Hackers Underworld 2: Forbidden Knowledge/Hackers Underworld 2: Forbidden Knowledge.iso/UNDERGRD/VOL_3/CUD327H.TXT

Text File | 1994-11-01 | 15KB | 262 lines

Date: Fri, 26 Jul 91 16:34:22 EDT
From: Jerry Leichter <[e-mail]>
Subject: File 8--re: Bill Vajk's latest comments

I found Bill Vajk's comments in Cu Digest, #3.26 somewhat depressing.
Here's a bright guy, willing to take the time to, for example, wade
through legal texts, who still seems unable to separate what he WANTS
the law to say, so as to get the RIGHT outcome in some PARTICULAR
case, from what it either DOES say or SHOULD say as a matter of good
social policy.

Let's look at the matter of copyrights an publication first.

>I was unable to discover the exact requirements currently mandate for
>deposit of software in order to support a copyright.

First we need to get the language right.  I know of no legal
significance to the term "support" with respect to a copyright.  In
order to sue for copyright infringement (and ONLY in that case is such
action REQUIRED), you must first register the copyright with the
Copyright Office.  The Office has regulations governing mandatory
deposit for registration (37 C.F.R. Chapter II, Sections 202.19 -
202.21).  The regulations, as published in 1978, contain exceptions,
including (Section 202.19(c)(5)) "computer programs [and other things,
like databases] ...  published ... only in the form of
machine-readable copies ... from which the work could not ordinarily
be visually perceived except with the aid of a machine...."  In
October 1989, the Copyright Office issued final regulations governing
machine-readable copies.  These regulations eliminated the exception
of 202.19(c)(5), authorizing the Office to demand deposit.  Note,
however, that the demand is not automatic.  Normally, the Copyright
Office only issues demands for material the Library of Congress tells
it it wants.  Appendix B to Part 202 includes a statement that the
current policy of the Copyright Office and the Library of Congress is
to demand the deposit only of materials in PC-DOS, MS-DOS or "other
compatible formats such as Xenix [?]", or Macintosh formats.

So, deposit MAY be required.  But WHAT must be deposited?  If the
October 1989 regulations follow the proposed regulations issued for
comment in September 1986 - which I believe is the case - then deposit
of computer programs for which trade secret protection is also
claimed, which have been published only in machine-readable form, can
take one of four forms:  The first and last 25 pages (or equivalent)
of source code, with no more than half the material blacked out; the
complete first and last 10 pages of source code; the first and last 25
pages of object code, containing at least 10 consecutive pages with
nothing blacked out; or, for programs of less then 25 pages, the whole
thing with no more than half blacked out.  In addition, it is possible
to petition for exceptions or suggest alternative forms of deposit.

It's worth noting that, even if a full deposit were required, the
deposited information, while a matter of public record, is NOT really
fully public:  It can be examined at the Copyright Office but may not
be removed or copied.

It's also worth noting that there is a completely separate deposit
requirement for the Library of Congress, mandated under a different
part of the law (Section 407 of the 1976 Copyright Act).  This applies
only to published material, and there are a variety of exceptions.  As
I noted before, failure to deposit under this regulation has no effect
on copyright, although it may subject you to fines.

>The Rose indictment calls the source code "confidential and
>proprietary." It is confidential in an AT&T security employee's dream,
>and that's about the extent.

AT&T provides copies of this software only under strict licenses.  It
goes after violaters, and they've done so for years.  (Consider the
Lyons book case.)  While copies have "leaked", copies of the Unix
sources are by no means freely available.  I think AT&T could make a
strong case for the claim that the sources remain "confidential and
proprietary".

>Leichter suggests that AT&T could claim to have never published the
>source code. This would be true if sale or offer to sell were a
>requirement. 17 USC addresses these issues with the term "vend"
>instead of "sell." The source code we're talking about has been
>published all right, and is in no way entitled to a "trade secret"
>status.

Nonsense.  It's been licensed on a restricted basis.  (Hardly anyone
sells software - you lose control of it too easily.  No one I know of
sells sources.)

Two kinds of words occur in legal documents:  "Terms of art"
(technical terms that have taken on specific legal meanings) and
normal English words.  In copyright law, "publication" has essentially
its normal English meaning.  Black's Law Dictionary, for example,
defines it as "The act of making public a book, writing, map, chart,
etc.; that is, offering or communicating it to the public for sale or
distribution of copies."  ("Publication" used to be a very significant
event because it terminated the common-law copyright that protected
unpublished works, and started the clock running on statutory
copy-right protections.  The 1976 Copyright Revision Act abolished
common law copy-rights, and the enabling registration under the Berne
treaty revised this area yet again, so the old concept is long dead.
Curiously, "publication" IS a term of art in another context:  For a
will to be valid, it must be "pub-lished".  However, in this case,
"publication" is accomplished by showing it to two (three?) witnesses,
whose signature is proof of such publication.  "Publication" can also
become an issue in tort law:  To sue for libel, you have to show the
material as "published".  Again, there is a special meaning.)

Given the way AT&T licenses its source code, it is clear that they
don't intend to publish it.  In fact, later in the same issue of Cud,
Craig Neidorf even includes a copy of AT&T's notice:

       Copyright (c) 1984 AT&T
       All Rights Reserved

     * THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF AT&T *
     * The copyright notice above does not evidence any    *
     * actual or intended publication of such source code. *

AT&T is hardly alone in taking this route to protecting its sources:
It's a commonly-recognized technique, recommended by practitioners in
the field.  I don't know if this has been tested in court, but keep in
mind that the judges who decide on the issue will come from the same
basic legal community that recommends the technique today.  Mr. Vajk,
who thinks he knows better, will not be asked for his opinion.

Even in the unlikely case that a court threw out this method of
protection, I'll give you excellent odds that legislation would be
introduced in Congress within a very short time to restore it:  The
computer business is just too important to this country, and too much
of the competitive advantage of American companies stems from software
protected under these terms.  Congress won't care a whit about the Len
Rose's of this world, but they WILL act if they can be convinced that
the Japanese or the Koreans or whoever are about to walk in and copy
all this important American software, and that no one will be able to
stop them.

>Leichter defends the errors made by law enforcement, stipulating that
>they have to learn how to deal with computer crime. Agreed, in
>principle, but not in detail. The problems I am addressing have to do
>with the general approach law enforcement seems to be taking to
>solving all crime these days. The Constitution hasn't changed
>recently.

I suggest Mr. Vajk learn a little history.  He might try, for example,
to talk to a Japanese-American citizen who spent time in American
internment camps in World War II.  Or to a woman who needed an
abortion before Roe v.  Wade.  (Actually, he may soon be able to find
many women to talk to on that issue.)

>Essentially the same rules have applied to investigations.  What does
>an officer have to learn about computer criminality in order to keep
>him from kicking in two doors because some law abiding individua