   
Universal Availability of Publications Core Programme
COPEARMS News
Issue 3, March 1998
Introduction
Welcome to the first issue of COPEARMS News which aims to give information about the Project's progress and about ERMS (Electronic Rights Management Systems) issues in general.
COPEARMS began in November 1995 with the aim of assisting other EC sponsored projects concerned with ERMS, either as a by-product of the final result or as an end product in itself, and to promote the concept of interoperability. It is also an important aim of the Consortium to keep up to date with ERMS development. As it enters its final phase the COPEARMS Services are being made available to anyone.
The COPEARMS Consortium draws on considerable experience from a variety of backgrounds in order to offer these services. Examples of services offered include:
Business advice- by getting involved at the beginning of a project COPEARMS can advise as to how the ERMS can be designed to suit specific business needs and be made more viable. Where protection is not the primary objective of the project COPEARMS can determine what, if any rights protection is necessary, thereby allowing for ERMS integration at the beginning rather than spending time and money trying to bolt on a protection mechanism at the end.
Legal issues- the Consortium can advise on the legal framework including contracts to help to avoid expensive mistakes and misunderstandings.
Technology- the Consortium has produced an ERMS reference model to prevent duplication of research. There are also ERMS tools available to assisted projects.
Security- the Consortium can advise on current best practice and comment on recent developments. Without a proven security system rights holders are unlikely to agree to storage of valuable copyrighted works. Without access to quality information the end product will not be commercially attractive.
Interoperability- the Consortium can advise on interoperability issues such as EDI and identifiers. Without some measure of interoperability ERMS may not be able to communicate with other systems (for example, TTP) which will make them ineffective as data may have to be reformatted to be transferred between systems.
Full details of the COPEARMS Offer will be included in the next issue of COPEARMS News, but meanwhile, if you would like to find out more please contact COPEARMS Project Co-ordinator, Mr Dominique Spaey, Bureau Van Dijk- Management Consultants, 250, Avenue Louise, Box 14, B-1050 Brussels, Belgium. Telephone +32 2 639 0606, fax: +32 2 648 8230, email dspaey@bvdmc.com
News in Brief
International Conference. When the technical annexe for the project was prepared there was a definite need for an ERMS International Conference, and it was planned that the project would hold one within two years. The original date was to be November 1997. However, we were not the only ones to recognise this gap in the market and a steady stream of ERMS based conferences workshops and seminars followed. As a result when we came to organise our conference we were competing with several others for delegates and did not manage to attract the numbers we needed to make the conference a success. It was then decided to postpone the conference and think again. At a recent Steering Board Meeting it was agreed that a conference was not now the best way to promote the project, ERMS and interoperability concepts. It was decided that remaining effort would be put into developing the WEB Site. Information about the project can be found at http://www.ifla.org/copearms which is within the general IFLA site and originally designed to give fairly basic information. The new version of the site should include more links with sites of interest, regularly updated features, summaries of project deliverables, interactive facilities giving visitors access to the COPEARMS experts, information about the COPEARMS services, and much more. Watch this space for further details. At the end of the project the contents will be downloaded to a CD-ROM.
The CopySmart project, one of the vertical projects receiving COPEARMS assistance had its final review at the British Library, Boston Spa on the 5 March. The project has developed a system for undertaking sophisticated management of rights between agents interacting in heterogeneous and distributed computing environments.
The CopySmart solutions offer a complete environment for developing and deploying trusted infrastructures and secure devices allowing for co-operation between unknown actors. For further information please contact EURITIS, 12, avenue des Près. F-78180. Montigny-le-Bretoneux. France, Phone : +33-1-30-12-00-71. Fax : +33-1-30-60-04-61. Email : Euritis@msn.fr
In future issues of COPEARMS News we hope to include regular updates of projects. Please send information to Judy Watkins, IFLA Office, British Library, Boston Spa, Wetherby, West Yorkshire, LS23 7BQ UK. Fax +44 1937 546478, email judy.watkins@bl.uk
Report of Special Interest Group Meeting
Athens 20 October 1998
The COPEARMS Consortium held a Special Interest Group Meeting and Workshop just before the IFFRO AGM in Athens in the hope of attracting delegates from the publishing industry and rights collection agencies. Due to the co-operation of IFFRO (and to some measure to the unexpectedly bad weather) both events were very well attended.
The purpose of the SIG was to promote the work of the project as well as the concept of interoperable electronic rights management systems (ERMS), and to provide an opportunity for current trends and concerns to be discussed.
COPEARMS Partners gave presentations about ERMS in general, security issues, legal issues, and a presentation about the COPEARMS offer. There was also a presentation about the VENIVA Project, which is developing a Pilot Application of a virtual archive to provide remote access of documents preserved in Venice, Corfu, Crete, and Vienna relating to Venetian history. Also presented was an overview of SCOPE'S 'CACTUS' ECMS which aims to deliver learning resources to students in a number of Higher Educational Institutions throughout Scotland via the internet. Finally there was a presentation about the SEDODEL Project which is due to start in April 1998. The project will combine emerging ERMS technology with technology of accessible information to produce a secure document delivery environment for blind and partially sighted people.
During the workshop delegates were asked to consider two scenarios of the future, in one the electronic world was seen as an extension of the paper world and existing rights and exceptions were kept. In the other access to work was based on ability to pay. Needless to say there was a great debate between the rights holders and libraries representatives about rights and exceptions. Although this is an area where there is unlikely to be full agreement between the two sides, it was agreed that there should be communication and co-operation between them if the gap is ever going to be bridged. Also discussed were the merits of ERMS and licensing schemes as methods of protection. In particular the Digital Object Identifier (DOI) was seen as a great development for the future.
It was particularly eye opening to have delegates from Zimbabwe and Nigeria at the workshop. It is easy to take access to new technology for granted and concentrate on copyright restrictions as the main barrier. At the workshop it was highlighted that if information in electronic form becomes widespread then a huge proportion of the world's population would not be able to use it as they do not have access to the internet. As information coming from the developing world would not be in electronic format it could well be overlooked by the developed world thus denying both developed and developing world the opportunity to share each others material.
A full copy of the proceedings is available from Pauline Connolly, IFLA Office at the British Library. Email pauline.connolly@bl.uk, fax +44 1937 546478
Proposal for a European Parliament and Council Directive on the harmonisation of certain aspects of copyright and related rights in the Information Society [1]
Séverine Dusollier & Jean-Christophe Lardinois, CRID
I. Introduction
In its Communication on the Follow-Up to the Green Paper on Copyright and Related Rights in the Information Society [2], the Commission announced that it intended to propose a number of harmonising measures in the field of copyright and related rights with a view to adjust and further complement the existing legislative framework, where this is necessary for the proper functioning of the Internal Market and for bringing about a favourable regulatory environment for the development of the Information Society in Europe.
At a same time, it implements a significant number of the new WIPO Treaty obligations (resulting from the "WIPO Copyright Treaty" and the "WIPO Performances and Phonograms Treaty" adopted at the Diplomatic Conference of Geneva in December 1996 [3]) at Community level in parallel with the ratification of these Treaties by the Community. In some cases, the proposal goes beyond the provisions enacted by the WIPO Treaties by seeking to implement at a European scale former proposals submitted -but not adopted- to the Diplomatic Conference.
According to the Explanatory memorandum of the proposal [4], action is considered necessary in two areas : first, through harmonised legal protection in order to achieve a Community level for copyright protection across national borders in the light of especially the obligations arising from the new two WIPO Treaties.
Secondly, in the technological side, by developing adequate systems allowing for Electronic Rights management and protection.
As set out in the Commission's Communication of 20 November 1996 [5], harmonisation is proposed on four elements :
- the right of reproduction;
- the right of communication to the public, including making available "on-demand" over the net;
- the protection of technological measures and rights management information
- the right of distribution of physical copies, including its exhaustion
1. Right of Reproduction
The stake of the definition of the scope of the reproduction right has always been fundamental for rights holders as others actors involved in on-line delivering of copyrighted material, such as users, telecommunications operators, access providers, etc...
Actually, the on-line transmission of works or presentations protected by an intellectual property right implies a number of transient and technical electronic reproductions of works. Whether such reproductions are covered by the scope of the reproduction right as defined in most Member States, is still uncertain, which justify the necessity to provide for a harmonised definition of this right of reproduction.
The definition finally adopted in the proposal is :
" the exclusive right to authorise or prohibit direct or indirect, temporary or permanent reproduction by any means and in any form, in whole or in part. "
The same definition was submitted to the WIPO Diplomatic Conference by the European Commission, but was finally not adopted , due to a strong opposition to the inclusion of the temporary reproduction in the restricted acts.
Such a definition conveys clearly that temporary and transient reproduction is subject to the exclusive right of the rights holder.
Nevertheless, an exception to this reproduction right with regards to this particular technical reproduction is put forward in the article 5 (1) of the proposal, which states that "temporary acts of reproduction which are an integral part of a technological process for the sole purpose of enabling use to be made of a work or other subject matter, and having no independent economic significance, shall be exempted form the right set out in Article 2".
This provision seeks to take into account the concerns of service and access providers concerning the incidental acts of reproduction. "Browsing" or "caching" may thus not be restricted acts if it comply with particular requirements set out in art. 5(1) [6]. The transposition of this exception of temporary acts of reproduction will be obligatory for the Member States.
Another important element of the definition refers to the direct and indirect reproduction. The term "direct" means reproducing a work or other protected subject matter directly onto the same or a different medium.
The term "indirect" covers reproduction done via an intermediate stage, for example, the recording of a broadcast which itself has been made on the basis of a Phonogram [7].
This provision applies also to the other rights holders recognised in the acquis communautaire (performers, Phonograms and film producers and broadcasting organisations) and the new WIPO Performances and Phonograms Treaty (WPPT) who benefit from the same level of protection for their works or other subject matter as regards the acts protected by the reproduction right.
2. Communication to the public right, including the right of making available works and other subject matter
Article 3 of the proposal sets out :
"Member States shall provide authors with the exclusive right to authorise or prohibit any communication to the public of originals and copies of their works, by wire or wireless means, including the making available to the public of their works in such a way that members of the public may access them from a place and at a time individually chosen by them"
This provision resumes the definition set out in the article 8 WCT.
One of the main objectives of this provisions, as it was during the Diplomatic Conference, is to make it clear that interactive "on-demand" acts of transmission are covered by this right. Actually, the fact that individuals may have access such services and request their transmission individually had raised a doubt whether such transmission was made to the "public" and not to a private person. This provision aims to settle this key question by providing that the "public" consists of individual "members of the public".
Furthermore, the provision does not cover mere private communication neither broadcasting, including new forms of it, such as pay-TV or pay-per-view, since in these latter -where the works are offered in the framework of a pre-defined programme-, the requirement of 'individual choice' is not met [8]. Such pay-per-view or near-video-on demand, seems to be already covered by the right of broadcasting or the right of transmission by satellite, as stated in the Directive on copyright applicable to satellite broadcasting and cable retransmission [9]. Nevertheless, the Commission considers that the development of such new systems of broadcasting could entail a further consideration of the broadcasting right. [10]
Similarly to the authors, performers, Phonograms and film producers, broadcasting organisations would benefit from this exclusive right [11] which would apply irrespective of the number of times the work or other subject matter is actually transmitted on-line on demand. It is the act of offering the service to the public which will require authorisation.
Article 3(3) reiterates that the on-line transmission of a work or other subject matter with the consent of the rights holder does not exhaust the relevant right which protects this act of exploitation, i.e. the communication to the public including its "making available form".
3. Distribution right
Article 4(1) of the Proposal provides for authors the exclusive right of authorising any form of distribution to the public, by sale or otherwise, of the originals and copies of their works.
Both new treaties (WCT and WPPT) contain also an exclusive right of distribution, namely the right to authorise or prohibit the distribution of fixed copies as tangible objects (e.g. on paper, CD, CD ROM, tape, as opposed to on-line form). The distribution right does thus not apply to services in general or on-line.
The second provision sets out that the distribution right is only exhausted in the whole of the Community upon the first sale of the copy of a work in the Community, providing that the sale is made by the rights holder or with his consent. Under this principle, once an author has agreed that tangible copies of his work may be sold in one Member State, these copies can be sold throughout the EU without requiring a new authorisation from the rights holder.
This latter provision meets finally the view of the Diplomatic Conference which decided that it shall be a matter for Member States to determine the existence and the conditions of the exhaustion of the distribution right [12]. Consequently, the Proposal has chosen the principle of community exhaustion while providing that the distribution right should not be exhausted after a first sale outside the European Union. [13]
4. Exceptions to the reproduction right and communication to the public right
4.1. Introduction
Article 5 harmonises the limitations and exceptions to the reproduction right and the communication to the public right. The list set out in this provision is exhaustive what entails that national legal systems would not be allowed to maintain any exceptions to copyright other than those enumerated.
But, apart from the exception for temporary reproduction mentioned above, the implementation of these exceptions is only facultative. Thereby, it shall be a matter for each Member State to decide which exceptions he will transpose in its legislation.
The harmonisation foreseen by the proposal is thus relative, since after the transposition of the directive in national laws, the systems of limitations to copyright could still comprise a number of disparities from a country to another both in the actual exceptions in force as in their scope and interpretation.
4.2. Exceptions to the reproduction right
Article 5(2) (a), (b) and (c) sets out three optional exceptions to the reproduction right :
Article 5(2) (a) allows Member States to maintain or introduce an exception for photo/print type reproduction ("reprography"), with or without a remuneration scheme.
Such reprography is limited to techniques of reproduction allowing a paper print. So the result of the reproduction must be in paper form.
Article 5(2) (b) allows for exceptions reproduction of audio and audio-visual material for private use and for non-commercial ends
This provision does not make any distinction between analogue and digital technology. With regards to the digital private copying, the Commission has considered it premature at this stage to provide for a more harmonised solution, since it is still largely unknown whether such copying will be a widespread activity of consumers or not [14]. Therefore, a consultation of interested parties will take place by the end of 1998 so as to envisage further action in this field.
Article 5(2) (c) allows Member States to exempt certain acts of reproduction from the reproduction right to the benefit of establishments which are accessible to the public, which are not for direct or indirect economic or commercial advantage, such as public libraries and archives
This exception does not apply to the communication to the public right.
Thus, the making available of a work by a library from a server to users on-line should and would require a licence of the rights holder or his intermediary and would not fall within a permitted exception.
It is stated in the Explanatory Memorandum that the communication of copyright protected material via the homepage or website of a library will in many cases be in competition with commercial on-line deliveries of material since perfect quality copies of any work could be made available to a large number of users, whether on-site (with a multiplicity of screens in the library) or off-site (to other libraries or remote users) [15].
This lack of exemption for libraries could be one of the key question in the progress of the adoption of this directive.
In our view, we regret that no distinction has been made between the on-line transmission of protected works by a library and the possibility for a library to make available works within the physical site of the establishment in specific and justified cases. In this latter case, a remuneration scheme could have been put forward.
Once again, in this directive, it appears that the threats carried by new technologies were considered sufficient to reform entirely the whole system of copyright, even regarding the analogue and traditional uses of protected works.
4.3. Exceptions to the communication to the public right and to the reproduction right
Article 5(3) provides Member State with the possibility of certain limitations to article 2 (the reproduction right) and article 3 (the communication to the public right).
Article 5(3) (a) allows Member States to exempt the use of a work or other subject matter (such as a sound or visual recording) or parts of it, provided that such use exclusively serves the purpose of illustration for teaching or scientific research, as long as the source is indicated.
In any case, only the part of the use which is justified by its non-commercial purpose may be exempted from the exclusive right.
Paragraph 3(b) to (e) allow Member States to provides for further exemptions to the reproduction right and to the communication to the public right, so as follows :
- for uses to the benefit of visually-impaired or hearing-impaired persons, which are directly related to the disability and of a non-commercial nature and to the extent required by the specific disability (handicapped persons);
- use of excerpts in connection with the reporting of current events, as long as the source is indicated, and to the extent justified by the information purpose (news reporting);
- quotations for purposes such as criticism or review, provided that they relate to a work or other subject matter which has already been lawfully made available to the public, the source is indicated, their making is in accordance with fair practice and to the extent required by the specific purpose (quotations);
- use for the purposes of public security or for the purposes of the proper performance of an administrative or judicial procedure (public security uses and uses in administrative and judicial proceedings).
4.4. Scope of the exceptions.
As stressed in Article 5(4), limitations and exceptions have to be confined to certain specific cases and may not be interpreted in such a way as to their application to be used in a manner which unreasonably prejudices the rights holders' legitimate interests, or conflicts with normal exploitation of the protected subject matter.
It is the so-called 'three step test' enshrined in the art. 9(2) of the Berne Convention and confirmed in the recent WCT and WPPT.
4.5. Nature of the exceptions
In a number of recent COPEARMS deliverables we have pointed out the fact that not defining whether the copyright exemptions are of binding nature or not, threatens the balance of rights set out in copyright regime.
Indeed, by blocking access to protected works, they can override the exceptions enshrined in the law. Since the ERMS reflects the terms of licence contracts, the only way to prevent ERMS from allowing a proper application of exceptions regime, is to state that such exceptions are imperative or binding and can not be overridden by contract.
This is already the case for some exceptions set out in the Software and Database Directives.
The present proposal does not address this issue, except for the private copying exception, albeit not very explicitly. The recital 28 of the proposal provides that "when applying the exception on private copying, Member States should take due account of technological and economic developments, in particular with respect to digital private copying and remuneration schemes, when technological protection measures are available; whereas such exceptions should not inhibit the use of technological measures" (we underline).
We could infer from that recital that with respect to the private copying, such exception is not binding but can and will be overridden by technological measures such as ERMS. Nevertheless, it does not follow that the same conclusion apply to other exceptions.
5. Technological measures
The proposal conveys a on-going concern of the Commission which consists of protecting technological measures, such as anti-copy devices or ECMS, by preventing them from being circumvented. The Commission has already submit a similar proposal in the framework of the adoption of WIPO Copyright Treaty, proposal which was considered premature and too precise by the Diplomatic Conference [16], which has preferred demanding to Member States to provide for 'adequate legal protection and effective legal remedies against the circumvention of effective technological measure".
Under Article 6 of the Directive, Member States shall provide adequate legal protection against any activities, including manufacture or distribution of devices of the performance of services, which have only limited commercially significant purpose or use other than to circumvent and are carried out knowingly or with reasonable grounds to know that they will enable or facilitate without authority the circumvention of any effective technological measure designed to protect any copyright or any rights related.
The 'technological measures' are defined as any device, product or component incorporated into a process, device or product designed to prevent or inhibit the infringement of any copyright or any rights related to copyright as provided by law or the sui generis right. Technological measures shall only be deemed to be 'effective' where the work or other subject matter is rendered accessible to the user only through application of an access code or process, including by decryption, descrambling or other transformation of the work or other subject matter, with the authority of the rights holders. This requirement of effectiveness of the measure would imply that rights holders have a duty to demonstrate the effectiveness of the technology chosen in order to obtain protection. This is the first time in all the former proposals and initiatives of the Commission in this field that such a requirement, which convey the terms of the WCT, is imposed.
The provision only covers the activities and services whose main commercially significant purpose or use is to circumvent, which would ensure that general-purpose electronic equipment or service is not prohibit even if they may be used to this end. [17]
It is worth mentioning that along the protection conferred by this proposal, another protection for the ERMS can be found in another proposal of directive on the protection of conditional access services. [18]
6. Rights Management Information
Article 7 of the proposal gives Member states appropriate flexibility in implementation adequate legal protection against any person performing without authority any of the following acts :
- to remove or alter any electronic rights management information
- to distribute, import for distribution, broadcast, communicate or make available to the public copies of works or other subject matter
In fact, dangers exists that illegal activities might be carried out in order to remove or alter the electronic copyright management information attached to it, or otherwise distribute, import for distribution, broadcast, communicate to the public or make available to the public copies which such information has been removed without authority.
Finally, it has been assert that these technical measures, in their technical functions, must respect privacy safeguards in accordance with Directive 95/46/EC.
Final provisions
Article 9 - Paragraph 1 sets out that all the works and other subject matter benefit from protection under this Directive, on the date of the transposition as referred to in the Directive, are protected by the legislation of the Member States in the field of copyright and related rights.
Paragraph 2 reflects a general principles, ensuring that the Directive has no retroactive effect and does not apply to acts of exploitation of protected works and other subject matter which occurred before the date on which the Directive has to be implemented by Member States.
Paragraph 3 and 4 sets out another general principle according to which contracts which have been concluded and rights which have been acquired before the adoption of the Directive could have been known by parties, are not affected by the latter, thereby excluding certain "old contracts" from the scope of application of the directive.
NOTES
- 10.12.1997, COM (97) 628 final, Hereinafter, the Proposal
- COM (95) 382 final of 19 July 1995
- WIPO Copyright Treaty, http://www.wipo.int/eng/diplconf/distrib/94dc.html, hereafter "WCT",
WIPO Performances and Phonograms Treaty, http://www.wipo.int/eng/diplconf/distrib/94dc.html, hereafter "WPPT". For comments on these Treaties, see CRID-Newsletter 1, deliverable 4.2.5, p.4
- Explanatory Memorandum, Introduction, point 5.
- Follow-Up to the Green Paper on Copyright and Related Rights in the Information Society, 20.11.96, COM(96) 568 final, Chapter 2, p. 9
- Recital 23 of the Directive
"Copyright and Related Rights in the Information Society - Proposal for Directive/Background", http://europa.eu.int/comm/dg15/en/intpropo/intprop/1100.html, p.7
- Explanatory Memorandum, Comment on article 2, point 3.
- Explanatory Memorandum, Comment on article 3, point 2
- Council Directive 93/83/EEC, 27.09.93, O.J. L 248, 6/10/93, p. 15
- Follow-Up to the Green Paper on Copyright and Related Rights in the Information Society, op. cit., p.20
- Article 3 (2) of the Proposal.
- WCT, art. 6 (2).
- Recital 18 of the Proposal
- Explanatory Memorandum of the Proposal, Comments on article 5.
- Directive Background, op. Cit., p. 9
- See CRID-Newsletter 1, Copearms deliverable 4.2.5., p.
- Explanatory Memorandum, Comment on article 6, point 2
- see CRID-Newsletter 2, Copearms deliverable 4.2.8., p.3
Intellectual Property Rights : An overview of the technical state-of-the-art.
Edmond F. KOUKA, EURITIS.
Intellectual Property Rights (IPR) issues came from a need for balance between the interests of the providers of digital content, the carriers of these contents, and consumers. This has been endorsed in the Follow-up to the Green Paper on Copyright and Related Rights in the Information Society, and recognised by the WIPO Copyright Treaty, which has provided new rights to copyright holders, avoided the adoption of provisions that risked stifling innovation and investment in new delivery technology, and taken account of the needs of consumers.
Copyright holders - content providers - must have effective protection or they will not produce works for an electronic environment. Infrastructure and communications providers - carriers - must have predictability about, and appropriate limitations upon, their liability for copyright infringement or they will not carry content which has been copyrighted. Consumers must have easy access to copyright works at reasonable cost and clear payment methods or there will be no market in the Information Society.
SMEs and information workers alike are particularly vulnerable in that they are especially intensive producers and users of information in electronic form and via electronic communications over public networks. They will particularly depend upon clarity in Electronic IPR legislation and operational procedures.
Clarity and balance in IPR legislation will overcome a key current and potential barrier to the implementation and deployment of electronic commerce and tele-work, and will reduce the risks of copyright infringement in introducing these operations in large and small organisations.
In order to overcome the current lack of harmonisation of IPR legislation at the world level, technology providers are proposing technical system for protecting IPR. They are called Electronic Copyrights Management Systems (ECMS) or more generally Electronic Rights Management Systems (ERMS). These systems are mainly focusing on object identification, encryption, watermarking, secure containers and rights management middlewares.
Digital Object Identification
In order to unambiguously identify any digital object circulating through networks and also for ensuring its automated processing, the specialists, right holders and industrialists agreed on the license plate concept. It's a generic concept for identifying a digital object, defining its class and checking its authorisations.
For books for example, the ISBN identifier is well known. CISAC (International Confederation of Authors and Compositors Societies) initiated the Common Information System (CIS) as a standard identification system for digital works. It includes the International Standard Audio-visual Number (ISAN) and the International Standard Work Code (ISWC).
MPEG and JPEG group reserved a sufficiently big computing space into the extensions of specification of MPEG and JPEG format for supporting work identifier codes.
The Association of American Publishers (AAP) launched the Digital Object Identifier numbering system (DOI).
Encryption
The major two functions of encryption are security and authentication. Security is to protect communicated message, and authentication is to certify authenticity of the sender and the content of the message. Authentication can be used in three instances such as to verify the sender, to certify the integrity of the message, and to reject the sender's false claim to deny his/her own message.
In the electronic commerce on the Internet, authentication of a sender of data is as important as protecting the data from wire trapping or tampering. There is such a method as using physical finger print or iris pattern, but the most common way to certify the sender is to use a public key method that uses a pair of public key and private key. To deter such crime as masquerading as another person, a public key unique to a person or an entity is generated, made public, and authorised by a certain organisation to prove that the key is actually the issuer's.
An important entity enabling and regulating public key based exchanges is the certificate authority (CA).
A certificate authority means a trusted third party that utilises public key method. Certificate authority is going to be used in many occasions such as when a consumer purchases goods from electronic shop on the Internet to ensure that both the consumer and the shop are actually who they claim they are. Certificate authorities are the essential infrastructure that will realise the security and trust on the Internet. Given that there will be multiple certificate authorities in the world, cross certification among independent certificate authorities will be important to enable universal usage of one's certificate.
Certificate authorities offer such services as issuing of certificates, registration and publicising of certificates, storage and management of certificates, revocation of certificates, and compiling the list of revoked certificates. In broader definition, credit check of a person to issue a certificate, registration and management of personal data, storage of digital data, certifying digital documents, and recovering keys.
Existing technologies used by certificates authorities include the following :
- Protocols : SET (Credit card settlement protocol), Secure Socket Layer (SSL web protocol)
- Form of certifications : ITU X.509, ISO | IEC 9594-8.
- Public key (RSA encryption etc.) Use a pair of public and private keys
Secret key (DES, Triple DES encryption etc.) Use a key specific to a pair of sender and recipient.
Digital signature technology and the law
The goal of digital-signature legislation is to regulate the technical steps involved in certificate generation and distribution so that a digital signature is acceptable as evidence in court. Uncertainty about digital signatures' evidence constitutes the most important impediment to their use. Today the general treatment and acceptance of digital signatures in Europe depend on country's legal system. There are two distinct types of legal system in Europe. In most European countries, including Germany, the Netherlands, and the UK, judges are allowed to accept any means of evidence (free system of evidence). However, in some countries, as Belgium and France for example, the law defines the means of evidence that judges can accept.
Germany set up a legal framework for digital signatures, based on a system of licensed certificate authorities, last year. Denmark and Belgium are about to initiate similar legislation processes. But these frameworks won't be obligatory expect for certain procedures in the public sector, and they won't make digital signature generally legally binding.
Watermarking, Fingerprinting
Digital watermarking technique represents a valid solution to the ever increasing need for copyright protection and authentication of digital contents transmitted through networks. A digital watermark is an identification code, embedded in the document to be protected, carrying information pertaining to copyright protection, data authentication, thus allowing to identify the creator, owner, distributor, authorised consumer of digital data (in this last case, the term Fingerprinting is usually used). Generally it is required that a watermarking algorithm be :
- Unobtrusive : it should be statistically and perceptually invisible not to degrade data quality and to prevent attacks from finding and deleting it;
- Readily extractable : the data owner or an independent control authority should easily extract it;
- Lossless : it should imply no loss of relevant information;
- Robust : it should resist to any attempt to remove it by attackers trying to counterfeit copyright of data;
- Unambiguous : its retrieval should unambiguously prove the identity of the data owner.
Watermarking and fingerprinting can be considered as steganographic techniques. They add subliminal data into the information without interfering with the message conveyed by the tagged information.
The Esprit projects IMPRIMATUR and TALISMAN have developed robust watermarking algorithms applicable on digital images and resistant to MPEG and JPEG compression.
Secure containers
These technical systems protect the data by delivering it over the Internet in locked form (mainly using encryption techniques as described above). As the computer which receives the delivery is able to access the publisher's web site, this communication link can be used again by the publisher to micromanage the user's access to the data. The data can be constantly locked up and users can be charged and traced for every time they access the data. It could be allowed out only on specific days or during any arbitrary access scheme.
IBM is currently pushing a software concept called Cryptolope. They take the text data and encrypt it with a key. When people want to read the data, they supply their ID number to the IBM central computer and it ships back the key. Each time they want to read the data, they pay again. A user must have an account with IBM, which handles the billing before paying a royalty to the data's owner.
EPR and the InterTrust Corporation Inc are shipping the DigiBox container. DigiBox allows to deliver an encrypted information through the InterTrust system. The DigiBox container includes several elements : organisational structures, properties, controls, and supporting data items.
The principle is very simple : content is placed in a secure DigiBox with control commands that are interpreted by the InterTrust application and after receiving the content, payment is transmitted back to the publisher in another DigiBox for authentication.
EURITIS is pushing the CopySmart Secure Device (CSM/SD) as a general purpose container allowing for : specification of conditions of use, remote connection for rights clearance and payment, data locking. This technology is usable for CD-ROM protection, software licensing and protection of any delivered digital content. Online management of rights is handled by the CopySmart Trusted Server (CSM/TS) which is an electronic rights brokerage platform. These applications use smart-card technology to enforce security and IPR protection.
ERMS Middlewares
ERMS middlewares are electronic rights brokerage platforms on the Internet which regulate interactions between liable agents and the copyrighted contents managed by these platforms. One particular aspect of these rights brokerage systems is that they give consistency to operations which take place in distributed computing environment.
Main liable agents are Content providers (authors, publishers, universities, etc.), Service providers (distributors, electronic shopping malls, publishers, retailers, etc.), Content registration authorities (content identifier issuers), Banks, Certificate authorities, Fees collecting societies, customers.
The ERMS repository contains electronic contracts and rules which specify permissions and conditions of uses of protected contents. Links to remote databases are specified thus allowing for a distributed storage of the content. The platform provides the following services: users registration, identification and authentication, content registration, access control, right clearance, auditing, billing.
The IMPRIMATUR project has set-up an ECMS demonstrator protecting the distribution of digital images on the Web.
EURITIS is commercialising the CopySmart Trusted Server (CSM/TS) as an ERMS dedicated middleware on TCP/IP networks (Internet, Intranet, Extranet).
The OMG (Object Management Group) has issued the CORBA (Common Object Request Broker Architecture) Licensing service specifications. These specifications allow for the integration and the monitoring of legacy applications thanks to the OMG Interface Definition Language which binds the existing applications with the licensing services requested from the Object Request Broker (ORB).
ORB applications are commercialised by ORBIX product from IONA Technologies Ltd, and Visigenix ORB from Borland.
Limitation to Technical protection of data : Fair use and exceptions.
Depending on some contextual factors, the technical systems of protection described above, must deactivate some protection. Factors to consider include:
- the purpose and character of the use (commercial or non-commercial) ,
- nature of the work (factual or fictional) ,
- percentage of copied material and the relevance of that material ,
- economic effect of the copying of digital material.
This is applied quite differently around the world. Due to the lack of legislation harmonisation.
| 