Development of Creative Commons licenses

[Terry Hancock <hancock AT anansispaceworks.com>]

[RE:  duration of a proposed promise to apply TPM to derived works to 
make them available on a TPM-only platform as a condition for applying 
TPM at all]

drew:
>  As long as he is distributing any works with the same license
>  elements hten?

That doesn't seem very logical at all. And note the problem with *who* 
is being required to provide this service.  We have at least three 
parties here:

1) TPM-Keeper (TK): a person who has a right to a key, and can use it to 
wrap content (thus providing this service). He might be a community 
member who has shelled out cash for a key license or he might be 
affiliated or identified with one of the other parties.

2)TPM-Platform-Owner (TPO): the person (or more probably company) that 
created the TPM-Only-Platform in the first place.  He is in a position 
either to permit TPM to be applied or to allow non-TPM work to run on 
his system.

3) TPM-Technology-Provider (TTP): the company whose technology is used 
to apply the TPM to works, typically contracted by the TPM-Platform-Owner

(none of whom is necessarily the content-owner or the recipient of the 
work who must agree to our terms)

Now, according to Mia Garlick earlier post, it is apparently the *TTP* 
who is the "copyright owner" who must give permission to legally 
circumvent a TPM system.  Note how incredibly far we are from being able 
to apply any license pressure on this party!

If we have sway on any of these people, it's the TK.  But he has almost 
no control over the legality or continued availability of TPM-conversion 
of anyone's work (even his own). He's under an essentially unconstrained 
contract with TPO and/or TTP to apply the key only according to their 
agreement. He might be charged a fee not only for having the key, but 
also for each time it is used, or for how many different packages it is 
used, or whatever. There's basically no legal limit to what this key 
licensing contract can demand.

Likewise, even if we are lucky enough to sway the TPO, he also may not 
be in a position to make promises which may be constrained by his 
contract with the TTP.  In general, he'd find it easier to make it 
possible to play non-TPM works on his platform.

The TTP can provide the assurance we want (for example, if the TPM was 
developed under GPLv3, we already have the necessary permission), but 
it's unlikely that he will, and he is not party to our content licensing 
agreement (he doesn't have to agree to the CC license, because he's not 
trying to play or distribute the content).

> > Our hypothetical community based TPM-keeper can't do it legally,
> > because of the terms under which he receives the key.
>
>  Well, the community keeper could just keep functioning instead.

Um, *no*. I just said, he *can't* promise to do that legally.  The TK's 
right to use the key can be revoked or may include (or have added) 
provisions prohibiting him from meeting the promise we demand of him.

BTW, I think it might be worth noting, based on my earlier comment about 
self-application of TPM and TPM-application being trivial and invisible: 
the TK could provide package-specific TPM-wrappers, just as they could 
proivd

>  Here is a fun condition:
>
>  Until the work goes into the public domain or until the keys are make
>  Free.

This is oddly unhelpful because it leaves the work locked under TPM even 
(in fact, only) when it enters the public domain (precisely when we 
should insist on it being free)!  But it still has the problem with 
who's being bound to this promise, and what is the remedy if they break 
that promise (as they may be legally compelled to do by other contracts 
if they are the TK or TPO and not the TTP!).

>  Perhaps, but we must remember that this DRM hairball is not something
>  we created. We should perhaps think along the line of solutions where
>  all but obviously bad intentioned actors can implement easily. (Is
>  that clear?)

"The road to hell is paved with good intentions". We're not even 
necessarily concerned with "intentions", but rather with outcomes and 
freedoms. Even if someone enters into this arrangement with the best 
intentions they can still fail their promise, possibly not even through 
any action of their own, but by the action of other parties binding them.

The TK may promise in good faith to provide a conversion service for 
everybody. He may do this based on a flat-rate license offered to him by 
the TPO or TTP. But what if the contract is then changed so that he gets 
charged every time he uses the key?

What if the TPM is really, really nasty and locks a music copy down to a 
particular CPU or a particular O/S kernel (i.e. it's used in concert 
with "Trusted Computing")? So that "TPM distribution" is then 
meaningless, and TPM has to be applied for each copy? Then the TK has to 
keep his promise not just for every derivative work, but for every copy 
of that work. It becomes a practical necessity to charge for this 
service (this won't bother a TPO who plans to sell per-copy licenses 
anyway).

>  Perhaps I don't understand DRM properly but can't there be multiple
>  sets of keys for the same device? Can't they make a set which can
>  only be legally applied to Free Works?

The question isn't so much "can it be so?" as it is "can we require it 
to be so?".

But let's suppose there is such a set.  Either it's published or it 
isn't. If it's published, then the keys can be used to make anything run 
on the platform. Thus the platform's TPM has been completely 
circumvented.  There's no way to do this just for one group of packages.

If it's not published, then we are at the mercy of whoever is holding 
the key as to whether they will provide TPM conversion as a community 
service.

OTOH, it might be the case that there is a "free key" which allows 
packages to be TPM'd, but can't be used to de-TPM packages TPM'd with 
another key.  However, this is equivalent to allowing the platform to 
simply play non-TPM'd content as well as TPM'd.

> > And if we require such involvement from the DRM distributor, DRM
> > platform owner, and DRM technology provider, why aren't we just
> > asking them to contact the authors, get permission, and pay a
> > royalty in order to sell the DRM'd version? They always have this
> > option.
>
>  Well, I am fine with them contacting me and paying me to use my work
>  in a non-Free manner. (Possibly.) This is pretty much the dual
>  license model after all.

Right, and so long as per-copy or per-package monetary charges might be 
involved to create TPM versions, or so long as specific key licenses are 
involved, it seems like an agreement has to be found on a case-by-case 
basis anyway. If that's so, then the penalty of seeking permission from 
the author(s) doesn't seem unreasonable to me.

TPM kills the low-friction environment that free-licensing is supposed 
to create, so why bother trying to preserve it at this point?  It seems 
to me that it's a rather empty gesture to make sure that copyleft 
protection isn't tying down a package that is already tied down by TPM 
(as if to say "Yes, it's not free, but it's not our fault that it's not 
free!").

What I'm trying to say is that if in the end, there is a solution, but 
it's more complicated than just seeking permission if you want to 
distribute TPM'd files, then it's better to keep it simple, and just go 
with the old-fashioned permissions approach.

This works pretty well if you think of the job of free licenses as 
protecting the fence around the commons, rather than trying to 
appropriate the territory outside of it: if  we concede that TPM-Only 
platforms are okay, and that users of them should have the right to 
voluntarily restrict their freedoms by using them, then it's not 
unreasonable for them to acquire free content as they do non-free 
content, by paying for it on a copy-by-copy basis. And if that's going 
to be done anyway, then it seems only fair that it should it be the 
authors (not the TPO) who get compensated!

> > It seems like we're in for some major slogging through the mud if
> > we want to draft this kind of requirement. Lots and lots of
> > details with risks at every step.

>  Well. Perhaps the simplest wording is transparent TPM + parallel
>  distribution and that will in effect cover all the bases. Then we
>  could draft a FAQ suggesting these various ways to achieve this.

It's already been established that we *can't* legally require that 
unless by "transparent TPM" you mean one for which the keys are already 
published. But at that point, the CC anti-TPM clause doesn't apply 
anyway, so no change is required (and "parallel distribution" is then 
meaningless).  So, IOW, the only way we can word this is equivalent to 
what we already have, so why fix the unbroken?

Cheers,
Terry

--
Terry Hancock (hancock AT AnansiSpaceworks.com)
Anansi Spaceworks http://www.AnansiSpaceworks.com