Tag: TPMs

Singapore’s New Copyright Act Three Years On: There’s No Need to Open the AI Exception Door Even Wider

Image: Shutterstock (modified)

The 2021 Revisions

Back in 2021 I wrote a mixed review of the revisions brought in to update Singapore’s Copyright Act. There were some significant positives for rights-holders, notably a new provision that made it illegal to sell ISDs (Illicit Streaming Devices, i.e. specially configured set top boxes) and associated software applications that offered access to pirated content (movies, television shows, sports events), or to advertise that the devices provided access to such content. Until the new law was brought in, Singapore had been a hotbed for streaming piracy with set top box retailers exploiting loopholes in the law to openly advertise and sell devices that could easily be modified to access pirated content. The ISD situation has improved markedly although illegal streaming of sports content remains a problem, with blocking of illegal offshore streaming sites (site blocking) being one solution. There were some other upsides for rights-holders as well, such as enhancing creator’s rights through a new right of attribution and providing a new public performance remuneration right for sound recordings. However, there were also some potential concerns and warning signs with regard to a broadening of copyright exceptions.

The Text and Data Mining (TDM) Exception

Some of the exceptions related to use by schools, galleries, museums and archives, and were suitably constrained to avoid negative commercial impact on content providers. Another more controversial exception was a Text and Data Mining (TDM) exception for “computational data analysis”. This was defined in the legislation as including the use of a computer program to identify, extract and analyze information or data from a work. Training for machine learning was used as an example. To me, that sounds a lot like scraping content to train AI algorithms. The 2021 TDM exception applied to both commercial and non-commercial uses (in many jurisdictions there are either no specific exceptions for TDM, as in Canada, or the use is limited to strictly non-commercial research purposes, as in the EU, where there is also an opt-out provision for rights-holders). The Singapore TDM exception is one of the broadest exceptions for AI training purposes anywhere. While it does have some safeguards, they are minimal.

Lawful Access Required

These safeguards require that the user have lawful access to the work. If the work is protected by a TPM (Technological Protection Method, aka digital lock) such as a paywall, and if the TPM is circumvented, or if the original was obtained from an online location known to have flagrantly infringed copyright, access would not be lawful. The Copyright Fact sheet explanatory brochure published by Singapore’s Intellectual Property Office provides the following illustration of this;

“A company is developing an artificial intelligence programme that can translate books from one language to another. To do so, the company carries out processes which involve making copies of various books in order to “teach” the programme how to recognise patterns. The company may rely on this exception to make the copies without first obtaining permission from the copyright owners of the books, provided that the company complies with the other conditions under this exception, such as not using the copies for any other purpose apart from computational data analysis. Moreover, the company must have lawful access to the materials that it copies. This means that it must first purchase the books it wants to use or subscribe to services that provide it with access to those books. The company should not circumvent paywalls to access the books.”

But Lawful Access Protection is Thin

Even this degree of protection does not really offer much comfort. For example, lawful access can be obtained by purchasing the cheapest or lowest minimal access possible and then using that access to justify commercial exploitation. Or, as in the example above, the company could purchase exactly one copy of each book that it wants to ingest. In the case of a paywall, instead of purchasing an institutional subscription, an employee of a company could purchase a single, individual subscription, gain lawful access and then proceed to exploit the content without licensing it. This is similar to the situation faced by the online journal in Canada, Blacklock’s Reporter, (which I wrote about here) where an employee of a government agency that employs 6000 people purchased a single subscription for about $150 and then shared the password for that subscription with whoever in that agency felt they needed access to the paywall-protected content. The Federal Court of Canada, in a controversial decision that is being appealed, found there was no infringement because the access was licitly obtained, and the use complied with fair dealing criteria.

Singapore has yet another loophole where an unlicensed user can mount an “I didn’t know” defence. Under the current law if the user did not know or could not have reasonably known that the copy of the work they were using was infringing, they could get a pass. (Gee, I didn’t know…and I didn’t try very hard to find out). Under another subsection, even if the first copy is an infringing copy “but the use of infringing copies is necessary for a prescribed purpose” and if the user “does not use the copy to carry out computational data analysis for any other purpose…”, a further exception to lawful use is created. In other words, using pirated content for TDM purposes is okay if the circumstances are right. All in all, the existing protection for rights-holders under Singapore’s laws is exceedingly thin.

Proposed Circumvention of Digital Protection for TDM Purposes

With respect to Text and Data Mining, this is the situation that has prevailed from 2021 until now. The exception was very broad but had some minimal guardrails (a requirement for legal access, with some exceptions) that provided a thin layer of protection for creators and content rights-holders. Now, however, even that minimal layer of protection is under threat. Pushed by the AI crowd, Singapore is now proposing to legalize circumvention of a TPM/digital lock for computational data analysis. In a consultation paper issued in April, the Ministry of Law sought input on the existing exceptions that currently allow for circumvention of digital locks (these include use of obsolete software, use of assistive technologies for audio and ebooks, educational uses of films in certified media courses, use of film clips for criticism or review in the making of a documentary, and a couple of others). Under the legislation, these must be reviewed every four years.

In addition to the review of existing exceptions that allow for the breaking of a digital lock, the Ministry is proposing three new purposes, on the premise that “circumvention should be allowed for… situations where access control measures are considered to adversely impair legitimate, non-infringing uses”. The new proposed exceptions to the prohibition on circumvention relate to use of copyrighted materials in a public collection for purposes of preservation and replacement, or for administrative purposes, (both unobjectionable) but also use of copyright works and protected performances for computational data analysis. In plain language, under this last provision, it would be legal in Singapore to hack a TPM (digital lock) that has been created by an author to protect access to copyrighted content as long as the intended use was for AI training purposes! Frankly, that is outrageous, and basically strips copyright owners of their rights to their property.

Of course, that is not how the Asia Internet Coalition sees it. Its brief to the Ministry it states that;

“The absence of an exception for computational analysis creates a disjointed regulatory landscape where conflicting laws may grant Text and Data Mining (TDM) rights but simultaneously prohibit their exercise. This ambiguity risks stifling investment and innovation in AI technologies. We emphasize the need for clear and coherent TPM laws that explicitly allow circumvention for fair use and TDM exceptions, ensuring legal certainty for stakeholders.”

The only “ambiguity” in the current law is that access must be lawful and hacking a digital lock to access the content renders the access unlawful. The AI crowd wants to strip away the sole, already-inadequate remaining protection for rights-holders.

Protecting TPMs (Digital Locks) and International Trade Commitments

On the other side of the equation, various rights-holder groups have weighed in, including IFRRO, the International Federation of Reproduction Rights Organizations (no, nothing to do with fertility or childbirth), the IIPA, the International Intellectual Property Alliance, the Copyright Alliance and the European Publishers Council, among others. IFRRO has based its comments on the lawful access argument. To hack a TPM that is protecting access to content is the antithesis of lawful access. Legalizing burgling doesn’t justify burgling. (My words, not IFRRO’s). IFRRO also points out that unduly permissive regimes have been rejected elsewhere, citing the EU and UK, and that they do nothing to sustain creative ecosystems over the long term. In addition to these arguments, the IIPA and the Copyright Alliance, both US based organizations, cite the 2004 Singapore-US Free Trade Agreement. That Agreement provides for a specified list of exceptions to the anti-circumvention rule (text and data mining is not among them) and while additional “temporary” exceptions (up to 4 years) are allowed, they must “not impair the adequacy of legal protection or the effectiveness of legal remedies that the Party (ie Singapore) provides against the circumvention of effective technological measures.” (Article 16.4.7 (f)).

There is also concern that, if adopted, the legalization of circumvention for AI scraping would violate the “three step test” of the Berne Convention, to which both Singapore and the US are parties. That provision requires that any exceptions to copyright protection be limited to (1) “certain special cases,” (2) “provided that such reproduction does not conflict with a normal exploitation of the work,” and (3) “does not unreasonably prejudice the legitimate interests of the author.” To strip away TPM access control protection for a copyrighted work so that another party can use the content for commercial purposes would clearly, in my view, be a violation of these terms of the Convention. That said, I am only aware of one situation where the three-step test has actually been litigated under WTO dispute settlement rules.

Don’t Throw Singapore’s Creators Under the Bus

Will these interventions have the desired effect of preventing the door allowing AI copyright exceptions from being kicked open even wider in Singapore? One would hope so, for the sake of creators everywhere, including those in Singapore. Throwing the creative industries under the bus to promote “innovation” in the name of generative AI development is a shortsighted and ultimately counterproductive strategy. One would hope that reasoning would have as much or more impact on Singapore policy makers as references to clauses in the US-Singapore FTA, but all arguments count.

Singapore’s Copyright Act review exercise needs to result in a balanced approach that protects creative industries while allowing for text and data mining within reasonable limits. The TDM exception door is already open very wide.  Kicking it open even wider would be a serious policy mistake.

© Hugh Stephens 2024. All Rights Reserved.

Fair Dealing, Passwords and Technological Protection Measures (TPMs) in Canada: Federal Court Confirms Fair Dealing Does Not Trump TPMs (Digital Lock Rules)

Image: Shutterstock.com

Anyone who has been following this case, Blacklock’s Reporter v Attorney General of Canada, might be scratching their heads about now, saying, “Wait a minute, didn’t I just read the exact opposite somewhere?”. Yes, if you were reading Michael Geist’s blog, that is precisely what you read. On June 1, Dr. Geist jumped in with both feet with his blog “Huge Win for Copyright User Rights in Canada: Federal Court Rules Digital Lock Rules Do Not Trump Fair Dealing”. That is one interpretation of the outcome of this case but, IMHO, there is one heck of a lot of spin and some wishful thinking in that headline. In fact, if you were to listen to the breathless self-congratulatory podcast on Prof. Geist’s blog featuring the lawyers who represented CIPPIC, the “Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic” at the University of Ottawa (of which Dr. Geist was a founder) in their intervention, you would think that Canadian copyright law had suddenly been turned on its head by this decision.

While there has been a lot of commentary from both sides of the copyright divide on this case, I think some additional perspective is needed. Apart from the “huge win” Geist school of thought (picked up by a number of blogs from law firms), there have been comments that this marks the end of password protection in Canada as well as statements claiming that this decision puts Canada in violation of the CUSMA/USMCA. Although there were indeed controversial aspects of the decision relating to passwords and circumvention, it did not invalidate the role of access control TPMs, nor did it violate the CUSMA (which requires remedies be taken against circumvention without authority), nor did it give a blank cheque to password sharing. Let’s dig a bit deeper.  

First, we could start with my headline above stating that “Fair dealing does not trump TPMs.” This is admittedly a bit of counter spin but is just as accurate as the headline in Michael Geist’s blog. The Court’s decision does not allow or condone circumvention (i.e. the “trumping” or “overriding”) of a TPM, even if the purpose of the circumvention is to engage in a fair dealing activity. That is because the Court ruled there was no circumvention given the circumstances of the case. As the judge noted,

“In the case at bar, there is no circumvention of a TPM simply because the password was not circumvented: it was properly obtained and used for a legitimate purpose.” (Para 120)

We may disagree with the conclusion that there was no circumvention, but it is important to note that the Court did not sanction circumvention.

First, a quick clarification of what a TPM is. A TPM (Technological Protection Measure), sometimes called a “digital lock” is defined in the Copyright Act, s. 41, as;

“any effective technology, device or component that, in the ordinary course of its operation, (a) controls access to a work, to a performer’s performance fixed in a sound recording or to a sound recording and whose use is authorized by the copyright owner; or (b) restricts the doing – with respect to a work, to a performer’s performance fixed in a sound recording or to a sound recording – of any act [which only the copyright owner has the right to do or authorize].

The ”or” is important, since this distinguishes between two types of TPM, those that control access to a work (Part a of Section 41), aka “access controls” (which is what we are concerned with in this case), and those that control reproduction or other copyright related activities related to a work (Part b). aka “copy controls”.

Access controls provide the gateway that allows business models to function in the digital environment. You cannot access a work protected by copyright unless you are given the “key”, normally by paying for a subscription. (This is where paywalls and passwords come into the picture). Copy controls (Part b of Section 41) protect a copyright owner’s rights with respect to how the work is used. Those rights include the right to reproduce and distribute the work, but these rights are subject to fair dealing, as are copy controls in both Canada and the US, (fair use in the US case). It is only the circumvention of access controls that is prohibited by law. The Blacklock case was about access controls. (Often copy controls are bundled with access controls, in which case the access control protection prevails).

Because a copy cannot be made for fair dealing purposes unless access is licitly obtained (i.e by not circumventing access controls), it seems reasonable to state, as I have done, that fair dealing does not trump TPMs/digital locks.  Content has to be accessed legally in order for fair dealing rights to be exercised. A TPM may be part of that legal access. If a TPM has to be circumvented in order to exercise a fair dealing purpose, that is offside Section 41.1 (1) of the Canadian Copyright Act. The Blacklock’s case does not change this.

The Court was very precise in its language stating that the fair dealing rights of the users, in this case employees of Parks Canada, could be exercised because they had licit access to the content through a licitly obtained password. In other words, there was no hacking, bypassing or decryption of a TPM in order to obtain access to and then subsequently use the content on the basis of fair dealing. At the same time, the Court refrained from ruling on whether or not a password was a TPM. More on this later.

This reaffirmation of protection afforded to a TPM will no doubt disappoint Dr. Geist and others who in the past have argued that it should be legal to bypass a TPM in order to assert fair dealing rights. He has claimed there is a self-described “fair dealing gap” that stops users from accessing content to exercise fair dealing. He has advocated for a “long overdue fair dealing exception for the digital lock rules” and has also called for establishing an exception “to allow for circumvention of a TPM for any lawful purpose”.

There are a few circumstances when it is legal to break a TPM. These are specified in the Copyright Act and include such things as law enforcement and national security; reverse engineering for software compatibility; encryption research; verification as to whether a TPM permits the collection or communication of personal information; security testing of computer systems; accessibility for disabled persons; temporary recordings made by broadcasters for technical reasons; and unlocking cell phones. Fair dealing is not among them.

To grant a legal exception to allow users to bypass a TPM in order to access content for a fair dealing purpose, such as research, would gut the ability of creators to protect content and operate a business model in the digital age. While third parties can use content in accordance with the law, including fair dealing purposes, access must be gained legally. This is just as true in the digital age as it was in the analog world. As one of the lawyers on the Geist podcast himself said, you can’t throw a brick through the window of a bookstore and grab a book just to exercise your fair dealing rights. Nor can you hack a TPM that controls access to a work, whether or not your ultimate purpose is to conduct research. The Blacklock case did not change this. I explained all this in a blog I wrote several years ago (Why Can’t I Legally Pick ‘Digital Locks’ to exercise my Fair Dealing Rights?)

But what about passwords and paywalls? Aren’t they access control TPMs? I would have thought so, and that is what Blacklock’s contended, but it seems that in terms of jurisprudence this may be unclear. A password is certainly a common means to control access, to open the door to protected content once payment or some other form of authorization is given, and is often an integral feature of a TPM. The Attorney General of Canada (AGC), representing Parks Canada, asserted that a password is not a TPM (and thus the use of a password does not constitute circumvention), and asked the Court to so affirm. It did not do so. In the absence of any evidence or expert testimony as to what a TPM is, the Court declined to address the issue. To quote from the decision, (Para 111)

“…the issue raised clearly lacks any evidence of a technical nature…There is no evidence either of what a “password” is and what it was in this case: thus, there was no expert evidence led by either party on what, in this case, constitutes the TPM.”

The Court then went on to a discussion of paywalls and whether a paywall was a TPM, or merely a means of enforcing a TPM. The end result was uncertainty regarding how a TPM (which you will recall is any effective technology, device or component that controls access to a work) is to be defined. The Court also focussed on the word “effective” to dismiss Blacklock’s argument that s. 41 was intended to empower owners to protect their works with any technological tool at their disposal, yet “effective” has been interpreted in CUSMA to simply mean that it cannot be accidentally bypassed. (Article 20.66 FN 72).

Another loose end is the meaning of circumvention. Password sharing, apparently, is not circumvention according to the Court.

Key takeaways:

  1. The absence of expert testimony as to what constitutes a TPM was not helpful to Blacklock’s case. The judge admitted that a password could arguably constitute a TPM (Para 133) but in this case there was a paucity of evidence to allow that determination.
  2. The fact that the password was obtained licitly was also not helpful to Blacklock’s. The password was not circumvented (defined as descrambled, decrypted, or otherwise avoided, bypassed, removed, deactivated or impaired). A subscription had been paid for, and a password provided, albeit shared within the organization-but for a fair dealing purpose.
  3. The terms and conditions under which the subscription was purchased were ambiguous. This case dates back more than a decade. Memories are not precise. No exact replication of the Blacklock’s website at the time the subscription was purchased (2013) is available, having vanished into internet history. Testimony as to what it contained was contradictory and inconclusive. The terms of use were contradictory, allowing circulation of Blacklock’s content for personal and non-commercial use, but then referring to bulk subscriptions. Moreover, the terms and conditions did not require explicit acknowledgement by the user, opening it to claims that the terms may not have been read in full or understood. In short, there were a number of unfortunate loopholes that weakened the case. To use a cricket analogy, the Blacklock’s case was played on a regrettably weak wicket.
  4. The use of the content was, in my view, consistent with fair dealing. It constituted non-commercial research. Of that there can be little doubt. It met the fair dealing test.

All of these elements created a perfect storm of conditions that undermined Blacklock’s case, although the Court specifically rejected the AGC’s low-blow allegation of entrapment and deception by Blacklock’s.

Going forward, the issue of whether a password or paywall is a TPM needs to be clarified. If it is, does unauthorized sharing of a password constitute circumvention? The circumstances of the sharing will certainly be relevant. As the Court stated (Para 125),

“how the password was obtained is significant as this may prevent a user from invoking the fair dealing provisions of the Act. Obtaining content by descrambling a signal or decrypting a communication may render invoking fair dealing very difficult to establish successfully.”

Properly drafted terms and conditions can provide protection against unauthorized sharing of passwords, avoiding a weakness faced by Blacklock’s in this case. The Court also went on record to note that its decision was decided on the evidence presented in this case alone and is not to become a reference at large.

It is legitimate for Blacklock’s to feel cheated by the Court’s ruling that there was no circumvention of a TPM in this case, and I can sympathize with their frustration. At the same time, it is important to note that the Court did not legitimize the circumvention of a TPM for fair dealing purposes. The law remains that a fair dealing purpose does not legitimize the circumvention of a TPM, (or the breaking of a digital lock if you will).

Commentators and analysts are free to take what they wish from any case, emphasizing this or that aspect. Michael Geist and CIPPIC have provided their interpretation, or spin. Now you have an alternate perspective. While the outcome is not what Blacklock’s hoped for, bypassing or circumventing a TPM in the name of fair dealing has not been legitimized. In other words, “Fair Dealing Does Not Trump a TPM”.

© Hugh Stephens, 2024. All Rights Reserved