Vous êtes sur la page 1sur 7

Peer-to-Peer File Sharing and Copyright Law: A Primer for Developers

by Fred von Lohmann


Senior Intellectual Property Attorney
Electronic Frontier Foundation
fred@eff.org

I. What this is, and who should read it II. Copyright Basics and the Intersection
with P2P File-sharing
The future of peer-to-peer file-sharing and
related technologies is entwined, for better or The nature of digital file-sharing technology
worse, with copyright law. If the early legal inevitably implicates copyright law. First, since
skirmishes yield any lesson for P2P developers, every digital file is “fixed” for purposes of
it is that an appreciation of the legal copyright law (whether on a hard drive, CD, or
environment should be part of any development merely in RAM), the files being shared
effort from the beginning, rather than bolted on generally qualify as copyrighted works. Second,
at the end. the transmission of a file from one person to
another results in a reproduction, a distribution,
This piece is meant as a general explanation
and possibly a public performance (in the world
of the U.S. copyright law principles most
of copyright law, “public performance” includes
relevant to P2P file-sharing technologies. It is
the act of transmitting a copyrighted work to the
aimed primarily at:
public). To a copyright lawyer, every
• Developers of core P2P file-sharing unauthorized reproduction, distribution, and
technology, such as the underlying public performance requires an explanation, and
protocols, platform tools, and specific client thus file-sharing systems seem suspicious from
implementations; and the outset.
• Developers of ancillary services that depend A. The end-users: “direct” infringement.
upon or add value to P2P file-sharing
For the end-users who are sharing files, the
networks, such as providers of search,
question becomes whether the reproductions,
security, metadata aggregation, and other
distributions, and public performances are
services.
authorized by the copyright owner or otherwise
This paper is aimed not at giving you all the permitted under copyright law (as “fair use” for
answers, but rather at allowing you to recognize example). If not, the end-users are what
the right questions to ask.1 copyright lawyers call “direct infringers”—they
have directly violated one or more of the
What this is not: The following discussion
focuses only on U.S. copyright law. While non- copyright owner’s exclusive rights.
copyright principles may also be mentioned, this In a widely-used public peer-to-peer file-
discussion does not attempt to examine other sharing environment, it is a virtual certainty that
legal principles that might apply to P2P file- at least some end-users are engaged in infringing
sharing, including patent, trademark, trade activity (unless specific technical measures are
secret, or unfair competition. Nothing contained taken to prevent this, like permitting only the
herein constitutes legal advice—please discuss sharing of files that have been cryptographically
your individual situation with your own marked as “authorized”).
attorney.
B. The P2P tool maker: “contributory”
and “vicarious” infringement
But what does this have to do with those
who develop and distribute peer-to-peer file-
sharing tools? After all, in a pure peer-to-peer
1
A longer version of this paper, updated from time to file-sharing network, the developer of the file-
time, is available at www.eff.org.
sharing tool has no direct involvement in the “site and facilities” that make the direct
discovery, copying or transmission of the files infringement possible can be enough.
being shared.
2. Vicarious Infringement
Copyright law, however, sometimes reaches
Vicarious infringement is derived from the
beyond the direct infringer to those who were
same legal principle that holds an employer
only indirectly involved. As in many other areas
responsible for the actions of its employees. A
of the law (think of the “wheel man” in a stick
person will be liable for vicarious infringement
up, or supplying a gun to someone you know is
if he has the right and ability to supervise the
going to commit a crime), copyright law will
direct infringer and also has a direct financial
sometimes hold one individual accountable for
interest in his activities. Thus, in order to prevail
the actions of another. So, for example, if a
on a vicarious infringement theory, a copyright
swapmeet owner rents space to a vendor with
owner must prove each of the following:
the knowledge that the vendor sells counterfeit
CDs, the swapmeet owner can be held liable for Direct Infringement: There has been a
infringement alongside the vendor. direct infringement by someone.
This indirect, or “secondary,” liability can Right and Ability to Control: The accused
take two distinct forms: contributory and vicarious infringer had the right and ability
vicarious. to control or supervise the underlying direct
infringement. This element does not set a
1. Contributory Infringement
high hurdle. For example, the Napster court
Contributory infringement is similar to found that the ability to terminate user
“aiding and abetting” liability: “one who, with accounts or block user access to the system
knowledge of the infringing activity, induces, was enough to constitute “control.”
causes, or materially contributes to the
Direct Financial Benefit: The accused
infringing conduct of another, may be held liable
vicarious infringer derived a “direct
as a contributory infringer.” In order to prevail
financial benefit” from the underlying direct
on a contributory infringement theory, a
infringement. In applying this rule, however,
copyright owner must prove:
the courts have not insisted that the benefit
Direct Infringement: There has been a be especially “direct” or “financial”—almost
direct infringement by someone. any benefit seems to be enough. For
example, the Napster court found that
Knowledge: The accused contributory
“financial benefit exists where the
infringer knew of the underlying direct
availability of infringing material acts as a
infringement. This element can be satisfied
draw for customers” and the growing user
by showing either that the contributory
base, in turn, makes the company more
infringer actually knew about the infringing
attractive to investors.
activity, or that he reasonably should have
known given all the facts and circumstances. The nature of vicarious infringement
At a minimum, however, the contributory liability creates a strong incentive to monitor the
infringer must have some specific conduct of users. This stems from the fact that
information about infringing activity—the knowledge is not required for vicarious
mere fact that the system is capable of being infringement liability—a person can be a
used for infringement, by itself, is not vicarious infringer even if they are completely
enough. unaware of infringing activity.
Material Contribution: The accused In other words, if you exercise control over
contributory infringer induced, caused, or your users and derive a benefit from their
materially contributed to the underlying activities, you remain ignorant of their conduct
direct infringement. Merely providing the at your own risk.

P2P and Copyright Law


Presented at IPTPS ‘03 (Feb. 2003) 2
III. Potential Defenses to Contributory “substantial noninfringing uses” for your service
and Vicarious Liability is irrelevant.
A. No Direct Infringer: “All of My Users Moreover, the Napster court concluded that
are Innocent” the Betamax defense may only apply until the
copyright owner notifies you regarding specific
If there is no direct infringement, there can
infringing activity by end-users. At that point, a
be no indirect liability. Consequently, if a peer-
failure to act to prevent further infringing
to-peer developer can plausibly claim that no
activity will give rise to liability, and the
users in the network are sharing copyrighted
existence of “substantial noninfringing uses”
works without authorization, this would be a
becomes irrelevant.
complete defense to any contributory or
vicarious infringement claims. The “Betamax defense” has also come under
attack in the Aimster case, where a court stated
Unfortunately, this may be extremely
that the defense was not available where the
difficult to demonstrate, given the decentralized
technology is primarily used for infringement.
nature of most P2P networks and the wide
(This notwithstanding the fact that the
variety of uses to which they may be put. It will
“proportion of uses” test was explicitly rejected
likely be difficult to show that every user is
in the Supreme Court’s Betamax ruling.) The
innocent. Nevertheless, in certain specialized
scope of the “Betamax defense” is also at the
networks that permit the sharing of only secure,
heart of the case against Kazaa, Morpheus and
authorized file types, this may be a viable
Grokster, currently pending in Los Angeles.
defense.
The recent court interpretations of the
B. The Betamax Defense: “Capable of
“Betamax defense” have at least two important
substantial noninfringing uses”
implications for P2P developers. First, it
Holding technology developers responsible underscores the threat of vicarious liability—at
for the unlawful acts of end-users obviously can least in the Ninth Circuit, a court will not be
impose a crushing legal burden on those who interested in hearing about your “substantial
make general-purpose tools. Fortunately, the noninfringing uses” if you are accused of
Supreme Court has defined an outer limit to vicarious infringement. Accordingly, “control”
copyright’s indirect liability theories. and “direct financial benefit,” as described
above, should be given a wide berth.
In a case involving the Sony Betamax VCR,
the Supreme Court found that contributory This will likely reduce the attractiveness of
infringement liability could not reach the business models built on an on-going “service”
manufacturer of a device that is “capable of or “community-building” model, to the extent
substantial noninfringing use.” In that case, the that these models allow the provider to control
Court found that the VCR was capable of user activity (i.e., terminate or block users) and
several noninfringing uses, including the time- create value by attracting a large user base.
shifting of television broadcasts by home
Second, with respect to contributory
viewers. In the Court’s view, it does not matter
infringement, the recent interpretations of the
what proportion of the uses are noninfringing,
Betamax defense suggest that, once you receive
only whether the technology is “capable” of
specific notices from copyright owners about
substantial noninfringing uses.
infringing activities, your “substantial
Unfortunately, the “Betamax defense” has noninfringing uses” may no longer serve as a
been under sustained legal attack in the cases complete shield to contributory liability. The
involving P2P technology. In the Napster case, risk then arises that a developer may have a legal
the court found that this defense does not apply duty to “do something” about the infringing
at all to vicarious liability. Accordingly, if you activities.
have control over, and derive a financial benefit
But what “something” must be done? The
from, direct infringement, the existence of
Napster decision recognizes that the ability to

P2P and Copyright Law


Presented at IPTPS ‘03 (Feb. 2003) 3
respond to these notices may be limited by the In the final analysis, qualifying for any of
technology behind the challenged service or the DMCA safe harbors requires careful
product. In cases involving decentralized P2P attention to the legal and technical requirements
networks, there may be nothing a software and obligations that the statute imposes. Any
developer can do to stop future infringements P2P developer who intends to rely on them
(just as Xerox cannot control what a photocopier should seek qualified legal counsel at an early
is used for after it is sold). stage of the development process—an after-the-
fact effort to comply is likely to fail (as it did for
Nevertheless, copyright owners are arguing
Napster).
that technologists should have a duty to redesign
technologies once they are put on notice
IV. Lessons and Guidelines for P2P
regarding infringing end-users. What this might
Developers
entail is difficult to predict, but may include, in
some cases, modification of the architecture and Because the relevant legal principles are in
capabilities of the tool, service or system. flux, these guidelines represent merely one,
general analysis of the legal landscape—please
The exact contours of the Betamax defense
consult with an attorney regarding your
are still being developed in the courts, some of
particular situation.
which seem to have embraced conflicting
interpretations. Breaking developments on this A. Make and store no copies.
front may have important ramifications for P2P This one may be obvious, but remember that
developers and should be closely monitored.
if you make or distribute any copies (even if
C. DMCA Section 512 “safe harbors” only in RAM) of copyrighted works, you may be
held liable as a direct infringer. The court will
In 1998, Congress enacted a number of
not be interested in “control” or “knowledge” or
narrow “safe harbors” for copyright liability.
“financial benefit” or “material contribution.” If
These safe harbors appear in section 512 of the
you made or transmitted copies, you’re probably
Copyright Act (see 17 U.S.C. § 512). These safe
liable for infringement.
harbors apply only to “online service providers,”
and only to the extent that the infringement Of course, this shouldn’t be a problem for
involves four functions: (1) transitory network most P2P developers, since the great insight of
transmissions; (2) certain kinds of caching; (3) peer-to-peer architectures is that the actual
storage of materials on behalf of users (e.g., web resources being shared need not pass through
hosting, remote file storage); and (4) the any central server. Nevertheless, be careful
provision of information location tools (e.g., where caching or similar activities are
providing links, directories, search engines). concerned.
Because Congress did not anticipate P2P B. Your two options: total control or
when it enacted the safe harbors, many P2P total anarchy.
products may not fit within the four enumerated In the wake of recent decisions on indirect
functions. For example, according to an early
copyright liability, it appears that copyright law
ruling by the district court in the Napster case, has foisted a binary choice on P2P developers:
an OSP cannot use the “transitory network either build a system that allows for thorough
transmission” safe harbor unless the traffic in
monitoring and control over user activities, or
question passes through its own private network. build one that makes such monitoring and
Many P2P products will, by their very nature, control completely impossible.
flunk this requirement, just as Napster did.
Contributory infringement requires that you
In addition to being limited to certain
have “knowledge” of, and “materially
narrowly-circumscribed functions, the safe contribute” to, someone else’s infringing
harbors are only available to entities that comply activity. In most cases, it will be difficult to
with a number of complex, interlocking statutory
avoid “material contribution”—after all, if your
requirements.

P2P and Copyright Law


Presented at IPTPS ‘03 (Feb. 2003) 4
system adds any value to the user experience, a wise to either incorporate mechanisms that make
court may conclude that you have “materially it easy to monitor and block infringing users, or
contributed” to any infringing user activities. choose an architecture that will convince a judge
that monitoring and blocking is impossible.
So the chief battleground for contributory
infringement will likely be the “knowledge” C. Better to sell stand-alone software
issue. The applicable legal standards on this products than on-going services.
question are still very much in dispute
Vicarious liability is perhaps the most
—especially as relates to the “Betamax defense.”
serious risk facing P2P developers. Having the
The Napster court’s analysis suggests that once
power to terminate or block users constitutes
you receive notice that your system is being
enough “control” to justify imposing vicarious
used for infringing activity (e.g., a “cease and
liability. Add “financial benefit” in the form of a
desist” letter from a copyright owner), you have
business model that depends on a large user
a duty to “do something” to stop it.
base, and you’re well on your way to joining
What might that “something” be? Well, it Napster as a vicarious infringer. This is true
should be limited by the architecture of your even if you are completely unaware of what
system, but may ultimately be decided by a your users are up to—the pairing of “control”
court. So, in order to avoid the unpleasant and “financial benefit” are enough.
surprise of a court telling you to re-engineer
Of course, most “service” business models
your technology to stop your infringing users,
fit this “control” and “benefit” paradigm. What
you can either include mechanisms that enable
this means is that, after the Napster decision, if
monitoring and control of user activities (and
you offer a “service,” you may have to monitor
use them to stop allegedly infringing activity
your users if you want to escape liability. If you
when you receive complaints), or choose an
want to avoid monitoring obligations, you’ll
architecture that will convince a judge that such
have to give up on “control.”
monitoring and control is impossible. (Copyright
owners have begun arguing that you must at Vendors of stand-alone software products
least redesign future versions of your software to may be in a better position to resist monitoring
prevent infringement. This remarkable argument obligations and vicarious infringement liability.
has not yet been accepted by any court.) After Sony sells a VCR, it has no control over
what the end-user does with it. Neither do the
The Napster court’s vicarious liability
makers of photocopiers, optical scanners, or
analysis also counsels for either a total control or
audio cassette recorders. Having built a device
total anarchy approach. Vicarious liability
with many uses, only some of which may
requires that you “control,” and receive
infringe copyrights, the typical electronics
“benefit” from, someone else’s infringing
manufacturer has no way to “terminate” end-
activity. The “benefit” element will be difficult
users or “block” their ability to use the device.
to resist in many P2P cases (at least for
The key here is to let go of any control you may
commercial products)—so long as the software
have over your users—no remote kill switch,
permits or enables the sharing of infringing
automatic updates feature, contractual
materials, this will serve as a “draw” for users,
termination rights, or other similar mechanisms.
which can be enough “benefit” to result in
liability. D. Can you plausibly deny knowing what
your end-users are up to?
So the fight will likely center on the
“control” element. The Napster court found that Assuming that you have escaped vicarious
the right to block a user’s access to the service infringement by eliminating “control” or
was enough to constitute “control.” The court “financial benefit,” there is still the danger of
also found that Napster had a duty to monitor the contributory infringement. To avoid liability
activities of its users “to the fullest extent” here, you will need to address whether you
possible. Accordingly, in order to avoid knew, or should have known, of the infringing
vicarious liability, a P2P developer would be activity of your users.

P2P and Copyright Law


Presented at IPTPS ‘03 (Feb. 2003) 5
Have you built a level of “plausible creation of an open set of protocols, combined
deniability” into your product architecture and with a competitive mix of interoperable, but
business model? If you promote, endorse, or distinct, applications is probably a good idea
facilitate the use of your product for infringing from a product-engineering point of view.
activity, you’re asking for trouble. Similarly,
This approach may also have legal
software that sends back usage reports may lead
advantages. If Sony had not only manufactured
to more knowledge than you want. Customer
VCRs, but also sold all the blank video tape,
support channels can also create bad
distributed all the TV Guides, and sponsored
“knowledge” facts. Instead, talk up all the great
clubs and swap meets for VCR users, the
legitimate capabilities, sell it (or give it away),
Betamax case might have turned out differently.
and then leave the users alone. Again, your
Part of Napster’s downfall was its combination
choices are total control, or total anarchy.
of indexing, searching, and file sharing in a
E. What are your substantial single piece of software. If each activity is
noninfringing uses? handled by a different product and vendor, on
the other hand, each entity may have a better
If your product is intended to work solely
legal defense to a charge of infringement.
(or best) as a mechanism for copyright piracy,
you’re asking for legal trouble. More A disaggregated model, moreover, may limit
importantly, you’re thinking too small. Almost what a court can order you to do to stop
all peer-to-peer systems can be used for many infringing activity by your users. As the Napster
different purposes, some of which the creators court recognized, you can only be ordered to
themselves fail to appreciate. police your own “premises”—the smaller it is,
the less you can be required to do.
So create a platform that lends itself to many
uses. Actively, sincerely, and enthusiastically Finally, certain functions may be entitled to
promote the noninfringing uses of your product. special protections under the “safe harbor”
Gather testimonials from noninfringing users. provisions of the Digital Millennium Copyright
The existence of real, substantial noninfringing Act (“DMCA”). Search engines, for example,
uses will increase the chances that you can enjoy special DMCA protections. Thus, the
invoke the “Betamax defense” if challenged in combination of a P2P file sharing application
court. with a third party search engine might be easier
to defend in court than Napster’s integrated
F. Do not promote infringing uses.
solution.
Do not promote any infringing uses. Be
H. Don’t make your money from the
particularly careful with marketing materials and
infringing activities of your users.
screenshot illustrations—entertainment company
attorneys are very good at making hay out of the Avoid business models that rely on revenue
fact that Beatles songs were included in sample streams that can be directly traced to infringing
screenshots included in marketing materials or activities. For example, a P2P file-sharing
documentation. Have an attorney review these system that includes a payment mechanism
materials closely. might pose problems, if the system vendor takes
a percentage cut of all payments, including
G. Disaggregate functions.
payments generated from sales of bootleg Divx
Separate different functions and concentrate movie files.
your efforts on a discrete area. In order to be
I. Give up the EULA
successful, peer-to-peer networks will require
products to address numerous functional Although end-user license agreements
needs—search, namespace management, (“EULAs”) are ubiquitous in the software world,
security, dynamic file redistribution—to take a copyright owners have used them in P2P cases
few examples. There’s no reason why one entity to establish “control” for vicarious liability
should try to do all of these things. In fact, the purposes. On this view, EULAs represent

P2P and Copyright Law


Presented at IPTPS ‘03 (Feb. 2003) 6
“contracts” between vendors and their users, and your staff out of it. (This will be easier if you are
thus give software vendors legal control over open source, of course.)
end-user activities. EULAs that permit a vendor
L. Be open source.
to terminate at any time for any reason may raise
particular concerns, insofar as they leave the In addition to the usual litany of arguments
impression that a vendor has the legal right to favoring the open-source model, the open source
stop users from using the software. approach may offer special advantages in the
peer-to-peer realm. It may be more difficult for a
P2P software vendors should consider
copyright owner to demonstrate “control” or
distributing their code without a EULA. Even
“financial benefit” with respect to an open
without a EULA, a software developer retains
source product. After all, anyone can download
all of the protections of copyright law to prevent
and compile open source code, and no one has
unauthorized duplication and modifications.
the ability to “terminate” or “block access” or
J. No “auto-updates” otherwise control the use of the resulting
applications.
Stay away from any “auto-update” features
that permit you to automatically patch, update, “Financial benefit” may also be a
or otherwise modify software on the end-user’s problematic concept where the developers do
machine. Copyright owners have argued that not directly realize any financial gains from the
these features establish “control” for vicarious code (as noted above, however, the Napster
liability purposes (on the theory that you can court has embraced a very broad notion of
always “update” software to prevent its use for “financial benefit,” so this may not be enough to
infringement, by retrofitting acoustic filtering, save you). Finally, by making the most legally
for example). dangerous elements of the P2P network open
source (or relying on the open source projects of
At a minimum, users should always retain
others), you can build your business out of more
the ability to decline any update. Control should
legally defensible ancillary services (such as
rest in the end-user’s hands, not the software
search services, bandwidth enhancement, file
vendor’s (this as much for security reasons as
storage, file meta-data services, etc.).
legal reasons).
K. No customer support.
Any evidence that you have knowingly ***
assisted an end-user in committing copyright References:
infringement will be used against you. In the
A&M Records, Inc. v. Napster, Inc., 239 F.3d
P2P cases so far, one source for this kind of
1004 (9th Cir. 2001).
evidence is from customer support channels,
whether message board traffic or email. A user A&M Records, Inc. v. Napster, Inc., 2000 WL
writes in, explaining that the software acted 573136 (N.D. Cal. May 12, 2000) (ruling on
strangely when he tried to download The Matrix. DMCA 512 safe harbor).
If you answer him, copyright owners will make
In re Aimster Copyright Litigation, 2002 WL
it seem that you directly assisted the user in
31006142 (N.D. Ill. Sept. 4, 2002) (granting
infringement, potentially complicating your
preliminary injunction against Aimster).
contributory infringement defense.
MGM v. Grokster (Kazaa/Morpheus/Grokster)
Even if you read the message but don’t
summary judgment briefs:
answer, or answer in a general FAQ, copyright
http://www.eff.org/IP/P2P/MGM_v_Grokster/
owners may argue that support requests were
enough to create “knowledge” of infringing
activities.
So let the user community support
themselves in whatever forums they like. Keep

P2P and Copyright Law


Presented at IPTPS ‘03 (Feb. 2003) 7