Hacker 2/HACKER2.mdf/cud/cud511b.txt

Text File | 1995-01-03 | 26KB | 476 lines

Date: 30 Jan 93 01:03:34 CST
From: Jim Thomas <[e-mail]>
Subject: File 2--A Chat with the SPA

((MODERATORS' NOTE: The following is a summary of conversations with
SPA personnel between October, 1992 and January, 1993.  The contacts,
especially Terri Childs (SPA Public Relations Manager), Illene
Rosenthal (SPA General Counsel), David Tremblay (Research Director),
and Katherine Borsecnik, were patient, cordial and open. They also
spoke slowly, allowing for occasional verbatim note-taking.
The narrative attempts to present the SPA from their own perspective.
We strongly encourage rational responses that address the issues raised)).

THE ORIGINS OF THE SPA

Ken Wasch, the founder and Executive Director of the SPA, was an
attorney working for the federal government in 1984.  Perhaps because
the Beltway is an environment teeming with trade associations, he
recognized a need for a trade association for the rapidly growing PC
software industry.  Unlike a professional association, which supports
individuals in furthering their professional career, a trade
association furthers the interests of companies in furthering their
enterprise.  He perceived a need, and he hoped to fill the vacuum.
When 25 software companies signed up, the SPA officially came into
existence as a non-profit organization. His motivation, according to
one SPA staff person, was that he simply liked the software industry
and wanted to further its goals.  The SPA was officially founded on
April 5, 1984.  Its current staff of about two dozen people provides a
variety of services to software publishers and others.

SPA MEMBERSHIP

Unlike some associations, such as the Business Software Alliance, SPA
membership is open to any legitimate software or trade-related
company.  SPA membership reached 1,000 in fall of 1992, and continues
to grow.  As a trade association, it represents companies, *not*
individuals.  So, if an individual wants to join, they do so as a
company.  About two-thirds of the members are software developers, and
one-third are companies who support the software industry, including
venture capitalists, market researchers, public relations firms, and
companies whose clients are software manufacturers.  The diversity of
membership is seen as one strength of the SPA, because it infuses a
variety of ideas and perspectives into programs and policy.

DUES AND BUDGET: SPA dues are assigned on an "ability-to-pay" sliding
scale, depending on the company's annual revenues. Dues range from
$750 to $125,000 a year. About 60 percent of the members pay in the
three lowest categories, which are $750, $850, and $1,000.  Annual
dues for a small software company are about the same as the costs for
a one-year family subscription to cable a cable television full
service, and are therefore not prohibitive even for the smallest
companies.

EDUCATIONAL AND COPYRIGHT FUNCTIONS:

The SPA is divided into two divisions, each with a separate operating
budget. The first, the GENERAL SPA FUND, is the association's main
group with an annual operating budget of about $4.5 million. The
second, the COPYRIGHT PROTECTION FUND (CPF), has a budget of about
$2.86 million for fiscal year 1993.  The term "fund" is used to refer
to each group, and does not refer only to a pool of money.

The general fund provides for rent, maintenance, conferences, and
salaries for the non-copyright protection personnel.  The copyright
Protection Fund's budget provides for enforcement, educational
outreach activities such as producing videos, going into schools, and
publishing SPA brochures, which are given away or at nominal cost. The
question of how much the SPA spends on education is complex, because
both groups engage in educational activities.  According to Katherine
Borsecnik:

     Remember, our primary mission is to serve our members, who
     are primarily software publishers. The copyright protection
     fund is a separate fund that pays for all our anti-piracy
     work, both the litigation and the education. The kind of
     education that you mention, going into schools, or going
     into businesses, or general speeches, all of that is related
     to copyright and intellectual property, so it all comes out
     of Copyright Protection Fund. We have a very large
     education budget in the general fund that goes for things
     like conferences for our members in the software
     industry. . . . I think we're talking about two different
     things here.  You're talking about general education as
     anti-piracy stuff. . . . So, the $2. 86 million budget includes
     speeches, brochures, videos, and other information that goes
     to end users. . . They are more expensive, because we do them
     in large quantities, than our legal expenses.

The SPA's anti-piracy activities are its most visible and dramatic,
but they constitute only a portion of what the SPA does for members.
Ms. Borsecnik explained:

    There's a laundry list of member benefits. We do a lot of market
    research.  A lot of companies join because that market
    research is very valuable to them, and they'd never get the
    kind of research that we do. So we do tons of market
    research. We track sales in 25 diferent software categories
    every single month. We also do market-specific end-user
    studies....

    And then we have a sales certification program, sort of like
    in the recording industry, gold and platinum, and these are
    programs that help companies with marketability programs,
    those little labels they put on the box that say "certified,
    100,000 sold" or whatever.

In addition, the general division does consumer and end-user studies
on education, provides salary studies, and distributes publications
that include newsletters, a recently-published book on distribution
channels, and lengthy articles. They also host three conferences a year.
They conduct an annual awards presenation modeled on the academy
awards, and this year 525 products are being nominated for 25
categories of awards.

THE COPYRIGHT PROTECTION FUND

The Copyright Protection Fund's staff includes one clerical position,
an administrative assistant, two or three non-attorney investigators,
and Illene Rosenthal, the SPA's general counsel and overseer of the
CPF. She and Ken Wasch, the SPA's Executive Director, are the
only two attorneys on staff.

The Copy Right Protection Fund, formed in 1985, is a separate subset
of the SPA.  It was initially set up and funded by contributions by
some of the members to help "prime the pump" in the SPA's anti-piracy
efforts.  After that initial pump-priming, it has been entirely
self-funded by litigtion settlements. A separate committee directs the
staff a to what kinds of actions to take and is the overseer of the
anti-piracy's efforts.  Similar to a board of directors, the committee
includes members from the software industry.  The dual goals are to
educate the public about acceptable software use and copyright law and
to litigate against those judged to abuse copyright law.  The fund
filed its first suit in March, 1988, against "The Clone Store," a San
Leandro, Calif., computer dealer.  The case was settled out of court
for $10,000.

The CPF has generated considerable publicity for its aggressive
reactive opposition to software piracy, but education, not
enforcement, is the division's professed primary goal. According to
staff.

The CPF produces brochures explaining copyright protection for
end-users, promotes awareness of the problem of "soft-lifting," a term
for using unauthorized copyright software akin to shoplifting, and
delivers its anti-piracy message to schools, business, and others.
The SPA's rap-video, "Don't Copy that Floppy" (reviewed in CuD #4.63)
is available at no cost.  The SPA has also developed a program called
SPAUDIT intended to help end-users, especially companies and schools,
identify over 650 software programs of members that might be installed
on a personal computer.  The program allows a user to first identify
which programs exist, and then sort out and remove those that might be
unpurchased.  The program is about 43K and quite easy to use. However,
in using it on my own system, it identified 13 programs, but at least
four of the "hits" were false in that these programs were not on my
system.  Nonetheless, the program, even if not particularly accurate,
possesses a symbolic function in that it raises the consciousness of
system supervisors and helps establish an ethos of attention to
outside software on "the boss's" computer.

THE CPF--SOFTWARE POLICE?

The CPF actively promotes a self-image of "software cop."
The June 17, 1991, issue of Information Week carried a cover graphic
similar to a 1940s' comic book: Two respectable looking office workers
are in their office when a super-hero in a suit and trenchcoat bursts
through the door, knocking it off its hinges. "Nobody Move! Keep your
hands away from those keyboards," he says. "Oh my gosh! It's the
SPA!!" exclaims a shocked male worker. "QUICK! Stash the disks!!" says
the female. Other advertisements, which it either sponsors or
endorses, carry the same law-and-order/piracy-will-get-you-jailed
theme.  According to Ms. Rosenthal, the ads and the motif are intended
to be humorous and not necessarily literal, but they nonetheless
symbolize what many observers see as a simplistic ethos of harshly
punitive responses to what in fact is a complex problem. Whether
justified or not, the SPA has the reputation of simply "not getting
it" when it comes to possession or use of unpurchased software.  It is
not that the SPA's critics condone theft or support the practice of
regularly and intentionally violating copyright protections. Rather,
critics point to what they judge to be questionable tactics in the
SPA's war on piracy.  The SPA responds by stressing that the rights of
software publishers must be protected from rip-off and deprivation of
fair compensation for their labor.

TARGETING "PIRATES"

Contrary to public perception, SPA personnel indicate that they do not
target a particular group or type of offender.  They respond to each
case individually and target those for whom there is "clear evidence"
of abuse. Despite their reputation for threats of litigation, they
stress that their primary strategy is to obtain voluntary compliance
with copyright law.  CuD asked several staff members to explain,
step-by-step, how they respond to a complaint of copyright violations.

First, the SPA receives information from employees, whistle-blowers,
or private citizens who call its highly publicized "anti-piracy"
hotline (800-388-PIR8).  They receive between 50-150 calls a week, but
only about 2 to 10 of these are pursued. The first step in pursuing a
case is to obtain as much information as possible. According to Illene
Rosenthal:

     We want to know how long the person's been working,
     where they've been working, what the relationship is they
     have with the company....Obviously, we want to know as
     much as possible. We want to know where the person
     worked, how long they've worked there, how they know this
     information, whether or not they've discussed it with
     management, basically, everything you do in an
     investigation.  What specific programs are involved, how
     many programs, illegal programs, there are.  This kind of
     information you're going to get over several phone calls.
     You're not going to necessarily get it on the first phone
     call. But, we do a thorough investigation, and when we're
     comfortable with that information, what we're going to do
     is pursue the case. If we're not comfortable with that
     information, obviously we're not going to pursue the
     case.

Depending on the evidence, the seriousness of the alleged offense, and
the motivation, one of several courses of action exist.  The first is
THE RAID, which involves entering the alleged offender's premises and
searching the computer system(s). Second is an AUDIT LETTER, in which
the SPA provides a target with an opportunity to voluntarily comply
with a request to examine hard drives for "unauthorized" software. Third
is a CEASE AND DESIST LETTER, which is a letter notifying an alleged
offender that they may be in violation of copyright law and provides
the target with the opportunity to voluntarily stop the perceived
offense and avoid further action.  The letter option allows the
company or BBS to do its own investigation and report back to the SPA.

The decision on which option to invoke depends on a number of criteria
on a case-by-case basis. According to Ms. Rosenthal:

     We discuss this in a group of about seven of us, and we sit
     down and discuss the cases, and we'll throw out the
     various factors and sometimes we'll say, "Look, I need more
     information," and they'll get back to the source to get more
     information. But, ultimately, you get the information you
     need so that you can feel as comfortable as possible taking
     whatever action you decide to pursue or not pursue in a
     given case. . . .We really look at each case on a
     case-by-case basis. It's not that we're looking for
     particular types of industries or particular types of
     organizations. It's the information that comes out, the
     quality of the information, the credibility of the
     informant, the seriousness of the violation, the
     willfulness of the violation, they're just all factors
     that go into it.

The AUDIT LETTER presumes good faith on the part of the target.  It
requests permission for SPA personnel to conduct a software audit on
the premises. In return, the SPA will forgo litigation.  The SPA's
Background Information brochure identifies four principles in the SPA
software audit:

1. An SPA representative observes as the directories of each PC are
printed.

2. Directory information is compared with purchase records.

3. The company agrees up front to make a penalty payment to the SPA
Copyright Protection Fund in the amount equal to the retail price of
each illegal software program found during the course of the audit.

4. All unauthorized copies are destroyed, and the audited
company agrees to replace them with legitimate copies.

Critics argue that this policy constitutes a double penalty.
First, they claim, there is the equivalent of a coerced fine
in payment of software costs. Second, purchasing a copy of
each product found may exceed what some companies need or
even were aware they had on the systems. SPA supporters
counter by arguing the payments are voluntary and if the
company feels an injustice has occured, they are able to
pursue it through the litigation option.

According to SPA staff, it would be difficult for the target to erase
"evidence," because auditors normally have prior information of what
software exists and where it is located.  "People have tried that
before and gotten caught," say staff.  Staff also indicate that, when
they choose an audit option, they normally have a source of
information to inform them of whether the target is answering in good
faith or not.  Although this presumably means an "inside source," SPA
staff stopped short of saying that it necessarily meant that the
informant was still employed for or involved with the target:  "We
always have access to information when we send out the audit letters,"
according to Ms. Rosenthal.  What happens if a target says "no!" to an
audit letter?  "We sue 'em," she said.

The CEASE AND DESIST LETTER, the least intrusive of the options,
conveys the threat of a suit if the recipient fails to comply, but
generally the letter accomplishes the goal.

Although the SPA has NEVER actually gone to court against an alleged
software transgressor, to date they have initiated about 150 civil
actions. All have been settled out of court, largely on the basis of
the evidence. According to the SPA General Counsel, in only one case
has the SPA been "wrong." The SPA's Background Information sheet
(July, 1992), indicates that the Copyright Protection Fund's first law
suit was filed in March, 1988, against "The Clone Store," a San
Leandro, California, computer dealer.  The case was settled for
$10,000. In a larger settlement, the SPA won $350,000 (plus attorneys'
feels) in a settlement against Parametrix, Inc., a Seattle-based
environmental and engineering consulting firm in 1991.  The
information sheet also reveals that in 1991 the SPA won a settlement
with the University of Oregon Continuation Center for $130,000, which
included an agreement that the University organize and host a national
conference in Portland, Oregon, on copyright law and software use.
The University denied the allegations and, according to the University
legal counsel, the settlement in no way implied an admission or
concession of guilt.

Why would a company chose to settle if they are innocent?  According
to one trial lawyer, it is often the most economically feasible.
Trials are costly, and even winning a case can be more costly than a
settlement. To lose can be even more costly.  Hence, settling without
an admission of guilt, as insurance and other companies have learned,
can be the most rational strategy.

When calculating the dollar amount of a settlement, SPA personnel look
at a number of factors, including the amount of unlicensed software on
a system. However, staff indicate that rarely will they include or
respond to non-members' software that might be present, and focus
instead on their memberships' programs. Nor do members share in
settlement fees.  All monetary awards are returned directly into the
Copyright Protection Fund to pay for education, salaries, and
other expenses. Ms. Borsecnik added:

     All of the money for our settlements goes back into the
     Copyright Protection Fund. The philosophy behind that is
     that that's how we produce the educational materials.
     Because, with the exception of one book that we charge for,
     all of our materials are either free or nominal cost because
     of postage.  So our settlements help us continue our
     educational activities.  The companies that pay membership
     dues don't pay for what we do on behalf of them in
     copyright. It's all self-funded. They pay us money, and we
     do a lot of other things. . . .education and publications, and
     just tons of stuff we do that have nothing to do with
     piracy.  Those things are our primary mission. Piracy is
     something in addition we do for them. They don't pay us
     extra to do that.

SPA personnel resist the accusation that they are more interested
in litigating than in broader educational activities.
According to the General Counsel:

     Our primary strategy is to get people to voluntarily comply
     with the software laws. And, we do that by a two-fold
     approach. The first is that we have an extremely effective
     and extremely good educational program. We give over a
     hundred lectures a year about the copyright laws and how to
     manage software, we give a lot of free material, we have the
     SPA audit kit, we have brochures that we give away for
     free--we've given away over 60,000 brochures that, in
     English, tell you what the copyright law is and what you
     have to do to comply, we have videos that talk to you about
     the software laws for about 12 minutes, we have educational
     videos that we give to schools for free.

However, the SPA does feel that voluntary compliance requires
a threat, as the General Counsel explains:

   ((As a criminologist)), you're certainly aware that people are
   unlikely to comply voluntarily if they think that there's no
   risk to complying.  This is the perfect situation of where you
   really have to have some reasonable threat of enforcement or
   there's really no incentive for most people to comply.

There is considerable debate among criminologists over the degree to
which coercion is necessary to constrain behavior, and according to
SPA data, software "piracy" steadily declined from 1989 to 1991.  1992
data is not yet available.  In 1989, they estimated that about 48
percent of PC was pirated, declining to 37 percent in 1990, and 22
percent in 1991.  This trend seems to challenge the view that
aggressive litigation has contributed to the decline, because the
heaviest SPA litigation and corresponding publicity has occured in the
past two years.  Critics would suggest that education and emphasis on
"computer ethics" has been far more successful in curtailing illicit
use.

THE SHRINK-WRAP LICENSE

There is considerable disagreement between attorneys and others over
the legal status of shrinkwrap licenses.  The SPA adheres to the view
that the shrinkwrap license is a legally binding agreement between an
end-user and the software author. A SHRINK-WRAP license is so-named
because most software programs come in a cellophane wrapping that
seals it.

The typical shrinkwrap licence, as typified by the package that
Microsoft's DOS 5.0 came in, provides among other things that 1) The
software is owned by the manufacturer, and the user is only licensing
it; 2) The user may install the program on one and only on one disk;
3) Only one backup/archival and no others may be made; 4) The user may
not decompile or disassemble the program; and 5) If the program is
transfered or given to another, no copies may be retained by the
original user.

Despite the many criticisms of these licenses, the SPA argues that
unsealing by breaking the cellophane is an explicit and unalterable
agreement that the user will abide by whatever restrictions on use and
copying are contained in the small print.  Although nothing on point
has been established in a court of law, the SPA defends shrinkwrap as
a valid contract.  Others, however, aren't so sure (see Lance Rose's
commentary in CuD 5.06).

SUMMARY

Whether one supports or opposes the SPA's methods, several points seem
clear:

1) The SPA is committed to serving its members, and does so
aggressively.

2) When discussing the SPA, care should be taken to distinguish
between its general activities and the Copyright Protection Fund.

3) The SPA's actions have been instrumental in raising the issues of
software piracy to a level that demands public dialogue regarding
whether and/or where an acceptable line should be drawn between
"zero-tolerance" and permissable fair-use.

4) The issues raised by the SPA's aggressive anti-piracy campaign
extend beyond a single organization or policy. They raise issues of
reconciling competing interests--those of publishers and
end-users--and of identifying appropriate social responses to alleged
transgressions. The issues also include resolving the problem of
applying familiar legal and ethical concepts and theories to changes
brought by revolutionary technology.

The SPA certainly deserves credit for raising the issues
of software abuse. However, some of its methods continue to be subject
to severe criticism. In the interstices between "zero-tolerance" and
fair-use lies considerable room for honest intellectual disagreement.
It is not sufficient for those of us who are critical of some of the
SPA's methods to simply sit back and take shots at their method. If we
don't like the methods, we are certainly bound to criticize them, but
we are also obligated to develop constructive alternatives to balance
the rights of both users and publishers. Among the questions we pose
to readers:

1) What, if any, are the acceptable limits of software copying and
distribution beyond those authorized by shrinkwrap licenses?

2) What legal sanctions ought be provided for the wide range of
possible infractions that recognize extreme abuse on one hand and
casual ethical lapses on the other?

3) How might current or future laws be revised or written that would
minimize potential prosecutorial abuse on one hand, but provide
sufficient sanctions for appropriate transgressions on the other?

4) When does "fair-use" become ripoff?

These and other issues will be explored in future issues.

((CONCLUDING NOTE: We invited the SPA to read this issue prior to
publication. We delayed  it by over a week to provide them the
opportunity. We indicated that we would be amenable to correcting any
errors, and would be willing to revise whatever they found inaccurate
or unfair. I was given an email address, and it was confirmed as
correct. Several notes and two of the three files were sent. The third
was to be sent when I received confirmation of receipt. I received no
response.  I left a message on the appropriate SPA staffer's answering
machine indicating that the files had been sent and reaffirmed
encouragement to read the files and provide feedback. I received no
answer as of Feb 7.

We encourage the SPA to engage in a dialogue over the issues to be
addressed in this and coming issues. If they are as serious about
public outreach and education as they repeatedly emphasized, we hope
they welcome the opportunity to engage in a dialogue with CuD
readers)).

Downloaded From P-80 International Information Systems 304-744-2253