ACLU Defends Law Student

The American Civil Liberties Union (ACLU) filed a brief Wednesday defending a first-year Harvard Law School student’s right to crack protected computer code.

The ACLU’s 26-page brief, filed in federal lawsuit Edelman v. N2H2, details the claims of Benjamin G. Edelman ’02 that his First Amendment freedom to research Internet filtering software trumps restrictions of copyright law, trade secret law, the End User License Agreement (EULA), and most prominently, the Digital Millennium Copyright Act (DMCA).

The case has the potential to redefine national interpretation of the controversial DMCA. To date, its prohibition against the “circumvention of copyright protection systems” has been universally upheld by federal judges.

Edelman intends to research a filtering program created by N2H2, a Seattle software company. He is suing N2H2 to ensure his rights to discover and publish the expected result—the list of websites excluded by the software.

He said he considers the research important because many libraries and public schools have been required to purchase and install this and other filtering programs.

“The list is of significant importance in public policy,” he said. “The administrators of schools might like to know what the software they’ve purchased is doing.”

Edelman said that N2H2 Internet Filtering “is reasonably consistently found to block the most actually explicit sites,” but that it “blocks somewhat too much—it’s known to have a high false positive rate.”

For instance, the software has blocked access to breast cancer information as well as Congressional campaign websites and the online home of Planned Parenthood.

Edelman’s current research arose from previous work he did for the ACLU. The group picked Edelman to conduct research on Internet filtering software for their case challenging the Children’s Internet Protection Act, a federal statute that required public libraries to purchase and install filters.

Edelman offered expert testimony in the case earlier this year on his two-year study of filters, which included N2H2 Internet Filtering. The ACLU agreed to represent Edelman when the legal perils of his current research became evident.

The ACLU’s preemptive legal strategy aims at getting the court to affirm Edelman’s rights under the Declaratory Judgment Act, a federal statute that allows a judge to rule on a party’s rights in a legal controversy.

“That’s what this lawsuit is about—asking the court that if I’m able to look inside N2H2’s software and determine what sites it blocks, then I may do so without fear of legal liability,” Edelman said.

Edelman and the ACLU hope to avert legal action by N2H2 down the road, claiming that filings issued by N2H2 constitute an explicit threat to take Edelman to court if he uncovers and publishes their filtering list.

“We...intend to assert all of our legal rights against Edelman if he engages in future activity that violates the agreement or our proprietary rights,” said N2H2 in its most recent 10-Q filing to the Securities and Exchange Commission.

But N2H2 spokesperson David Burt said the company has not “specifically threatened to sue Mr. Edelman, but we’d reserve the right to do so.”

William Coats, a partner at Orrick, Herrington and Sutcliffe LLP who represents N2H2, said the current lawsuit is “not very exciting.”

“There’s nothing to rule on,” he said. “We don’t punish people for what they may be thinking of doing.”

The distinction between Edelman’s current research and his previous research on filtering is his method of choice. He previously uncovered blocked websites by filtering a sample of approximately 500,000 websites and determining which ones were blocked.

He said that due to the sheer size of the Internet, this method would not work to uncover a full list of blocked websites. As a result, he plans to try to decrypt N2H2’s list by cracking their programming code.

If N2H2 successfully held that its list was a “work,” then Edelman’s discovery and distribution of the list would constitute copyright violation. Edelman pointed out that certain kinds of collections, like the phone book, cannot be copyrighted, and he believes N2H2’s list falls into this category.

Edelman said that when a company treats something like a secret, and it cannot be discovered, then it may be considered a trade secret and is protected under federal law—but if he can decrypt the list, it clearly can be discovered and thus would not hold up as a trade secret.

Under the terms of the EULA, when a user installs N2H2 Internet Filtering, he agrees not to crack the code, as Edelman intends to do. But Edelman said the courts have declined to enforce many contracts in analogous situations involving non-negotiable one-sided contracts.

But the DMCA’s restriction against cracking security systems would seem to apply here, Edelman acknowledges, as N2H2’s use of encryption probably constitutes a security system. Nevertheless, Edelman said he believes that his First Amendment rights to research trump this provision.

N2H2 opposes making their list public because they want to maintain an advantage over their competitors and they don’t want to make “the largest directory of pornography in the world” available to children, according to Burt.

Burt said he sees no need for the whole list to be released, because Edelman’s existing method and studies are an adequate tool for assessing the filter.

“I do not think that Edelman’s claims that there is no way for them to evaluate the program at all without decrypting is accurate,” he said. “His own research shows that you can do meaningful statistics with large samples, and he found our database 99 percent accurate.”