2004 (Thoughts about the UCITA)

by Rado <r.dejanovic@vipnet.hr>

What do you get when you put a bunch of lawyers, judges and law professors in one room and tell them to think about software?

As seen in an Infoworld article, you get an almost unanimously agreement that software industry shall be protected against anything that can jeopardize one's rights to get as much money as he can.

It is said America is a land of freedom, where everyone can be and is protected by law and government, including but not limited to foreigners, tourists, wild animals and minorities. If I look at the UCITA paper that was voted by 300 members of National Conference of Commisioners on Uniform State Laws (NCCUSL), I'd never let any of them defend me in the court if my case is anyhow connected to the software.

That people voted for UCITA (Uniform Computer Information Transactions Act) with 43 states in favor of the proposal (thanks God, it is just a proposal - for now), with just 6 against, 2 abstaining and 2 not present.

I'll cite the most important part of Infoworld article:

"The UCITA deregulates product licensing and covers software, multimedia interactive products, data and databases, and the Internet and online information. It further allows vendors to disable software remotely as a means for repossessing products; makes shrinkwrap licensing terms more enforceable; prevents license transfers from one party to another without vendor approval; outlaws reverse engineering; and lets vendors disclaim warranties. "

That proposal goes far. It doesn't only include data in its raw state, but defines it as different aspects of computer industry. It would be hard to restrict every data since it is in violating with human rights, but if you say "software, multimedia, data and databases, the Internet and online information" you've defined every important aspect of only todays software industry, but even of technologies that are yet to come. It is a sneaky business, being an lawyer. You know that each word, each comma and each punctuation matters. Today, everything that run on computer is a software, multimedia or is somehow connected to information flow on the Internet and any other online information (MSN anyone?).

So, we have closed the circle, saying that everything that run on the computer can be protected by this proposal. Ok, now let's see why all of us should shake and shiver:

"It allows vendors to disable software remotely as a means of repossessing products" My knowledge of English isn't sufficient to play with words and the meaning of the sentence like lawyers do, but one thing is clear: it will allow software company to gain some level of access and control over your own computer. Sure, you paid for it, it is in your room and only you can access it. But soon this won't mean that you're the only person who can use it, if that proposal becomes a law. It will give software companies legal rights to inspect and control your storage media. It will allow the company to disable or even erase their pirated software on your computer. Yes, it is illegal to have pirated software. If we agree (we shouldn't do that at any cost) that software company may peek at our hard drive to search for the pirated software, the other part will make lots of troubles to Windows users. Imagine, you just borrowed pirated version of Ultrafastsuperdeluxe paint program and installed it. After few days, you connect to the Internet and the publisher of the software find out that you don't have a license for that product and simply order it to remove itself from your computer. Alas, it used some modified system DLL that doesn't exist anymore, and half of your licenced products refuse to work, or even destroy themselves because they detected that someone has messed up with the DLL's they use, and because there's law that allow self-destruction, they'll nuke themselves to protect the software companies that made them, probably rendering your system unusable. Want a horror story? Imagine a malfunction in vendors computer which deactivates absolutely legal, licensed real-time, mission critical software in some company that heavily relies on it... And you can't sue them, because of the license agreement, that sentence written with CAPITAL WORDS that claim no responsibility at all for your existing data and other software installed. Of course, you may say "they'll just disable the software, not erase anything" but it is not the point. We already have lots of software that disables itself if you don't have license. Shareware programs like to use that feature and it is Ok, because you have some time to try out the program, and if you like it, you should buy it. UCITA goes a step further - it will allow acces to your own storage media to check for licences, directly interfering with your right to privacy. And if you say "it is Ok because there are lots of cracks which circumvent the integrated license checks", then you don't know much about computers. Cracks were, are and will be around. It is just as easy to crack online checking as it is to crack hard-coded checking.

It "... makes shrinkwrap licensing terms more enforceable...". This means just the same as the above, it just adds the rule to shrink-wrapped software and creates a big problem for those who don't have Internet access. Why? Simply, because if software company want to control your computer, it should be connected to it somehow. The most logical thing is to require Internet connection for some operations - you may want to access clipart gallery, and at that time you have to be connected to the Internet to receive new upgrades and new set of images, while at the same time, your license key is being verified by the company. If you don't have Internet access, then there are no clipart for you, sorry. And none seemed to think about license fraud on the Internet, the way your license could be stolen by third person while hoping from router to router. UCITA doesn't say a word about that, but hey - it is all about protecting the industry, not human rights. Imagine that you're living in small, undeveloped country. You've been working whole year to collect the money to buy some fancy, yet not so professional 3D software for just 1K$. Surprisingly, it demand Internet access for procedural textures. And you can't access it because you don't have money for that or there's even no Internet access at all. What would you do?

It "...prevents license transfers from one party to another without vendor approval...". Excuse me, are we nuts or what? If I buy software and want to sell it to my friend, should I ask the company for allowance? There are two facts that can be used in defense for that: the "real" software, one that has just few copies on this planet, due to its price or specialized use has been and is controlled that way. If you buy software, you have to contact the manufacturer if you want to sell it. But this is common only for the software that has great value or may be a risk if delivered to terrorists or countries with evil government. In such cases, I agree, some control over the copies is necessary. But is it necessary for a bloody Quake, MS Office or bloated operating systems? No. This is perhaps the most stupid part of UCITA, because it not just allows the company to totally control the flow of their software, it will make software more expensive, because there will be one more department, responsible just for tracking the copies. It takes more people, more expenses and result in the price of the product. You'll have to register and re-register every piece of software, it will destroy some more forests or make more bloat on the Internet bandwidth, depends on the way you choose to re-register. Perhaps it is ok for cars, but for software?

It "...outlaws reverse engineering...". Start panicking. This may completely change the face of the software industry for years to come! Even this has a good intention, because you have to have the way to protect someone's property from being copied, but the words are completely incorrect. While reverse engineering does mean the people analyzing the structure of a processor, trying to make a compatible copy, it also means Samba, Executor, and lots of other things. Reverse engineering is a way to get things done. It was (and maybe still is) widely used in technology - take a look at someone's product, reverse engineer it and make your own product that is made out of stolen knowledge. Just how do you think all those IBM PC compatibles came out? If you reverse engineer something, you do it for two reasons: either you have no knowledge to do it yourself (so you have to steal it), or you need to make your product work with something else. While it is Ok to ban reverse engineering that result in stealing the code or technology (but don't they already have laws for that?), careless use of the phrase "reverse engineering" may result in ban for Samba for example, because people used reverse engineering methods to find out how to connect Unix to Windows network. Even if they didn't peek into Windows code (they didn't), it is still called reverse engineering, because they had to look what is happening on the network and what input returns what output. "It just keeps weirder and weirder" (Johnny Bravo) - imagine this: "The user has reverse engineered our GUI by looking at it and evaluating results of left and right mouse clicks in an effort to make his own copy of our GUI."

UCITA could make a great job for Microsoft - none could make Samba vs. NT tests anymore, and none will be able to choose the OS he want to use. It will still be possible to mix Win and Mac because two companies will license technology to each other, but Linux boxes would be simply cut-off from Windows networks. And if some day Microsoft enforces its own TCP/IP mutant, no free software could be made to support it. Reverse engineering is just too wide phrase to be used just like that, or it may backfire in helping big companies spreading information monopoly very soon after the proposal becomes a law.

It "...lets vendors disclaim warranties." Isn't this self explanatory? Not only vendors take no responsibility for bugs in the software, now they may be able to disclaim everything. No matter if it counts for software manufacturer, reseller or dealer, it is still shrinking your rights as a customer, human being and intelligent creature. It sounds like software manufacturer is not responsible for anything, but it will be able to get control over your data. George Orwell might say "I missed just 20 years".

There's one nice comment on Slashdot - someone wrote that in future, there'll be two kinds of software - open and fascistic. Indeed, this may not be true, but it will surely make two hemispheres in the world of computing. The one that will allow monopolists to control their business, and the other that won't allow such things. If UCITA becomes a law, rest of the world could make similar laws, spreading the protection over the big companies, and giving small, independent software makers and even amateurs and hobbyists a hard time to struggle for their own ideas, in fear of being sued for reverse engineering. And plain citizens will become just paranoic because they'd never know who is accessing their data and for what reason. That would give Linux, GNU and the open family a great respect - you'll be able to have not even free software, but also your own privacy. Playing with human rights is not a good idea - even if you make the fastest, most reliable thing on the world people wouldn't use it, but that software which is maybe not so perfect, but it doesn't spy on them. Not everyone thinks so - in Infoworld's article you can read a comment of one law professor who was also one of the UCITA drafters: "We think that this will extend the rights of end users. Can you believe this guy is teaching students the law?
 
 

There are some other problems with remotely disabling software that you could have mentioned.

1) What if the software vendor makes a mistake? The people who run software companies are only human (technically, anyway), so some time, somehow, someone will make a mistake. Would this mean that a clerical error could cause one's copy of Office to suddenly not work, or be deleted?

2) What if the terms of the contract change without notice (which the UCITA allows, I believe), and one is unknowingly in violation of the new terms, and one's copy of the software is disabled because of this?

3) What if the software vendor makes the terms of the license harsher and more expensive, perhaps to the point of being legally questionable? With remote disabling of software, the software vendor can potentially paralyze a business, making it more difficult to negotiate new terms, or generate revenue (since there's no business) for paying court costs should there prove to be a reason to sue.

I'm not a lawyer, but it seems that UCITA may allow software vendor no responsibility if he make a mistake. One way or another, since vendor may disclaim warranty and may put whatever he wants into disclaimer. Vendors already take no responsibility for your data, and this fairly protects them from their own mistakes - you agreed that you can claim them responsible for problems with your data, remember ;) This should either change in way that vendor is responsible for its own mistakes, or not responsible for anything.

2) What if the terms of the contract change without notice

AFAIK, it already happened in case of disclaimers and warranties, but if you make a real contract with the company, they can't just make a change without your approval. It makes sense for big companies, but the end-users are almost helpless.

3) What if the software vendor makes the terms of the license harsher and more expensive, perhaps to the point of being legally questionable?

The answer is IMHO, that this company will simply dissapear from the market because none will buy their software. Even allmighty Microsoft could die in pains if they try to do that. Not that they wouldn't, but they are not so stupid to enforce their will over the customers. It may be passable few years before, but now the open source is really threatening them, and such thing would surely kill them, speaking in long terms.