LIBRARY OF CONGRESS UNITED STATES COPYRIGHT OFFICE Comment of Association of Global Automakers, Inc. Regarding Exemption for Proposed Class 22 From Liability Under 17 U.S.C. 1201 Docket No. 2014-07 Submitted by Of Counsel Ellen J. Gleberman Vice President & General Counsel Association of Global Automakers, Inc. 1050 K Street, NW, Suite 650 Washington, DC 20001 egleberman@globalautomakers.org Susan B. Flohr David M. Perry Shaun J. Bockert Blank Rome LLP Watergate 600 New Hampshire Avenue Washington, DC 20037 Flohr@blankrome.com Association of Global Automakers, Inc. The Association of Global Automakers represents international motor vehicle manufacturers, original equipment suppliers, and other automotive-related trade associations. Our members include: American Honda Motor Co., Aston Martin Lagonda of North America, Inc., Ferrari North America, Inc., Hyundai Motor America, Isuzu Motors America, Inc., Kia Motors America, Inc., Maserati North America, Inc., McLaren Automotive Ltd., Nissan North America, Inc., Subaru of America, Inc., Suzuki Motor of America, Inc., Toyota Motor North America, Inc., ADVICS North America, Inc., Delphi Corporation, Denso International America, Inc., Robert Bosch Corporation and Sirius XM Radio, Inc. We work with industry leaders, legislators, and regulators in the United States to create public policies that improve motor vehicle safety, encourage technological innovation, and protect our planet. Our goal is to foster an open and competitive automotive marketplace that encourages investment, job growth, and development of vehicles that can enhance Americans’ quality of life. For more information, visit www.globalautomakers.org. The Association of Global Automakers respectfully asks the Librarian of Congress not to exempt the following class of works from the prohibition on circumvention of technological protection measures under 17 U.S.C. § 1201(a)(1): Proposed Class 22: (Vehicle Software – Security and Safety Research) Computer programs that control the functioning of a motorized land vehicle for the purpose of researching the security or safety of such vehicles. 1 I. Overview As part of the sixth triennial rulemaking proceeding under the Digital Millennium Copyright Act (“DMCA”), the United States Copyright Office (“Copyright Office”) requests comment on the proposal that persons who circumvent technological protection measures that control access to vehicle software be exempt from liability under Section 1201(a)(1), so long as that circumvention is in the interest of researching the security or safety of automobiles. The exemption should be denied for the reasons more fully set forth herein, all of which essentially stem from the fact that automotive software is unlike any other copyrighted work subject to such a proposed exemption. Permitting unauthorized access to automotive software is likely to have uniquely long-lasting and far-reaching, harmful effects. Accordingly, Global Automakers respectfully submits that automotive software (and those who gain unauthorized access to it) should not receive special treatment under Section 1201(a)(1). Restricting access to automotive software benefits the public. First, it ensures that the automobiles on our streets comply with the many regulatory standards governing motor vehicles, including those addressing safety, security, and environmental wellness. Second, it allows automobile manufacturers and suppliers to protect their valuable copyrights and encourages them to continuously invest in new and innovative software to improve automotive safety, security, and environmental functions. Proponents of the exemption have not justified the loss of these public benefits and have failed to carry their burden to prove that the proposed uses are non-infringing. The unauthorized modification of or “tinkering” with automotive software is not fair use under 17 U.S.C. § 107, nor is it “repair” or “maintenance” under 17 U.S.C. § 117. Such “tinkering” is, on the contrary, a violation of automotive software owners’ exclusive rights under 17 U.S.C. § 106. These owners should be free to use all legal and technological precautions available to prevent infringement. Otherwise, we put at significant risk the public benefits described above, including the safety, security, and environmental standards achieved through vehicle software. Automobile manufacturers are not adverse to external input and have a long and symbiotic history with aftermarket businesses and others, but are justifiably unwilling to risk public safety, security, and environmental wellness by compromising quality controls and oversight. Moreover, the exemption is unnecessary given that automobile manufacturers already provide access to their valuable copyrighted materials for the precise purposes proposed. By allowing every automobile owner to access and copy automotive software in the name of research, the proposed exemption undermines existing research efforts and, ultimately, wrests control of such research from those in the best position to actually improve the security and safety of our automobiles: the automobile manufacturers and their suppliers, who have the utmost responsibility to ensure that vehicles are safe and secure. The very real risk that ostensibly legitimate research unwittingly undermines vehicle security by serving as a guidebook to software vulnerabilities that enables or even accelerates illicit hacking and malicious modifications to automotive software weighs heavily against the proposed exemption. The balance of benefit versus detriment, in view of all factors involved, simply dictates against the proposed exemption. 2 In short, the Librarian of Congress should not exempt Proposed Class 22 from liability under Section 1201(a)(1), as doing so unnecessarily and imprudently risks the safety and security of the public and the environment and threatens the efficacy of existing research efforts. II. Restricting Access to Automotive Software Benefits the Public Modern automobiles are typically comprised of a series of Electronic Control Units (ECUs) that are connected through a Control Area Network (CAN) to monitor and control the functionality of vehicle systems. These systems contain millions of lines of code designed to ensure that the vehicle functions as intended. Given the interdependence between software modules that exist in the various ECUs, a change in one part of the system may result in entirely unknown or unintended consequences in another. For example, crash avoidance systems such as crash imminent braking, or lane keeping assist rely on data from vehicle sensors as well as data from other ECUs to determine appropriate braking force for reducing the severity or occurrence of a crash. In addition, the calibrations for the individual ECUs are vehicle-specific. Because calibration factors several unique automotive properties, specific to each vehicle, the process demands in-depth product knowledge. Any modifications that are made by parties other than the appropriate internal engineers, using the specific calibrations equipment, could negatively affect the vehicle and/or its operation. The proper functioning of these systems is critical to public safety and security, as well as environmental wellness. In short, these systems are integral to a modern automobile’s compliance with the many standards and regulations protecting the public and the environment. From the latches on hoods1 to the exhaust emitted through tailpipes,2 automobiles and, in turn, automobile manufacturers are subject to a host of rules, regulations, and standards. Because automotive software is crucial to functions bumper-to-bumper, including regulated functions, automobile manufacturers invest a great deal of authorship and financial resources in the efficacy and reliability of automotive software. Their reputations – indeed, their livelihoods – depend on it. In order to secure continued regulatory compliance and protect investments, some automobile manufacturers restrict access to automotive software, and the underlying source code, to only those vetted and authorized licensees who are contractually bound to comply with quality controls and permit oversight. Indeed, the Clean Air Act specifically recognizes the threat to public welfare resulting from unauthorized modifications by prohibiting tampering with any automotive device in an automobile for sale that is designed to maintain compliance with emissions standards.3 These sorts of restrictions on “tinkering” ultimately benefit vehicle owners and the public by ensuring that automobiles continue to comply with safety and security regulations and standards. Automobile manufacturers and their suppliers best understand the interdependence of automotive software systems and are in the best position to know when a modification, regardless of how slight, would disrupt another system. At the same time, however, the creation of an open field of modifying automotive software risks grave, uncontrolled, and untraceable tampering. After all, research is not undertaken in a vacuum, but for the ultimate 1 Federal Motor Vehicle Safety Standard (FMVSS) No. 113. Control of Air Pollution From Motor Vehicles: Emission and Fuel Standards, 79 Fed. Reg. 23,414 (April 28, 2014). 3 42 U.S.C. § 7522(a)(3). 2 3 goal of implementing findings. In addition, such modifications would raise grave concerns as to the traceability of changes and could result in a disconnect between the manufacturing data and that which is actually included in the ECU software. Intentions aside, even well-meaning research and slight modifications in the name of security could cause entire systems to malfunction. By limiting access to qualified licensees, automobile manufacturers protect the public and the environment, as well as their reputations, by certifying compliance and fostering an environment where security research can be carried out in a reasonably defined, unified environment. III. The Proposed Exemption Promotes Infringement, Not Non-Infringing Uses Proponents bear the burden of establishing the need for the proposed exemption.4 Accordingly, they must show, by a “preponderance of the evidence,” 5 that “the proposed use is likely to qualify as noninfringing under relevant law.”6 Proponents of exempting Proposed Class 22 from liability under Section 1201(a)(1) proffer that accessing automotive software for the purposes of researching the security and safety of automobiles are both fair uses under Section 1077 and noninfringing uses of computer programs under Section 117.8 The proposed uses, however, are neither noninfringing fair uses under Section 107 nor noninfringing under Section 117. They are, instead, infringements of the exclusive rights granted to copyright owners under Section 106. A. The Proposed Uses are not Fair Uses Under Section 107 Section 107 provides that certain uses of copyrighted content, namely, “fair uses,” do not infringe the exclusive rights of copyright owners. The sets forth four nonexclusive considerations for determining whether a use is fair, none of which, as discussed below, support a claim of fair use.9 Purpose and Nature of Proposed Uses The purpose and character of the proposed uses are to access copyrighted content, outside copyright owners’ established research programs and protocol, for the purported purpose of researching the safety and security of automobiles. To wit, the proposed exemption does not even clarify whether the proposed uses seek to improve the security and safety of automobiles, meaning even those that intentionally seek to impede safety and security would qualify for the exemption. Even if research resulted in asserted improvements to be made on the software, the complex environment in which automobile software resides – a web of legal, regulatory, safety, environmental, and other standards – suggests little utility could ever result from unbridled, 4 Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies, Notice of Inquiry, 79 Fed. Reg. 55,687, 55,689 (Sept. 17, 2014) (“Those who seek an exemption from the prohibition on circumvention bear the burden of establishing that the requirements for granting an exemption have been satisfied.”) 5 Id. 6 Id, at 55,690. 7 See, e.g., Petition of Electronic Frontier Foundation, In the matter of Exemption to Prohibition of Copyright Protection Systems for Access Control Technologies, Docket 2014-07, pp. 3-5. 8 See, e.g., Petition of Electronic Frontier Foundation, In the matter of Exemption to Prohibition of Copyright Protection Systems for Access Control Technologies, Docket 2014-07, p. 5. 9 17 U.S.C. § 107. 4 private actions under the proposed exemption. Section 107, and fair use principles generally, is intended to promote public welfare, an aim hampered by the proposed exemption. Nature of Copyrightable Work Automotive software is, by nature, copyrightable content. The mere fact that automotive software has practical uses does not negate automobile manufacturers’ and suppliers’ rights to protect access to, or to prevent others from using that content.10 As copyright owners, automobile manufacturers are not unlike other owners of different categories of copyright works, and must not be assailed for seeking to protect competitive advantages arising from those works. Allowing public access to the source code would negatively impact the business model of suppliers within the automotive industry and stifle innovation. Amount and Substantiality of the Portion Copied The proposed uses copy the bulk, if not the entirety, of the copyrighted work. In order to research and analyze automotive software, the copier must access and use a substantial amount of the copyrighted software. Because the “heart,” if not the entirety, of the copyrighted work will be used and copied, the amount and substantiality of the portion copied strongly indicates that the proposed uses are not fair.11 Impact on Marketplace for Copied Work Automobile manufacturers constantly seek to improve the safety and security of automobiles, including through improvements of automotive software. Not only do automobile manufacturers have internal research programs serving this aim, but they regularly share their proprietary materials with vetted third parties who share a similar interest in promoting the safety and security of the automobiles on our streets. For example, Toyota Motor Engineering & Manufacturing North America, Inc. operates the Collaborative Research Center, which works with various third party partners – including many universities, hospitals, and other research institutions – to advance automotive safety in North America.12 Similarly, Honda R&D Americas, Inc. operates Honda Developer Studio, which provides independent software developers access to Honda’s engineers and test vehicles to improve the reliability and efficacy of information technologies.13 These are only two examples of several such initiatives in the industry, each of which depends on the participation and investment of automobile manufacturers, who not only understand the urgency of the safety and security of our automobiles, but are also in the best position to know how to safely implement design proposals without impairing other aspects of automotive functions. Again, given the interdependence of automotive computer systems, even seemingly small modifications to automotive software, developed with the best of intentions, require a holistic knowledge of a particular automobile. Accordingly, safely implementing the results of this research requires the participation of automobile manufacturers, who, as stated 10 See, e.g., Nuñez v. Caribbean International News, Corp., 235 F.3d 18, 23 (1st Cir. 2000) (“[T]he impact of … creativity on the fair use finding is neutral.”) 11 See, e.g., Harper & Row v. Nation Enterprises, 471 U.S. 539 (1985) (holding that a substantial portion of a work was copied because the copied excerpt was the “heart” of the work). 12 Collaborative Safety Research Center, Toyota (March 22, 2015), http://www.toyota.com/csrc/. 13 Honda Developer Studio, Honda (March 22, 2015), https://developer.hondasvl.com/. 5 above, are well under way with their own internal and external research programs. Declaring the proposed uses fair uses would entirely damage and disrupt these programs, likely for little gain. B. The Proposed Uses are not Noninfringing Under Section 117 Section 117 provides specific exceptions to the exclusive rights of software copyright owners. Specifically, the owner of a copy of a software program is permitted to copy or adapt that program if the new copy or adaptation is an “essential step” in the utilization of the program in conjunction with a machine.14 The Section further provides that it is not infringement to copy a software program for purposes of maintenance or repair of a machine, if that machine contains an authorized copy of that program and the copy is made “solely by virtue of the activation” of the machine15 – where “maintenance” and “repair” are defined as the servicing or restoring of the machine to “work in accordance with its original specifications.”16 The proposed uses do not qualify for any of these exemptions. Contrary to the contention of proponents of the exemption, 17 copying software for research purposes is simply not addressed in Section 107. Copying automotive software for research purposes is not an essential step to using an automobile. Research also does not qualify as “maintenance” or “repair” under Section 117(d), as Section 117(d) limits “maintenance” and “repair” to those activities aimed at servicing or restoring the automobile to “work in accordance with its original specifications.”18 Simply put, research and analysis are not addressed in Section 117. Thus, this Section does not provide an exemption to the straightforward infringement contemplated by the proposed uses. IV. The Proposed Exemption Would Harm the Public, the Environment, and Auto Repair Markets A. Automotive Software Systems are Interdependent The proposed exemption risks public safety, public security, environmental wellness, and threatens to circumvent the safeguards of existing research programs. As previously noted, modern automobiles are comprised of millions of lines of code. Given the interdependence between software modules that exist in the various ECUs, a change in one part of the system may result in entirely unknown or unintended consequences in another. Manufacturers rigorously test the way in which inputs and outputs are communicated across the vehicle network to ensure that the overall system performs as intended. A modification to the system however, could result in an undesired outcome, particularly if, for example, an ECU that controls vehicle Electronic Stability Control is relying on inputs from several software modules to determine the necessary action or output. Another example is the air bag system, which cannot be personalized or otherwise accessed to change its function without compromising safety. Even a well-meaning 14 17 U.S.C. § 117(a). 17 U.S.C. § 117(c). 16 17 U.S.C. § 117(d). 17 Petition of Electronic Frontier Foundation, In the matter of Exemption to Prohibition of Copyright Protection Systems for Access Control Technologies, Docket 2014-07, p. 4. 18 17 U.S.C. § 117(d). 15 6 change by an owner or service provider could have significant consequences, up to and including the potential to create safety and emission non-compliance. B. Effective Research Demands a Current and Holistic Understanding of Automotive Software Systems Even seemingly small modifications to automotive software, developed with the best of intentions, require a holistic and current knowledge of a particular automobile. In order to ensure that automobiles comply with or exceed all applicable standards and regulations, automobile manufacturers periodically update vehicle software. A fruitful research program must have a current understanding of all developments and updates to automotive software. Thus, the success of a research initiative requires the intimate involvement of automobile manufacturers, who are in the best position to know how to safely implement design proposals without impairing other aspects of automotive functions. Otherwise, the results of any independent research may be outdated or impracticable to implement without hindering contemporaneous efforts by automobile manufacturers and their authorized research partners. C. Existing Research Initiatives will be Disrupted As discussed above, automobile manufacturers constantly seek to improve the safety and security of automobiles, both through internal research programs and with third party research partners. The Collaborative Safety Research Center 19 and the Honda Developer Studio 20 described in Section III are only two examples of several. The proposed exemption is not only unnecessary given these existing programs, but it is imprudent. Not only are they, as discussed above, unlikely to advance the safety and security of automobiles, but they are likely to disrupt existing research initiatives. D. Policing of Software Modifications Not only is efficacy of the proposed uses questionable, but there is a very real threat that immediate harm will result from uses bearing the guise of the proposed uses. Who would bear the burden of policing which research is in the name of safety and security, and which is straightforward copyright infringement? Many modifications to automotive software are likely to look like security improvements, at least on their face, but actually serve more frivolous aims. By removing automobile manufacturers from research programs, independent researchers will be free to further any agenda in the name of security. This not only puts public safety and security at risk, but it uniquely risks the reputations of automobile manufacturers, who are likely to be mistakenly associated with any harms arising from such programs. E. Adverse Impact on Warranties and Downstream Purchasers The general public bears the greatest risk with the proposed exemption. Consider how modifications to automotive software would impact downstream purchasers, many of whom would be unaware of these modifications and unaware of the aforementioned safety and security risks. Second and third owners would unknowingly risk the safety and security of themselves 19 20 Collaborative Safety Research Center, Toyota (March 22, 2015), http://www.toyota.com/csrc/. Honda Developer Studio, Honda (March 22, 2015), https://developer.hondasvl.com/. 7 and their passengers. In the event of an issue, these downstream purchasers would go to automobile manufacturers for help, pointing to the warranties on these vehicles for relief. Automobile manufacturers typically warrant proper automotive function for significant periods, with emissions and safety warranties often lasting for the useful life of the vehicle. Modifications to vehicle systems could void these warranties if the changes resulted in damage to the vehicle or its component parts. In addition, without the proper or controlled validations procedures, these modifications would violate the integrity and intent of the supplier and automaker’s original design. The proposed exemption exposes automobile manufacturers to significant risk under these warranties and gambles with the value of used automobiles to downstream purchasers. F. Adverse Impact on Products Liability and Insurance Consider as well the role that consistency of automotive software plays in determining the cause of automobile malfunctions, liability for claims arising from them, and the impact on automobile insurance, where predictability and causal determinations impact both premiums and coverage. Any modification to automotive software, even in the name of security, threatens this consistency, especially if automobile manufacturers are not involved. Following a vehicle collision, manufacturers routinely analyze post-crash data, both to determine the factors contributing to a crash and to improve vehicle safety. If unauthorized, uncontrolled third party changes to the vehicle software were made to the vehicles, it is much more challenging to ascertain what factors may have affected crash outcome. While it may be possible to simulate the performance of a known system, without specific details of the modification and affect it had on the vehicle systems, it may be practically impossible to determine the root cause of the collision. With less knowledge of the causes of automobile accidents, automobile manufacturers will have a decreased ability to prospectively prevent them. This is yet another way the proposed exemption threatens public safety, but also a reason why the proposed exemption threatens to disrupt existing insurance markets. In short, the proposed exemption will undo many existing research initiatives and financial markets. As should be clear, the proposed exemption leads to an imbalance by which the negative consequences far outweigh any suggested benefits associated with providing an exemption to allow modifications to vehicle software and, in the worst cases, leads to disastrous consequences. Risking public safety, security, environmental wellness, and thriving research initiatives, the exemption minimally increases the accessibility of what is already widely available to those in the best position to improve the safety and security of automobiles. It is an imprudent risk for little gain. V. Conclusion For the reasons set forth above, the Association of Global Automakers, Inc. respectfully asks the Librarian of Congress not to exempt Proposed Class 22 from the prohibition on circumvention of technological protection measures under 17 U.S.C. § 1201(a)(1). 8