LibraryLaw Blog

Any creative thinkers out there? Copyright Office solicts comments on controversial law that makes it criminal to tamper with digital locks on content (DMCA). Due December 1st.

This is a challenge - to come up with classes of works that should be exempt from the draconian protections (prison time) that Congress gave content owners who put digital locks on their works ... even when use of the work would otherwise be legally permissible. 

If you're new to this topic, you can catch up by looking at the infamous 1998 Digital Millennium Copyright Act, partly at 17 USC 1201(a). Part of the deal was that the Librarian of Congress could promulgate exemptions after scheduled periods of public comment.

The Copyright Office is now soliciting written comments due December 1, 2005 and reply comments by February 2, 2006.

The exemptions for the four very-narrow classes of works that were approved last time will expire unless there's a good case to renew them.  And of course we need to figure out a way to identify other classes of works that libraries are blocked from, resulting in a loss to public information access. 

Here are the four classes from last time. I'm oversimplifying -- the classes are defined more narrowly. This post's continuation gives more detail.

1) Filter block lists

(2) Obsolete or malfunctioning computer programs protected by dongles

(3) Computer programs and video games distributed in obsolete formats

(4) Ebooks that aren't otherwise accessible by screen readers (i.e. for people with disabilities)

As a strange side note, the law itself already has a library exception that I swear I'm not making up.  We're allowed to hack into DRM in order to evaluate works for purchase.  Basically that means we must get a blue-haired teenager on our staff to hack, as it is still illegal to traffic in hacker equipment.  Has anyone ever needed to do this?  Vendors want libraries to examine their stuff for purchase. 

I've asked some of the usual library copyright crowd if anyone knows how this peculiar library exception made it into law, and no one I asked seems to know the answer.  Does anyone out there reading this have a clue (or even a guess)?

Excerpt from DMCA ... at 17 USC 1201(d):

Exemption for Nonprofit Libraries, Archives, and Educational Institutions.—
(1) A nonprofit library, archives, or educational institution which gains access to a commercially exploited copyrighted work solely in order to make a good faith determination of whether to acquire a copy of that work for the sole purpose of engaging in conduct permitted under this title shall not be in violation of subsection (a)(1)(A). A copy of a work to which access has been gained under this paragraph—
  (A) may not be retained longer than necessary to make such good faith determination; and
  (B) may not be used for any other purpose.
(2) The exemption made available under paragraph (1) shall only apply with respect to a work when an identical copy of that work is not reasonably available in another form.
(3) A nonprofit library, archives, or educational institution that willfully for the purpose of commercial advantage or financial gain violates paragraph (1)—
  (A) shall, for the first offense, be subject to the civil remedies under section 1203; and
  (B) shall, for repeated or subsequent offenses, in addition to the civil remedies under section 1203, forfeit the exemption provided under paragraph (1).
(4) This subsection may not be used as a defense to a claim under subsection (a)(2) or (b), nor may this subsection permit a nonprofit library, archives, or educational institution to manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, component, or part thereof, which circumvents a technological measure.
(5) In order for a library or archives to qualify for the exemption under this subsection, the collections of that library or archives shall be—
  (A) open to the public; or
  (B) available not only to researchers affiliated with the library or archives or with the institution of which it is a part, but also to other persons doing research in a specialized field.

Full Notice of Inquiry below.

Where can I find sample Patriot Act Section 215 orders?

Answer: Although actual issued orders are under seal, the ACLU has posted the form used by the FBI to apply for Section 215 orders, the form letter that it uses to order disclosure, and related 215 and National Security Letter documents.

http://www.aclu.org/SafeandFree/SafeandFree.cfm?ID=15327&c=262

New! Procedural Rules of the Foreign Intelligence Surveillance Court
Form letter used by FBI to order disclosure under Section 215 
Form used by FBI to apply for Section 215 orders from FISA court
Form Section 215 order proposed by FBI to FISA court
FBI internal e-mail discussing scope of Section 215 
Form used by FBI field offices to request Section 215 orders from FBI headquarters         
Memo delegating authority to approve Section 215 applications         
Memo indicating that FBI applied for a Section 215 order in October 2003         
Memo for FBI field offices explaining Section 215         
List of National Security Letters issued by FBI between October 26, 2001, and January 21, 2003            

Welcome Florida Library Directors - here's the police guide I recommended

I'm wishing you a weakened and turned-away-Wilma.  It was great to meet you all! 

Here's the link to the COPS Problem-oriented policing guides I recommended.  The guides are "designed to identify and remove the causes of recurring crime and disorder problems that harm communities" and offer a range of approaches, adaptable to varying situations.  See http://popcenter.org/

For example, Disorderly Youth in Public Places discusses creating alternative legitimate places for youth, modifying public places to discourage disorderly behavior, establishing and enforcing rules of conduct etc., as well as responses with limited effectiveness.

San Francisco Public Library RFID report now online

Radio Frequency Identification and the San Francisco Public Library Summary Report Prepared by the San Francisco Public Library Technology and Privacy Advisory Committee (October 2005) 76 pages http://www.sfpl.org/librarylocations/libtechcomm/RFID-and-SFPL-summary-report-oct2005.pdf

TABLE OF CONTENTS

Executive Summary

Committee History and Description

RFID and Public Libraries

Sample Questions Suitable for an RFI

Recommendations to the Library

RFID Resources

Appendix A: San Francisco Public Library - First Floor Remodel Progress Report. April 10, 2003.

Appendix B: Repetitive Stress Injuries (RSIs), A Presentation to the Library Commission

Appendix C: Vendors Consulted

Appendix D: California Polytechnic State University RFID Survey, Fall 2004

Appendix E: The Most Popular RFID Read Range Frequencies

Appendix F: American Library Association's Intellectual Freedom Committee’s (IFC) DRAFT

Guidelines on RFID Implementation

Wouldn't it be great to have copyright information as part of an item's metadata?

Karen Coyle makes the sensible proposal that we actually enter copyright information (e.g. copyright notice information) into the metadata when we digitize stuff from our library collections. 

This would help us all (especially users) when we see an image and then try to figure out the copyright status of the original item. Read more about her proposal in Descriptive metadata for copyright status in First Monday October 2005

Would this make a good CIPA-as-applied lawsuit?

I think so. If actually implemented as reported (unless the "capable" filters are turned off), the ACLU or others might take a look at filing a First Amendment as-applied challenge.

All library computers will soon have one of two filters: children's computers will have broad filters capable of blocking pornographic material as well as violent or hateful material. Adult computers will have narrower filters designed to block visually pornographic sites.

By Alison Shackelford, L.A. County libraries set porn limits on computer users October 13, 2005 Copley News Service

I understand the impulse to protect children from violent and hateful sites - but they have a right to such material, and in fact who decides what's hateful or violent?   Government prohibitions against violent video games, however well intended, fail once challenged in court. See July 17, 2004 LibraryLaw Blog post.

Query: How much information do libraries have about their wireless patrons?

Karen Coyle forwarded this question from Web4lib:

A patron wants to know if he used our wireless on our internet, would his computer then be subject to the same scrutiny under the Patriot Act as our library machines are? To expand this, can wireless interactions be tracked the same as in-library interactions?

Have any of you had to answer this question, or dealt with this issue in your library?  Any ideas, articles, etc. would be helpful.  I couldn't find much specifically on this issue.

Minow comment:  This question embraces a combination of legal and technical issues.  Legally, the Patriot Act and related measures do indeed make one's own laptop susceptible to a host of search, intercept, Sect 215, national security letters and other orders.  I've written a chart, with the orders I'm aware of. I'd like to put the chart into a wiki so it's easy to update, but I haven't quite figured out how. Patriot Act Sect 215 applies to "any entity," not just libraries.  In fact when it's labelled the "library provision" I am often curious as to why a multitude of others, particularly the press, haven't written about how it applies them as well.  Then there's the question as to who actually receives the order, and what information that entity has.  If a library serves as the ISP and gets an intercept or pen trap order, what information does it actually have on its wireless users?  Do libraries install keyloggers to trap every keystroke? 

As an aside, I know that if I go to an Internet cafe, someone can spoof the SSID and route all my keystrokes through their computer on the way to the net, with me none the wiser.  I also recently read that someone can audiotape my keystrokes and figure out with a high degree of certainty what  my keystrokes have been.

If you're someone who works with wireless services in libraries - please weigh in as to what user information your library sees.

Query: What identification is needed to establish residency?

I was just asked by a Florida librarian what identification is needed to establish residency to get a library card. Anyone know of any legal authorities on point for Florida or elsewhere?

Update: The answer is it's up to the locality. (I checked with the Florida State Library) - Mary

Congress Is Trying to Rein In Pseudo-Classification in the DHS

Classified documents are exempt from disclosure under the Freedom of Information Act. (FOIA). Another way to shelter agency documents from disclosure is by pseudo-classification: labeling documents that can’t actually be classified with “keep secret” titles. According to the nonpartisan Congressional Research Service’s report, “Sensitive But Unclassified” and Other Federal Security Controls on Scientific and Technical Information: History and Current Controversy:

The U.S. Government has always protected scientific and technical information that might compromise national security. Since the 2001 terrorist attacks, controls have been widened on access to information and scientific components that could threaten national security. The policy challenge is to balance science and security without compromising national security, scientific progress, and constitutional and statutory protections.

That balance has been hard to come by, as there is no overall statutory definition of "Sensitive but Unclassified" (SBU) or other "not classified" types of documents. The Department of Homeland Security (DHS) is one example; The Patriot Act required DHS to implement regulations regarding Sensitive Security Information (SSI), and it did so at 49 C.F.R 1520 et seq.The definitions of documents to be labeled  SSI is at 49 C.F.R. 1520.5, and the definitions are extremely broad. There are fifteen listed categories, and a final catchall category that can sweep in anything accidentally left out:

"Any information not otherwise described in this section that TSA determines is SSI under 49 U.S.C. 114(s) [anything detrimental to the security of transportation] or ... 49 U.S.C. 40119
[anything detrimental to transportation safety].Upon the request of another Federal agency,
TSA or the Secretary of DOT may designate as SSI information not otherwise described in this section."

Unlike classified documents, there are no consistent rules about what constitutes a document that is being “pseudo-classified.” There is no review agency. Since SBU has not been defined by statute, agencies have been left to their own devices to come up with definitions. Some examples include Sensitive But Unclassified (SBU), Sensitive Security Information (SSI), For Official Use Only (FOUO), and Controlled Unclassified Information (CUI). For a more detailed list of potential pseudo-classifications, see The Office of Security and Emergency Preparedness’s Manual Guide – Information Security.

Even the Heritage Foundation, a self-designated conservative think tank,is calling for consistency and oversight. The Foundation notes that "unclassified but security-relevant information" does not have a usable definition, a common understanding about how to control it, no agreement on the significance of the information for national security, and no means of adjudicating concerns about appropriate levels of protection. The Foundation issued a critical report in 2004, called DHS 2.0: Rethinking the Department of Homeland Security, and recommended that:

"There must be consistent policy and legislation that encourages the sharing of unclassified but security-relevant information between the private sector and the government. This policy must be sensitive to the public benefit of openness and should not necessarily remove information from public access."

Congress apparently agrees, and it is starting with DHS. The latest House Conference Report on H.R. 2360, The Department of Homeland Security Appropriations Act 2006, states the conferees concerns about insufficient management controls over SSI, and adds section 537 to the bill, requiring each office that creates SSI to have one officer to coordinate policy and provide guidance, and requires a yearly list of each and every document designated SSI to be provided to Congress starting in January 3, 2006.

Thanks to Secrecy News and the Federation of American Scientists for the tip about the Conference Report.