Business Strategies in Digital Rights Management Eric Baron University of Connecticut School of Law May 2007

E. BaronBusiness Strategies in DRM2 Introduction to DRM Growth of Digital Content and Internet –Perfect copies –Widespread distribution WIPO Copyright Treaty of 1996 –Article 11: Adequate protection against circumvention of effective technical protection measures (TPMs) –Article 12: Adequate remedies against alteration or removal of rights management information (RMI)

E. BaronBusiness Strategies in DRM3 U.S. – DMCA of U.S.C. §1201 – TPM –Proscribes circumvention 17 U.S.C. §1202 – CMI –Proscribes removal or alteration 17 U.S.C. §1203 – Private Right of Action 17 U.S.C. §1204 – Criminal Offense 5 years / $500K (first offense) 10 years / $1M (subsequent offenses)

E. BaronBusiness Strategies in DRM4 EU Copyright Directive Each Member State to implement laws Article 6 – TPM –Tools and acts of circumvention Article 7 – RMI –Removal or alteration Country Specific Differences –Varying exceptions –Labeling requirement (Germany)

E. BaronBusiness Strategies in DRM5 DRM Options Contract Based –EULAs and Technology Licensing Technology Based –TPM: Restrictions Basic Access Controls Rights Expression Language Secure Containers –RMI/CMI: Identifiers Watermarks Fingerprinting

E. BaronBusiness Strategies in DRM6 Access Restriction Example Content locked at source Unlocked by user with proper credentials Source: Cunard et al., Current Developments in the Field of Digital Rights Management, WIPO SCCR 10/2 Rev, p 38 (2004).

Watermark Identifier Example Source identifier –Added to digital content –Can be visible or encoded –Extracted by a monitoring / analysis application E. BaronBusiness Strategies in DRM7 Source: Cunard et al., Current Developments in the Field of Digital Rights Management, WIPO SCCR 10/2 Rev, p 28 (2004).

E. BaronBusiness Strategies in DRM8 CMI: Whats really necessary? US case law says: –© notice next to original images is not good enough. Kelly v. Arriba Soft Corp. –A trademark does not qualify as CMI. IQ Group Ltd. v. Weisner Publishers LLC. –Placing an author's name and copyright notice electronically on a digital photo is sufficient. McClatchey v. Associated Press. –BUT: Only District Court cases.

E. BaronBusiness Strategies in DRM9 Possible Identifier Regimes Levy System –Levies paid by those who produce products that are enhanced adaptation of © works via file swapping systems. Tax and Royalty System –Government tax ISP access, and tax paid to © holders based on access of works. Digital Retailers Model –ISPs monitor and bill based on download of © works.

E. BaronBusiness Strategies in DRM10 RMI/CMI with User Identifier Add user identifier to digital content upon purchase or access event. Monitor peer-to-peer sites for unauthorized copies. Source: Cunard et al., Current Developments in the Field of Digital Rights Management, WIPO SCCR 10/2 Rev, p 29 (2004).

DRM in Action E. BaronBusiness Strategies in DRM11

E. BaronBusiness Strategies in DRM12 DRM Criticisms Not Fully Effective –Analog Hole –Protection schemes are broken Component compatibility Privacy Creation of security loopholes

DRM Criticisms (cont.) Fair Use / Exceptions Public access rights –Physically impaired Bootstrapping –TPM on products not traditionally covered by ©. E. BaronBusiness Strategies in DRM13

E. BaronBusiness Strategies in DRM14 Business Strategies 1. Select a preferred format of distribution. 2. Consider a blended approach of contract plus technology based DRM. 3. Using simple RMI/CMI may be good enough, especially for small businesses. 4. Consider identifiers instead of TPM. 5. Partner with an established company for packaged solutions, particularly for TPM.

E. BaronBusiness Strategies in DRM15 Business Strategies (cont.) 6. Consider a tiered TPM, RMI/CMI, and/or DRM-free approach. 7. For contract-based DRM, review potential enforceability issues in countries of distribution. 8. Examine potential patent infringement issues when creating home grown DRM solutions.

E. BaronBusiness Strategies in DRM16 Business Strategies (cont.) 9. Consider adding a user identifier to digital content upon purchase. 10. Avoid bootstrapping non-copyrightable works with TPMs.