Journal of Intellectual Property Rights Vol 17, November 2012, pp 532-538 Information Disclosure Mechanism for Technological Protection Measures in China Lili Zhao† Center for China Information Security Law, Xi’an Jiao tong University, Shaanxi Xi’an, P R China 710 049 Received 12 February 2012, revised 21 May 2012 With increasing cases of digital works being copied and pirated, technological protection measures have been greatly favoured by copyright owners for protecting the intellectual property in their digital works, while ensuring that these works can be used and disseminated. However, when any copyright owner or supplier fails to disclose the information of technological protection measures appropriately or effectively, damages such as privacy violations, security breaches and unfair competition may be caused to the public. Therefore, it is necessary to establish an information disclosure mechanism for technological protection measures, make the labeling obligation with regard to technological protection measures by copyright owners apparent and warning to security risks obligatory by legislation; effectively guarding against information security threats from the technological protection measures. Keywords: Technological protection measures, TPM, information disclosure, label and warning The advance of digital technologies make many information security, it is necessary to integrate such acts things become possible, including the copy and in a standardized, normalized and legal manner. dissemination of commercially valuable digital works Therefore, to further prevent copyright owners from through global digital network. Particularly, among using insecure or untested software, protect information the copyright owners of entertainment industry, security and prohibit the abuse of TPMs; disclosure technological protection measures (TPMs) have been obligations should be established for the right holders of regarded as a necessary creation to help digital works TPMs in the form of legislation. Thus, damage from survive in global markets. TPMs to information security can be effectively In 2005, it was found that the computers of about prevented. two million American users were unconsciously exposed to malicious hackers after installation of XCP TPMs and Information Disclosure Mechanism (extended copy protection) of DRMs (digital rights Definition of TPMs measures) embedded with unknown software – TPMs of copyright refer to protection measures ‘rootkit’, made users lose control over their that are adopted by copyright owners to control the computers.1 The installation of a ‘rootkit’ could hide accessing, copying and transmitting of their works by any code to launch an attack on the user’s computer effective technological methods.3 Therefore, as one and network, and then damage their cyber information kind of technological methods and means, TPMs of security. This case was considered as a typical case of copyright must firstly meet the characteristics of the impact of TPMs on cyber information security. At technicality; secondly, TPMs of copyright should the same time, the non-transparency of TPMs was have close association with the object of copyright also thought to be the principle factor to this accident. since it is created for protecting the transmission of As for the copyright owners and suppliers of the works and realizing copyright and related rights; and TPMs, they prefer not to inform their users the use of thirdly, TPMs must have the desired effect of TPMs because they are not welcomed by users.2 protecting copyright owners. Practices have shown that it is unrealistic to expect copyright owners to disclose the information of TPMs on Legal Protection of WCT and WPPT their own, so in order to prevent potential risks of The WIPO Copyright Treaty (WCT) and the WIPO Performances and Phonograms Treaty (WPPT) afford ____________ †Email: [email protected] legal protection to TPMs, and require Member States ZHAO: INFORMATION DISCLOSURE MECHANISM FOR TECHNOLOGICAL PROTECTION MEASURES 533 to provide technological adjuncts to the protection of China stipulates that citizens in the exercise of copyright and related rights, when exploited on the freedom must respect and not harm others’ freedom Internet. According to the definition of Article 11 of and rights and also not harm national, social and WCT, ‘Contracting Parties shall provide adequate collective interests. On this ground, the Civil Law of legal protection and effective legal remedies against China categorically forbids the abuse of power by the circumvention of effective technological measures related subjects. Therefore, copyright holders or that are used by authors in connection with the copyright-related subjects should bear corresponding exercise of their rights under this Treaty or the Berne obligations and responsibilities for adverse effects Convention and that restrict acts, in respect of their caused by improper use of their TPMs, when enjoying works, which are not authorized by the authors the freedom, rights and interests of using TPMs in concerned or permitted by law’.4 Accordingly, their works. In this case, a systematic information effective technological measures for copyrights can disclosure mechanism is urgently needed to reconcile be used by copyrights holders to prohibit infringement the conflicts between copyright protection and without the authorization of the holders and information security. legislation. Information disclosure mechanism can improve the information equivalence between TPM owners and Definition of Disclosure Mechanism for TPMS users. According to the Asymmetric Information Information disclosure mechanism of TPMs refers Theory in economics, asymmetric information means to the statement and explanation that the creator or that each subject participating in market activities is operator of TPMs make with regard to the restriction unique, in an asymmetric state and in an asymmetric in the running process of TPMs and the possible status, which may result in adverse selection or moral security accident and security risk that may cause hazard.6 Each subject in the market will bear different damage to personal security, property security, public risks and benefits based on the volume of information interest and national security. It is mainly composed in the digital space. In a market transaction, the more of labels and warning: firstly, disclosure of the basic information a subject possesses, the stronger the characteristics of TPMs as well as the restriction in position it will be in. When TPMs are inserted into the running process of TPMs to users before they digital products in the form of a series of code in install and run the software; secondly, disclosure order to protect copyright, the users will only have warning users of the possible security risk and access to the code, without control or even fully damage that may cause to their interests before understanding the risks involved in the use of digital installation; thirdly, disclosure of information relating products. Hence, in a transaction of digital products to security risks to relevant safety supervision with TPMs, materials that can prove the damages department, and cooperating with this department for caused by TPMs are not equally known to the creators further details under this circumstance, when any or operators and users.7 Based on the fact that security threat that may endanger national security is regulations for TPM labeling and warning obligations found. are absent in legislation, it is necessary to regulate disclosure obligations, so that users can make rational The Rationale behind Information Disclosure choices before buying and installing TPMs. Mechanism for TPMs Disclosure mechanism is one of the most effective Obligation of Information Disclosure of TPMs: ways to reconcile the conflicts between copyright Global Perspective protection and information security. Issues of Sony The disclosure mechanism for TPMs was not BMG’s TPMs on its CD products and Microsoft’s specified in WCT or WPPT, but can be seen in some ‘Black Screen of Death’ indicate TPMs have posed a regulations in US, EU and France. threat to information security. It has been acknowledged that users including individuals, governments, USA enterprises and other organizations may face information To execute the obligations of WCT, the US Digital security threats, when TPMs are maliciously used by Millennium Copyright Act (DMCA) stipulates that somebody to remotely control their system, track their protection measures should afford enough and usage information, and even break their system and steal effective provisions to prevent anyone from their information.5 Article 51 of Constitutional Law of circumventing TPMs used by copyright owners, 534 J INTELLEC PROP RIGHTS, NOVEMBER 2012 namely anti-circumvention provision. According to rights in the personal data processing in electronic the Act, this provision mainly includes the following communication field, and ensuring that the regulations three conditions: (1) access to protected works between these data and electronic communication without permission is not allowed; (2) transacting on equipments and services coordinate with each other access and control of TPMs is forbidden; and well in this community. This directive was amended in (3) exercise of rights related to works protected by 2009, which established the first compulsive security TPMs without permission is not allowed. Based on breach disclosure system. However, while this system