of computer intrusion. It's protected speech and vital to the free flow of information about computer security vulnerabilities. Silencing researchers does not improve security -- the vulnerability was there before the students discovered it and would remain in place regardless of whether the students publicly discussed it or not."

Although the gag order was lifted, the MBTA's litigation against the students still continues. The students have already voluntarily provided a 30-page security analysis to the MBTA and have offered to meet with the MBTA and walk the transit agency through the security vulnerability and the students' suggestions for improvement.

"The only thing keeping the students and the MBTA from working together cooperatively to resolve the fare payment card security issues is the lawsuit itself," said EFF Senior Staff Attorney Kurt Opsahl. "The MBTA would be far better off focusing on improving the MBTA's fare payment security instead of pursuing needless litigation."

This case is part of EFF's Coders' Rights Project, launched two weeks ago to protect programmers and developers from legal threats hampering their cutting-edge research. EFF was assisted in this case by John Reinstein, ACLU of Massachusetts Legal Director, and Fish & Richardson attorneys Adam Kessel, Lawrence Kolodney, and Tom Brown.

For more on MBTA v. Anderson:
http://www.eff.org/cases/mbta-v-anderson

Contacts:

Rebecca Jeschke
Media Coordinator
Electronic Frontier Foundation
press@eff.org

Kurt Opsahl
Senior Staff Attorney
Electronic Frontier Foundation
kurt@eff.org
12:41
Victory for MIT Students in MBTA Lawsuit Hearing
» ‎ Electronic Frontier Foundation

Today, Judge George O'Toole lifted the gag order on three MIT students who were sued by the Massachusetts Bay Transportation Authority for discovering a security vulnerability in the MBTA's fare payment system. The Court found that the MBTA was not likely to prevail on the merits of its claim under the federal Computer Fraud and Abuse Act. MBTA had argued that the CFAA, which prohibits the transmission of a program that causes damage to a computer, also covers "verbal transmission," such as talking to people at conferences. Judge O'Toole, however, looked closely at the statute, and held that the CFAA does not apply to security researchers like the students talking to people. More details to follow.
1:42
MIT Coders' Free Speech At Stake
» ‎ Electronic Frontier Foundation

As regular Deeplinks readers know, EFF's Coders' Rights Project is defending the rights of three MIT students who were prevented from presenting their research on security vulnerabilities in Boston's transit fare payment system. The students were hit with a temporary restraining order that silenced their planned presentation at DEFCON.

Why this is Important

At first glance, the issues at play may appear obscure, and of interest only to technical researchers and lawyers. But as we noted in a post last week, the right to publish without pre-publication review is part of the purpose of the 1st amendment, and one of the reasons Americans fought the Revolutionary War. (The MBTA's stance is all the more ironic, considering Boston's role in that war.)

Beyond this core constitutional principle, EFF is defending the ability to conduct security research in the digital age. As we note in our Vulnerability Reporting FAQ, security researchers by definition raise questions that corporations and government agencies would prefer to keep quiet. But by investigating flaws in security, and alerting the public to vulnerabilities, researchers play an important role in keeping private and public institutions accountable.

The MIT students were behaving as good citizens within this culture of security research. They met with the MBTA before the presentation. They never planned to expose the full details of their successful expose of the vulnerability of the MBTA's fare system, and MBTA officials admit that students had provided them with "a written summary of every vulnerability that they claimed to have discovered and how to fix these vulnerabilities." As promised, the students provided a detailed 31 page analysis of the security vulnerability, and the MBTA has finally admitted that a vulnerability exists.

The free speech implications are even more important because showing faults with a government agency's systems is core political speech. The Boston Herald reports that an MBTA Advisory Council Member was concerned with the fare card payment systems (in light of this controversy), and noted that the "T gave a no-bid contract for CharlieCard services to a former government employee." This makes the public interest in this matter even stronger.

The MBTA is Seeking a Dangerous Precedent

Moreover, if the MBTA's unprecedented expansion of the federal computer intrusion law (considering a talk to people the same as transmission of a program to a computer, considering a piece of paper with a magnetic stripe to be a computer, etc.) is adopted by the federal court in Boston, it would also have the unintended consequence of chilling future academic research and discussion. An anti-virus researcher, for example, presenting virus code on the PowerPoint screen at an anti-virus software conference, could be charged with a similar offense. Releasing a computer security textbook which describes attacks and defenses to networks would become a crime. The court and the MBTA should think about the consequences beyond the scope of this lawsuit.

The MBTA is also misguided with its notion that anytime a security researcher dares looks at a vulnerability, he suddenly has an obligation to provide the vendor of the faulty code with all of the research materials and to stay silent until the vendor decides he can speak. They seem to believe that they have right to all of any such academic researchers' notes, drafts, tools, and anything else, because they did them a favor and told them about a vulnerability the vendor didn't know about previously. The MBTA not only asserts that the researchers have this as a moral obligation, but a legal obligation to allow the vendor pre-publication review.

The MBTA's strategy of shooting the messenger is not only counter-productive and shortsighted, it is dangerous. The vulnerability existed long before the students discovered it, and it could be (and may have been) discovered by others. The MBTA and its vendors are the one who adopted a faulty system for its payment cards, not the students. The MBTA's priority should be fixing the problem, not continuing needless litigation.

A Reasonable Way Forward

The only thing stopping the students and the MBTA from working together cooperatively to resolve the fare payment card security issues is the lawsuit itself. The students have offered to meet with the MBTA and voluntarily walk the transit agency through the security vulnerability and the student's suggestions for improvement--for no charge--if only the MBTA would drop this lawsuit. It appears that the MBTA, a public transit agency supported with billions in public money, would rather spend these taxpayer dollars on litigation in a misguided attempt to keep the vulnerability quiet than work with the students to resolve the situation.

On Tuesday morning, the federal court with either lift the restraining order, or convert the order to a preliminary injunction. EFF's Coders' Rights Project will be there, arguing for the First Amendment rights of the students, and for the right of researchers to investigate security flaws in the public interest.
August 18, 2008
16:04
What If the Kindle Succeeds?
» ‎ Electronic Frontier Foundation
The news recently has been full of reports that Amazon's e-book reader, the Kindle, is doing better than expected. Analyst Mark Mahaney from Citibank says Amazon is on track to sell about 380,000 Kindles this year, and says the Kindle "is becoming the iPod of the book world," with sales expected to hit $1 billion by 2010.

For it's part, Amazon remains coy about releasing the actual numbers, so it might be best to take these predictions with a grain of salt — and sales of the Kindle haven't come close to the numbers for the iPod. But Amazon has reported that, of titles carried in both paper and electronic form, the e-books comprise 10% of sales, a percentage that is likely to grow.

Steve Jobs said recently that the whole idea of e-book readers was flawed since "people don't read anymore". But for those of us who do read, the e-book elicits skepticism for different reasons. For us, the look and feel, even the smell, of a physical book is part of the joy of reading. Will anyone actually want to curl up with an electronic device for an evening of literary comfort?

But the success of the Kindle suggests that some people will. And digital books bring some advantages that suggest the trend won't disappear any time soon:
- Ease of access: We have become accustomed to the fact that we can access millions of songs and albums instantaneously online, with a single click. The same is now increasingly possible with books.
- Ease of sharing: Everyone loves to share a good book with friends. Digital books can be shared as easily as sending an email — and you don't need to give up your copy in order to do so! (Publishers may try to restrict copying with DRM copy protection, but as we saw with MP3 files, this strategy will fail.)
- Ease of carrying: A single Kindle device can carry at least 200 books. As the technology improves, you will soon be able to carry a copy of your entire library in your bag (and have a back-up at home), just as you now carry your music collection in your pocket.
- Price: As more people use digital books and as competition increases, the price of digital books will come down, reflecting the real costs of production — no expensive printing, no shipping across country or storing in warehouses.
Skeptics should remember that it wasn't long ago that many predicted that CDs would never replace vinyl, and later that MP3s would never replace CDs. You can still find great record stores that specialize in vinyl, but the trend towards digital music has been steady and unstoppable. And the music industry has paid a huge price for their failure to embrace the new technology. After first ignoring new technologies, they then proceeded to try to sue innovators, restrict users with DRM copy protection and then punish fans with indiscriminate lawsuits, none of which did a thing to stop online sharing of music. Sales are down, illegal filesharing is up, and no one has found a way to unite the industry around monetizing the sharing of digital music (though EFF has suggested a Better Way Forward).

Will the same thing happen to the publishing industry as books become digital? If the trend continues, with better devices promising longer battery life and better screen resolution, digital books will become a force to be reckoned with. Are we doomed to watch the publishing industry run through the same gamut of bad decisions that have plagued the recording industry for the last few years?

Here are some questions the book industry should be asking itself.

read more
12:48
Innocent Customers Potentially Dragged Into Legal Battle Over Satellite TV
» ‎ Electronic Frontier Foundation

San Francisco - The Electronic Frontier Foundation (EFF) asked a federal court Friday to reject efforts by Echostar to get the names and addresses of every customer that purchased a free-to-air satellite receiver. Echostar claims that the receiver can be modified to pirate DISH satellite TV programming. EFF argues that Echostar's demand, which seeks all purchasers regardless of whether they actually pirated DISH TV, would violate user privacy and leave innocent purchasers vulnerable to bogus legal threats.

The demand for customer records came up in a lawsuit between Echostar, the company behind the DISH satellite TV service, and Freetech, Inc., the manufacturer of Coolsat free-to-air satellite receivers. As part of the suit, Echostar subpoenaed 17 distributors of Coolsat receivers, demanding the names, addresses, phone numbers, email addresses, and other information of every person who purchased a Coolsat receiver over the last five years.

"Innocent customers should not be dragged into federal litigation just because they bought a product that other, less scrupulous purchasers may be hacking for unlawful purposes," said EFF Senior Intellectual Property Attorney Fred von Lohmann. "The court should recognize the privacy interests of these customers, especially since Echostar does not need these customer lists in order to have its day in court against Freetech."

In recent years, satellite TV companies, record labels, and movie studios have all engaged in dragnet litigation tactics that threaten individuals with costly lawsuits unless they pay significant financial sums to "settle" the dispute. These mass litigation campaigns leave innocent consumers trapped between paying a "settlement" for something they did not do or facing even higher legal costs to prove their innocence. Satellite TV provider DirecTV pioneered this approach in 2001, threatening more than 120,000 individuals with legal action and commencing more than 24,000 federal lawsuits, often with no evidence other than the fact that the individual purchased multi-purpose devices that could be used for piracy.

"Once the names of Freetech customers are disclosed to Echostar, there may be little that any court can do to protect these people from harassment, settlement demands, and legal expenses," said EFF Senior Staff Attorney Matt Zimmerman. "This may be the last chance the court has to protect the privacy of these individuals."

For the full amicus brief:
http://www.eff.org/files/filenode/echostar_v_freet/EFFamicusEchostarvFre...

For more on Echostar v. Freetech:
http://www.eff.org/cases/echostar-v-freetech

Contacts:

Fred von Lohmann
Senior Intellectual Property Attorney
Electronic Frontier Foundation
fred@eff.org

Matt Zimmerman
Senior Staff Attorney
Electronic Frontier Foundation
mattz@eff.org
August 15, 2008
20:21
DRM for Streaming Music Dies a Quiet Death
» ‎ Electronic Frontier Foundation

Yet another nail has been driven into DRM's coffin, this time for streaming audio (PCPro has a nice overview of the state of DRM for digital music).

Two of the leading on-demand streaming music sites, iMeem and LaLa, are not using DRM on their audio streams, instead sending the music as MP3s dusted with a dash of obfuscation. This is significant because both sites have been licensed by all the major record labels -- the very same record labels that were just last year pushing Congress to require DRM on all noninteractive webcasts. So it looks like the RIAA companies have changed their minds, dropping DRM requirements for the on-demand streaming music services.

This should put an end to legislation to mandate DRM on noninteractive webcasters. After all, why should these webcasters be in a worse position than the free, on-demand music services like LaLa and iMeem?

This also undermines the argument that DRM for music is necessary for subscription services. If the major labels have given up DRM for free, ad-supported (correction: iMeem is ad-supported, LaLa is free for a first listen of a track, 10 cents for repeat listening), on-demand streaming services like LaLa and iMeem, there's no plausible reason to insist on DRM for paid subscription services like Rhapsody and Napster 2.0. After all, there's no reason to think that those who prefer commercial-free subscriptions like Rhapsody are more likely to "pirate" streams than those who prefer ad-supported services like LaLa iMeem.

LaLa and iMeem each take slightly different approaches to streaming music. LaLa uses HTTP to download each requested song as an MP3 to your browser, but relies on aggressive "no-cache" headers and pre-expired date stamps to suggest that your browser not make a copy of the file on your hard drive. Using a packet sniffer to capture the entire HTTP session, however, easily reveals the complete MP3 embedded right after the HTTP headers.

iMeem also downloads and caches each requested song, but sends the MP3 as the audio track of a Flash Video file. This FLV file is typically saved (cached) on your hard drive as an obscurely named temporary file, which is overwritten when you request your next song (we mentioned iMeem's approach back in January, and it's essentially unchanged). Copy this temp file, however, and you can easily extract the audio track from the Flash video, saving it as a stand-alone MP3 file.

(The location of this TemporaryItems folder, and its equivalent on other operating systems, varies significantly depending on operating system and version. On some operating systems it's buried deep within the directory hierarchy, but it can be found automatically with standard tools.)

While the light obfuscation used by iMeem and LaLa might create a "speed bump" of inconvenience for users who want to keep the MP3 files, it doesn't rise to the level of a "technical protection measure" protected by the DMCA. In short, this is yet another example of why there is no legitimate business case for DRM on music -- it doesn't prevent piracy and it's not necessary to enable "new business models" like subscription or ad-supported music. (Of course, as the movie industry has demonstrated, DRM can still be valuable for impeding competition and putting the brakes on disruptive innovation. But it's hard to see how the law should protect those goals.)
19:09
MBTA Transit Official Supports MIT Students' Story
» ‎ Electronic Frontier Foundation

Today, Richard Sullivan, a Sergeant Detective in the Transit Police of the Massachusetts Bay
Transportation Authority (and the liaison to the FBI), filed a Supplemental Declaration. In his declaration, Det. Sullivan said:

the MIT Undergrads reiterated that they did not exploit the supposed vulnerabilities that they had identified in the MBTA's computer system, they promised that they would not do so in the future, and they promised that they would not teach others how to.

Earlier the MBTA had asserted that "At a meeting last Tuesday involving all the parties, MIT staff and the students agreed to provide the MBTA with a copy of the presentation."

Det. Sullivan, however, says that at the meeting:

I asked the students to prepare a written summary of every vulnerability that they claimed to have discovered and how to fix these vulnerabilities. The MIT Undergrads agreed to provide me with such a paper within two weeks.

While the MBTA had originally requested the information within two weeks of the August 4 meeting (August 18), the students nevertheless provided the MBTA with a confidential vulnerability report on Friday, August 8 (as promised), and a very detailed "Security Analysis" on August 13. After the meeting, the students understood that the MBTA's concerns were resolved, and that the students were to provide a confidential vulnerability assessment by the end of the week.

The disconnect over when to expect further information from the students appears to have been a major factor leading to the lawsuit. According to an MBTA statement: "When no call or information was forthcoming, the MBTA instructed its legal counsel to begin drafting Court papers, so that the MBTA could obtain this information." While we disagree that a lawsuit is the best way to obtain security researcher's work, it appears that this remains a critical purpose of the MBTA's lawsuit.

Det. Sullivan concludes by saying:

On August 6, 2008, both myself and [FBI] Agent Shafer personally met with [MBTA Official] Joseph Kelley and others to discuss the meeting that had taken place. I conveyed to all in attendance that we were confident that the students did not violate any state or federal criminal statues. Moreover, I conveyed that we were both comfortable and confident that the students would honor their declaration to us that they would not disclose any information that would enable others to harm the MBTA. After that meeting, I contacted Professor Rivest to let him know that Mr. Kelley may be reaching out to him.

The students never wanted attackers to have sufficient information to mount an attack. The students left out some key details in the work they did, because they did not want anyone to be able to attack the ticketing system or circumvent the system and get free fares. As security expert Eric Johanson confirmed "key information needed to compromise both the Charlie Ticket and the Charlie Card is not present in the Slides." In any event, the students never gave the talk nor released any software tools.

Unfortunately, it appears that misunderstandings remained. On the late afternoon of August 8, without any advance notice to the students, the MBTA filed a federal lawsuit that falsely asserted that the students violated federal law, were "traveling on the MBTA lines without paying fares," "have instructed others" in riding without paying fares," and "received or will illegally receive money and profits that rightfully belong to MBTA, in the form of lost transit fares." Of course, the students never rode the T for free or helped others do so. Much trouble could have been avoided if these misunderstanding could have been cleared up without the need for litigation.

The students have always been interested in coming to a reasonable resolution, and remain hopeful that the MBTA is willing to be reasonable. In the interim, they have no choice but to litigate.
August 14, 2008
20:03
MIT Students Still Gagged by Federal Court
» ‎ Electronic Frontier Foundation

A federal court judge in Boston Thursday refused to lift an unconstitutional gag order against three students from the Massachusetts Institute of Technology (MIT) who uncovered vulnerabilities in Boston's transit fare payment system. In an editorial today, the Boston Globe wrote that Judge O'Toole "ought to lift it." Instead, the judge continued the hearing until Tuesday, and left the temporary restraining order in place.

EFF began representing the students in this case on Friday, when the Massachusetts Bay Transit Authority (MBTA) sued the students in federal court. On Saturday, a judge issued the gag order in violation of the students' First Amendment right to discuss their important research.

The court relied on a federal law aimed at computer intrusions in issuing its order, holding that even discussing the flaws at a public conference constituted a "transmission" of a computer program that could harm the fare collection system. But discussion in a public forum is clearly not the same as computer intrusion, and the students had already assured the MBTA they would withhold a key detail of the results so others could not use the information for fraudulent purposes.

Compounding the issue Thursday, the judge also ordered the students to hand over more documents about their research, so the judge and the MBTA could see the documents before deciding whether the students could speak. This pre-publication review by a government agency -- whether it is a federal judge or a city transit agency -- is exactly the kind of prior restraint the First Amendment was designed to abolish. As the Supreme Court has noted:

The doctrine [against] prior restraint has its roots in the 16th and 17th century English system of censorship. Under that system, all printing presses and printers were licensed by the government, and nothing could lawfully be published without the prior approval of a government or church censor.

Our founders included the Bill of Rights in the Constitution to reject that system. Thus, under the First Amendment, Court have rejected "not only licensing schemes requiring speech to be submitted to an administrative censor for prepublication review, but also injunctions against future speech issued by judges." Here we have both.

Nevertheless, the students are interested in responsible disclosure, met with the MBTA on August 4, and already voluntarily gave the MBTA a confidential vulnerability assessment last Friday. Prior to today's hearing, the students provided, as part of a good faith effort to help resolve this matter, a more detailed 31-page Security Analysis that discusses the security vulnerabilities uncovered by the students. The report was provided to the MBTA on August 13, and filed with the court under seal.

According to the Boston Globe:

The T is not sure there is a security problem, but the 10-day injunction will provide time to find out. "The injunction is allowing us to review the research that they have and see if there is any validity to their findings, and take corrective action, if any is even necessary," said Lydia Rivera, a T spokeswoman.

The students have made clear that, since DEFCON is over, they will never give the presentation previously planned. Nevertheless, the MBTA is seeking to extend the 10-day TRO into a preliminary injunction that will last indefinitely, and has not indicated that any intent to drop the lawsuit.
12:33
minilinks for 2008-08-14
» ‎ Electronic Frontier Foundation
- Oops! FBI Sorry For Spying on Journalists
  FBI Director Robert Mueller called the NY Times and the Washington Post to express regret for a breach of reporters' phone records.
- Google Comes Clean On Targeted Advertising
  The Internet giant confessed to using DoubleClick cookies to deliver targeted advertising to users.
- Coordinated Cyberattack in Georgia War
  The embattled state of Georgia accused Russia of launching denial of service attacks against Georgian websites.
- Jobs Confirms iPhone Kill Switch
  Steve Jobs admitted that Apple implemented a tool to pull the plug on any iPhone software that appears malicious -- or otherwise disrupts the business model.
- Fliers Without ID Placed on List
  The TSA is adding names of passengers who entered checkpoints without
  IDs to a database of suspicious persons.
- Cops Using GPS to Track Suspects
  Police around the country are using GPS devices attached to cars to
  track people -- without using a warrant.
- Yahoo to Make Targeted Ads Optional
  As Congress investigates targeted advertising, Yahoo announces it will adjust its policy.
- The Permission Problem
  James Surowiecki reviews Michael Heller's book, "The Gridlock
  Economy," discussing the ways too much private ownership can be bad for economies.
- Warner Investing in Online Music
  An SEC filing shows that Warner invested $15 million in the same service it previously sued for infringement.
- Dell Unlikely to Get Trademark on "Cloud Computing"
  The US Patent and Trademark Office has rescinded its earlier decision to grant Dell the right to trademark the term "cloud computing."
- Selectable Output Control and DRM
  Techdirt argues that the MPAA does not need DRM to release movies.
- AT&T "Sin Tax"
  BoingBoing's Joel Johnson recommends that iPod users pay a "sin tax" each time they pay their AT&T bill -- with a donation to EFF!
August 13, 2008
19:11
Condition or Covenant, and Why Should You Care?
» ‎ Electronic Frontier Foundation

Imagine that you write some code, and offer it to the public under an open source license that requires that if someone distributes modified versions of the code, the modified versions also be open sourced. Now assume someone distributes modified versions of your code, but fails to open source the modified code.

Do you have a claim for breach of contract? Or for copyright infringement? Or both? And why should anyone other than a law professor care?

Copyright law and contract law are very different. The things you need to prove to win a case are different. Copyright law is federal, while contract claims fall under state law, which varies from state to state. Copyright damages will often be more expansive than contract damages. The standards for injunctive relief are different. The prevailing party in a copyright case can seek attorneys' fees, while the general rule in contract cases is that both sides bear their own attorneys' fees.

So it matters whether copyright or contract law applies.

And, truth be told, the hypothetical at the top of this post is not quite so hypothetical; it is very close to the facts in Jacobsen v. Katzer, a case concerning open sourced code from the Java Model Railroad Interface group. Today, the Federal Circuit vacated a district court decision [PDF] that had held that only contract law was implicated by the defendants' alleged breach of the open source license applicable to the JMRI code.

The court concluded that the key question was whether the parts of the agreement the defendants allegedly breached were mere covenants (things the defendants agreed not to do when they accepted the license), or also conditions of the license (things that must be satisfied in order for the defendants to be licensed at all). Because the license at issue went out of its way to state that licensees' obligations were "conditions," the court concluded that if the defendants were in breach, the plaintiff could sue for copyright infringement.

There are a lot of things in this opinion that the open source community should cheer. The opinion notes that open source software "can often be written and debugged faster and at lower cost than if the copyright holder were required to do all of the work independently," and points out that "[t]here are substantial benefits, including economic benefits, to the creation and distribution of copyrighted works under public licenses that range far beyond traditional license royalties." And the court emphatically concluded that "[c]opyright holders who engage in open source licensing have the right to control the modification and distribution of copyrighted material."

While we're pleased to see a panel of learned judges endorse the legal foundations of the open source software paradigm, the decision may also encourage proprietary software vendors who frequently fill their "end user license agreements" with restrictions that are denominated as "conditions" on the license.

If violating a "condition" in a EULA results in copyright infringement liability, what's to stop a software vendor from imposing conditions that are unrelated to copyright law (e.g. an agreement not to disparage the copyright owner, or to wear pink bunny ears on Tuesdays), or even antithetical to copyright law (e.g. a waiver of fair use rights)?

For a view of the dark side of "conditions" imposed in proprietary software licenses, consider the "thou shalt not run software we don't like" terms that Blizzard imposes on those who purchase World of Warcraft software, terms that recently were upheld in court despite a very astute amicus brief by Public Knowledge.

We're sure to see this issue come up again in future cases, so stay tuned.

← eGovMonitor - UK EList - Nettime-l →

Gregarius » Electronic Frontier Foundation

Feeds

Electronic Frontier Foundation (10 unread)