Technology as security.

• Author: McCullagh, Declan
• Position: Privacy protection, encryption, and copy protection rights

1. INTRODUCTION

   It has become fashionable to fret about whether developments in technology have outpaced the law. To continue the metaphor, athletic Internet entrepreneurs are racing against stately, but plodding, courts and legislatures. The University of Michigan Law School has sponsored a symposium subtitled "Is Technology Outpacing the Law?" (1) Former Attorney General Janet Reno claimed in June 2000 that the Microsoft antitrust case proved to be a "strong reaffirmation" of antitrust law's ability to keep up with technology. (2) A commentator has described the 1998 Digital Millennium Copyright Act as "only about keeping up with technology." (3)

   But truthfully, technology has begun to supplant law, and at an accelerated pace. (4) Contrary to conventional wisdom, this may be a welcome and inevitable development. Instead of protecting rights such as privacy, free speech, and copyright through legal means, more people are turning to technological protection methods. To guarantee liberty, mechanisms such as public key encryption and anonymity-providing "dc-nets" (5) rely on the equations of mathematics and not the whims of courts and legislatures.

   Congress may, for instance, allow police to wiretap more easily or reduce the requirements for warrants. Judges may rule works like James Joyce's Ulysses to be obscene, then reverse positions a generation later. (6) But the laws of mathematics do not vary based on the whims of government officials or shifts in public opinion.

   This view is somewhat controversial. Freedom fighters using encryption to conceal their communications from Burma's brutal military junta may applaud technology's rule, but the FBI warns that the widespread use of encryption allows terrorists, drug smugglers, and child pornographers to evade law enforcement. (7) Anonymous publishing tools may cheer whistleblowers, yet provide little legal recourse when malicious lies are spread anonymously. Although copyright protection mechanisms may hinder piracy and reduce costs to consumers, librarians and civil libertarians argue that fair use rights will be lost in the process. (8)

   A loosely organized group of essayists, activists, and programmers called the "cypherpunks" has been a fierce champion of a technology-over-law approach. Using a mailing list (9) and a smattering of physical meetings around the globe, they have developed technological tools to protect privacy and free expression in areas where they feel the law does not. (10) A 1988 essay written by "cypherpunks" co-founder Tim May explains it well:

   Computer technology is on the verge of providing the ability for individuals and groups to communicate and interact with each other in a totally anonymous manner. These developments will alter completely the nature of government regulation, the ability to tax and control economic interactions, the ability to keep information secret, and will even alter the nature of trust and reputation. (11) As it turns out, May's prediction was premature. Technology has not forced governments to rethink their tax systems, and government regulation has not changed dramatically in the last ten years. But, May was one of the first to point out the powerful possibilities of protecting rights through technologies such as encryption and anonymity. (12)

2. COPYRIGHT

   Consider copy protection technology. Content owners, distributors, and publishers fret about how relatively easy online distribution methods will encourage copyright infringement and reduce sales. (13) They have reason to worry. As bandwidth increases and distribution technology improves, the cost of reproducing intellectual property could begin to edge toward zero. Everyone likes getting something for free, and piracy has always nibbled at the edges of publishers' and distributors' profits. But it is far easier and cheaper to copy an MP3 file than to photocopy a Tom Clancy novel, and digital copies--unlike their analog counterparts--do not diminish in value. Every digital copy has the same quality, which means that, if taken to its logical conclusion, widespread piracy will destroy the incentives to create valuable content.

   The law, standing alone, has not been able to protect copyrighted works effectively. Teenage pirates flout legal restrictions, secure in the knowledge that there are too many judgment-proof youth to fight with a civil suit. In the United States, trading copyrighted works is a felony under the No Electronic Theft Act of 1997. (14) But the prospect of becoming federal felons did not stop some 50 million Napster aficionados, whom the Justice Department has yet to force into compliance. (15) Overseas pirates are even less likely to be concerned about copyright laws, because foreign piracy laws are generally not as strict as those in the United States.

   Just as tangible property holders rely on technology in the form of fences, locks, and safes to guard their property, copyright holders have started to do the same. Unhappy with the limited number of criminal prosecutions and recognizing the futility of suing millions of potential customers, companies like Adobe, Microsoft, and Verance are turning to technology instead of the law. They are testing copy-protection systems and watermarking methods that may become widely used as technological protection schemes for copyrighted works. (16) It is too early to tell whether they will be successful, which technologies will become standards, what kinds of licenses will emerge as defaults, and whether consumers will tolerate strong copy protection--but the trend is clearly moving towards trusting technology more and the law less.

   Unfortunately for copyright holders, another trend is equally apparent: using technology to circumvent copy protection schemes. Hackers who want to play DVDs on a Linux computer for which there is no licensed player, those who want to view Adobe's eBooks on a laptop for which they do not have a license, and those who simply plan to pirate copyrighted material have made a sport of tunneling through content owners' technological schemes. Under the Digital Millennium Copyright Act ("DMCA"), this is a violation of federal law. (17) The DMCA, however, has had scant effect. Eight movie studios sued 2600 Magazine under the statute to remove a copy of DeCSS, a DVD-descrambling program, from its website. (18) The magazine complied by deleting DeCSS--and replacing it with the web address of where it could be found. A Google search in August 2001 reported 82,700 matches for DeCSS, many of them copies of the program the movie studios would like to erase from the Internet. (19) These facts reveal the other side of technology's coin. If content owners hope to rely on technological protection mechanisms, they had better hope such schemes actually work.

3. PRIVACY

   In the United States, privacy rights depend on an intricate patchwork of state statutes, caselaw, and federal statutes. Federal privacy law has taken a sector-by-sector approach, with data collection and...