T H E C O M P U T E R LAW S E C U R I T Y R E P O R T
2 CLSR
In the light of this, the Data Protection Act 1984 is also relevant since there is a requirement to provide the appropriate confirmation of protection of personal data by means, perhaps, of the same mechanisms. Computer professionals can do much to safeguard themselves against accusations of a poorly controlled system, but work is really required by law reform organisations and other interested parties to improve upon existing law. Unlike the situation where it is possible to query a statement by an individual, it is just not practicable to examine all the intricacies of the computer operation. The actions of the IT industry must ensure that it will always be possible, by reference to documents and procedures, to conform to sensible legal requirements that take account of the pace of technological development. It must be pointed out, however, that the writer is not in the legal profession and the views expressed are those of a chartered engineer in the information technology industry. This topic will be pursued further by the writer but in the meantime any comments and/or experiences which readers of The Report might have would be of considerable interest. Please address them to:Tony Stayton-Davis, CCTA, CT4 Division, Room 606,
inadmissible as hearsay. The above was viewed in the light of the then current Police and Criminal Evidence Act of 1965 and the appeal was heard in early 1980. The Police and Criminal Evidence Act 1984 has since repealed the 1965 Act with new provisions on computer evidence. Civil Law In so far as civil cases are concerned, the statute which is relevant is the Civil Evidence Act 1968 and within the particular section there are four conditions to be satisfied. These are:1. That the document containing the statement was produced by the computer during a period over which the computer was used regularly to store or process information for the purposes of any activities regularly carried on over that period ....... 2. That over the period there was regularly supplied to the computer in the ordinary course of those activities, information of the kind contained in the statement or of the kind from which the information so contained is derived. 3. That throughout the material part of that period, the computer was operating properly or, if not that any respect in which it was not operating properly or was out of operation during that part of that period, was not such as to affect the production of the document or the accuracy of its content. 4. That the information contained in the statement reproduces or is derived from information supplied to the computer in the ordinary course of those activities. The above four requirements seem adequate, but one has only to consider the implications of the last two paragraphs to realise how impossible this task might be. In this age of transaction processing and networking, it is difficult to envisage how anyone could certify that the conditions of paragraphs 3 or 4 obtained in a case where substantial numbers of terminals were connected on-line to a network.
Riverwalk House, Millbank, LONDON SWlP 4RT (Tel: 01-217-3195, GTN 217-3195)
Tony Stayton-Davis, Advanced Technology and Telecommunications Division, Central Computer and Telecommunications Agency. This note first appeared in the April 1986 issue of CCTA News
o0o COPYRIGHT AND COMPUTER OUTPUT Revision of the Copyright Act 1956 was considered by the Whitford Committee which reported in 1977 and a Green Paper followed in 1981. A further Green Paper Intellectual Property Rights and Innovation (1983) took a more general view of the place of intellectual property in the national economy. The recently published White Paper Intellectual Property and Innovation follows up these earlier documents with proposals which will affect the law on patents, designs, and copyright as well as the structure of the Patent Office. A single Bill will include a consolidation of copyright legislation together with amendments to other Acts which are affected by the proposals. It seems likely that the Bill will be available within the next twelve months - perhaps even later this year.
Admissibility One of the problems which has barely emerged yet is that of the admissibility of evidence produced by "expert systems" which might be said to express opinions. In practice, the mechanism of confirming the computer processes back to the original document might well be further confused, not only by the interpretation put on the computer output by the computer software itself, but also by the difficulty of identifying a repeatable logical path through the inferences. Even if one takes conventional systems, there are undoubtedly still areas in both the hardware and software where it would be difficult to state accurately that there was no possibility of undetected errors occurring. The potential problems range from electrical interference, through damage on electromechanical sub-systems, to software problems in the operating systems, utilities and application programs. In both hardware and software terms, manufacturers always provide engineering changes to the former, and "patches" and new releases to cure "bugs" which have emerged in the latter. None of the above takes into account the intentional corruption or alteration of computer held data. The increasing incidence of "hacking" and the matching greater potential for it by means of microcomputers does not make the legal problem any easier.
Recent developments Changes in the law to take account of the impact of computer technology were suggested in both the Whitford Report and the 1981 Green Paper, but the world has moved on since then. Firstly, advances in technology have produced the personal computer, networking of large databases, and expert systems which are examples of concepts not even in the minds of those who gave evidence to the Whitford Committee. Secondly, the protection of computer programs by copyright is no longer a matter for debate. The Copyright (Computer Software) Amendment Act 1985 settled the issue and provided substantial penalties for copyright infringement. The Bill will retain these provisions and will also clarify two points on subsistence of copyright and reproduction of programs. However, the Bill will not include any specific provisions relating to works created by the use of computers.
Access control and audit trials Two additional disturbing facets of this topic are those of access control and audit trials. It is essential to have adequate facilities in both areas if there is to be any legal case based upon the output of information from computers. This problem becomes greater of course if microcomputers are used to provide evidence in courts since the likelihood of having either operator logs or audit trail software is that much less.
The problem of output Copyright law must be c~.pable of dealing with computer output as subject matter for protection, because a steadily 15
JULY - AUGUST
THE COMPUTER LAW AND SECURITY REPOPT
increasing proportion of all data output will be produced in this way. The application of copyright to computer output was overshadowed for some time by the activity in securing protection for programs, but the recent judgement of Mr Justice Whitford in the Express Newspapers case has redirected attention to some of the issues in this area. As an example of the possible complexity, consider a word processing system such as is widely used already for the generation of reports, books and newspapers. If such a system is connected to a telephone line to allow it to transmit and receive data, more than 300 public databases covering a variety of subject areas become available. It is technically possible for the user of the system to add selected information from several of these sources to his own information to generate a composite output. It has been argued that such a situation raises questions of authorship, ownership and susistence of copyright which cannot be answered under the present legislation. Let us examine the relationship between computer-generated output and what may be thought as more conventional examples of copyright works. The computer art itself can produce generalised statements unclouded by the differences in the copyright provisions and terminology of the various categories of copyright works such as literary, artistic, musical, broadcast etc.. One form of such a generalised statement is:An author provides input data, subjects that data to a transformation process and dervies output data in materia/ form from that process. The author wi// certainly use tools to record the output data in materia/ form and wi// frequently use tools in carrying out the process. As a first example of the application of the statement, consider the case of a writer who has a plot for a short story. The writer is the author and his input data is the plot because that is the information element which is unique to this situation. The process is the application by the writer of his knowledge of how to express ideas, describe scenes, etc. in the English language, and how to revise the edit successive versions to achieve the desired expression of the plot in story form. The output data is each and all of the versions of the story which the author has recorded on paper. The writer may have used a pen, or perhaps a typewriter, as the too/which enabled him to record the output data. He may also have used some too/s in the transformation process, such as a dictionary and some reference books. Given that the author is a "qualified person", then clearly copyright would subsist in the output data. Now let us change the tools without changing the statement. We will allow the writer to use a word processor instead of the typewriter because of the ease with which the process functions of revision and editing can be carried out. The word processor can also act as a dictionary to check the writer's spelling, change every occurrence of the hero's name, or provide a list of synonyms for a word which is not quite right. However, it will change or select a word only in response to the writer indicating his decision by pressing the appropriate keys. Thus, despite the apparent cleverness of the word processor, it is merely a more efficient tool than a simple manual typewriter for the writer to use in his generation of the copyright work. As another example, the author could be a photographer who is using a camera (a tool) to take a picture of a scene. He frames the picture using the viewfinder of the camera and sets the focus, aperture, and shutter speed to produce a suitably exposed film frame (output data). Alternatively, the camera could be controlled by the latest computer microchip, or by some more primitive technology, to give automatic
setting of focus, aperture or shutter speed. However, it is the photographer who uses his artistic skill and expetise to select the scene (input data), the view and the moment of exposure. Thus, it is clear that the camera is the tool not the master, and that pictures produced from that film frame fall within the normal provisions of copyright whether or not an automatic camera has been used.
Popular misconceptions Both the Green Paper and Mr Justice Whitford found no difficulty in accepting the concept of the computer system per se as a tool. However, it has been suggested that this concept still does not resolve problems in two areas. It is suggested that there may need to be joint ownership of copyright in the output by the programmer and by the operator or user of the computer system and that in some circumstances the computer may appear to be the author. I believe that the difficulty is created by taking a patent-like approach and treating the computer hardware and the programs which it runs as being separate integers operating in combination and that the answer is to be found in treating the computer as it is programmed at the time of use as being the tool. We must also take care not to fall into another trap in trying to solve the apparent problems raised in the Green Paper. If provisions are introduced into copyright law which treat computer-generated data differently from data generated in other ways, then it will be necessary to determine, in each case where tools have been used, whether or not the output data is computer-generated. For example, where in the continuum from the manual typewriter, through the word processor to the large mainframe computer is the dividing line to be sought? Is the picture produced by the automatic camera of the earlier example to be treated as computergenerated? How do we treat a computer which acts like a simple slide projector to display a predetermined sequence of frames? The examples are endless and in any case a definition of computer which is written today will surely be outdated in a few years. One does not create a comparable problem by treating computer software in a special way, simply because there is nothing which serves the equivalent purpose for noncomputer applications. Hence there is no dividing line to be drawn.
Advantages of tool-based approach A tool-based approach which allows an author to use whatever inanimate means he chooses to assist him in producing his copyright work has several benefits. Firstly, it means that an author will always have copyright in his output data if it results from his input data and meets the requirements of the Act as to subject matter, originality etc., regardless of what tools may have been used by him at any stage of producing that output data. Thus, the computer system will never be anything other than a tool and there will not be any situation in which it might be considered as itself generating copyright material. Nor will the programmer be an author of the output data, which is logically correct because he did not provide any of the input data. Secondly, the approach works equally well for any kind of tool, not just those which are clearly computers. If someone finds a method of using one of today's clever copying machines to generate a work, there will be no need for mental gymnastics to determine its copyright status, the well established tests will provide the answer. Thirdly, another issue has been the copyright status of a transient image on a computer display. Staying with conventional concepts, it is comparable with a projected film 16
T H E C O M P U T E R LAW S E C U R I T Y R E P O R T
2 CLSR
Conclusions
image on a screen. Since it is not fixed in any material form the computer image per se would not be protected by copyright. However, a recording of the data on magnetic media or a photographic film could be protected.
Finally, what conclusions does this analysis lead to in relation to the proposals in the White Paper? Firstly, the new Act should leave no doubt that the provisions on subsistence of copyright and on reproduction apply equally to software and to computer-generated, stored and processed data. The views expressed in Chapter 9 of the White Paper may have oversimplified the situation, so that the definitive wording in the Bill will require careful scrutiny. Secondly, two "for the avoidance of doubt clauses" would save much argument:(1) The use of a tool of any kind by an author in generating a copyright work does not affect the copyright status of that work in any way; (2) Subject to any agreement to the contrary, the legitimate user of computer-based copyright material owned by another party (programs, databases, records, etc.) may freely incorporate extracts of such material in his computergenerated output to an extent consistent with the basis on which he has obtained access to the material.
Pre-existing rights preserved Since the approach which I have proposed is based on conventional copyright principles, it does not remove any preexisting rights. Thus, the owner of a database may claim copyright in its data because he has created it himself or purchased the rights from other authors. The users of the database can access it only with his permission and he can licence the users subject to any restrictions which he considers to be reasonable. For example, it is quite common to have different subscription rates depending upon the extent to which the user wishes to disseminate extracts from the database. In a similar way, the copyright in the software is unaffected and can be licensed in the variety of ways which have become established. The user of a computer system may modify and adapt the licensed material of a database instead of merely selecting and incorporating parts of it in his output data. This may create a separate copyright in a manner similar to that which arises with conventional literary works, such as compilations. This does not appear to introduce any new problems.
John Cartwright, Consultant. Report Correspondent
US FOCUS Hackers' documentary
Wallace, the author of PC Write, pointed out that he has grossed over $250,000 from his "freeware". The program is a great history of micro computer evolution in the United States. Hopefully, it will be picked up by the BBC and shown in the UK before long.
Recently, the public broadcasting system in the US aired what I thought was a very interesting programme, entitled "Hackers - Wizards of the Electronic Age". The programme, a documentary on hackers, was essentially the video version of Steven Levy's book: Hackers. The program, like Levy's book, was the who's who of hacking with comments from: Steve Wozniak, co-founder of Apple Computers; John Draper, the famous "Captain Crunch", credited with inventing the blue box - a device used to bypass telephone billing systems; Richard Cheshire known in hacking circles as "Cheshire Catalyst"; Andrew Flugelman, the author of PC Talk; and many others. The programme did distinquish between the criminal hacker and the regular hacker. Richard Stallman, labelled the last "pure hacker", because he is still at MIT, the birthplace of hacking said hackers (the regular kind) are noted for their 'love of excellence in programming" and desire to do "neat things" with computers. The "hacker's ethic" was explained and discussed. The "hacker's ethic" is the concept there are no secrets on systems or programs - source is always available. This "ethic" was hotly debated by some of the authors of computer games, who equated their work with creating a work of art. Any changes to their program by another programmer would be like another artist changing the work of a fellow artist. However, out of the "hacker's ethic" came "freeware" or "shareware". "Freeware" or "shareware" is just what the name implies: free software. The software is distributed free but has a note, generally displayed when the program starts, asking you to send $10.00 or so to the author if you like and use the software. A number of "freeware" authors post their software on electronic bulletin boards and just wait for the satisfied users to mail in the cheques. Needless to say, there is quite a debate in the computer community surrounding this. One "freeware" author, Bob
This is work?? Currently, Gato, a World War II submarine-battle game has become the talk of the business world in the United States. It seems that the game manufacturer, Spectrum Holobyte, Inc. of Boulder Colo., put a fake spreadsheet in it. So if someone is around, instead of up periscope - - - it's up spreadsheet! Phillip G. Adam, Executive Vice President of Spectrum Holobyte recently told the Wall Street Journal that some customers thought they might want to play the game at work and could they turn off the sound from the game. Spectrum thought it might be a cute idea to put in a dummy spreadsheet. The spreadsheet "feature", while not documented in the manual, comes up as an option when you hit the "escape" key. It asks if you want to continue or " S " for spreadsheet. I had the opportunity to try the game and several of my associates tried it - ALL thought it was great. It was particularly popular in Accounting. I'm not advocating the playing of this at work, but I found it challenging and a pleasant diversion. If you like computer games, I highly recommend it. The game is available in the UK and Australia for $39.95 (US) and in France for $49.95 (FF). Distribution is being handled by Mirrorsoft in the UK, Imagineering in Australia, and Logitec in France.
RSA public keys inventors start own company The three authors of the RSA public key encryption system, who developed the system while teaching together at the Massachusetts Institute of Technology (MIT) in 1977, recently purchased the exclusive commercial rights to the RSA system from MIT. The three: Ronald Rivest, Professor of computer science at 17