NP 2.0 Wiki: Wiki Pages

Sotomayor IP Wiki

Keenan, Michael — Wed, 10 Jun 2009 13:46:53 GMT

Wiki Content:

On May 26, 2009 President Barack Obama named Judge Sonia Sotomayor as his Supreme Court nominee to replace Justice David Souter. While anytime a new Justice joins the Court a myriad of issues resurface in the political debate, Judge Sotomayor’s nomination poses an interesting perspective on the future of intellectual property litigation.

          After serving as a public prosecutor for many years, Judge Sotomayor joined the private New York law firm Pavia & Harcourt in 1984, specializing in intellectual property law. During her eight years with the firm, Judge Sotomayor represented top clients like Ferrari and Fendi, specifically suing counterfeiters to stop them from importing fake Fendi goods. According to a profile printed by The New York Times on May 26, 2009, “if the firm had a tip from the United States Customs Office about a suspicious shipment, Ms. Sotomayor would often be involved in the risky maneuver of going to the warehouse to have the merchandise seized. One incident that figures largely in firm lore was a seizure in Chinatown, where the counterfeiters ran away and Ms. Sotomayor got on a motorcycle and gave chase.” Sheryl Stolberg, Sotomayor, a Trailblazer and a Dreamer, The New York Times, May 26, 2009 available at http://www.nytimes.com/2009/05/27/us/politics/27websotomayor.html
          While Judge Sotomayor has ruled on a variety of legal topics during her time on the bench, including appeals in over 3000 cases and writing 380 majority opinions during her time on the federal district court, she also has been involved in two key copyright cases that help illuminate her stance on IP litigation, Tasini v. New York Times Co., 972 F. Supp. 804 (S. D.N.Y. 1997) and Castle Rock Entertainment v. Carol Publishing Group, 955 F. Supp 260 (S.D.N.Y. 1997).
          Tasini v. New York Times Co. 972 F. Supp 804, originally decided by Sotomayor in 1997, involved a copyright infringement suit brought against The New York Times and other news organizations by several freelance journalists. The freelance journalists claimed that the publishers improperly distributed articles they had written to Lexis/Nexis without their permission, while the publishers claimed the articles fell under the collective work copyright privilege according to § 201(c) of the Federal Copyright Act of 1976. The collective work copyright is one “in which a number of contributions, constituting separate and independent works in themselves, are assembled into a collective whole.” Id. at 809 (citing 17 U.S.C. § 101). Under the collective work copyright doctrine “the owner of the copyright in the collective work is presumed to have acquired only the privilege of reproducing and distributing the contribution as part of that particular collective work, any revision of that collective work, and any later collective work in the same series.” Id. at 809 (citing 17 U.S.C. § 201(c)). In the case, the freelance journalists asserted that the publishers had gone beyond the privileges granted in §201(c) because the republishing in Lexis/Nexis did not constitute a “revision of that collective work.”
          Sotomayor ruled in favor of the publishers, holding that they were entitled to reproduce articles within the Lexis/Nexis database under the protection of the collective work copyright. Sotomayor examined the plain language of the statute and the legislative history in reaching the conclusion that the terms “privilege,” “reproducing” or “any revision” found in §201(c) of the Federal Copyright Act did not impose any significant limitations upon publishers. Id. at 820. Ultimately, Judge Sotomayor held that “a privilege is transferrable; a reproduction can occur in any medium; and “any revision” might include a major revision. The key limitation imposed upon publishers under Section 201(c) rests in the fact that publishers are permitted only to reproduce a particular plaintiff's article “as part of” a revised version of “that collective work” in which the article originally appeared.” Id. at 820. However, while Sotomayor took a more pro-business approach and expansive reading of the Federal Copyright Act in Tasini, she was ultimately overruled by both the appellate court and the US Supreme Court. In finding for the freelance journalists, the Supreme Court in a 7-2 decision held that the collective work copyright privilege did not apply because articles in Lexis/Nexis do not appear as a collective work, but rather each article is treated and appears as a separate item when a user conducts a search in the database.
          In the same year Tasini was decided, Judge Sotomayor also ruled on the copyright infringement case Castle Rock Entertainment v. Carol Publishing Group, 955 F. Supp. 260 (S.D.N.Y. 1997). Castle Rock Entertainment, which owns the copyright of the popular television show Seinfeld, brought suit against Carol Publishing Group for publishing a book entitled The Seinfeld Aptitude Test (SAT). The book consisted of 643 trivia questions testing the readers’ knowledge of the events and characters depicted in the show. While Carol, who did not receive permission from Castle Rock Entertainment to publish the trivia book, argued that it only copied “un-copyrightable facts” about the show, Judge Sotomayor ultimately rejected their theory. Id. at 266. Judge Sotomayor focused on the fact that SAT did not pose factual biographical questions about the show, such as “who acts in the program, who directs or produces the show, how many seasons it has run, etc. Instead, SAT pose[d] questions about the events depicted during episodes of the Seinfeld show.” Id. at 266.
          In addition to finding that the trivia book’s questions were predominately focused on the creative components of Seinfeld and not mere facts, Judge Sotomayor also focused her analysis on the four statutory factors regarding fair use. Under the Federal Copyright Act of 1976, “the fair use of a copyrighted work … for purposes such as criticism, news reporting, teaching …, scholarship, or research, is not an infringement of copyright.” Id. at 267 (citing 17 USC § 107). In evaluating whether or not copyrighted information was used according to the fair use doctrine, courts examine four factors: “1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes; (2) the nature of the copyrighted work; (3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and (4) the effect of the use upon the potential market for or value of the copyrighted work.” Id. at 267 (citing 17 USC §107). Judge Sotomayor conducted a careful analysis of each factor and found that on the whole, SAT did not represent a fair use of Seinfeld. Her explanation of the four factors shows a strong command of IP law, particularly her analysis of the fourth factor where she recognized that potential markets includes both those market areas that the copyright owner has engaged in and those market areas one has affirmatively decided not to pursue. Judge Sotomayor reasoned that “artists express themselves not merely by deciding what to create from their original work, but by deciding what not to create as well.” Id. at 272. The Second Circuit ultimately affirmed Judge Sotomayor’s decision.
          Judge Sotomayor also wrote the majority opinion in two key cybersquatting cases, Storey v. Cello Holdings LLC 347 F. 3d 370 (2^nd Cir. NY 2003) and Mattel, Inc v. Barbie-Club.com 310 F. 3d 293 (2^nd Cir. 2002). While both cases address more procedural issues rather substantive issues, they illustrate Judge Sotomayor’s experience in dealing with the dense statutory requirements that are so often critical in IP and media law cases. In Storey v. Cello Holdings, LLC, Sotomayor addressed the ever growing conflict between trademark rights holders and internet domain-name registrants, “where the former seek to prevent consumer confusion by policing others’ use of the trademarks that identify their goods, services or identities, the latter have acquired rights in domain names, which may be identical or confusingly similar to trademarks, through a first-come, first-serve process that does not consider trademark rights.” Id. at 373. Sotomayor overturned the Southern District of New York’s ruling that a trademark owner’s earlier litigation under the Uniform Domain-Name Dispute-Resolution Policy (UDRP) barred it from seeking relief under the Anti-cybersquatting Consumer Protection Act (ACPA).
          In Mattel Inc. v. Barbie-club.com, 310 F. 3d 293 (2^nd Cir. 2002), she held that a federal court may obtain in rem jurisdiction over a domain name under the ACPA only in a district in which the domain name registrar or other domain-name authority is located. While the ruling was clearly based on plain language of the ACPA, Judge Sotomayor explicitly rejected the prevailing thought that federal court jurisdiction could be created in any federal district merely by “depositing” written evidence of the domain registration with the trial court. If Judge Sotomayor is confirmed as the next Supreme Court Justice, she would be the only justice to come to the bench with prior experience ruling on cyberlaw issues.

Judge Sotomayor’s past experience with IP litigation is extremely relevant when one considers the docket for the Supreme Court’s next term. The Court is set to hear Bilski v. Doll 545 F. 3d 943, (Fed. Cir. 2008), a challenge to a ruling last fall by the US Court of Appeals that narrowed the patentability of “business methods,” which include a broad range of processes not tied to manufacturing. The case is currently set to be argued in the Court’s next term when Judge Sotomayor may be in place on the Court instead of Justice David Souter, who has traditionally look unfavorably towards extending the patentability of business methods.

NPCreate: 6/10/2009

Tiffany v. eBay

Hickman, Benjamin — Fri, 25 Jul 2008 18:24:21 GMT

Wiki Content:

On July 14, 2008, the U.S. District Court for the Southern District of New York, in the closely watched case of Tiffany (NJ) Inc., et al. v. eBay, Inc., entered judgment in favor of eBay. Following a bench trial, the Court held that Tiffany failed to carry its burden with respect to all of its claims against eBay - direct and contributory copyright infringement, unfair competition, false advertising and direct and contributory trademark dilution. Tiffany sought to hold eBay liable for these causes of action on the grounds that eBay facilitated and allowed the counterfeit items to be sold on its websote. In particular, Tiffany argued that having been on notice of the problem, eBay was obligated to investigate and control the illegal activities of individual sellers using its service.

I. Direct Infringement

With respect to its direct infringement claim, Tiffany argued that eBay directly infringed its trademark by its (1) advertising the availability of Tiffany jewelry on eBay by using the Tiffany name on the eBay home page and in eBay documents and publications, and by subsequently deriving revenue from the sale of that jewelry on its websote; (2) purchasing “sponsored links on Google and Yahoo! Advertising eBay listings that offer Tiffany jewelry for sale; (3) participating in the sale of counterfeit merchandise on the eBay websote, thereby becoming jointly and severally liable.

With respect to eBay’s use of the Tiffany name, the Court concluded eBay’s use of Tiffany marks was protected under the nominative fair use. The Court decision was based on the facts that the product in question was not readily identifiable without the use of the Tiffany trademark; eBay had used only so much of the mark as was reasonably necessary to identify the product or service; and eBay did not do anything that would suggest sponsorship or endorsement by Tiffany.

With respect to the sponsored links, the Court held that eBay’s use of the Tiffany marks in sponsored links is effectively identical to its use of the Tiffany name on the eBay websote and, as such, is also protected under the “nominative fair use doctrine.”

Regarding Tiffany’s allegation of joint and several liability, the Court found the argument to be misplaced, because eBay never takes possession of items sold through its websote and does not directly sell the counterfeit. For these reasons, the Court held that eBay was not liable for directed trademark infringement.

II. Contributory Infringement

Tiffany’s claim for contributory infringement was predicated on the allegation that eBay continued to supply its sales platform despite its knowledge that, or reason to know, that counterfeit merchandise was being sold. In the alternative, Tiffany argued that that eBay failed to take reasonable precautions against the occurrence of third person’s infringing conduct under circumstances in which eBay could “reasonably anticipate” the infringing conduct. The Court found that eBay exerted sufficient control over its websote that the test for contributory infringement established by the Supreme Court in Inwood Laboratories, Inc. v. Ives Laboratories, Inc.[1] applied. However, the Court quickly dismissed Tiffany’s “reasonable anticipation,” theory, holding that the Supreme Court’s decision in Inwood forecloses the “reasonable anticipation” standard as a basis to impose liability for contributory trademark infringement. Further, while the evidence demonstrated that some portion of the Tiffany goods sold on its websote might be counterfeit, the court rejected Tiffany’s position that such generalized knowledge required eBay to preemptively remedy the problem at the very moment that it knew or had reason to know that the infringing conduct was generally occurring, even without specific knowledge as to individual instances of infringing listings or sellers. This conclusion was based on the Court’s finding that eBay responded appropriately to Tiffany’s notices of specific infringing items, and that eBay’s general knowledge of infringement is insufficient to impute knowledge to eBay of specific infringing listings. The Court also rejected Tiffany’s position that, faced with Tiffany’s letters and other evidence that the problem existed, eBay was obligated to conduct an investigation to determine the extent of counterfeit Tiffany jewelry available on its site and, eBay’s failure to do so constituted willful blindness. Specifically, the Court concluded that Tiffany had failed by a preponderance of the evidence that eBay deliberately ignored counterfeiting activity of which it was aware. Instead, the evidence established that when eBay had general knowledge of counterfeiting on its website it took reasonable steps to investigate and stop that wrongdoing through general anti-fraud measures.

The court summarily denied Tiffany’s unfair competition claims, noting that the elements required to prevail on a trademark infringement and unfair competition claims under New York common law mirror the Lanham Act claims for the trademark infringement and unfair competition. The Court concluded, therefore, that since Tiffany had failed to prove its Lanham act claims, its common law clams also fail.

III. False Advertising

In support of its false advertising claims under the Lanham Act, Tiffany challenged certain advertising practices eBay – namely, eBay’s (i) references to Tiffany merchandise in promotional features on the eBay home page, and (ii) purchases of the “Tiffany” keyword so as to indicate the availability of Tiffany merchandise via “sponsored links” on Internet search engines such as Google and Yahoo!. In response, the Court first concluded that eBay’s use of the term “Tiffany” in advertising is protected, nominative fair use. Second, to the extent that to the extent that Tiffany argues that eBay’s advertising was impliedly false, Tiffany failed to prove that eBay had specific knowledge as to the illicit nature of individual listings. Finally, to the extent that the advertising was false, the Court concluded that the falsity was the responsibility of third party sellers, not eBay. In short, Tiffany failed to establish that eBay’s ads were likely to mislead consumers because authentic items were offered for sale, and inauthentic items were only listed on eBay due to the illicit acts of third parties.

IV. Trademark Dilution

The court denied Tiffany’s claim of trademark dilution on the basis that Tiffany failed to show that eBay used the marks in a way that was likely to cause either dilution by blurring or tarnishment More, the Court found that eBay’s use of the Tiffany marks on its website and through its purchase of sponsored links was protected by the statutory defense of nominative fair use.

V. Contributory Dilution

Finally, with respect to Tiffany’s claim of contributory dilution, the court questioned whether such cause of action even exists. The Court noted that, even assuming arguendo that a contributory dilution claim exists, it would fail for the same reasons with respect to Tiffany’s contributory infringement claim. In other words, Tiffany failed to demonstrate that eBay knowingly encouraged others to dilute Tiffany’s trademarks. Instead, to the extent that eBay may have had general knowledge of infringement and dilution by sellers on its website, eBay did not possess knowledge or a reason to know of specific instances of trademark infringement or dilution as required under law.

VI. Conclusion

This case appears to maintain the American law principle that a third-party conduit website should not be held liable for acts conducted by people who use their website. This contrasts significantly from a recent French judgment that eBay lost.

[1] Contributory infringement is a judicially constructed doctrine articulated by the Supreme Court in Inwood Laboratories, Inc. v. Ives Laboratories, Inc. In that opinion, the Supreme Court held that: [I]f a manufacturer or distributor intentionally induces another to infringe a trademark, or if it continues to supply its product to one whom it knows or has reason to know is engaging in trademark infringement, the manufacturer or distributor is contributorially responsible for any harm done as a result of the deceit.

NPCreate: 7/25/2008

Federal Rule of Evidence 502

Smith, Jenny — Fri, 19 Sep 2008 18:27:48 GMT

Wiki Content:

Written by Ronald J. Hedges and Jonathan Sablone

On September 8, 2008, the House of Representatives passed Senate Bill S.2450, which President Bush is expected to sign into law. The new Federal Rule of Evidence 502 will, among other things, set a nationwide federal standard for waiver of attorney-client privilege and work product protection, and allow for non-waiver orders that will bind non-parties in federal and state proceedings. Rule 502 will, thus, allow litigants to exchange materials without waiver of privilege or work product protection. However, exactly how Rule 502 will operate is open to debate, as no courts have had an opportunity to interpret or apply it.

The enactment of the new Rule 502 was driven by the challenges associated with electronic discovery. The purposes of the Rule are to reduce the burdens associated with e-discovery (and the often massive exchange of materials in electronic format), provide clear guidance to courts and parties on waiver of attorney-client privilege and work product protection, avoid broad waiver of privilege and work product protection by the disclosure of materials in discovery, and protect parties which enter into non-waiver agreements.

Rule 502 would accomplish these purposes in several ways. It explains that intentional disclosure of privileged materials or work product to federal offices or agencies, or in federal proceedings, gives rise to a waiver of those materials and to “undisclosed” material that concern the same subject matter if these should, “in fairness … be considered together.”

As to inadvertent disclosure of privileged materials or work product in either federal or state proceedings, there should be no waiver under Rule 502 if reasonable steps are taken to prevent disclosure and to promptly rectify any erroneous disclosure. Rule 502 further provides that, under certain circumstances, a disclosure of privileged materials or work product in a state proceeding will not be a waiver in a federal proceeding.

On the other hand, a federal court order that provides that “privilege or protection is not waived by disclosure connected with the litigation” becomes binding “in any other Federal or State proceeding.” Finally, Rule 502 essentially offers parties in federal proceedings an option: Rather than secure a non-waiver order, or, if the federal court refuses to enter such an order, the parties may enter into a non-waiver agreement that “is binding only on the parties.”

What does Rule 502 mean for litigants in federal courts or for those before federal regulators? First, litigants will need counseling regarding the level of disclosure (if any) of privileged material. There may be circumstances under which protected material should be shared with a federal regulator or an adversary. Care must be taken, however, to limit the scope of any waiver of undisclosed material.

Second, Rule 502 would appear to encourage discussion between parties or with a federal regulator to guard against waiver by inadvertent production. This, in turn, may place an emphasis on reasonable procedures undertaken by parties to protect against inadvertent production and on reasonable procedures to promptly discover any error.

Third, there is the question of how to address these issues by a party to another proceeding. Must that party intervene before the court that issued the order? What arguments must the party make before that court to modify or vacate the order?

The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.

NPCreate: 9/19/2008

Non-competition Agreements and Requirements for Broad ReleaseWaiver Agreements

Covitz, Philip — Fri, 22 Aug 2008 16:05:30 GMT

Wiki Content:

The California Supreme Court rejects non-competition agreements and clarifies requirements for broad release/waiver agreements

By Jeffrey M. Tanenbaum and Matthew J. Frankel

The California Supreme Court has now clarified state law governing non-competition and release/waiver agreements between employers and employees. In Edwards v. Arthur Andersen LLP, Case No. S147190 (Aug. 7, 2008), the Court held that Business & Professions Code § 16600 prohibits virtually all contractual provisions that purport to limit a former employee’s ability to compete with a former employer. In so doing, the Court wholly rejected the so-called “rule of reasonableness”—previously intermittently applied by California’s federal courts and the majority rule across the country—which allowed for the enforcement of contractual provisions that reasonably restrict, but do not prohibit outright, competition by a former employee.

The Court also held that employers drafting broad release and waiver agreements with departing employees need not include express exceptions for non-waivable statutory provisions. The Court’s ruling made clear that agreements waiving or releasing “any and all” claims will not be deemed invalid for failure to specifically except employees’ non-waivable statutory rights, and that an employer’s attempt to enforce such a provision, without more, does not constitute wrongful conduct.

Non-competition agreements

In his suit, Edwards challenged Andersen’s attempt to contractually prohibit him from performing services for or soliciting Andersen’s clients following his departure. The Supreme Court (quoting the Court of Appeals) noted that “[t]he first challenged clause prohibited Edwards, for an 18-month period, from performing professional services of the type he had provided while at Andersen, for any client on whose account he had worked during 18 months prior to his termination. The second challenged clause prohibited Edwards, for a year after termination, from ‘soliciting,’ defined by the agreement as providing professional services to any client of Andersen’s Los Angeles office.” The Court held that the agreement was “invalid because it restrained his ability to practice his profession.”

The Court’s ruling upheld California’s long-standing legislative policy rejecting restrictions on competition by former employees. Outside of enumerated exceptions in the context of dissolution of businesses (see Business & Professions Code §§ 16601, 16602, and 16602.5), California employers cannot restrict their employees from competing with them post-employment. In fact, other courts have held that even attempting to do so may be a violation of California’s unfair competition laws, potentially subjecting wayward employers to liability and injunctive relief. See Application Group, Inc. v. Hunter Group, Inc., 61 Cal. App. 4th 881, 906-08 (Cal. Ct. App. 1998).

With the Supreme Court removing any doubt about the scope of California’s wide-ranging prohibition on non-competition agreements, employers should be especially wary of including such provisions in their California employment agreements. Employers can still require employees to sign agreements that protect the employer’s trade secrets and other confidential or propriety information. However, those provisions must not extend to preventing the employee from competing with the employer—by, for example, working for a competitor or soliciting the employer’s clients—once the employment comes to an end. Employers who transgress the bright line drawn by the California Supreme Court in Edwards may well find themselves defending lawsuits filed by aggrieved current and former employees. Conversely, when hiring new employees in California, pre-existing non-competition clauses should prove far less troublesome to resolve.

Release/waiver agreements

Edwards also challenged as invalid a broad waiver/release provision that released “any and all” claims that Edwards might have had against his employer. He argued that the provision’s failure to specifically exclude claims based on Labor Code § 2802—which provides a right of action for employees to seek indemnity from employers for acts taken within the scope of employment—was unlawful, and that Andersen’s attempt to enforce the provision was an independently wrongful act sufficient to support a tortious interference claim.

The Court rejected Edwards’ contention, relying primarily on the maxim of construction that a contract should be interpreted in such a way “as will make it effective rather than void.” Noting that the agreement did not mention Section 2802 or indemnity one way or the other, the Court rejected Edwards’ suggestion that the phrase “except as otherwise prohibited by law” should have followed the words “any and all,” thus expressly excepting Edwards’ Section 2802 and other non-waivable statutory rights. Such a requirement, the Court noted, would require “voiding all existing releases which include the language ‘any and all,’” an inappropriate result. In sum, the Court held that “a contract provision releasing ‘any and all’ claims…does not encompass non-waivable statutory protections, such as the employee indemnity protection of section Labor Code 2802.”

The holding in Edwards makes it clear that employers need not create express carve-outs for non-waivable statutory rights when using broad waiver/release language in severance and other termination-related agreements. Of course, numerous federal and state laws do require mandatory language with respect to a host of other issues, and employers are well-advised to run all waiver and release language by employment counsel. Employers can rest easier, however, knowing that a failure to include express exceptions for non-waivable statutory rights will not invalidate an otherwise sound waiver/release agreement. The flip side, of course, is that even the broadest permissible release and waiver provision will not prevent an employee from bringing suit to enforce his or her non-waivable statutory rights, including claims for indemnity based on Section 2802.

NPCreate: 8/22/2008

Internet Law

Covitz, Philip — Wed, 14 May 2008 19:22:58 GMT

Wiki Content:

Internet Law

Click-Thru or Click-Wrap Agreements/Contracts

Copying Pages from a Website Could Cost You

E-Discovery

Federal Rule of Evidence 502

Privacy Policies

Electronic Communications Privacy Act (ECPA)

Government Entities

SEC Proposes Internet Availability of Proxy Materials

Litigation and Record-Retention

Constitutional Issues

NPCreate: 2/10/2008

Intellectual Property

Covitz, Philip — Wed, 14 May 2008 19:22:30 GMT

Wiki Content:

The Basics

Ownership and Licensing

Infringement

Copying Pages from a Website Could Cost You

Third-Party Liability

Digital Millenium Copyright Act Safe Harbor Provisions

Fair Use

Use of Motion Picture Clips in Television Programs

Digital Millenium Copyright Act (DMCA)

Digital Millenium Copyright Act Safe Harbor Provisions

Section 230 and Other Related Rights

Immunity Under Section 230 of the Communications Decency Act of 1996: A Short Primer

Software

Foreign Copyrights/Berne Convention

Copyrights and Federal Government Contracts

Trademark/Domain Names

Patents

Supreme Court revises Federal Circuit's limitations on patent exhaustion

Trade Secrets

NPCreate: 2/10/2007

Privacy and Cyber Security

Covitz, Philip — Fri, 22 Aug 2008 15:42:34 GMT

Wiki Content:

Privacy and Cyber Security

Privacy Policies

Electronic Communications Privacy Act (ECPA)

NPCreate: 8/22/2008

SEC Allows Internet Availability of Proxy Materials

Crawford, Cindy — Wed, 14 May 2008 21:27:44 GMT

Wiki Content:

This Securities Law Alert discusses the SEC rules permitting proxy materials to be delivered by posting the materials on a Web site and providing notice of their availability to shareholders.

On December 9, 2005, the SEC proposed new rules that would modernize the availability and delivery of proxy solicitations and materials.[1] Those rules, with some modifications, were adopted and became effective on March 30, 2007. [2] Under the old rules, an issuer was required to deliver proxy materials in paper format unless the shareholder consented to electronic delivery of such materials. The new rules champion a “notice and access” model, allowing an issuer to publish proxy materials on the Internet as an alternative to mailing them, if it notifies its shareholders of the address to the Web site’s where proxy materials are available.

Under the new rules, issuers, intermediaries, and third parties may use the “notice and access” model except in conjunction with mergers, acquisitions, asset sales, exchange offers, and other business combination transactions. These rules likely will reduce the cost of distributing proxy materials to shareholders, while also lowering financial barriers for third parties engaging in proxy contests. In designing the rules, the SEC was careful to note that they will not affect any applicable state law requirements governing communications with shareholders.

I. Effects of Rules on Issuers

Notices to shareholders must be sent out at least forty days before the meeting or vote is to take place and may only be combined with similar notices required by state law. As proposed, the Notice must contain, and may only contain, a specified legend displayed prominently in bold-face type; the date, time, and location of the meeting or vote; instructions on how to attend the shareholder meeting and vote in person; a clear and impartial identification of each matter intended to be acted upon; a list of materials being made available at a publicly accessible Web site; the specific address at which the proxy materials are located; instructions on how to access the proxy card, including any control or identification numbers needed to access the proxy card (though the Notice may not include a means to execute a proxy that would allow the shareholder to execute a proxy without having access to the annual report and proxy statement); and a toll-free telephone number, Web site, and e-mail address at which shareholders could request a hard copy of proxy materials.

Proxy materials that may be posted online include notices of shareholder meetings, proxy statements and consent solicitations, proxy cards, information statements, annual reports to security holders, additional soliciting materials and any amendments to any of the foregoing. If any proxy materials are to be furnished online, then all soliciting materials must be furnished on the same Web site no later than the day such materials are first sent to shareholders or made available to the public. Pursuant to the final rules, the proxy card may not be sent with the Notice; instead, an issuer or other soliciting person may send a proxy card ten days or more after it sends the Notice, provided that the proxy card is accompanied by a copy of the Notice. This is different from proposed rules, which would have allowed the proxy card to be furnished on the Web site or with the Notice. As a result of comments made on the proposed rules, the ten-day rule was added to the final rule in an attempt to prevent uninformed proxy voting by shareholders who do not have access to the proxy materials, with the idea that the ten days will give the shareholder enough time to access the proxy materials online or request a paper or e-mail copy.

If the issuer elects to use the notice and access model, these proxy materials must be posted on an independent Web site other than EDGAR, at no charge to shareholders. The Web site must include a means for a shareholder to execute a proxy as soon as he or she has electronic access to the proxy statement. This can be done through an electronic voting platform that is linked to the Web site or a telephone number for executing a proxy. An issuer may decide on a case-by-case basis whether it chooses to post proxy materials on the Internet or mail out physical copies of proxy materials, but this decision may be made independently each time the issuer sends out proxy materials. Issuers would still need to keep hard copies of proxy materials on hand for shareholders who request them. While the proposed rules only allowed for a shareholder to request a paper or e-mail copy of the proxy materials for a particular meeting, the final rules allow the shareholder to request that all future proxy materials distributed by the issuer in reliance on the notice and access model be sent in a paper or e-mail copy.

II. Effects of Rules on Intermediaries

Intermediaries, or those who distribute proxy materials to beneficial holders of securities, would be required under the final rules to distribute proxy materials through the notice and access model when they are requested to do so by their issuer. An intermediary cannot follow the notice and access model on its own initiative without the permission of its issuer.

Intermediaries are required to prepare their own Notices, with information from the issuer or other soliciting person, to distribute to beneficial owners. These Notices contain much of the same information as the notice from an issuer and should include any control or identification numbers required for the beneficial owner to provide voting instructions. The Notice also should direct the beneficial owner to request paper or e-mail versions of documents from his or her intermediary, instead of from the issuer. The intermediary’s Notice may not, however, include a means (such as a telephone number) that would enable the beneficial owner to provide voting instructions without having access to the annual report and proxy statement. As with issuers, intermediaries are required to send its Notice to beneficial owners at least forty days before the meeting.

Under the final rules, the intermediary may choose to direct beneficial owners who wish to access proxy materials to the intermediary’s Web site—so long as it is free of charge and does not compromise the beneficial owners’ anonymity—or to the issuer’s Web site. If beneficial owners are directed to the issuer’s Web site, the intermediary is required to inform the beneficial owners “that they can submit voting instructions to the intermediary, but cannot execute a proxy directly in favor of the issuer unless the intermediary has executed a proxy in favor of the beneficial owner.” [3] Additionally, intermediaries are required to allow beneficial owners to elect that they receive paper or e-mail versions of all future proxy materials distributed pursuant to the notice and access model with regard to securities held in the beneficial owner’s account. The intermediary then must maintain records of which beneficial owners have elected to receive future proxy materials in paper or e-mail form.

III. Effects of Rules on Third Parties

Under the final rules, shareholders and other third parties who wish to send out proxy materials may also choose to do so under the notice and access model, following similar procedures as an issuer. Once again, if the shareholder or third party decides to use the notice and access model, its proxy materials would need to be posted on an independent Web site that is publicly accessible. However, the Notice sent out by a shareholder or third party may differ from that required of an issuer. For example, the Notice must only include the agenda items known by the soliciting person, not the full agenda that is required of an issuer. Additionally, if the soliciting party is providing only a partial proxy card, which is a card that only addresses the agenda items of interest to the soliciting party, the notice must make clear whether the execution of such a partial proxy card would invalidate the shareholder’s earlier vote submitted through the issuer’s proxy card.

A third party that posts proxy materials online need not send a Notice to all shareholders, although if it does not, it must clearly state so on its Notice. The soliciting person must also send a paper or e-mail copy of the proxy statement to any shareholder to whom the soliciting person sends a Notice, if the shareholder requests it. Such a Notice would only be required where such person furnishes a proxy card without proxy materials if its communications are within the ambit of Exchange Act Rule 14a-12. However, when a third party does choose to send out notices, it must do so prior to the later of forty days before the meeting or ten days after the issuer first sends out its own proxy solicitation.

Under Rule 14-7 of the Exchange Act, issuers may be required to send out a soliciting person’s proxy materials on his or her behalf or provide a shareholder list. Because of concern around giving third parties certain information from the shareholders, such as e-mail addresses, the issuer is only required to give the soliciting person information on whether a shareholder has decided to receive all future proxy materials in paper form. Under the final rules, the third party, and not the issuer, would be able to decide whether such materials are sent to shareholders or distributed to shareholders by the “notice and access” method. If a third party requests the notice and access model, though, that party is responsible for providing copies of its Notice to the issuer for all shareholders to whom the person expects to provide a notice.

IV. Conclusion

Spearheaded by the recent Securities Act reforms, these new rules continue the SEC’s recent trend towards enabling issuers to use the Internet in presenting information to investors. In addition, these rules should save issuers substantial printing, duplication and delivery costs. On the other hand, the rules also allow dissenting shareholders to have a less costly means of waging a proxy contest, and by extension could lead to more proxy contests.

1. See SEC Release No. 34-52926, which can be found at http://www.sec.gov/rules/proposed/34-52926.pdf.
[Back to reference]

2. See SEC Release Nos. 34-55146; IC-27671, which can be found at www.sec.gov/rules/final/2007/34-55146.pdf
[Back to reference]

3. See SEC Release Nos. 34-55146; IC-27671, page 37.
[Back to reference]

NPCreate: 12/13/2005

Software and Rights in Technical Data

Crawford, Cindy — Wed, 14 May 2008 22:43:42 GMT

Wiki Content:

Federal government acquisition contracts include clauses that give the government certain rights to the technical data and computer software delivered by the contractor. The breadth of the rights obtained by the government controls the future commerciality of the item described in the technical data and the computer software. This is so even if the software has a registered copyright.

The government never obtains ownership, title, or copyright to the technical data or computer software through these provisions. However, if the government’s use rights are unlimited, such that it may literally distribute your technical data to the public -- including your competitors, then your ownership of the data or the copyright may mean little.

As a result, it is important to understand the different types of use rights the government obtains in its contracts. It is also important to appreciate that civilian agencies and the Department of Defense (DOD) use different mechanisms to protect a contractor’s data and software.

Types of Government Use Rights

Under the Federal Acquisition Regulation (FAR), which governs civilian agency contracts, there are two types of government rights in data: “unlimited rights” and “limited/restricted rights.” When the government obtains “unlimited rights,” it can provide your data to any entity for any purpose. Providing such rights to the government may destroy the commercial value of the data or software. On the other hand, when the government obtains “limited rights,” or for computer software, “restricted rights,” it may not disclose the data outside the government, use the data for manufacture, or allow another party to use the data on the government’s behalf. With limited or restricted rights, the government may only allow disclosure to a foreign government for evaluation or another party for emergency overhaul or repair. Providing the government with limited rights allows the contractor to maintain the commercial value of its data or software.

The DOD, through the DOD FAR Supplement (DFARS), adopts the limited/restricted and unlimited rights categories of the FAR and adds a middle position, “government purpose rights” (GPR). GPR allows the government to use a contractor’s data or software for any government purpose, or to disclose it to others to use for a government purpose. Thus, data acquired with GPR may be provided to your competitor by the government, but only for government purposes (another government contract) and not for commercial purposes. These rights expire after five years.

Source of Funds Test

Determining which rights the government is entitled to is based upon a “source of funds” test. If, for example, the contractor can prove that it paid for the development of the item or software in question with 100 percent private funds, then the government only is entitled to limited rights. Under the FAR, if the government provided any funds for development, the government obtains unlimited rights. Under the DFARS, the government obtains GPR if the development was paid for with mixed funds, i.e., private and public funds, and the government obtains unlimited rights only if the development was paid for with 100 percent government money.

Thus, establishing systems to carefully define “development” and track the “color” of money for development is essential for all government contractors.

Differing Methods of Protection: Trap for the Unwary

Typically, a contractor may prevent the government from claiming unlimited rights by providing notice to the government of its rights and by marking the data and software with specified restrictive use legends. However, there is a very important distinction between the FAR and DFARS in the way a contractor is required to protect its data from a government claim of unlimited rights. In a DOD contract, the contractor is required to deliver data it seeks to protect to the government with the requisite prior notice and include restrictive markings on the data and software. In a civilian agency contract, the basic method of protecting data and software is to withhold the information from the government. Under the standard technical data rights clause, if the contractor seeks to assert that the government should obtain only limited rights in the data or software in question, it must withhold the data or software, and instead submit form, fit or function data. This is true even if the data or software in question is a deliverable under the contract. If the contractor provides the data or software to the government, even with restrictive markings, the government obtains unlimited rights in the data or software.

Thus, DOD favors disclosure of limited rights data, while the civilian agencies favor withholding of that data as the method to protect the commercial value of your data and software. Of course, in most cases, the rights obtained by the government can and should be specially negotiated. While the government will insist upon certain minimum rights in all cases, there is room to negotiate the specific rights and uses of the data and software by the government.

NPCreate: 4/7/2004

Open Source Software

Covitz, Philip — Wed, 14 May 2008 19:29:39 GMT

Wiki Content:

On June 29, 2007, the Free Software Foundation (FSF) announced that it would begin to use a new version of its General Public License (GPL), called Version 3.0. Previous versions of GPLs did not expressly grant a patent license to users of open source software. Under the terms of GPL Version 3.0, royalty-free licenses are granted for relevant patents owned by contributors. In addition, Version 3 of the GNU Affero GPL, released on November 19, 2007, protects users from anti-circumvention laws with regard to network server software, in addition to patent challenges. The risk of using open source software, whether intentionally or inadvertently, has increased significantly.

Background

Open source software is software that is distributed with the source code, and without prohibitions on modifying that source code or distributing the software. Those who contribute modifications to software licensed as open source agree to distribute the modifications in accordance with the appropriate open source license, most commonly the GPL. As a result, the GPL has a “viral” effect. Previous versions of GPL licenses did not expressly grant a patent license to users of open source software.

The GPL Version 3.0

As indicated above, under the terms of GPL Version 3.0, “[each] contributor grants you [meaning licensees] a non-exclusive, worldwide, royalty-free patent license under the contributor’s essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version” (see Sections 0 and 11 of the GPL). For users, this means that they will be able to work with GPLv3-covered software without risk of a contributor suing them for patent infringement for that specific use. For software developers and distributors, this indicates that the risk of the viral effect of open source software is increased, because they may inadvertently grant a license to some of their patents when incorporating open source software into their code.

Section 11 of GPL Version 3.0 defines Essential Patent Claims as

“all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, ‘control’ includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.”

The new Affero GPL Version 3

This Affero GPL is specifically written to cover network server software. As the Preamble indicates, the Affero GPL “requires the operator of a network server to provide the source code of the modified version running there to users of that server.” Regarding anti-circumvention laws, Section 3 of the Affero GPL now reads:

“When you [licensees] convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work’s users, your or third parties’ legal rights to forbid circumvention of technological measures.”

Section 3 does not suggest that digital rights management is prohibited. According to the FSF, users can utilize code released under the Affero GPL to develop any kind of Digital Rights Management (DRM) technology they desire. However, Section 3 says that the system will not count as an effective technological “protection” measure, which means that an individual who breaks a DRM code will be free to distribute his or her own software as well, unhindered by the Digital Millennium Copyright Act and similar laws. In other words, according to the FSF, the GNU GPL does not restrict what people do with their software; it just stops them from restricting others.

NPCreate: 6/29/2007

Employers Face Liability for Improper Disposal of Consumer Information

Crawford, Cindy — Wed, 14 May 2008 22:24:27 GMT

Wiki Content:

The Federal Trade Commission (FTC) estimates that twenty-four million Americans have experienced identity theft. To combat identity theft, President Bush signed the Fair and Accurate Credit Transactions Act of 2003 (FACTA) on December 4, 2003. This act requires the FTC and other federal agencies to issue regulations requiring any person who maintains or otherwise possesses consumer information derived from consumer reports to properly dispose of such information. The final FTC disposal rule, 16 C.F.R. Part 682, became effective on June 1, 2005.

These new rules apply to everyone, except the individual consumer who obtains her/his own consumer report. Lenders, landlords, insurers, mortgage brokers, and automobile dealers are covered. Any employer - regardless of industry or size - that possesses or maintains consumer information for a business purpose is covered by these rules.

The expansive definition of “consumer information” used in the Fair Credit Reporting Act (FCRA) applies to these new disposal rules. That is, any written or oral summary of someone’s general reputation, character, credit-worthiness, credit standing, personal characteristics, or lifestyle prepared or collected by a consumer reporting agency constitutes “consumer information.” Accordingly, any record about an individual, whether in paper, electronic, or other form, that qualifies as a consumer report under FCRA (or is derived from a consumer report), must be properly discarded. Note, however, that an employer’s own searches for background information on applicants or employees are not covered by FCRA. In general, employers and others covered by FACTA must now take all reasonable measures to protect against unauthorized access to, or use of, consumer information during or in connection with its disposal.

Some industries already follow similar disposal rules. Title V of the Gramm-Leach-Bliley Act requires financial institutions to take precautions to protect customer information. HIPAA obliges health care plans and providers to guard against unauthorized disclosure of personal information. State laws may address this issue. Under a 2003 California law, employers and others must disclose security breaches involving the personal data of any California resident; other states are considering similar laws. Additionally, a range of personal information laws remain in effect, each with their own particular record retention requirements (e.g., I-9 forms, payroll information).

Whereas the proposed FTC disposal rule would have covered any information that identified particular individuals, the final rule is narrower, expressly excluding aggregate information and blind data. 16 C.F.R. § 682.1(b). Neither the proposed nor the final rule specifies its own record retention period prior to disposal.

The FTC’s interpretative guidance contains interesting, even amusing, descriptions of reasonable disposal measures. Paper records, for example, may be shredded, burned, or pulverized as long as they cannot practicably be read or reconstructed. The FTC suggests that a paper shredder can be purchased for a little as $25. For the sale, donation, transfer, or other disposal of computer discs and hard drives with stored consumer information, the FTC recommends destruction or erasure by (1) “simply smashing the material with a hammer” and (2) overwriting or “wiping” data prior to disposal. Wiping tools, the FTC adds, “are widely available for under $25” or as free downloads on the Internet.

The final rule provides illustrative examples of “reasonable” disposal methods that, the FTC warns, are not safe harbors. Employers must determine “reasonableness” using four factors: (1) the sensitivity of the consumer information, (2) the nature and size of the company, (3) the costs and benefits of different disposal methods, and (4) technological changes.

What actions should employers take under this new final disposal rule?

· Establish security policies and procedures governing the disposal of consumer information.

· Educate and train their employees regularly on proper disposal procedures.

· Update and monitor compliance with their information security and disposal programs on a periodic basis.

· Carefully select outside companies for disposal contracts to ensure they are reputable and competent, and then monitor these companies’ compliance with those contracts.

Personal information may even be stolen by a company’s own employees. At one company, a computer assistance employee sold the passwords and access codes of 30,000 individuals to identity thieves. Employers should seriously consider whether they must acquire consumer information, and if so, they must limit access to those who absolutely need the data. On top of these dangers, some identity thieves have embedded employees within a company for the express purpose of stealing consumer information. Fortunately, employers can fight back with defenses such as background checks, heightened security, frequent employee monitoring and training and nondisclosure agreements prohibiting the misuse of confidential information for employees allowed internal access to such information.

Identity theft is the fastest-growing crime in the United States. Identity thieves will do anything to gain access to confidential personal information, so employers who acquire such information must carefully protect it. Merely enacting data security policies and procedures is not enough to avoid liability; employers must also enforce such policies through outside audits and continuing compliance checks.

NPCreate: 6/6/2005

Copying Pages from a Website Could Cost You

Crawford, Cindy — Wed, 14 May 2008 20:59:55 GMT

Wiki Content:

by Peter Durant
How would you like to be able to stop a competitor or anyone else from copying portions of your website? You might, just by putting a virtual “landmine” in your terms of use so that it becomes very costly to copy your website’s content without your permission. Certainly the website owned by Suzanne Shell, profane-justice.org, has tripped up Internet Archive, a long-time automated search engine, and it just remains to be seen whether Internet Archive will be maimed in the explosion.

A little background. Shell hosts profane-justice.org, which provides information and services to individuals accused of child neglect. Evidently Profane-Justice and various child-protective services do not see eye to eye because the website states—to individuals accused of child neglect—that: “YOU WILL BE ADVISED… THAT USING ANY INFORMATION CONTAINED ON THIS SITE WILL HURT YOUR CASE.” Since Shell believes that certain individuals and organizations copy and deliver portions of her website to her clients and viewers out of context, she has offered a “bounty” of five percent (5%) of the damages collected to anyone who can assist her in proving that Profane-Justice’s website pages were copied illegally and in violation of the website’s terms of use.

The website states that: “[I]f any portion of this web site appears in any [state agency], attorney or service provider record or other non-licensee’s possession, that is copyright infringement and WE WILL PROSECUTE IT.” (Emphasis in original.)

Profane-Justice’s terms of use deem any copying of the site’s contents as entering into a contract:

IF YOU COPY OR DISTRIBUTE ANYTHING ON THIS SITE - YOU ARE ENTERING INTO A CONTRACT. READ THE CONTRACT BEFORE YOU COPY OR DISTRIBUTE. YOUR ACT OF COPYING AND/OR DISTRIBUTING OBJECTIVELY AND EXPRESSLY INDICATES YOUR AGREEMENT TO AN ACCEPTANCE OF THE FOLLOWING TERMS ….

The draconian terms include charging the user $5,000 for each individual page copied “in advance of printing,” granting a perfected security interest of $250,000 “per each occurrence of unauthorized use” of the website in all of the user’s land, assets and personal property, the user agreeing to pay “$50,000 per each occurrence of failure to pre-pay” for use of the website, “plus costs and triple damages,” and agreeing to waive numerous defenses in any claims by Shell against the user. Internet Archive v. Shell, 2007 U.S. Dist. LEXIS 10239, February 13, 2007 (U.S. Dist. Ct. Colorado).

Before the lawsuit, the website’s copyright notice was accessible through an icon located on the website. Sometime thereafter the website was modified so that any attempt to view the copyright notice required a click-through agreement, which has generally been held to be an enforceable contract. Specht v. Netscape Communications Corp., 306 F.3d 17 (2d Cir. 2002).

Internet Archive is a nonprofit organization devoted to preserving a record of websites. Its automated bot called the Wayback machine systematically browses the Worldwide Web, reproducing content for placement in its archive. This is done automatically without seeking permission, although Internet Archive explains on its website how content owners can remove material from the archive.

Shell discovered that the Wayback machine had reproduced the contents of her website approximately 87 times between May 1999 and October 2004 and “displayed her entire website to the public daily during that time period. Although Internet Archive removed Shell’s website contents from its archive after Shell’s request to do so, Shell demanded $100,000 and threatened to sue if Internet Archive failed to pay. Internet Archive failed to pay, Shell sued, and the Colorado District Court denied Internet Archive’s motion to dismiss Shell’s claim for breach of the contract on Profane-Justice’s website. Thus, Internet Archive is exposed to potential liability for copying the contents of the website even though it was done automatically and the terms of the contract were allegedly unknown to any “human being” at Internet Archive.

The court relied only on the facts alleged in the pleadings to reach its decision. But on that basis, it agreed that Internet Archive and Suzanne Shell could have entered into a contract by virtue of the parties’ conduct. The court acknowledged that a one-time user might have been unaware of the website terms of use but also that user might have been aware of the terms during subsequent uses, citing Register.com, Inc. v. Veiro, Inc., 356 F.3d 393 (2d Cir. 2002). Since Shell’s complaint stated that notice of the contract terms “is published on every page of the website,” the court said a factual investigation needed to be made on the location of the terms, “how a user reaches [them], and when a user becomes aware of [their] existence.”

Internet Archive tried to argue that the U.S. Copyright Act preempted Shell’s claim of breach of contract. The court made short shrift of that argument, noting that contracts requiring payment for use of copyrighted material “protect a right beyond the rights protected in the Copyright Act, and so establish the extra element necessary to thwart preemption.” The court went on:

The logic of these cases is persuasive…. Assuming a contract exists, Internet Archive has contracted for the use of Shell’s material, and agreed to pay ‘$5,000 per printed page’ for the website contents…. Failure to meet these terms grant Shell a security interest in the user’s assets and goods, as well as triple damages. These requirements of damages lie well beyond the protections Shell receives through the Copyright Act.

When in doubt, plead unconscionabilty. Unfortunately for Internet Archive, the court noted that: “[A]bsent further factual findings, I cannot conclude that [the alleged] contract is unconscionable.”

Any website owner should take note of Shell if it believes material on its website is being used by its competitors or other unauthorized entities or individuals. A little creative drafting could go a long way, and Google has deep pockets.

NPCreate: 3/13/2007

Abstraction-Filtration-Comparison Analysis Guidelines for Expert Witnesses

Crawford, Cindy — Wed, 14 May 2008 21:21:23 GMT

Wiki Content:

The purpose of this paper is to provide an outline for software experts who have been retained to perform “abstraction-filtration-comparison” analysis in software copyright infringement cases to use in preparing their reports. The paper also serves as a primer for attorneys on the legal issues associated with such an analysis.

I. The Copyright Infringement Test

The test for copyright infringement in cases involving software is the same as in other types of copyright infringement cases. To prevail, the plaintiff must (1) prove ownership of a valid copyright and (2) present direct evidence of actual copying by the defendant or, alternatively, show that the defendant had “access” to the copyrighted work and that the copyrighted work and the work alleged to infringe are “substantially similar.”[1] If a plaintiff can establish actual, unauthorized copying by the defendant of substantial amounts of original source or executable code, then, assuming what was copied is copyrightable (a very important and often overlooked assumption), the plaintiff is well on its way to victory in a copyright infringement case.

Copyright protection extends not only to the “literal” elements of computer software—the source and executable code—but also to a program’s nonliteral elements, including its structure and user interfaces.[2] Cases involving actual copying of source or executable code are properly categorized as “literal” copying of “literal elements” cases. Such cases arise most frequently in the context of pirated video games or other plainly pirated software.

Most reported software cases, however, are more complicated and involve allegations of “nonliteral” copying or literal copying of “nonliteral elements.” Copyright protection applies to “nonliteral copying … else a plagiarist would escape by immaterial variations.”[3]

Nonliteral copying, when applied to the written word, is copying that is paraphrased or loosely paraphrased. When nonliteral copying is alleged in software cases, the court must analyze whether the plaintiff’s software and the software that is alleged to infringe are “substantially similar.” The majority of circuit courts that have considered the issue have adopted what is known as the “abstraction-filtration-comparison” test to perform this analysis in software cases. The goal of this paper is to outline, for nonlawyer computer experts, how to perform his analysis.

Courts have held that the nonliteral elements of a computer program include its “structure” and “fundamental essence.”[4] An example of a nonliteral element of a computer program is the menu-command hierarchy in a computer spreadsheet program.[5] Thus, if the alleged infringer copied the menu command hierarchy and user commands of a program, but did not copy the actual source or executable code of the program, that case alleges literal copying of nonliteral elements.

II. Literal and Nonliteral Copying

A. Literal Copying

The standards for expert analysis in software copyright infringement cases vary somewhat from circuit to circuit and differ based on the nature of the copying alleged. In cases involving literal copying, expert analysis may be necessary to assist in establishing that the plaintiff’s software (or material portions thereof) was literally copied. A simple side-by-side comparison of the plaintiff’s work and the work that it is alleged to infringe will suffice. Experts are frequently useful in pointing out programming errors shared by both programs that logically could have arisen only as a result of literal copying.[6] This analysis may be more complicated in cases involving literal copying of nonliteral elements (such as a menu-command hierarchy). Still, all that is required to establish copying in such cases is a side-by-side comparison of the nonliteral elements of the plaintiff’s work and the allegedly infringing work.

Establishing copying, however, is only the first part of the inquiry. The other, equally important, issue is whether the portions of the plaintiff’s work that were copied are copyrightable. The courts call this “filtration” analysis. Experts can be of great assistance with this part of the analysis. Filtration analysis is discussed in more detail below.

B. Nonliteral Copying

The leading method of analysis in cases involving allegations of nonliteral copying of either literal or nonliteral elements is the “abstraction-filtration-comparison” test first enunciated by the Second Circuit in Computer Associates. This approach requires a court to [7]

1. break down the plaintiff’s program into its constituent structural parts (“abstraction”);

2. examine each part for incorporated “ideas,” elements taken from the public domain, methods of operation, processes or procedures, or otherwise unprotected material (“filtration”); and

3. compare the remaining kernel of creative expression, if any, to the work alleged to infringe at each level of abstraction (“comparison”).

The table below summarizes the typical allegations in infringement cases and the type of analysis required:

Literal Copying of Literal Elements

(Side-by-side comparison of source code and “filtration” analysis)

Literal Copying of Nonliteral Elements

(Side-by-side comparison of nonliteral elements and “filtration” analysis)

Nonliteral Copying of Literal Elements

(Abstraction-filtration-comparison analysis)

Nonliteral Copying of Nonliteral Elements

(Abstraction-filtration-comparison analysis)

III. Abstraction-Filtration-Comparison Analysis

A. Abstraction

The application of the “abstraction” portion of the analysis necessarily varies from case to case and program to program, and the courts recognize that experts are required to guide them in properly abstracting a computer program. It is, nevertheless, generally recognized that nearly all computer programs can be broken down into at least the following generally declining levels of abstraction:[8]

1. The main purpose of the program (i.e., a spreadsheet, database, etc.)

2. The structure and architecture of the program (i.e., a flowchart or visual depiction of how the program works, including the sequencing of tasks, and the movement of information through the program)

3. Program modules or subroutines (there may be several levels to this analysis as some routines are built into larger routines that are then incorporated into still larger modules; the focus is on the operations performed and data types used at each stage)

4. Algorithms (a specific series of steps that accomplishes a particular operation) and data structures (a precise representation of the type of data used, such as integers, variables, etc.)

5. Source code (the literal text of a program written in a programming language comprehensible to humans)

6. Object or executable code (the literal text of a program written in machine-readable language)

Other potential levels of abstraction for experts to consider are

1. subroutine names (some names contain expression, and merit protection; others are merely descriptive, and merit no protection);

2. input and output formats (these could merit protection for any artistic expression they might incorporate, but the types and layout of the data is likely not protectable);

3. sorting criteria; and

4. programmer remarks or comments (these warrant a high level of protection because they are usually intended to communicate the programmer’s ideas to others and are thus expressive).

Abstraction is not an end in itself. Rather, it is merely a prerequisite procedure that facilitates the next step of filtering out the elements of the program that are not protectable under copyright law.

B. Filtration

Once an expert has identified the various levels of abstraction of a given computer program, the expert (and ultimately the court) must then “filter out” those elements of the program that are not protected by copyright law.

1. Facts

Facts cannot be copyrighted. There is a distinction in copyright law between the creative expression of a fact and the fact itself. Because facts do not owe their origin to an act of authorship, no one may claim originality as to facts or discoveries under the Copyright Act. Thus, to the extent that any level of abstraction in software consists of facts, those facts must be filtered out at this stage of the analysis. It is well established that copyright does not protect the effort involved in discovering or exposing facts.[9]

However, the selection and arrangement of facts, if sufficiently original and not dictated by external factors such as governmental requirements, hardware standards, mechanical specifications, software standards and compatibility requirements, industry practices, customer demands, or standard computer industry programming practices may be copyrightable.[10] Thus, before the facts are filtered out, the expert must first consider whether the arrangement of facts is sufficiently original to warrant protection or whether the arrangement was largely dictated by external factors.

2. Public Domain

Elements of computer programs that are taken from the “public domain” are not copyrightable. Many programming techniques and methods of program organization are so well known to, and so frequently used by, the programming community that they are in the public domain and free to anybody to use.[11] It takes a programming expert to identify and filter out public domain or commonly used program and organization elements. Experts are also useful in providing testimony about standard programming practices and techniques and general industry knowledge at the time of the alleged infringement. It is not a violation of the Copyright Act to copy material that is in the public domain.

3. Ideas

One of the most basic principles of copyright law is that copyright protection applies only to the author’s original expression and not to the ideas embodied in that expression. It has been held that program features such as having two text editors instead of one, color coding keywords, and automatically presenting (floating above the cursor position) a list of available commands are all uncopyrightable ideas. [12] Similarly, courts have held that centered headings, underscored program names, and features that have become industry standards (even if the original selection was completely arbitrary at the time the feature was first adopted) are not protectable. The challenge for experts (and for the courts) is distinguishing between ideas and expression. While this is sometimes difficult because almost all software is essentially utilitarian in nature, the cases teach at least a few general guidelines.

The main purpose or function of a program, for example, is always an idea that is not protected by copyright law.[13] Similarly, at intermediate levels of abstraction, the main purpose or function of a program module or subroutine is almost always an unprotectable idea.

By contrast, at the lowest levels of abstraction, source and executable code are almost always found to be protected expression. The only caveats to this observation are if the doctrines of “merger” or scenes à faire apply.

Under the scenes à faire doctrine, there is no copyright protection for unoriginal elements that flow from the undisputed standard and inherent characteristics of a common idea.[14] The hornbook example of this is illustrated by vampire novels or murder mysteries. Both necessarily involve killings and eerie or macabre settings. Inherent story characteristics that flow from such a common idea are not protected by copyright law.[15]

The scenes à faire doctrine is often applied in software cases because it is frequently impossible to write a program in a particular computing environment without employing certain standard programming techniques and design elements.[16] This is because certain functions, data elements, and the order of operation of a program can be dictated by such things as the type of computer on which the program will run, the programming language used, the operating system environment, governmental requirements, industry demands and standards, and widely accepted programming practices.[17] For these reasons, the graphical user interfaces in modern computer programs “have received thin copyright protection that amounts to a prohibition against verbatim copying. This heightened standard is justified by an interest in standardization and the fact that there are a limited range of expressions to achieve a useful screen display.”[18]

The merger doctrine is also a useful tool in filtering out ideas. Under the merger doctrine, when there is really only one way (or a very limited number of ways) to express an idea, and the idea and expression are inseparable, such expression cannot be copyrighted. Merger was an important concept in the electronic spreadsheet cases of the 1990s because there was really only one logical way to express the idea of a spreadsheet.[19] Well before those cases, the merger doctrine was applied to deny copyright protection to certain language in insurance forms because the language at issue was essential to accomplishing the desired result and there were few, if any, viable alternatives to the language used.[20]

Expert testimony is important in guiding courts as to whether to apply the merger doctrine. Computer experts familiar with a particular type of application are usually well qualified to testify as to whether there is only one way (or a very few ways) to accomplish the desired task. Depending upon the nature of the application involved, it may be necessary to supplement the testimony of a computer expert with an industry expert.

4. Processes, Procedures, Systems, and Methods of Operation

Section 102(b) of the Copyright Act denies copyright protection to procedures, processes, systems, and methods of operation. Thus, while the “expression” of a programmer is protected by copyright, the processes and methods embodied in a program are not. Certain processes and methods of operation may well be patentable, but they are not copyrightable. “Unlike a patent, a copyright gives no exclusive right to the art disclosed; protection is given only to the expression of the idea—not the idea itself.”[21]

Processes can be found at every level of abstraction except for the “main purpose” level. Thus, before proceeding to the comparison step, the expert must filter out all of the unprotectable processes found at each level of abstraction. “Most commonly, processes will be found as part of the system architecture, as operations within modules, or as algorithms.”[22]

The issue for both experts and the courts is how to distinguish between protected expression and unprotected processes, procedures, systems, and methods of operation. The terms “processes,” “procedures,” “systems,” and “methods of operation” should be commonly defined by experts to mean a “method for achieving a particular result.”[23] Thus, the fact that two programs both incorporate a method to achieve a certain result (such as one-click ordering) does not mean that one program infringes the other. Rather, the issue is whether the expression of that method is the same or substantially similar.

C. Comparison

After an expert has filtered out those elements of the plaintiff’s program that are not protectable, the kernel or core of the program that remains (if any) is what constitutes protected expression. The issues then become whether what remains (1) is the same or substantially the same as the corresponding portion of the work alleged to infringe; and (2) constitutes a “substantial part” of the original work.

If a side-by-side comparison shows that the competing programs are identical or nearly so, that ends the similarity analysis. If a side-by-side analysis reveals that the portions are not the same, the issue becomes whether the protected portions are “substantially” the same. This is a qualitative and somewhat subjective analysis and a place where computer experts can provide real value to their clients and guidance to the courts. The results of the reported cases, however, teach that only literal copying or very close paraphrasing of protected elements of works will be deemed to infringe in most cases.

Whether the amount of protected and allegedly infringed expression in a given program is “substantial” involves an equally ad hoc analysis. The issue is whether, taken as a whole, the allegedly infringed portion is a “substantial” or “important” part of the program.[24] This is where a copyright doctrine known as “fair use” comes into play.

Congress has specifically exempted from infringement literal copying that amounts to a “fair use” under 17 USC §107 (setting forth four nonexclusive statutory factors). The fair use doctrine is designed to exempt from copyright infringement actions the copying of small amounts of copyrighted material, particularly in educational or not-for-profit contexts. The application of the fair use doctrine varies from case to case and, despite many widely held misconceptions (even among lawyers) about its scope, there are no bright line rules for fair use, especially in the commercial context.

Because of the ad hoc nature of the fair use/substantiality analysis, this is another area where expert input and analysis is valuable. Outside of the software context, fair use is a frequently invoked and often successful defense. In software copyright infringement cases, however, the fair use defense has been rarely asserted outside of the context where a competitor has made a single copy of a program to “reverse engineer” it to make a noninfringing system function with the plaintiff’s system.[25] This may be because program elements that might have been amenable to a fair use argument are often filtered out before the comparison analysis.[26]

D. Expert Checklist

Set forth below is a checklist or set of instructions for programming experts to use in software copyright infringement cases. This list should not be viewed as exhaustive and should be tailored somewhat in accordance with the facts and allegations of an individual case and the controlling law in the relevant jurisdiction.

A. Abstraction Analysis

1. Break the plaintiff’s program and the allegedly infringing program into heir component parts at each level of abstraction

a. Determine the main purpose of the overall program and each subroutine.

b. Analyze the overall structure and architecture of the program and prepare a flowchart or other visual depiction of how the program works, including the sequencing of tasks, sorting criteria, input/output formats, and the movement of information through the program.

i. Analyze screen displays or the menu/command hierarchy and identify any limitations on the available range of alternative choices for screen display appearance and the order of screen displays (such as consumer preferences, browser compatibility, hardware requirements, etc.).

c. Analyze the function, organization and interrelationships of the various program modules and subroutines. This may be a multilayered analysis if modules or subroutines are incorporated into still larger modules or routines. Make distinctions between the ideas and methods of operation embodied in various modules and the expression of those ideas and methods of operation.

d. Examine the source code for the presence of identifiable algorithms and data structures. Make distinctions between ideas and methods of operation and the expression of those ideas and methods of operation in an algorithm or data structure. Look for programmer comments in source code.

e. Print out the entire source code for each program.

B. Comparison of Literal Source Code

1. Perform a comparison of the literal source code (including comments) and identify similarities and dissimilarities. Determine whether executable or object code was copied.

2. Discuss the available range of alternative choices for code sequences or algorithms that perform the same function.

3. Identify any factors affecting the range of alternative choices for code sequences or algorithms, and explain why they create a limitation (e.g., programming language, operating system, industry standards, etc.).

4. Comment on the existence and prevalence of the same or similar code sequences in other works or in computer science literature (e.g., identification of works with similar coding, use of standard techniques, industry standards).

C. Comparison on Nonliteral Elements

1. Identify routines and subroutines in the parties’ modules that perform the same function.

2. Compare the order and relationship of routines, subroutines, and algorithms, and identify any similarities and dissimilarities.

3. Discuss the range of alternative choices for the order and relationship of routines, subroutines, and algorithms.

4. Identify any factors affecting alternative choices for the order and relationship of routines and subroutines, and explain why they create a limitation (e.g., logic and efficiency, interoperability, functionality, nature of the problem to be solved).

5. Comment on the existence and prevalence of the same or similar order and relationship of routines and subroutines in other works or in computer science literature.

6. Analyze and express an opinion as to whether any similarities between the protected portions of the relevant programs are substantial or important and explain why.

IV. Conclusion

Software copyright infringement analysis is complex, both in terms of the legal principles involved and the technical expertise necessary to conduct a proper review. Accordingly, technical experts play an indispensable role in assisting with such an analysis. For expert testimony to be useful (or even admissible), however, attorneys must educate the experts they retain in how to conduct an appropriate infringement analysis. The burden is on the plaintiff to establish infringement in a copyright case. Failure to conduct an appropriate infringement analysis is generally a fatal error for plaintiffs.

1. Feist Publications v. Rural Telephone Service Co., 499 U.S. 340, 361 (1991); Yankee Candle Co. v. Bridgewater Candle Co., 259 F.3d 25, 33 (1st Cir. 2001).
[Back to reference]

2. General Universal Systems v. Lee, 379 F.3d 131, 142 (5th Cir. 2004).
[Back to reference]

3. Nichols v. Universal Pictures Co., 45 F.2d 119, 121 (2d Cir. 1930) (L. Hand, J.).
[Back to reference]

4. Computer Associates Int’l, Inc. v. Altai, Inc., 982 F.2d 693, 701 (2d Cir. 1992).
[Back to reference]

5. See Lotus Dev. Corp. v. Borland Int’l, Inc., 49 F.3d 807, 810–12 (1st Cir. 1995).
[Back to reference]

6. See Atari Games Corp. v. Nintendo of America, 975 F.2d 832, 845 (Fed. Cir. 1992).
[Back to reference]

7. Computer Associates, 982 F.2d at 706-10.
[Back to reference]

8. Gates Rubber Co. v. Bando Chemical Indus., Ltd., 9 F.3d 823, 835 (10th Cir. 1993).
[Back to reference]

9. See, e.g., Gates Rubber Co. v. Bando Chemical Indus., Ltd., 9 F.3d 823, 842–43 (10th Cir. 1993) (filtering out “constants” (which reflected scientific observations of the physical relationships concerning the load that a belt could carry at different speeds) as unprotectable facts and rejecting the argument that such facts should be protected because the plaintiff had spent thousands of hours determining them).
[Back to reference]

10. These factors are also relevant to the “merger” and scenes à faire issues discussed below.
[Back to reference]

11. Complex computer programs usually consist of relatively independent parts called subroutines or modules. Most experienced programmers maintain a “library” of routines written for other programs. These library routines are often reused by programmers to avoid having to reinvent the wheel each time they start a new program. Reused library routines are not copyrightable.
[Back to reference]

12. Ilog, Inc. v. Bell Logic, LLC, 181 F.Supp.2d 3, 13–14 (D. Mass. 2002).
[Back to reference]

13. Gates Rubber, 9 F. 3d at 836.
[Back to reference]

14. Maddog Software, Inc. v. Sklader, 382 F.Supp.2d 208, 278 (DNH 2005).
[Back to reference]

15. Id. at 278 n.7.
[Back to reference]

16. Computer Associates, 982 F.2d at 709.
[Back to reference]

17. Id. at 709–10.
[Back to reference]

18. Marshall Leaffer, Understanding Copyright Law, at 85 (3d ed. 1999).
[Back to reference]

19. See Lotus Development Corp. v. Borland Int’l, 49 F. 3d 807 (1st Cir. 1995), aff’d by an equally divided court, 516 U.S. 233 (1996).
[Back to reference]

20. Continental Cas. v. Beardsley, 253 F.2d 702, 706 (2nd Cir. 1958); see also Morrissey v. Proctor & Gamble Co., 379 F.2d 675, 678–79 (1st Cir. 1967) (applying merger doctrine to contest rules).
[Back to reference]

21. Mazer v. Stein, 347 U.S. 201, 217 (1954).
[Back to reference]

22. Gates Rubber, 9 F.3d at 837.
[Back to reference]

23. Id. at 836 n.13.
[Back to reference]

24. Gates Rubber, 9 F.3d at 839–40 n.15.
[Back to reference]

25. See, e.g., Sony Computer Entertainment, Inc. v. Connectix Corp., 203 F.3d 596 (9th Cir. 2000).
[Back to reference]

26. See Lexmark Int’l, Inc. v. Static Control Components, Inc., 387 F.3d 522, 537 (6th Cir. 2004) (“With respect to computer programs, ‘fair use doctrine preserves public access to the ideas and functional elements embedded in copyrighted computer software programs’”).
[Back to reference]

NPCreate: 1/6/2006

The Duty to Preserve Evidence in a Digital World

Crawford, Cindy — Wed, 14 May 2008 21:24:40 GMT

Wiki Content:

In a series of widely publicized cases, courts have issued harsh sanctions for the destruction of electronic evidence. As companies wrestle with the uncertain scope of the duty to preserve in the context of burgeoning digital data, proposed amendments to the Federal Rules of Civil Procedure promise clearer guidance. Unfortunately, the amendments largely relegate parties to the underdeveloped body of common law on the subject.
By Mark D. Robins
Originally published in Metropolitan Corporate Counsel®,
Volume 13, No. 12 © December 2005. Text reproduced by permission.

The Scope of the Duty to Preserve

The scope of a party’s duty to preserve evidence remains unsettled, but many courts have articulated a test whereby a party must preserve all evidence the party knows or has reason to know is (i) relevant to a pending action, (ii) reasonably calculated to lead to the discovery of admissible evidence, (iii) reasonably likely to be requested in discovery, and/or (iv) the subject of a pending discovery request.[1] However, courts have done little to flesh out the meaning of each prong of this test. Take, for example, the third prong. As most litigators know all too well, it is often reasonably likely that an adversary will request items that are unlikely to lead to the discovery of admissible evidence, and hence not properly discoverable. The test articulated by these courts may ensure the preservation of such items until a court can resolve their discoverability. However, it is unrealistic to expect a party to anticipate everything reasonably likely to be requested in discovery.

Deleted Data, Archived Data, and Metadata

Moreover, the manner in which computers create and store electronic information will frequently make it infeasible to preserve all evidence in this potentially limitless category. For example, when a witness creates an electronic document (whether it be an e-mail message, a word processing document, or a database), that document will contain a variety of “metadata,” information about the document that was never meant to be seen by the external world. Metadata includes such information as file names, directory paths, names of persons who created or updated a document, and dates of creation and update. This type of information is constantly evolving as documents are accessed and used. Furthermore, when a witness deletes a document or a draft of a document, the deleted data continues to reside on the computer’s hard drive. However, as new information is saved and randomly allocated to available storage space on the hard drive, a deleted document may be overwritten partially or entirely. In addition, a document that has been deleted from a hard drive may also exist in archival media, including on tapes containing periodic backups. Such backup tapes are often recycled for reuse, which may render previously stored information irretrievable. Regardless of whether deleted data has been overwritten, the recovery of deleted data from a hard drive or from backup tapes may be costly and disruptive.

In most litigation, one would expect the discoverable evidence to consist of data created within that part of a document meant to be viewed by the external world, and one would expect discoverable documents to continue to exist in a reasonably accessible form in the possession of one or more witnesses. Accordingly, most litigation should not require production of metadata, deleted data, or archived data. Nevertheless, a number of lawyers are routinely requesting these items. Furthermore, even where these items are not explicitly requested, a discovery target will often be confronted with the difficult task of determining whether a particular case is one that warrants searching for such items.

Accessibility and Preservation

In addressing these problems, the central advance in the law of discovery is the recognition that a party’s discovery obligations should vary depending upon the degree to which data is deemed “accessible” or “inaccessible.” This distinction was articulated in the highly influential Zubulake case, in which the court held that whether discovery of electronic data should be deemed unduly burdensome turns primarily on whether such data is “accessible” or “inaccessible.” The court deemed electronic data to be typically accessible due to the capabilities of search engines but also noted that data contained in certain backup tapes and erased, fragmented, or damaged data may be sufficiently more expensive and cumbersome to restore to a usable format such that they should be deemed inaccessible.[2]

Although this classification helps in determining whether data should be discoverable, absent cost-shifting to the discovering party, it does not provide as ready a guide for a party attempting to determine whether data that might be deemed inaccessible should be preserved. For example, in addressing the scope of a party’s discovery obligations, one court recognized the inaccessible nature of data residing on backup tapes by likening the recovery of such data to “dumpster diving,” but nevertheless ordered such discovery subject to cost-shifting.[3] As noted earlier, courts articulating the scope of the duty to preserve go one step further by indicating that the duty to preserve applies to evidence that is reasonably likely to be requested in discovery.

The Zubulake court addressed the duty to preserve by outlining one of presumably multiple ways to discharge the duty. The course of action outlined by the Zubulake court consists of preserving all backup tapes in existence to the extent such tapes can be identified as containing information for “relevant personnel” and making a mirror image of the hard drives for the entire company’s computer system.[4] However, because a mirror image of a hard drive captures every bit of information (active data, metadata, and deleted data) residing on the hard drive, taking mirror images of the entire computer system may come close to preserving every document in the company. Yet, courts seemingly agree that a party does not have a duty to preserve every piece of paper.[5] One court has suggested that if the type of approach suggested by Zubulake is cost prohibitive, a party may discharge its duty to preserve by performing searches for relevant information to capture and preserve information that is likely discoverable before it is lost in routine operations.[6]

In this unsettled environment, the Advisory Committee on the Federal Rules of Civil Procedure has proposed amendments specifically addressing electronic discovery. One such amendment to Rule 26 adopts the accessible/inaccessible distinction by providing that a party need not produce discovery of electronically stored information from sources the party identifies as not reasonably accessible because of undue burden or cost. Under this proposal, such an identification does not render such information absolutely immune from discovery. Rather, if either party files a motion, the discovery target will bear the burden of proving that the information is not reasonably accessible because of undue burden or cost, and, even if that showing is made, the court may order that the discovery be produced if good cause is shown.[7]

Unfortunately, even under this amendment, the accessible/inaccessible distinction will be of limited utility in determining the scope of a party’s duty to preserve. Indeed, the Advisory Committee Note to Amended Rule 26(b)(2) expressly states that identifying sources of electronically stored information as inaccessible will not eliminate any common law or statutory duties to preserve such information, and that the facts of the particular case will determine whether a party must preserve unsearched sources of potentially responsive information believed to be not reasonably accessible.[8]

Safe Harbor for Routine Operations

Nevertheless, included within the proposed amendments is a safe harbor for the destruction of certain data according to routine, good-faith operation of an electronic system. Specifically, an Amended Rule 37(f) provides: “Absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, good-faith operation of an electronic information system.”[9]

This proposal also suffers from problems that will limit its utility. One fundamental problem with the proposal is that it limits sanctions that may be imposed under the rules of civil procedure only, whereas the rules of civil procedure are not the source of the duty to preserve evidence or of sanctions enforcing that duty (absent violation of an order compelling production). Indeed, the Advisory Committee Note expressly states that the proposed rule would not affect other sources of authority to impose sanctions.[10] Thus, the proposed rule appears merely to offer guidance rather than instruction.

Furthermore, in attempting to apply this safe harbor to metadata, deleted data, or data residing on backup tapes that are the most obvious candidates for information that would be lost through “routine…operation of an electronic system,” a party must remember that its operation of the system must be in “good faith” to qualify for the safe harbor and that, even then, the party may lose the protection of the safe harbor in “exceptional circumstances.”[11] Thus, at most, the safe harbor would appear to establish a presumption that loss of information through routine operations should generally not be grounds for sanctions. However, the proposed rule provides no indication of when a party would have to suspend routine operations to discharge its duty to preserve. The Advisory Committee Note merely states that whether a party must take steps to prevent the loss of information from sources not believed to be reasonably accessible will depend upon the facts of each case and hints that one factor influencing this determination should be whether that information is likely to be discoverable and unavailable from other sources.[12]

Conclusion

Accordingly, companies attempting to comply with the duty to preserve must determine what types of cases are likely to implicate metadata, deleted data, and data residing on backup tapes. This determination is particularly difficult given that the use of these types of data in litigation is a relatively new phenomenon. Nevertheless, a party may wish to consider whether there are questions about the authenticity or origins of or motives behind a document, the individual storage and deletion practices of the key witnesses as a general matter, and whether witnesses are likely to have deleted discoverable information in the particular case at hand. In addition, to the extent a particular case is deemed reasonably likely to implicate these types of data, a party will need to determine what efforts it must devote to locating and preserving such data before it is lost in routine operation. Here, parties must choose between the approaches outlined in Zubulake and Wiginton, as well as other potential options. Finally, a party attempting to discharge its duty to preserve must not lose sight of the need to locate and take appropriate steps to preserve all accessible data, which may be widely distributed in a vast organization.

Addendum

Since the above article was written, the proposed amendments to the e-discovery rules of the Federal Rules of Civil Procedure—notably Rule 26, Rule 34, and Rule 37—were approved by the Judicial Conference of the United States and went into effect December 1, 2006. For more information on the e-discovery rules, see the Federal Judicial Center’s Web site.

See, e.g., Zubulake v. UBS Warburg LLC, No. 02 Civ. 1243, 2003 WL 22410619, *3 (SDNY Oct. 22, 2003); Danis v. USN Communications, Inc., No. 98 C 7482, 2000 WL 1694325, *32 (ND Ill. Oct. 23, 2000).
[Back to reference]
See Zubulake v. UBS Warburg LLC, 217 FRD 309, 318-20 (SDNY 2003).
[Back to reference]
See Rowe Entmt., Inc. v. William Morris Agency, Inc. , 205 FRD 421, 431 (SDNY 2002).
[Back to reference]
See Zubulake v. UBS Warburg LLC, 220 FRD 212, 218 (SDNY 2003).
[Back to reference]
See, e.g., Wiginton v. Ellis, No. 02 C 6832, 2003 WL 22439865, *4 (ND Ill. Oct. 27, 2003); Shamis v. Ambassador Factor Corp., 34 F. Supp. 2d 879, 889 (SDNY 1999).
[Back to reference]
See Wiginton, 2003 WL 22439865, at *5.
[Back to reference]
Proposed Fed. R. Civ. P. 26(b)(2).
[Back to reference]
Proposed Fed. R. Civ. P. 26(b)(2), advisory committee note.
[Back to reference]
Proposed Fed. R. Civ. P. 37(f).
[Back to reference]
Proposed Fed. R. Civ. P. 37(f), advisory committee note.
[Back to reference]
Proposed Fed. R. Civ. P. 37(f).
[Back to reference]
Proposed Fed. R. Civ. P. 37(f), advisory committee note.
[Back to reference]

NPCreate: 12/22/2005

Supreme Court revises Federal Circuit's limitations on patent exhaustion

Crawford, Cindy — Fri, 13 Jun 2008 19:41:38 GMT

Wiki Content:

On June 9, 2008, the United States Supreme Court issued a decision in Quanta Computer, Inc. v. LG Electronics, Inc. (No. 06-937), revising certain limitations existing in Federal Circuit law to the patent exhaustion doctrine. Following what it stated was the "longstanding doctrine of patent exhaustion," the Court found that exhaustion applies equally to method and apparatus claims, and that an authorized sale of an article substantially embodying the patented claims takes that article outside the scope of the patent monopoly.

An authorized sale of a patented article prevents patent holders from invoking patent law to control post-sale use

The Supreme Court continued its recent bid to unwind Federal Circuit precedent in Quanta Computer, Inc. v. LG Electronics, Inc. (No. 06-937) (June 9, 2008), this time finding that patent exhaustion is triggered only by a sale of a patented product that is authorized by the patent holder, and that the doctrine is equally applicable to method and apparatus claims. Thus, an authorized sale of an article substantially embodying the claims of a patent takes that article outside the scope of the patent monopoly, and the patent holder can no longer assert patent rights against the post-sale use of that article. While this decision squarely alters certain limitations to the scope of the patent exhaustion doctrine imposed by the Federal Circuit, it also expressly avoids a number of issues regarding a patent holder’s ability to control the post-sale use of its patented articles.

The specific issue before the Supreme Court related to the sale by Intel of microprocessors and chipsets that embodied a number of patents owned by LG Electronics (LG). Intel and LG had entered into a series of agreements in which Intel obtained authorization to “make, use, sell (directly or indirectly), offer to sell, import, or otherwise dispose of” Intel products that practiced the claims of the LG patents. However, the agreements explicitly did not extend to “any third party for the combination by a third party of Licensed Products of either party with items, components, or the like acquired … from sources other than a party hereto, or for the use, import, offer for sale, or sale of such a combination.” Intel also agreed to give notice to any customers who bought Intel products that practiced the LG patents that, while Intel had obtained a license “ensur[ing] that any Intel product that you purchase is licensed by LG and thus does not infringe any patent held by LGE,” the license did not extend to any of the customer’s products that were made by combining the Intel product with a non-Intel product.

Intel sold the microprocessors and chipsets at issue to Quanta Computer, which, in turn, manufactured computers using the Intel products in combination with non-Intel products. LG sued, alleging that the combined use by Quanta of Intel products and non-Intel products constituted patent infringement. The district court initially found that the license by LG to Intel resulted in forfeiture of any potential infringement actions against legitimate purchasers of the Intel Products. However, it limited that ruling, holding that patent exhaustion applied only to apparatus claims, not to method claims. LG Electronics, Inc. v. Asustek Computer, Inc., 248 F.Supp. 2d 912, 918 (ND Cal. 2003). The Federal Circuit affirmed in part and reversed in part, finding both that patent exhaustion did not apply to method claims and that Intel’s sale of products to Quanta for use in combination with non-Intel products did not exhaust the patents. 453 F.3d 1364, 1377 (Fed Cir. 2006). The Supreme Court reversed, on both grounds.

In doing so, the Supreme Court followed what it stated was the “longstanding doctrine of patent exhaustion,” which “provides that the initial authorized sale of a patented item terminates all patent rights to that item.” Thus, the difference between ways in which patented methods are sold versus articles or devices is immaterial, as “methods nonetheless may be ‘embodied’ in a product, the sale of which exhausts patent rights.”

Significant to the Court’s decision was the fact that (1) the Intel products substantially embodied the LG patents, even though the products could not carry out the patented functions until being attached to memory and buses by Quanta, and (2) there was “no reasonable use for the Intel [p]roducts other than incorporating them into computer systems” that practiced the LG patents. In other words, the fact that a patented article needs to be completed in some way before being able to practice the patents in question does not necessarily mean that the authorized sale of the uncompleted patented article cannot trigger patent exhaustion. In this case, the “inventive part of the patent” was not the fact that Quanta added standard elements, such as memory and buses, to the Intel products during the manufacture of computer systems. Rather, the inventive part of the patents was “included in the design of the Intel [p]roducts themselves,” and the way those products were designed to interact with the standard elements added by Quanta.

Finally, it is the authorized sale of a patented article alone that triggers patent exhaustion. Thus, while LG required Intel to give notice to its customers, including Quanta, that LG had not licensed those customers to practice its patents, Intel’s authority to sell Intel products embodying the LG patents was not conditioned on giving that notice or on the decision by Quanta to abide by LG’s directions in that notice. “[E]xhaustion turns only on Intel’s own license to sell products practicing the LG [p]atents,” and the question of whether the license agreement with Intel disclaimed any license to downstream customers to practice the patents is irrelevant.

While the opinion never specifically cites the Federal Circuit’s more recent limitations to the patent exhaustion doctrine, the Quanta decision unequivocally contradicts Federal Circuit precedent that had limited the doctrine to apparatus claims (LG Electronics, Inc. v. Bizcom Electronics, Inc., 453 F.3d 1364 (Fed. Cir. 2006); Bandag Inc. v. Al Bolser’s Tire Stores Inc., 750 F.2d 903 (Fed. Cir. 1984)), and at least calls into question Federal Circuit law allowing a patent holder to “contract around” patent exhaustion (LG Electronics, Inc. v. Bizcom Electronics, Inc., 453 F.3d 1364; Mallinkrodt Inc. v. Medipart Inc., 976 F.2d 700 (Fed. Cir. 1992)).

What is clear is that, in those cases where the sale of a patented article is authorized by the patent holder, the patent holder cannot sue downstream users for patent infringement. However, the Supreme Court specifically distinguished the facts in Quanta, where Intel’s sale to Quanta was explicitly authorized by agreements between Intel and LG, from those facts presented in General Talking Pictures Corp. v. Western Elec. Co., 304 U.S. 175 (1938). In that case, the sale in question was in breach of an agreement between the patent holder and a licensee that limited the sale of patented amplifiers to private and home use. Thus, exhaustion did not apply to sales of patented amplifiers for commercial use. Id. at 181.

Further, the Court in Quanta specifically expressed no opinion on whether contract damages might be available to a patent holder even though exhaustion operates to eliminate patent damages. Thus, an avenue still potentially remains for patent holders to limit the post-sale use of patented articles through the use of carefully crafted licenses and agreements that restrict licensed manufacturers or sellers to certain kinds of authorized sales. Patent holders and licensees alike should take heed of what is and is not authorized under the terms of existing and future agreements.

NPCreate: 6/9/2008

Trademark Dilution Revision Act of 2006

Crawford, Cindy — Fri, 13 Jun 2008 19:56:20 GMT

Wiki Content:

The Trademark Dilution Revision Act of 2006 (“TDRA”) was signed into law on October 6, 2006. The TDRA amends Section 43(c) of the Lanham Act, 15 U.S.C. § 1125(c), and permits an owner of a famous trademark to assert a claim based on a likelihood of dilution. The TDRA overrules the Supreme Court’s ruling in Moseley v. V Secret Catalogue, Inc., 537 U.S. 418 (2003), a decision that required a party asserting a claim under the Federal Trademark Dilution Act (“FTDA”) to present evidence of actual dilution.

The TDRA creates a cause of action for the owner of a famous mark against any person who uses a mark in commerce that is “likely to cause dilution” of the famous mark, “regardless of the presence or absence of actual or likely confusion, of competition, or of actual economic injury.” Thus, Congress has eliminated the heightened standard of actual dilution imposed by the Supreme Court’s decision in Moseley.

The TDRA protects against “dilution by blurring” (which occurs when an “association arising from the similarity of” the parties’ respective marks “impairs the distinctiveness of the famous mark”) as well as “dilution by tarnishment” (which occurs when the similarity of the parties’ respective marks “harms the reputation of the famous mark”). The TDRA also clarifies that a mark possessing acquired (as opposed to inherent) distinctiveness may qualify for protection under the Act. This is a departure from circuit court precedent, which had interpreted the anti-dilution law to extend protection only to inherently distinctive marks.

The TDRA defines a famous mark as one that is “widely recognized by the general consuming public of the United States as a designation of source of the goods or service of the mark’s owner.” By defining the relevant universe as the “general consuming public,” the TDRA seems to obviate the argument that a mark can be famous within a market segment (so-called “niche fame”).

The TDRA also allows the owner of unregistered trade dress to bring a dilution claim upon a showing that: “the claimed trade dress, taken as a whole, is not functional and is famous” and “if the claimed trade dress includes any mark or marks registered on the principal register, the unregistered matter, taken as a whole, is famous separate and apart from any fame of such registered marks.”
The TDRA also affects the invocation of the fair use defense. Specifically, in addition to exclusions for news reporting and news commentary, the TDRA exempts “any fair use, including a nominative or descriptive fair use, or facilitation of such fair use, of a famous mark by another person other than as a designation of source for the person’s own goods or services,” including use in comparative advertising or in “identifying and parodying, criticizing, or commenting upon the famous mark owner or the goods or services of the famous mark owner.” The Act also protects “any non-commercial use of a mark.”

The TDRA went into effect upon signing.

NPCreate: 10/6/2006

Verizon Services Corp. v. Vonage Holdings Corp

Crawford, Cindy — Fri, 13 Jun 2008 19:37:29 GMT

Wiki Content:

On September 26, 2007, the Federal Circuit, inter alia, vacated and remanded the district court's award of $58 million and 5.5% royalty rate on future infringing sales in a suit involving U.S. Patents No. 6,282,574, No. 6,104,711, and No. 6,359,880, which related to a server for enhanced name translation useful in implementing an internet telephone system. The Federal Circuit affirmed the judgment of infringement regarding the ‘574 and ‘711 patents, but vacated and remanded with regard to the ‘880 patent. The Federal Circuit stated:

Vonage proposed construing the term “localized wireless gateway system” to mean “a plurality of base station transceivers with a limited range of a few feet and a packet service gateway that compresses/decompresses and packetizes voice signals.” Vonage argues that the gateway is limited to a transmission range of only a few feet because of statements made by the patentee during prosecution of a related patent of the same family as the ‘880 patent that so limited the term. The district court instructed the jury to interpret the term “localized wireless gateway system” as: “a system which is fixed to a limited or local area and which provides wireless service coverage within that local area,” and did not include a “few feet” limitation.

[A] statement made by the patentee during prosecution history of a patent in the same family as the patent-in-suit can operate as a disclaimer. To operate as a disclaimer, the statement in the prosecution history must be clear and unambiguous, and constitute a clear disavowal of scope. Such a clear disavowal has occurred here. The claims of the ‘880 patent originated in U.S. patent application No. 08/814,291. During prosecution the examiner issued a restriction requirement on the ground that the ‘291 application covered two independent and distinct inventions. The applicants then filed divisional application No. 09/363,750, pursuing some of the claims of the original ‘291 application, which was allowed as the ‘880 patent. The remainder of the claims of the original ‘291 application in turn matured into U.S. Patent No. 6,542,497. The claims of both applications require a “localized wireless gateway system.” During prosecution of the ‘291 application the applicants' claims were rejected based on prior art wireless gateway systems. The applicants gained allowance of the claims of the ‘291 application after stating that the prior art systems “all appear to be directed to non-localized systems,” and that the “present invention,” by contrast, was “restricted to operate within a few feet from a base station (i.e. wireless handsets).” [The applicants] clearly disclaimed coverage of systems operating with a range greater than a “few feet,” and that the district court erred in failing to construe the localized system as requiring a range of a few feet.

[B]ecause of the district court's claim construction Vonage was not able to introduce evidence that its telephones did not operate beyond a range of a “few feet.” The record also clearly shows that it was prepared to offer such evidence. Under such circumstances we believe that Vonage has satisfied the requirement of prejudice. The district court's error in failing to limit the localized system to one with a range of a few feet therefore requires a new trial under the correct construction. Since a new trial is necessary on the issue of infringement with respect to the ‘880 patent, we believe it appropriate to interpret other claim terms that are disputed by the parties on appeal and are likely to be at issue in the new trial.

Vonage challenges the district court's construction of the term “localized wireless gateway system” of asserted claims 1 and 6-8 of the ‘880 patent (the same term pertinent to the “few feet” limitation) . . . . In the course of describing the “present invention,” the specification then states that “[t]he gateway compresses and decompresses voice frequency communication signals and sends and receives the compressed signals in packet form via the network.” When a patent thus describes the features of the “present invention” as a whole, this description limits the scope of the invention. Thus the term “localized wireless gateway system” must be limited to one performing compression and packetization functions at the gateway. Vonage also argues that the district court erred in failing to require that the “localized wireless gateway system” have multiple base station transceivers, because the specification states that “[t]he inventive system includes a plurality of base station transceivers.” However, [a] limitation requiring a “plurality” may be satisfied by a single object. Therefore, Vonage has failed to show error in the district court's interpretation. Finally, Vonage challenges the district court's construction of the claim term “wireless telephone terminal” of asserted claims 1 and 6-8 of the ‘880 patent. . . . Although the specification on occasion makes reference to “roaming” telephones, Vonage fails to identify language that would require roaming in every case. Vonage argues that because the patent requires multiple base stations, telephones must then roam between base stations. But we have rejected the contention that there must be multiple base stations, and the claims do not require roaming.

NPCreate: 9/26/2007

In re Buszard

Crawford, Cindy — Fri, 13 Jun 2008 19:39:29 GMT

Wiki Content:

On September 27, 2007, the Federal Circuit reversed and remanded the decision of the Board of Patent Appeals and Interferences that upheld the patent examiner’s rejection of the claims of U.S. patent application Serial No. 10/429,429, which related to a flame retardant composition that produces a flexible polyurethane foam, as invalid for anticipation under 35 U.S.C. § 102. The Federal Circuit stated:

Buszard argues that the Eling reference shows only a rigid polyurethane foam which when mechanically crushed loses its rigidity because it is in small particles. Buszard states that the Eling rigid foam product is chemically different from a flexible polyurethane foam that is directly produced by polymerization, without crushing, and that this difference is readily understood by a person of ordinary skill in the field of polyurethane foams. Thus Buszard states that the flexible foam mixture required by his claims is different in kind from the rigid foam mixture described by Eling, whether or not Eling’s product is subsequently crushed into small particles.

The PTO states that Buszard’s claims, when given their broadest interpretation, read on the Eling product and thus are anticipated by Eling. Buszard states that this interpretation is devoid of support, even when viewed in accordance with the protocols of patent examination. During examination, the patent application claims may be given their broadest interpretation consistent with the specification, in order to facilitate sharpening and clarifying the claims at the application stage. Thus the patent examiner and the applicant, in the give and take of rejection and response, work toward defining the metes and bounds of the invention to be patented. . . . “An essential purpose of patent examination is to fashion claims that are precise, clear, correct, and unambiguous. Only in this way can uncertainties of claim scope be removed, as much as possible, during the administrative process.” Buszard argues that the Board’s construction of the claims to read on and thus be anticipated by Eling’s crushed solid foam is not reasonable.

The Board interpreted the claim term “flexible polyurethane foam reaction mixture” to mean “any reaction mixture which produces, at least ultimately, a flexible polyurethane foam.” Buszard states that persons experienced in the field of polyurethane foams know that a flexible polyurethane foam reaction mixture is different from a rigid polyurethane foam reaction mixture, and that this process limitation cannot be found in Eling, no matter how broadly that reference is read. The PTO Solicitor agreed, at the argument of this appeal, that the flexibility or rigidity of foamed polyurethane depends on the composition of the reaction mixture, which controls the degree of chemical cross-linking and thus the flexibility of the polymer. The Solicitor agreed that a person of ordinary skill in the field of polyurethane foams knows that a flexible foam and a rigid foam have different chemical structures and are produced from different chemical reactants. Nonetheless, the Solicitor argued that the rejection should be sustained simply because the examiner is entitled to give claims their broadest reasonable interpretation during examination. Buszard responded that the examiner’s interpretation is not reasonable, as a matter of well-known chemistry, for flexible foam reaction mixtures are different from rigid foam reaction mixtures, and one does not encompass the other.

The Solicitor proposed at oral argument that when a rigid foam is mechanically crushed, the chemical bonds are broken and the product is the same as the flexible product of a flexible foam reaction mixture. There was no rejection on this ground, there is no evidence or argument to this effect in the record, this theory was not mentioned by any examiner or in the Board’s opinion, and it appears to be contrary to science. This theory was proposed without support or citation, and without opportunity for Buszard to refute it. It is not sufficiently creditable to warrant further consideration.

Buszard’s specification and claims specifically state the requirement of a flexible polyurethane foam reaction mixture. No matter how broadly “flexible foam reaction mixture” is construed, it is not a rigid foam reaction mixture. The Eling reference describes only a rigid foam reaction mixture that produces a rigid product. Only by mechanically crushing the rigid product into small particles is it rendered flexible, as a rock can be mechanically crushed to produce particles of sand. This description cannot reasonably be construed to describe, and thus to “anticipate,” the flexible foam product of a flexible foam reaction mixture. We agree with Buszard that it is not a reasonable claim interpretation to equate “flexible” with “rigid,” or to equate a crushed rigid polyurethane foam with a flexible polyurethane foam.

NPCreate: 9/27/2007

Court Blocks USPTO's Patent Rule Changes

Crawford, Cindy — Fri, 13 Jun 2008 19:54:08 GMT

Wiki Content:

On April 1, 2008, the U.S. District Court for the Eastern District of Virginia granted summary judgment for plaintiffs GlaxoSmithKline (GSK) and Tafas to permanently enjoin the United States Patent and Trademark Office (USPTO) from enforcing the USPTO’s recently enacted patent rule changes. The decision effectively voids the USPTO’s final rules, entitled “Changes to Practice for Continued Examination Filings, Patent Applications Containing Patentably Indistinct Claims, and Examination of Claims in Patent Applications” (Final Rules). At the same time, the court denied the USPTO’s motion for summary judgment and motion to strike. While the USPTO can appeal the decision, this ruling postpones, and possibly prevents, the implementation of the Final Rules.

The USPTO originally created the rules in an effort to restrict: (a) the number of continuation applications an applicant can file; (b) the number of Request for Continued Examinations (RCEs) an applicant can file; and (c) the number of claims an applicant can file in a patent application. The Final Rules were published by the USPTO on August 21, 2007, after an intense notice-and-comment period where the then-proposed rules received hundreds of mostly negative written comments. Shortly after the rules were published, Tafas and GSK separately filed suit (the actions were later consolidated) seeking to bar the USPTO from enforcing the Final Rules. On October 31, 2007, a day before the Final Rules were to go into effect, Judge Cacheris granted a temporary restraining order and preliminary injunction enjoining the implementation of the Final Rules. This summary judgment decision followed, the details of which are set forth below.

Because the USPTO’s rulemaking authority does not extend to substantive rules, and because the Final Rules are substantive in nature, the court found that the Final Rules are void as “otherwise not in accordance with law” and “in excess of statutory jurisdiction [and] authority.” Focusing on the rulemaking authority of the USPTO and whether the Final Rules were “substantive” rather than procedural, the court did not address other aspects of the Final Rules such as their intended retroactive effect.

In reaching this conclusion, the court first analyzed whether the USPTO has authority to issue substantive rules. Relying heavily on Merck & Co., Inc. v. Kessler, 80 F.3d 1543 (Fed. Cir. 1996) and Animal Legal Def. Fund v. Quigg, 932 F.2d 920 (Fed. Cir. 1991), the court found that the USPTO’s authority is limited to rules governing “conduct of proceedings” before the Office. The USPTO does not have the authority to issue substantive rules, and it does not have the authority to make substantive declarations interpreting the Patent Act, 35 U.S.C.

The court then analyzed the Final Rules to determine whether they were substantive in nature. In particular, the court focused on three aspects of the Final Rules: the rules designed to restrict the number of continuation and continuation-in-part applications that can be filed (Final Rule 78); the rules designed to restrict the number of RCEs that can be filed (Final Rule 114); and the rules designed to restrict the number of claims an applicant can file (Final Rules 75 and 265). In each aspect, the court found that substantive rulemaking by the USPTO had taken place. As discussed below, the Final Rules changed existing law and departed from the language of the patent statute.

Continuations and continuation-in-part applications: Although Final Rule 78 does not completely prohibit applicants from filing more than two continuation or continuation-in-part applications, the court found that because the USPTO intends to deny additional applications in almost all circumstances, they effectively impose a hard limit on additional applications. Under 35 U.S.C. § 120, an applicant is entitled, the court states, to an unlimited number of continuation and continuation-in-part applications as a matter of right. By imposing the hard limit, the court found that the USPTO changes the existing law and applicants' rights under 35 U.S.C. § 120.

Requests for Continued Examination (RCEs): The court found that Rule 114, in limiting an applicant’s ability to file only one RCE per application family, changes the existing law in two ways. First, the rule places a limit on RCEs as of right on the basis of application family, rather than each individual application. This, according to the court, is a clear departure from 35 U.S.C. § 132, which states that the USPTO must provide for the continued examination of each application. In reaching this conclusion, the court looked to the Congressional intent of the statute, finding that upon enacting § 132(b), Congress stated that the RCE provisions “shall apply to all applications.” Second, the court looked to the plain language of 35 U.S.C. § 132(b) and the statement, “The Director shall prescribe regulations to provide for the continued examination of applications for patent at the request of the applicant.” Focusing on the “shall” and “at the request of the applicant,” the court interpreted this section as Congress allowing an unlimited number of RCEs at the discretion of the applicant, not the USPTO.

Restriction on the number of claims (the 5/25 rule): The court also took issue with the rules limiting the number of claims to five independent claims and 25 total claims per application, arguably the most procedural aspect of the Final Rules. 35 U.S.C. § 112 expressly permits, according to the court, an application to file “one or more claims.” The court also points out that CCPA case law since 1938 has consistently held that the Patent Act does not place any mechanical limits on the number of claims.

However, the bigger issue with the 5/25 rule for the court related to its requirement for an applicant to provide an Examination Support Document (ESD) when presenting any claims over the 5/25 rule. The court found that the ESD requirement changes existing law and alters the rights of applicants under the current statutory scheme, by shifting the examination burden away from the USPTO and onto applicants. This is in contrast to Federal Circuit rulings, according to the court, stating that applicants have “no duty to conduct a prior art search” and “no duty to disclose art of which an applicant could not have been aware.” 35 U.S.C. § 131 states that the USPTO “shall cause an examination to be made of the application,” which the court interprets (together with §§ 102 and 103) as placing the burden of examination and the burden of proof to make a prima facie case of patentability on the USPTO. By requiring applicants like GSK and Tafas to perform prior art searches and by shifting the examination burden away from the USPTO, the court concludes that the ESD requirement manifestly changes existing law and alters applicants’ rights under §§ 102, 103, and 131.

The court thus found that the Final Rules are substantive rules that change existing law and alter the rights of applicants such as Tafas and GSK under the Patent Act. The Final Rules constitute what the court has deemed as a “drastic departure from the terms of the Patent Act as they are presently understood.” By so departing, the court writes, the Final Rules effect changes in GSK’s and Tafas’s existing rights and obligations.

The dispositive issue, as discussed above, rested on the substantive nature of the Final Rules and the USPTO’s authority to enact substantive rules. The court declined to address the other issues presented by the parties, relying on the principle that “one who judges least[,] judges best.”

NPCreate: 4/1/2008

Court of Appeals finds Use of Competitor's Trademark in Website Metatags Actionable but Limits Remedies

Crawford, Cindy — Fri, 13 Jun 2008 19:45:23 GMT

Wiki Content:

The United States Court of Appeals for the Eleventh Circuit has sided with those courts holding that use of a competitor’s trademark in a website’s meta tags may be actionable as trademark infringement. In the same ruling, however, the court limited the ability of a competitor to obtain a preliminary injunction based on a false advertising claim, where the advertising in question did not refer to the plaintiff.

In North American Medical Corp. v. Axiom Worldwide, Inc., North American Medical Corp. (NAM) and Axiom Worldwide, Inc. (Axiom) were competing manufacturers of physiotherapeutic devices for providing traction to treat back pain. NAM’s complaint alleged that Axiom had used two of NAM’s trademarks, “Accu-Spina” and “IDD Therapy,” in the meta tags of Axiom’s website. Meta tags are code in websites that ensure search engines catalog the website as relevant to terms contained in the meta tags. The complaint alleged that Axiom’s use of these trademarks in Axiom’s meta tags resulted in the listing of Axiom’s site in Google as the second-most-relevant result in a search for either of those trademarks. The complaint also alleged that Axiom engaged in false advertising by falsely representing an affiliation between NASA and either Axiom or its product, and by falsely representing Axiom’s product to be approved by the FDA.

In defending its use of NAM’s trademarks in Axiom’s website meta tags, Axiom relied on a Second Circuit case, 1-800-Contacts, Inc. v. WhenU.Com, Inc., which held that a software program that placed website addresses in a directory used to display advertisements when a user was seeking to access websites in the directory did not “use in commerce” any trademarks contained in those website addresses. Use in commerce must be present to prove infringement. The North American Medical court found the use of trademarks in meta tags to be distinguishable from an “unprotected website address” and found that the use made by Axiom caused NAM’s to be displayed to the consumer in search results.

The North American Medical further disagreed with the Second Circuit’s use-in-commerce analysis. According to the North American Medical court, absence of the display of a mark may be relevant to determining whether there is a likelihood of confusion but not to determining whether there has been a use of the mark in commerce. The North American Medical court went on to find a likelihood of confusion based on the fact that search results in Google displayed NAM’s trademarks in the search results linking to Axiom’s website. Because consumers may assume that Axiom distributed the products identified by the trademarks in these search results, the court found a likelihood of actual source confusion. By finding a likelihood of actual source confusion, the North American Medical court did not have to rely on the controversial “initial interest confusion” doctrine, under which some courts have found that certain uses of a competitor’s trademark on the Internet may lead consumers to mistakenly access the wrong website and that the mistaken access is actionable even if any confusion is dispelled when the consumer sees the website accessed.

While the North American Medical court upheld a preliminary injunction based on trademark infringement, it vacated a preliminary injunction based on the false advertising claim—even though the court found that NAM was likely to succeed on its claims that Axiom was falsely representing an affiliation with NASA and was falsely representing approval by the FDA. Unlike trademark infringement, where the plaintiff’s likelihood of success on the merits leads to a presumption of the irreparable harm necessary to warrant a preliminary injunction, the court held that a likelihood of success on a false advertising claim only leads to a presumption of irreparable harm where the false statement involves a comparison between the plaintiff’s and defendant’s products. Because Axiom’s statements did not involve such a comparison, the court found an insufficient basis for the preliminary injunction.

The North American Medical case is likely to further fuel the debate about whether various uses of a competitor’s trademark are actionable as uses in commerce. By finding use-in-commerce and likelihood-of-source confusion where the competitor’s trademark is displayed to consumers, the court has articulated an approach that may be used to pursue such claims, even in courts that have rejected such claims to date. However, the court’s cautious approach to granting preliminary injunctions in false advertising cases means that plaintiffs will not be able to rely as readily on a quick remedy.

NPCreate: 4/11/2008

Substantial Federal and State Legislation Pending to Address Responses to Internet Data Breaches

Crawford, Cindy — Thu, 15 May 2008 13:57:24 GMT

Wiki Content:

Recently, there have been a number of well-publicized incidents in which Web sites have been hacked and personal information that could lead to identity theft was compromised. Ray Gustini, one of the nation’s leading privacy attorneys, summarizes the proposed federal and state legislation currently pending to set new rules for appropriate response, including whether and when to notify affected customers, to such attacks.

Background

According to recent Congressional testimony by Vermont’s assistant attorney general, in 2005 there have already been 118 data leaks affecting some fifty-seven million U.S. consumers. In July 2003, California was the first state to enact a comprehensive data protection and notice law. Since then, some twenty-one states have followed California’s lead and provided protections that supplement, differentiate and in some instances go beyond federal law, including those currently under consideration. The principal debate involves the definition of sensitive personal information, the manner of notice to consumers, and whether all or a portion of existing federal data protection law (principally GLBA) should control and preempt state law and whether a federally mandated credit freeze right should be provided.

In recent months, a cascade of highly publicized data leaks, theft, and losses have greatly increased public awareness and policymaker concerns:
- ChoicePoint
- Ralph Lauren
- Bank of America
- Kellogg School of Management
- Boston College Alumni
- MasterCard International

Overview of Principal Federal Legislative Initiatives

As a result of the convergence of publicized data breaches, the rapid enactment of data protection laws by a number of state legislatures, and the desire of businesses for uniform nationwide standards, momentum is building for federal legislation. Although unlikely in 2005, it is increasingly a case of when and not if. The four principal vehicles are the following:

H.R. 3997, The Financial Data Protection Act, House Financial Services Committee
- Sponsors:Representatives LaTourette, Hooley, Price, Castle and Moore
- Amends: FCRA
- Approach: Goes beyond GLBA by creating uniform requirements and standards for all companies that hold a consumer’s “sensitive financial identity” and “sensitive financial account” information
- Notice Trigger: In event of a breach, consumer reporter must notify consumers if security breach is reasonably likely with respect to “sensitive financial identity and sensitive financial account information” if reasonably likely to be misused in a manner causing substantial harm to the consumer. Uniform consumer notice standards are a key element.
- GLBA Safe Harbor: Yes
- Preemption: Amendments FCRA to preempt state law with respect to responsibility to protect or safeguard information to investigate and provide notices.
- Principal Open Issue(s): Credit freezes and notice requirements
- Private Right of Action: None
H.R. 4127, Data Accountability and Trust Act, House Energy and Commerce Committee
- Sponsors: Representatives Stearns, Pryce, Upton, et al.
- Amends: Free standing
- Data Security: Persons engaged in interstate commerce that own or possess “sensitive personal information” are required to establish and implement information security practices.
- Notice Trigger: If a “breach of security” occurs, notice must be given to consumer upon discovery.
- GLBA Safe Harbor: No specific safe harbor, but sponsors assert that financial institutions are exempt. The extent of the exemption and whether bank subsidiaries and nonbank affiliates are covered is unclear.
- Preemption: Any provision of state law that expressly requires security of personal information and notice is preempted. Only entities covered by the Act and subject to regulations thereunder obtain preemption protection.
- Private Right of Action: None
S. 1408, Identity Theft Protection Act, Senate Commerce Committee
- Sponsors: Senators Smith, Nelson, Stevens, McCain, Pryor, Inouye, and Clinton
- Amends: Free standing
- Data Security: Requires covered entity that collects “sensitive personal information,” including social security numbers, drivers license information, financial account information, or information that FTC determines can be used for identity theft, to secure it with physical and technological safeguards. Also covers purchases of information.
- Notice: If a “breach of security” is discovered, notice to consumers must be provided when it creates a “reasonable risk” of identify theft.
- Breach: Unauthorized access to and acquisition of data in any form containing sensitive personal information that compromises the security or confidentiality of such information and creates a reasonable risk of identity theft.
- Identity Theft: Means (i) unauthorized acquisition, purchase, sale, or use by any person of a person’s “sensitive personal information” that violates 18 USC § 1028 (fraud and related activity in connection with identification documents and information, (ii) similar state laws describing identity theft, or (iii) if the unauthorized acquisition results in economic loss.
- GLBA Safe Harbor: Compliance with the Act’s notification and security requirements is deemed to exist if the security and notification requirements of GLBA are met.
- Enforcement: FTC issues regulations on when and how notice is given. Breaches involving more than 1,000 persons are required to be reported to the FTC, consumer reporting agencies, and the entities’ primary regulator. Notice must be timely filed.
- Private Right of Act: None
- Preemption: Specifically identifies the type of state laws that are preempted, e.g., laws involving information, security, notice of breach, liability for failure to protect data or notify consumers, consumer report freeze, and social security numbers. Other local and state laws are not preempted.
S. 1789, Personal Data Privacy and Security Act, Senate Judiciary Committee
- Sponsors: Senators Spector, Leahy, Feinstein, and Feingold
- Amends: Free standing with no explicit rulemaking requirements
- Data Security: Any business collecting, storing, accessing, transmitting, using, or disposing of “sensitive personally identifiable information” on 10,000 or more U.S. persons must comply with FTC safeguards rule.
- Notice: Must be given to any U.S. person when sensitive, personally identifiable information has been accessed or acquired.
- Breach: Occurs when there is a compromise in the security, confidentiality, or integrity of computerized data through misrepresentation or actions that result in unauthorized access to or acquisition of sensitive, personally identifiable information.
- Sensitive Personally Identifiable Information: Means (i) a person’s first and last name, or first initial and last name, in combination with a complete social security number or similar identification number; or (ii) any two of the following: home address or telephone number; mother’s maiden name; month, day, and year of birth; unique biometric information; unique electronic identification number; other information determined by the FTC; or (iii) a financial account number in combination with the security or access code or password.
- GLBA Safe Harbor: The legislation exempts financial institutions covered under GLBA from the security provisions. However, no safe harbor is provided with respect to notice provisions.
- Private Right of Action: None
- Preemption: Preempts state notification laws involving individual access to and correction of personal electronic records.
Activity at the State Level
California’s law, the California Security Breach Information Act (the “California Act”), SB 1386, became effective in 2003. A number of states have adopted similar laws.
- California Act took effect on July 1, 2003:
  - Triggered by a breach, e.g., unauthorized acquisition of stored, unencrypted confidential personal information on customers or employees.
  - Form of Notice: Left to company
  - Applies to any company that stores information on a computerized file of any type and that has one or more employees or customers in California regardless of size and includes those companies who store data.
  - The California Act does not authorize actions by the state attorney general and requires no notice to any government officials.
- Other States: Great variety of approaches. New York, for example, has enacted (effective December 7, 2005) the Information Security Breach and Notification Act (the “New York Act”). The New York Act in some ways provides greater protection for consumers, and could be viewed as more onerous by businesses.
- The New York Act features:
  - Encrypted Data: The New York Act is triggered even where data is encrypted if it can be shown the encryption feature is no longer valid.
  - Notice to Public Officials: The New York Act requires notice to public officials such as the state attorney general.
  - State Attorney General: Has right to initiate legal actions for damages.
- Laws in Other States
  - Notice and data protection laws have been enacted in Arkansas, California, Connecticut, Delaware, Florida, Georgia, Illinois, Indiana, Louisiana, Maine, Minnesota, Montana, Nevada, New Jersey, North Carolina, North Dakota, Rhode Island, Tennessee, Texas, and Washington.
Other Issues
- Credit Freeze: A number of states have enacted laws permitting consumers to order credit bureaus to place a credit freeze on consumer accounts. In some cases there is a cost for a credit freeze; in others (such as were ID theft has occurred) it is free. With a credit freeze, no third party can obtain any credit in a consumer’s name and third parties are not able to obtain access.
- Credit freeze laws have been enacted in California, Texas, Louisiana, Vermont, Washington, Nevada, Connecticut*, Illinois*, Maine*, and Colorado*.
- Credit Freeze at the Federal Level: Credit freeze provisions available on a nationwide basis will likely be part of the debate on all federal data security bills going forward.
  - Industry Reaction: Credit freezes are viewed as impractical and having a distinct chilling effect on point-of-sale purchases relying on credit checks—for example, cell phones, automobiles, or preapproved credit cards.
- Fraud Alert: Viewed as less cumbersome than freeze. Burden on retailer to verify identity of the consumer with a fraud alert.

*Effective in 2006.

NPCreate: 12/8/2005

Website Privacy Statement After-the-Fact Amendments do not Offset Unauthorized Sharing

Crawford, Cindy — Wed, 14 May 2008 22:30:03 GMT

Wiki Content:

This article discusses how the FTC (still very proactive in the privacy area) reacted in a recent case involving Gateway Learning Corporation, which inadvertently ignored a promise in its Web site privacy policy not to share consumers’ information, and then tried to amend the policy to accommodate the unauthorized sharing.

A recent privacy action brought by the FTC (www.ftc.gov) shows that corrective amendments to an online privacy policy (permitting information-sharing with third parties) provide little protection if the original private policy was not followed. The case involved Gateway Learning Corporation, the company that produces the “Hooked on Phonics” learning programs. Gateway entered into a consent agreement effective September 2004, to settle the FTC’s charges that it had both “rented” consumers’ personal information to telemarketers and then “failed” to give consumers opt-out rights when it later amended its privacy policy to permit the rentals to occur. The settlement with the FTC prohibits Gateway from retroactively making material changes to its privacy policy prior to the time the policy was amended to permit third-party disclosures (June 20, 2003) unless Gateway gets express affirmative consumer consent, i.e., opt-in from the consumers. Gateway was also barred from making “deceptive” claims about how it would use consumer information and fined $4,600. The principal provisions of the FTC order have a twenty-year term.

Background

Gateway Learning Corporation’s well-known product, “Hooked on Phonics,” has been purchased and used by thousands of families since its introduction. Since 2000, Gateway began marketing “Hooked on Phonics” from its Web site (www.hop.com), from which it collected personally identifiable information from parents such as name, address, e-mail address, and the age and gender of their children. The www.hop.com Web site had a privacy policy with three very powerful statements on protection of consumer information.

First, the statement said, “We do not sell, rent or loan any personally identifiable information regarding our consumers with any third party unless we receive customer’s explicit consent.” (Emphasis supplied)
Second, it said it would not provide personally identifiable information about children under the age of 13 for “any purpose whatsoever.”
Finally, the privacy policy addressed future changes, saying that if the privacy policy changed to allow sharing consumers’ personally identifiable information, consumers would be given the right to “opt out” of having such information shared.

In April of 2003, Gateway (without obtaining its consumers’ consent) began a program of renting to a telemarketing firm, for a fee, personal information provided by some of its consumers. The information included names, addresses, and telephone numbers of the consumers as well as information on the age ranges and gender of their children.

Some two months after the rental program began, Gateway amended its online privacy policy by eliminating one of its most powerful protections, i.e., “we do not sell, rent or loan…” and substituted a more ambivalent statement saying Gateway would “from time to time” provide consumers’ personal information to “reputable companies.” None of Gateway’s consumers were, according to the FTC, specifically notified about the change or provided opt-out rights. On July 1, 2003, Gateway decided to suspend the practice of renting information it collected online.

After termination of the third-party rental arrangement, Gateway made yet another change to its online privacy policy. On July 17, 2003, it added an amendment saying that for consumers who did not want personal information shared with third parties, opt-out rights “were available” but advised that consumers could still be contacted by companies until their names were actually placed on the “do not disclose” list.

The FTC filed a complaint in 2004, charging that Gateway had “expressly or by implication” represented that it would not sell consumer information unless it received explicit consent from its consumers and that it had promised not to provide information to third parties about children for any purpose. The FTC said that in “truth and fact information was rented to third parties without explicit consent and information about children was also provided.”

Also, the FTC’s complaint focused on the revised privacy policy provision allowing consumer information to be sold to reputable companies. This provision was “retroactively applied,” said the FTC to information that Gateway had already collected from consumers and shared. The FTC noted that the retroactive language was inconsistent with Gateway’s original promise and the revisions were not outweighed by the countervailing benefits and were not “reasonably avoidable” by consumers. These practices were viewed as unfair and deceptive by the FTC. The case was settled by a consent agreement between Gateway and the FTC that was announced on September 9, 2004.

In the settlement, Gateway was required to cease misrepresenting how it uses consumer information. More importantly, Gateway was also required to obtain an affirmative opt-in from any consumers from whom it collected information prior to June 30, 2003 (the date of its revised policy posting), if it disclosed a consumer’s personally identifiable information to third parties or amends its privacy policy. This requirement has a twenty-year duration.

The Impact of Gateway

The Gateway case represents another in a growing line of privacy cases in which the FTC has used its unfair and deceptive acts or practices authority to enforce failed online privacy promises. In the earlier cases, the FTC found unfair and deceptive practices for broadly delivered promises on the security of consumers’ online information (Eli Lilly and Tower Records), the accuracy of privacy statements (Microsoft), and promises that information involving children would not be sold under any circumstances (Toysmart). The Gateway case reinforces that the FTC will continue to act when it finds a failure to honor promises broadly delivered to consumers and that well-intentioned remedial action will not protect against failed promises delivered prior to the remediation.

Conclusion and Comment

Although details are not provided, the insignificant fees received by Gateway for the renting of names, a little over $4,600, suggests that the sharing program was isolated and perhaps undertaken without the knowledge of Gateway’s senior management. Yet the practice conflicted directly with a clearly stated privacy principle on Gateway’s www.hop.com Web site and imposed twenty years’ worth of oversight and reporting to the FTC by Gateway. The case dramatically illustrates the need to focus on privacy policies at every level of a business dealing with consumers. Failure to do so can have profound effects.

A final cautionary point is that privacy statements where children may be part of the audience require extra sensitivity and caution and will most certainly receive extra attention from the FTC.

NPCreate: 12/22/2004

Licensing Open Source Software - Legal Tips and Pitfalls

Crawford, Cindy — Wed, 14 May 2008 22:39:40 GMT

Wiki Content:

Source code—the human-readable computer instructions that reveal the inner workings of a software program—has traditionally been considered the “crown jewel” of software companies and jealously guarded as a trade secret. But now software companies are frequently making the source code for their programs available for others to use and modify. Well-known software programs such as the Linux operating system and the Web browser Netscape Navigator are distributed using this “open source” model.

This paper addresses several aspects of the open source code model, including:

How open source software differs from other types of software
How the open source movement began
Why so many companies make their source code available to others
How and why open source software is used
Legal issues to consider when using or distributing open source software

Defining open source software

What open source software is not

It is not closed source software. The most common software licensing model is closed source. Here, the software is protected by copyright, its source code is kept secret, and use of its object code is licensed for a fee. Most software offered at retail and most Microsoft applications, including the Windows operating system and Microsoft Office, are closed source software.

It is not freeware. This is software protected by copyright, but made widely available for use at no cost. Like closed source software, freeware’s source code is not available.

It is not shareware. Shareware is also protected by copyright and offered at no initial cost. However, after a brief trial period users are asked to pay a modest license fee. The WinZip compression utility, for example, is shareware.

It is not public domain software. Like the Hello World program, this is software not protected by copyright and therefore not subject to any constraints on its use.

What open source software is

Open source software is copyright-protected software distributed with its source code and with the right to modify and further distribute it. The term “open source” is now more widely used than the term “free software,” but both are similar in meaning. Open source software does not carry the prohibitions typical of closed source software, but it is not necessarily without cost, or free of license terms and conditions that control its use.

Examples of open source software include:

GNU/Linux
Web Server (runs 60 percent of Web sites)
Netscape
BIND (runs the Internet domain name system)
MySQL (a popular database program)

The origins of open source software

The movement known today as “Open Source” has its roots in the Free Software Foundation, which was founded in the 1980s by Richard Stallman when the software industry was emerging. Then, the programming and hacker culture was characterized by curiosity, cooperation, and the voluntary sharing of code and programming effort to stimulate innovation.

With time, however, software firms shifted from a cooperative to a proprietary model. Stallman became frustrated by his increasing inability to fix, adapt, or build on software at will. He feared that “closing” software code to third parties would lead to performance, incompatibility, and security problems, not to mention slow the pace of change and improvement. Consequently, he founded the Free Software Foundation, published a manifesto, and began the quest for a free version of the UNIX operating system. The Foundation’s development project is called “GNU,” a recursive acronym for GNU’s Not UNIX.

The GNU project produced a large body of high quality software and eventually, through the contribution of an essential kernel by Linus Torvald, led to the development of the Linux operating system. Today, Linux is among the most widely used operating systems.

People sometimes mistakenly assume that free software disregards the proprietary rights of developers. On the contrary, it recognizes that only a proprietary system can ensure freedom on one’s own terms. This application of copyright principles to prevent their normal exclusionary effect is called “copyleft.” The license agreement used to enforce copyleft on free software is called the GNU General Public License, or GPL.

The type of freedom espoused by the Free Software Foundation is not for everyone. The movement surrounding it is personal, ideological, and cultural. The open source model has been widely credited with helping software freedom gain mainstream acceptance.

Why distribute software as open source?

If most software developers jealously guard the source code of their products and charge for its use, why would any developer distribute software as open source?

Many open source devotees, typically small software companies and individual developers, adopt the open source model because they share the values that led Richard Stallman to found the Free Software Foundation. Others are simply proud of their work and want to share the results of their effort with the developer community. Perhaps the most common reason, however, is to gain from the improved development methodology many believe it affords. Because open source code is available for review by the entire developer community, it can be more highly scrutinized. This, proponents believe, reduces product flaws while increasing stability and functionality.

Why use open source software?

The open source model is often adopted because it is less costly. Open source software is generally offered at no cost, although some providers, including Linux distributor Red Hat, charge for related support and development services. Others use open source because it is perceived to be more robust when it comes to debugging and modification by the developer community. In some cases, it is the only software available to perform a certain function.

Legal issues to consider when using, distributing, or licensing open source software

Open source software is characterized by users’ freedom to modify and distribute it, so comprehending the terms and conditions of its distribution license is essential to understanding your rights to use and distribute it.

There are many different open source software license agreements. Each adheres to certain core principles, but specific terms often vary. The most common license is the GNU General Public License (GPL) created by Richard Stallman. It currently governs the use of approximately 70 percent of open source software, including GNU/Linux and MySQL. Other open source license examples include the Apache Software license, the BSD license, the IBM Public license, the MIT license, and the Mozilla Public license (under which Netscape Navigator is distributed).

When reviewing an open source software license, users—especially developers—should pay special attention to the following issues:

Does the license allow modification of source code?
Does the license allow redistribution of such modifications?
Does the license require redistribution of source code and modifications under the same open terms?

Terms of the GNU general public license (GPL)

The GPL was written by a programmer, not a lawyer, so it is sometimes difficult to interpret using traditional legal standards. Here are the license’s key terms:

The software’s source code must be distributed (or otherwise made available) with its object code
The source code of the program may be copied and modified by all users
All portions of the program, including modifications, must be distributed subject to the GPL terms. This includes software that uses portions of a program licensed under the GPL. In other words, the GPL is “viral,” so software distributed under it infects all other software it “touches.”
The text of the GPL license must be distributed with the program
No royalties may be charged, but the distributor may charge for copies
A copyright notice and warranty disclaimer must be included
No changes to the GPL license are permitted, and no additional restrictions may be imposed

Practical concerns when dealing with GPL terms

Open source licenses, such as the GPL, raise significant issues for software developers who choose it as a distribution model. The same is true for users who use or distribute open source software.

Before releasing software under GPL terms, consider that doing so will make it difficult to earn revenues from the software. Although the GPL does permit distributors to charge for certain software related services, the product itself must be distributed free of charge. Software companies should also note that the GPL encourages employees to have employers waive copyright protection for software they develop.

Before incorporating GNU GPL software into products you develop and plan to distribute, remember that the GNU GPL has a “viral” effect, i.e. any product that includes portions of a program licensed under the GNU GPL must itself be licensed under the GNU GPL. The relevant provision reads:

You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.

Note that open source programs may be included on the same media as proprietary files provided that they are not linked. Here, the relevant provision reads:

Mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.

Also, before using GNU GPL licensed software, consider that the license offers no warranties concerning performance or indemnification for intellectual property infringement.

Avoiding Copyleft

There are at least two ways to avoid the viral effect of including software licensed under the GPL in software products you wish to distribute.

The first is to create a “demilitarized zone” within the software. This includes:

A proprietary product core that does not include or link to any GPL code
A GPL licensed interface linked to the GPL code
Calls to output from the interface used by the core at runtime.

See the following diagram:

INSERT IMAGE HERE

A more straightforward approach to circumventing the GPL viral effect is to obtain non-GPL license rights from the copyright holder of the software you wish to use, thereby avoiding the problem entirely.

NPCreate: 4/7/2004

Digital Millenium Copyright Act Safe Harbor Provisions

Crawford, Cindy — Wed, 14 May 2008 22:37:02 GMT

Wiki Content:

In today’s wired economy, almost every company regardless of its size or industry does some level of business online. Most company Web sites offer chat rooms or message boards for customers or the public at large to post comments and materials, and/or provide hyperlinks to other online content. If your company engages in any of these activities, it may be held liable under the U.S. Copyright Act for acts of copyright infringement by third parties using your services to post infringing content. The safe harbor provisions of the Digital Millennium Copyright Act (“DMCA”) may offer immunity to your company as an online service provider from direct, contributory, and vicarious liability for copyright infringement by third parties in some circumstances. Qualifying for immunity can completely bar the monetary damages to which your company may be exposed and significantly limit injunctive relief.

To qualify for the DMCA safe harbor immunity, your company must meet of the DMCA’s definition of a “service provider,” its allegedly infringing activities must fall under one of four categories set out in the statute, and it must meet the requirements for exemption for that category. In addition, it must designate an agent to receive notices of alleged infringement, adopt and reasonably implement a policy of terminating the accounts of subscribers who are repeat infringers, and adopt and not reasonably interfere with “standard technical measures.”

The DMCA was intended to provide service providers a greater degree of certainty about avoiding liability for acts of copyright infringement by third parties on the Internet. Despite this goal, the statute itself is far from clear whether any specific conduct qualifies for any of the safe harbor exemptions. The application of the DMCA’s safe harbor provisions to various types of online services has not been fleshed out in the courts. The cases that have reached the courts to date have not reached unanimous decisions even where the online services are facially indistinguishable. Thus, neither the statute nor the cases applying the statute offer any crystal-clear guidelines for online service providers about whether their specific services might qualify for safe harbor immunity. It is therefore advisable to seek the advice of counsel if such a determination must be made. In addition, it is prudent to implement corporate policies and procedures that will enable your company to qualify for an exemption from liability regardless of the specific type of service your company provides.

This summary is intended to provide an informational overview of the DMCA safe harbor provisions. It is intended for informational purposes only and not as legal advice. Readers should not act on this information without professional counsel.

Definition of “Service Provider”

The DMCA contains two definitions of “service provider.” A “service provider” for the purpose of the first limitation, “transitory digital network communications,” is defined as “an entity offering the transmission, routing, or providing of connections for digital online communications, between or among points specified by a user, of material of the user’s choosing, without modification of the content of the material as sent or received.” For the purposes of the remaining three limitations, a “service provider” is defined more broadly as “a provider of online services or network access, or the operator of facilities therefore.”

Service Provider Activities That Qualify for DMCA Protection

Engaging in the following activities may qualify a service provider to qualify for the DMCA’s safe harbor:

Transitory digital network communications
System caching
Storage of material residing on a system or network at the direction of a user
Referring or linking users to an online location using information location tools

Each of these four categories is independent. A determination that a service provider’s conduct does not qualify for immunity under one limitation does not affect a determination of whether another limitation applies.

The DMCA provides special rules for service providers that are nonprofit educational institutions. The rules apply in situations where faculty members or graduate students use the educational institution’s online services to engage in infringing activities while performing teaching or research.

“Takedown” Requirements

To qualify for exemption from liability for infringing material on Web sites, message boards, chat rooms, and other information repositories hosted on a system, or for hyperlinks to infringing materials, online directories, or search engines, an service provider must move “expeditiously” to remove or disable access to allegedly infringing material if it: (1) receives “actual knowledge” that the material or an activity is infringing; (2) becomes aware of “red flags,” i.e., facts or circumstances from which infringing activity is apparent; or (3) receives a notice “substantially complying” with the DMCA notice provisions.

1 . Actual Knowledge of Infringement

The DMCA is silent on what constitutes “actual knowledge” of infringing material or activity, and a determination of “actual knowledge” will require a legal analysis. By way of example, actual knowledge could include the discovery of an express comment in a chat room that the material is taken from a copyrighted source, e.g., “click here to hear this bootleg CD!”

2. Awareness of Facts or Circumstances from Which Infringing Activity is Apparent

The DMCA does not define or provide examples on the type of facts or circumstances that might give rise to an awareness of “red flags” from which infringing activity is apparent. However, the legislative history of the DMCA suggests that a service provider would not qualify for safe harbor immunity if it “had turned a blind eye to ‘red flags’ of obvious infringement.” By way of example, a “red flag” might be raised if the service provider discovers a link to a Web site whose sole function is to enable the unauthorized downloading of pirated songs.

3. Receipt of Notification of Claimed Infringement

To trigger the service provider’s takedown obligations under the DMCA, the notice to the service provider must be delivered in writing to the service provider’s “designated agent” and must comply “substantially” with the following requirements:

Identification of the copyrighted work claimed to have been infringed or, if multiple works are at issue, a representative list of those works
Identification of the allegedly infringing material that is to be removed or access to which is to be disabled, and information “reasonably sufficient” to permit the service provider to locate the material
Information “reasonably sufficient” to contact the complaining party, such as an address, telephone number, and e-mail address
A statement that the complaining party has a good-faith belief that the material to be removed is infringing
A statement that the information in the notification is accurate and, under penalty of perjury, that the complaining party is authorized to act on behalf of the copyright owner
A physical or electronic signature of a person authorized to act on behalf of the copyright owner

If the notice fails to comply substantially with requirements (i) through (iii), a service provider is under no obligation to respond. If the notice complies substantially with the first three requirements but not one or more of the other requirements, the service provider must contact the person making the notification and take reasonable steps to obtain a notification that substantially complies with all of the above requirements.

No Liability for Good Faith “Takedown”/Subscriber Counter Notification

Under the DMCA, a service provider is exempt from liability to “any person” for any claim based on the service provider’s good faith disabling of access to or removal of material claimed to be infringing or based on awareness of “red flags,” regardless of whether the material ultimately is determined to be infringing.

This immunity from liability for good faith takedown of allegedly infringing content does not apply with respect to a service provider’s subscribers , however, unless the service provider:

takes reasonable steps to notify the subscriber that the material has been removed or access has been disabled;
upon receipt of an effective counter notification from a subscriber, provides the person who provided the notification with a copy and informs that person that it will replace the removed material or cease disabling access to it within ten business days; and
within ten to fourteen business days following receipt of counter notification, actually does replace the removed material or cease disabling access unless the person files an action seeking a court order restraining the subscriber from engaging in the allegedly infringing activity.

To be effective, the subscriber’s counter notification must made in writing to the service provider’s designated agent and must include “substantially” the following:

Identification of the material that has been removed or to which access was disabled, and its location prior to removal or disabling of access
A statement made under penalty of perjury that the material was removed or disabled due to a mistake or misidentification
The subscriber’s name, address, and telephone number, and a statement that the subscriber consents to the jurisdiction of the federal district court of the judicial district in which the address is located or, if the subscriber is located outside the United States, the judicial district in which the service provider may be found, and that the subscriber will accept service of process from the person providing the notice or their agent
The subscriber’s physical or electronic signature

If a service provider follows these “put back” procedures, it cannot be subject to liability for infringement of the copyright identified in the original notice.

Material Misrepresentations

The DMCA provides safeguards against material misrepresentation in a notification or counter notification. Any person who knowingly materially represents that material is infringing, or that material or activity was removed or disabled by mistake or misidentification, shall be liable for damages, including costs and attorneys’ fees incurred by the alleged infringer, copyright owner, or their authorized licensee, or a service provider.

Designated Agent

To qualify for DMCA protection, a service provider must designate an agent to receive notification of alleged infringements. The following information should be made available through the service provider’s terms of service, including on its Web site in a location accessible to the public:

the name, address, phone number, and e-mail address of the agent; and
other contact information as may be required by the Register of Copyrights.

The Copyright Office issued Interim Rules on October 28, 1998, to assist service providers wishing to designate agents under the DMCA. The Interim Rules are available at http://www.copyright.gov/fedreg/1998/63fr59233.html. Until the final rules are issued, the Copyright Office Interim Rules require service providers to file a document entitled Interim Designation of Agent to Receive Notifications of Claimed Infringement,” available at http://www.copyright.gov/onlinesp.agent.pdf. If the information changes, an amendment should be filed, which is available at http://www.copyright.gov/onlinesp.agenta.pdf.

The Copyright Office Interim Rules will be valid until the office issues final rules. At that time, service providers will have to file new designations complying with the final rules. During the interim period, related companies, e.g., parents and subsidiaries, must file separate interim designations.

Policy for Termination of Repeat Infringers

To qualify for DMCA immunity, a service provider must have adopted and reasonably implemented a policy providing for termination of repeat infringers. The service provider must also inform subscribers and account holders of this policy. At a minimum, service providers should incorporate this policy into their terms of their service contracts.

Noninterference with Standard Technical Measures

Another precondition to claiming the DMCA’s safe harbor immunity is that the service provider must accommodate and not “reasonably interfere” with “standard technical measures.” “Standard technical measures” are measures used by copyright owners to identify or protect copyrighted works, such as technologies preventing the unauthorized copying of copyrighted DVDs.

Responding to Subpoenas to Identify Infringers

The DMCA grants copyright owners the ability to request district courts to grant subpoenas requiring service providers to identify persons who allegedly infringe copyrights. Upon receiving such a subpoena, the service provider must “expeditiously” disclose the requested information to the copyright owner or their agent.

Limited Liability for Copyright Infringement

The incentives for qualifying for exemption from liability under the DMCA are enormous. The DMCA exempts qualifying service providers from any “monetary relief,” including damages, costs, attorneys’ fees, and any other form of monetary payment. This exemption can be significant given that infringers can be subject to monetary penalties of up to $150,000 for each act of infringement. In addition, the DMCA permits courts to issue only limited injunctions in cases where a service provider qualifies under the DMCA safe harbor.

NPCreate: 4/7/2004

ECPA and Subpoenas Issued to Internet Service Providers

Crawford, Cindy — Wed, 14 May 2008 22:26:49 GMT

Wiki Content:

What limitations and obligations does the Electronic Communications Privacy Act place upon an Internet service provider (“ISP”) when responding to a governmental subpoena, search warrant, or court order?

Question Presented

Analysis

Subpoenas typically seek information that can be broadly grouped for analytical purposes into one or more of three broad categories: (1) customer information; (2) transactional information; and (3) the contents of electronic communications. Because the Electronic Communications Privacy Act makes important distinctions concerning a recipient’s duties and obligations depending on what type of entity is behind the subpoena and what type(s) of information is (or are) sought, the first challenge in responding to any subpoena is to characterize and classify accurately the type of subpoena that has been received and the information that it seeks.

The Background of the ECPA

The rights and duties of recipients of subpoenas for electronically transmitted information are governed by the Electronic Communications Privacy Act of 1986 (the “ECPA”). The ECPA updated existing federal antiwiretapping laws.[1] Title III was limited to wiretapping and was the primary federal law protecting personal and business communications in the United States.

By 1986, Congress had realized that Title III was outdated. The purpose of the ECPA was “to update and clarify federal privacy protections and standards in light of dramatic changes in new computer and telecommunications technologies.”[2] Congress believed that “the law must advance with the technology to ensure the continued vitality of the Fourth Amendment.”[3] Congress feared that absent congressional action privacy would “gradually erode as technology advances.”[4]

In 2001, Congress amended the ECPA in the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (the “USA Patriot Act”)[5] In addition to clarifying certain provisions in the ECPA, the USA Patriot Act broadened a specific type of information an ISP is required to disclose when subpoenaed. While the USA Patriot Act is often thought of as expanding the government’s law enforcement powers in a variety of contexts, it has been the courts that have recently had the most significant impact in altering the level of protection the ECPA provides to electronic communications. Two recent cases, Theofel v. Farey-Jones and United States v. Councilman[6] are discussed below.

Most practitioners and many courts still frequently refer to Title III as either the Federal Wiretap Act or merely as Title III.[7] This nomenclature can be confusing because, with the 1986 amendments, the ECPA is now itself broken into three titles, Title I, Title II, and Title III. To avoid confusion going forward, this memorandum eschews the use of the term “Title III” to refer to the Federal Wiretap Act and instead uses the terms Title I and Title II to refer to specific sections of the ECPA. This memorandum does not discuss Title III of the ECPA in any detail because that section deals only with pen registers and trap and trace devices.

Requirements Under Title I of the ECPA

Title I of the ECPA (which is appropriately called the “Federal Wiretap Act”) addresses wiretapping. Prior to 1986, Title I covered only wire and oral communications. The 1986 amendments extended the coverage of Title I to “electronic communications” in addition to wire and oral communications.[8] Title I proscribes the intentional interception of any wire, oral, or electronic communication unless the intercept is authorized by a court order or one party to the conversation (who is not acting under color of state law) consents to the interception.[9]

Subject to certain exceptions, an electronic communication is:

Any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce . . . . [10]

Put more simply, electronic communication means the “transfer” of information by any means other than sound waves from one point to another.[11] This definition is also used in Title II of the ECPA.

There are very strict requirements for the government to conduct a wiretap under Title I and thereby obtain access to the contents of “electronic communications” while such communications are in transit. [12] Under Title I, senior federal or state law enforcement officers must apply for a court order authorizing the wiretap. To obtain authorization the government must convince the court that there is probable cause to believe that the subject of the wiretap is engaging in criminal conduct.[13] Interestingly, a wiretap of “electronic communications” can be authorized to obtain evidence relating to any federal felony, whereas a “wire” or “oral” communication wiretap may only be authorized for evidence relating to a narrow set of enumerated felonies.[14]

Subpoenas for Stored Communications from Governmental Entities

Title II of the ECPA, 18 U.S.C. §§ 2701-11, is known as the “Stored Communications Act.” Title II is “modeled after the Right to Financial Privacy Act, 12 U.S.C. § 3401 et seq., to protect privacy interests in personal and proprietary information, while protecting the Government’s legitimate law enforcement needs.”[15]

Title II concerns unauthorized access to “stored” electronic communications. Interestingly, however, a definition for the term “stored” cannot be found anywhere in the ECPA. That omission can lead to much difficulty and potential confusion in interpreting the statute.

Section 2703 of the ECPA is the primary section governing the requirements for governmental access to stored communications. It is broken into subsections addressing access to:

The “contents” of “electronic communications” in “electronic storage” held by providers of “electronic communications services” (§ 2703(a))
The “contents” of “electronic communications” in a “remote computing service” (§ 2703(b)) and
Records concerning customer use of either an “electronic communication service” or a “remote computing service” (§ 2703(c))

Before moving forward, it is important to examine the three main subsections of § 2703. Subsection (a) is entitled “contents of electronic communications in electronic storage.” That title makes it seem as if the subsection applies to electronic communications providers as well as providers of remote computing services. By its terms, however, § 2703(a) is strictly limited to providers of “electronic communications services” and it does not apply to “remote computing services” providers. Thus, one way to look at subsections (a) and (b) is that while both concern the “content” of electronic communications, subsection (a) addresses content held in the possession of electronic communications services providers and subsection (b) addresses content held by providers of remote computing services. While that is a sensible reading of the organizational structure of the statute, there are two problems with that interpretation.

An “electronic communications service” is “any service which provides to users thereof the ability to send or receive wire or electronic communications.”[16] ISPs, because they typically provide the ability to send and receive electronic mail, qualify as providers of electronic communications services.[17] Any networked business can also qualify as a provider of electronic communications services if it provides the ability to send and receive e-mail.

The first problem in interpreting the statute is that subsection (a) does not address all “contents” of electronic communications. Rather, it concerns only contents that are in “electronic storage.” Electronic storage means:

(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and

(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication.[18]

Thus, the term “electronic storage” is much more narrowly defined than one might imagine. Instead of meaning any communication stored in electronic form, the term is limited to cover only “temporary, intermediate storage of . . . [an] electronic communication [that is] incidental to the . . . transmission thereof” as well as communications stored for backup purposes. The United States Department of Justice interprets this to mean “unopened electronic mail.” The theory is that the storage of unopened electronic mail is both temporary and merely incidental to its transmission. The “meat space” analogy is the Post Office holding unopened mail for someone in a post office box.

The Justice Department’s view is certainly one possible interpretation. However, Congress knew what electronic mail was back in 1986 and repeatedly discussed it in the legislative history of the ECPA.[19] Had Congress intended § 2703(a) to apply only to unopened e-mail Congress could easily have been a bit more clear when drafting the statute.

For the Justice Department’s interpretation to work another nonobvious construction of the statute must also be made. That is that the moment someone allows a customer or employee to store opened electronic mail at the server level that entity instantly becomes a provider of “remote computing services.” Without that additional interpretation there would be a giant hole in the ECPA because no provision in the ECPA would cover opened electronic mail stored by an electronic communications services provider.

A “remote computing service” means “the provision to the public of computer storage or processing services by means of an electronic communications system.”[20] To understand what kind of entity Congress was trying to define, it is necessary to examine the legislative history and to think back to the computer industry of the mid-1980s.

In the mid 1980s, the computer industry was still dominated by large mainframe computers. Because not every company could afford a large mainframe computer, an industry grew up that was known alternately as the “time sharing” or “service bureau” industry. Large mainframe computers could be partitioned into multiple “virtual machines,” which gave users the impression that they had the system to themselves when in reality they were sharing system resources with many other users. One of the services offered by this industry was the ability to lease a portion of a large mainframe. To access these computers, users would dial in to the computer using either switched or leased lines. Electronic Data Systems was a classic example of this type of company.

The legislative history of the ECPA indicates that Congress was targeting the time sharing industry when it attempted to define “remote computing services.”

In the age of rapid computerization, a basic choice has faced the users of computer technology. That is, whether to process data in-house on the user’s own computer or on someone else’s equipment. Over the years, remote computer service companies have developed to provide sophisticated and convenient computing services to subscribers and customers from remote facilities. Today businesses of all sizes—hospitals, banks and many others—use remote computing services for computer processing. This processing can be done with the customer or subscriber using the facilities of the remote computing service in essentially a time sharing arrangement, or it can be accomplished by the service provider on the basis of information supplied by the subscriber or customer. Data is most often transmitted between these services and their customers by means of electronic communications.[21]

The Justice Department’s position is that the instant an ISP allows customers to store the contents of opened electronic mail at the ISP server level, that storage is no longer incidental to the transmission of the message. Rather, at that point the ISP is providing remote computer services because it is providing computer storage to the public. Therefore, the provisions of § 2703(b) apply.

The Justice Department’s interpretation of the ECPA is the most reasonable way to interpret this incredibly complex and poorly written statute.[22] While that interpretation does not square precisely with the plain language or organization of the statute, any other interpretation leads to complete confusion or serious gaps in the coverage of the ECPA. For that reason this memorandum concludes that § 2703(a) applies only to unopened electronic mail and that § 2703(b) applies to opened electronic mail and other types of content that might be stored by a provider of remote computing services.

Warrant Required for Unopened E-Mail Stored for 180 Days
or Less

Under § 2703(a), a governmental entity (state or federal) is permitted to compel a provider of “electronic communications services” to produce the contents of an “electronic communication” that has been in “electronic storage” for 180 days or less “only pursuant to a warrant issued under the Federal Rules of Criminal Procedure or equivalent State warrant.” This means that ISPs can be compelled by the government to produce the contents of unopened electronic mail messages that they have stored for 180 days or less only when presented with a valid search warrant.[23]

Subpoena with Customer Notice for Unopened E-Mail Stored for More than 180 Days and for Opened E-Mail and Other Stored Content

If the subject matter of a governmental subpoena concerns opened electronic mail, unopened electronic mail stored for more than 180 days, or any other type of stored “content,” a different and somewhat more complex set of rules applies.

If a governmental entity seeks to gain access to the contents of “electronic communications” stored by a provider of “electronic communications services” for more than 180 days, then the governmental agency must follow the procedures set forth in subparagraph (b) of § 2703.[24] Subparagraph (b) of § 2703 applies to “any electronic communication” held or maintained by a remote computing service “on behalf of, and received by means of electronic transmission from . . . a . . . customer of such remote computing service . . . solely for the purposes of providing storage or computer processing services to such . . . customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than providing storage or computer processing.”[25]

The government can gain access to the contents of electronic communications in a remote computing service in two ways:

(1) via a subpoena, providing the governmental entity gives prior notice to the subject of the subpoena or obtains a court order; or
(2) without prior notice if the governmental entity obtains a search warrant.[26]

Curiously, the statute is completely silent as to the form of the required notice and whether the governmental entity must provide proof or certify that notice has been given. Nevertheless, because an ISP faces potential civil liability for an unauthorized disclosure, it would presumably be within its rights to demand to see proof of subscriber notification before complying with a subpoena for opened electronic mail.[27]

ISPs are permitted to notify affected customers that they have received a subpoenas for their information (even though many governmental subpoenas admonish ISPs not to notify their customers). Section 2705 of the ECPA provides the only exception to this rule. That section allows governmental entities to apply for a court order commanding the ISP not to notify any other person, especially the subscriber, of the existence of the subpoena. A court is empowered to issue such an order if it determines “that there is reason to believe” that notification will (1) endanger someone; (2) cause the target to flee prosecution; (3) result in the destruction of or tampering with evidence; (4) lead to witness intimidation; or (5) otherwise seriously jeopardize an investigation or unduly delay a trial.[28]

Backup Preservation and Requirement to Preserve Evidence

The ECPA also contains a provision requiring ISPs to preserve specified records pending the issuance of a court order or other process.[29] Such records are required to be preserved for 90 days. That period can be extended an additional 90 days upon a renewed request by the governmental entity.[30]

Governmental entities can also request in their subpoenas that ISPs create a backup copy to preserve specified communications.[31] This is an alternative procedure (which cannot be challenged) that the government can use if it believes, in its sole discretion, that notification under § 2703 would result in the destruction of or tampering with evidence. This complex procedure is set forth below:

Acting pursuant to § 2703(b), a governmental entity may include in its subpoena or court order a demand to the ISP to create a backup copy of specified communications;
Without notifying the subscriber or customer of such subpoena or court order, an ISP must create a backup copy within two business days and give notice to the governmental entity that the backup has been performed.
Upon receipt of notice from the ISP that a backup copy has been made, the governmental entity must, within three days after receipt of such confirmation, give notice to the subscriber that it has subpoenaed the information, unless notice has been delayed pursuant to § 2705. This requires a court order delaying notice or, in the case of an administrative subpoena, written certification from a supervisory official of the need for delay. In both cases, a court order is necessary to prevent an ISP from thereafter notifying its customer of the subpoena.
ISPs must retain any backup copies created at governmental request until the later of the delivery of the information or the resolution of any proceedings concerning the government’s subpoena or court order.
The ISP may not release the information until 14 days after notice to the subscriber and then only if the ISP has not received notice from the subscriber of an intent to challenge the subpoena and an actual challenge has not been filed.[32]

Customers have 14 days after receipt of notice to move to quash the subpoena or vacate the court order.

Gaining Access to Subscriber Information and
Transactional Data

The ECPA makes important distinctions between the contents of stored communications and information pertaining to subscribers and their transactional data. A provider of electronic communications services has no obligation to keep “record[s] or other information pertaining to a subscriber” confidential.[33] Indeed, an ISP “may disclose a record or other information pertaining to a subscriber” or customer to any person other than a governmental entity.[34]

The ECPA does not define “records or other information pertaining to a subscriber.” The meaning of this term can only be deduced by process of elimination. Subscriber information and transactional records are not the same as the “contents” of a communication. As shown above, “contents” receive special protection under § 2702.[35]

Subsection (c) of § 2703 is entitled “records concerning electronic communication service or remote computing service.” Within subsection (c), however, Congress made something of a distinction between different types of “customer information” and “transactional records” that fall under this broad heading.[36] When a governmental entity desires access to a “record or other information pertaining to a subscriber or to [a] customer” (which we shall call “transactional records”) it must either:

Obtain a warrant
Obtain a court order (which can be issued only if the government presents “specific and articulable facts showing that there are reasons to believe the . . . [information sought is] relevant and material to an ongoing criminal investigation)
Have the consent of the subscriber or
Submit a formal written request indicating that the investigation concerns telemarketing fraud.[37]

Until late 1994, governmental entities could also use its subpoena power to access this kind of subscriber information for its own use.[38] However, when passing the Communications Assistance for Law Enforcement Act (“CALEA”) in October of 1994, Congress amended the ECPA and took the subpoena power for this type of information away from governmental entities.[39]

The legislative history of this amendment reveals that Congress recognized “that transactional records from on-line communication systems reveal more than telephone toll records or mail covers.”[40] Thus, the ECPA was amended to “eliminate[] the use of a subpoena by law enforcement to obtain from [ISPs] the addresses on electronic messages. In order for law enforcement to obtain such information, a court order is required.”[41] According to the legislative history, the “intent of raising the standard for access to transactional data is to guard against ‘fishing expeditions’ by law enforcement.’”[42]

The amendment imposes an “intermediate standard” of proof on the government to gain access to transactional information. This standard is less than the “probable cause” standard required to get a warrant, but more than the standard for a subpoena. “Under the intermediate standard, the court must find . . . that there are specific and articulable grounds to believe that the records are relevant and material to an ongoing criminal investigation.”[43] This standard is codified at 18 U.S.C. § 2703(d). Based on the plain language of this statute and its legislative history, it appears that the government does not have the power to obtain this type of information for its own use via either a court order or a subpoena in a civil case.

Nevertheless, Congress did give the government the power to subpoena a certain subset of customer information for the government’s own use:[44] Pursuant to 18 U.S.C. § 2703(c)(2), ISPs are required to disclose to governmental entities the following customer-related information upon receipt of a valid administrative, grand jury, or trial subpoena:

Name and address
Local and long-distance telephone connection records, or records of session times and durations
Length of service of a subscriber
The types of services the customer uses
Telephone number or other subscriber number or identity
Any temporarily assigned network address
Means and source of payment for services, including credit card or bank account information.

This list should be viewed as an exhaustive list of the types of data that qualify as “customer information.”[45] Thus, “transactional records,” strictly by process of elimination, should be viewed as everything else about a customer not contained in the above list and that is not “content.” Examples of such information includes, but is certainly not limited to, addresses of Web sites visited by the customer and names and electronic mail addresses of individuals with whom the customer corresponds.[46]

Thus, the ECPA recognizes four types of communications/information and sets forth different rules for gaining access to each. These rules are summarized below.

SUMMARY OF RULES CONCERNING GOVERNMENTAL ACCESS

Type of Information	Rules Governing Governmental Access
Wiretap (content in transit)	High-ranking federal or state law enforcement official must apply for court order authorizing wiretap. Electronic communications may be intercepted for evidence of any federal felony (18 U.S.C. §§ 2516 and 2518). Probable cause standard of proof. For obvious reasons, neither the government nor the carrier are permitted to notify the customer.
Stored Content (content at rest in either open or unopened form)	Warrant required to gain access to all unopened e-mail (18 U.S.C. § 2703(a)). Subpoena with notice to customer required to gain access to unopened e-mail stored for more than 180 days. Subpoena or court order with notice to customer required to gain access to all opened e-mail; no notice to customer required if government obtains a search warrant (18 U.S.C. § 2703(b)).
Transactional Records	Court order based on showing of “articulable facts” pointing to criminal conduct required (18 U.S.C. §§ 2703(c)(1)(B), (d)).
Customer Information	Subpoena. Government not required to notify customer (18 U.S.C. § 2703(c)(1)(C).)

Notes

Pub. L. No. 99-508, 100 Stat. 1848 (1986), codified as amended , 18 U.S.C. §§ 2510-21 and 2701-11. The ECPA amended Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (18 U.S.C. §§ 2510-13, 2515-20 and 47 U.S.C. § 605 (1982)
[Back to reference]
S. Rep. No. 99-541, at 1 (1986), reprinted in 1986 U.S.C.C.A.N. 3555.
[Back to reference]
Id.
[Back to reference]
Id.
[Back to reference]
Pub. L. No. 107-56, 115 Stat. 272.
[Back to reference]
359 F.3d 1066 (9th Cir. 2003) and 373 F.3d 197 (1st Cir. 2004), respectively.
[Back to reference]
See Steve Jackson Games, Inc. v. United States Secret Service, 36 F.3d 457, 460 (5th Cir. 1994).
[Back to reference]
18 U.S.C. § 2510(12). Prior to the passage of the USA Patriot Act, Title I governed law enforcement access to unopened voice mail as a “stored wire communication” covered under § 2510(1). This resulted in the government needing a wiretap order, rather than a search warrant, to access voice mail held by a service provider. However, § 209 of the Patriot Act removed “electronic storage” from the definition of “wire communications” found in § 2510, and also added language to § 2703 of the Stored Communications Act to cover both stored wire and electronic communications. The result of the change is that stored wire communications, including voice mail, are now covered under the same rules as those governing stored electronic communications – namely those found in the Stored Communications Act.
[Back to reference]
18 U.S.C. §§ 2511(1)(a) and 2511(1)(d). Nearly every state also has laws prohibiting either “wiretapping” or electronic “eavesdropping.” While the laws can be quite complex, the fundamental distinction concerns the consent of the parties whose conversations are being monitored. Under Title I, it is legal to record or “intercept” a conversation so long as one party to the conversation (who is not acting under color of law) consents to the interception of the conversation. The majority of states have also adopted one-party consent wiretapping statutes. Many states, however, have anti-eavesdropping laws. These states require all parties to a conversation to consent before the conversation can lawfully be recorded or monitored. Whenever the term eavesdropping is used in a state statute it is usually a code word for an all-party consent jurisdiction.
[Back to reference]
18 U.S.C. § 2510(12).
[Back to reference]
See United States v. Reyes, 922 F. Supp. 818, 836 (S.D.N.Y. 1996); 1986 U.S.C.A.N.N. at 3568 (“As a general rule, a communication is an electronic communication . . . if it is not carried by sound waves and cannot fairly be characterized as containing the human voice. . . . This term also includes electronic mail, digitized transmissions, and video teleconferences.”).
[Back to reference]
A recent case in the First Circuit, however, nearly eviscerates Title I’s protection for electronic communications in transit. In United States v. Councilman, 373 F.3d 197 (1 st Cir. 2004), an Internet service provider employee wrote and installed a program to scan the incoming electronic mail of the ISP’s customers for certain keywords. Other ISP employees then read the selected e-mails before they were received by the ISP’s customers in an effort to gain a commercial advantage over the ISP’s competitors. Councilman, 373 F.3d at 199. The ISP employee who wrote the program was charged with conspiracy to violate 18 U.S.C. § 2511(a) of the Wiretap Act. The district court dismissed the indictment, however, and a three-judge panel of the First Circuit affirmed. The First Circuit held that because the electronic mails were intercepted in the random access memory of the ISP’s computer system, they were held in temporary electronic storage, and therefore not in transit and not covered by the Wiretap Act. Id. at 202. Thus, under Councilman the level of protection an electronic mail receives depends on whether the message is in transit between intermediate servers, or merely stopped for a nanosecond on one of those servers. In addition, t he Department of Justice could install a program (such as the newly developed Carnivore) with at most only a search warrant, and the FBI would no longer need a search warrant if the owner of a computer where Carnivore is installed consents to the installation, and that owner is a University or business (other than an ISP). Whether Councilman will remain the law in the First Circuit is unclear at this time, as the First Circuit has agreed to rehear the case en banc.
[Back to reference]
18 U.S.C. §§ 2516 and 2518.
[Back to reference]
Id. Section 202 of the USA Patriot Act amended the set of enumerated felonies to include felony violations of the Computer Fraud and Abuse Act (18 U.S.C. § 1030).
[Back to reference]
1986 U.S.C.C.A.N. at 3557. There are a variety of other (somewhat conflicting) statutes addressing personal privacy in the electronic age. See, e.g., The Foreign Intelligence Surveillance Act (“FISA”) of 1978, 50 U.S.C. §§ 1801-11, 18 U.S.C. § 2511, and 18 U.S.C. § 2518-19 (FISA is confined to surveillance in national security cases); The Communications Assistance for Law Enforcement Act (“CALEA”), 47 U.S.C. § 1001-1010 (requiring telephone companies to cooperate with law enforcement); The Video Privacy Protection Act of 1988, 18 U.S.C. §§ 2710-11 (addressing the disclosure of video rental records); and the Cable Communications Policy Act of 1984, Pub. L. No. 98-549, 98 Stat. 2779 (prohibiting cable operators from disclosing customers’ viewing records) (codified in various sections of 15, 18, 46, 47 and 50 U.S.C.). Section 211 of the USA Patriot Act amended title 47, section 551(c)(2)(D) of the Cable Communications Policy Act to clarify that the ECPA, the wiretap statute and the trap and trace device statute, and not the Cable Communications Policy Act, govern disclosures of customer records that relate to telephone and internet services, regardless of whether or not a cable company provides both cable television and internet services.
[Back to reference]
18 U.S.C. § 2510(15).
[Back to reference]
United States v. Hambrick, 55 F. Supp. 2d 504, 507 (W.D. Va. 1999); see also 1986 U.S.C.A.N.N. at 3568 (“Existing telephone companies and electronic mail companies are providers of electronic communications services. Other services like remote computing services may also provide electronic communications services”). As the legislative history implies, the categories of “electronic communications service” provider and “remote computing service” provider are not mutually exclusive. Entities can fall into one category for one purpose (i.e., transmitting e-mail) and another for other purposes (i.e., storing e-mail or other types of files or providing other types of services).
[Back to reference]
18 U.S.C. § 2510(17).
[Back to reference]
1986 U.S.C.A.N.N. at 3562.
[Back to reference]
18 U.S.C. § 2711(2).
[Back to reference]
1986 U.S.C.A.N.N. at 3564-65.
[Back to reference]
The Ninth Circuit, however, held differently in Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2003). In Theofel, the defendant’s lawyer in a commercial litigation case subpoenaed the plaintiff’s Internet service provider to produce “all copies of e-mails sent or received by anyone” at the plaintiff’s company. Id. at 1071. The subpoena was not limited as to time and scope, resulting in the lawyer reading messages that were personal and privileged. Id. As a result, employees of the plaintiff’s company sued the lawyer for violating the Stored Communications Act. The district court dismissed the Stored Communications Act claim on the grounds that the employees’ e-mails had not been in electronic storage because they were not being held incidental to their electronic transmission. Id. at 1072. The Ninth Circuit reversed, holding that the employees’ opened e-mails were still held in electronic storage because they were kept for purposes of backup protection, and therefore they were covered under 18 U.S.C. § 2510(17)(B). Id. at 1075. While the United States argued as amicus curiae against this interpretation of § 2510(17)(B), Theofel is currently controlling in the Ninth Circuit. The holding means that the government must get a search warrant in order to obtain the contents of any electronic communication that has been stored by an Internet service provider for less than 180 days.
[Back to reference]
1986 U.S.C.C.A.N at 3592.
[Back to reference]
18 U.S.C. § 2703(a).
[Back to reference]
18 U.S.C. § 2703(b)(2).
[Back to reference]
18 U.S.C. § 2703(b)(1)(A) & (B).
[Back to reference]
Section 2707(e) provides that good faith eliance on a court warrant, order, or grand jury subpoena, is a complete defense to a civil action for damages for violating the Stored Communications Act through an unauthorized disclosure.
[Back to reference]
18 U.S.C. § 2705(b).
[Back to reference]
18 U.S.C. § 2703(f)(1).
[Back to reference]
18 U.S.C. § 2703(f)(2).
[Back to reference]
18 U.S.C. § 2704.
[Back to reference]
18 U.S.C. § 2704(a).
[Back to reference]
18 U.S.C. § 2703(c)(1)(A).
[Back to reference]
Id.
[Back to reference]
Under the ECPA, “contents” is defined as “any information concerning the substance, puport, or meaning of [a] communication.” 18 U.S.C. § 2510(8).
[Back to reference]
The ECPA does not make this specific distinction. However, it is useful and far easier to refer to subscriber information that is not content-related as either “transactional records” or “customer information.”
[Back to reference]
18 U.S.C. § 2703(c)(1)(B)(i)-(iv).
[Back to reference]
One of the great anomalies of the ECPA is that transactional records receive more protection than does opened electronic mail. This is purportedly the result of compromises made when the ECPA was amended in 1994.
[Back to reference]
Pub. L. 103-414, H. Rep. No. 103-827, 1994 U.S.C.C.A.N. 3489, 3511 (1994).
[Back to reference]
Id.
[Back to reference]
Id.
[Back to reference]
Id.
[Back to reference]
Id. at 3511-12 (emphasis added).
[Back to reference]
Some states require Internet service providers to notify customers when they receive civil subpoenas for this type of customer-related information. See, e.g., Va. Code Ann. 8.01-407.1(A)(3) (Michie Cum. Supp. 2003).
[Back to reference]
The last two types of customer information were added with the 2001 USA Patriot Act amendments to the ECPA. When a customer uses a credit card to pay for Internet access, that account information is now properly subject to subpoena. However, when a credit card is used to buy other goods or services, that credit card number is considered transactional information, not basic customer information , and it may only be obtained through a court order under 18 U.S.C. 2703(d). Furthermore, there is some uncertainty as to whether or not the government may use a subpoena to access a customers dynamically assigned IP addresses, as the statute only requires production of “temporarily assigned network addresses.”
[Back to reference]
See Orin Kerr, Department of Justice, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations , III.B, at 86-87 (2002), available at http://www.usdoj.gov/criminal/cybercrime/s&smanual2002.pdf.
[Back to reference]

NPCreate: 1/10/2007

NP 2.0 Wiki: Wiki Pages

Sotomayor IP Wiki

Tiffany v. eBay

Federal Rule of Evidence 502

Non-competition Agreements and Requirements for Broad ReleaseWaiver Agreements

Internet Law

Intellectual Property

Privacy and Cyber Security

SEC Allows Internet Availability of Proxy Materials

Software and Rights in Technical Data

Open Source Software

Employers Face Liability for Improper Disposal of Consumer Information

Copying Pages from a Website Could Cost You

Abstraction-Filtration-Comparison Analysis Guidelines for Expert Witnesses

The Duty to Preserve Evidence in a Digital World

The Scope of the Duty to Preserve

Deleted Data, Archived Data, and Metadata

Accessibility and Preservation

Safe Harbor for Routine Operations

Conclusion

Supreme Court revises Federal Circuit's limitations on patent exhaustion

Trademark Dilution Revision Act of 2006

Verizon Services Corp. v. Vonage Holdings Corp

In re Buszard

Court Blocks USPTO's Patent Rule Changes

Court of Appeals finds Use of Competitor's Trademark in Website Metatags Actionable but Limits Remedies

Substantial Federal and State Legislation Pending to Address Responses to Internet Data Breaches

Background

Overview of Principal Federal Legislative Initiatives

Website Privacy Statement After-the-Fact Amendments do not Offset Unauthorized Sharing

Licensing Open Source Software - Legal Tips and Pitfalls

Digital Millenium Copyright Act Safe Harbor Provisions

Definition of “Service Provider”

Service Provider Activities That Qualify for DMCA Protection

“Takedown” Requirements

1 . Actual Knowledge of Infringement

2. Awareness of Facts or Circumstances from Which Infringing Activity is Apparent

3. Receipt of Notification of Claimed Infringement

No Liability for Good Faith “Takedown”/Subscriber Counter Notification

Material Misrepresentations

Designated Agent

Policy for Termination of Repeat Infringers

Noninterference with Standard Technical Measures

Responding to Subpoenas to Identify Infringers

Limited Liability for Copyright Infringement

ECPA and Subpoenas Issued to Internet Service Providers

Question Presented

Analysis

The Background of the ECPA

Requirements Under Title I of the ECPA

Subpoenas for Stored Communications from Governmental Entities

Warrant Required for Unopened E-Mail Stored for 180 Daysor Less

Subpoena with Customer Notice for Unopened E-Mail Stored for More than 180 Days and for Opened E-Mail and Other Stored Content

Backup Preservation and Requirement to Preserve Evidence

Gaining Access to Subscriber Information andTransactional Data

SUMMARY OF RULES CONCERNING GOVERNMENTAL ACCESS

Wiretap (content in transit)

Stored Content (content at rest in either open or unopened form)

Transactional Records

Customer Information

Notes

Warrant Required for Unopened E-Mail Stored for 180 Days
or Less

Gaining Access to Subscriber Information and
Transactional Data