HACKING DIGITAL VIDEO RECORDERS: POTENTIAL COPYRIGHT LIABILITY FOR DVR HACKERS AND SERVICE PROVIDERS

To what extent does Sony's time-shifting fair use argument extend to recent innovations that make it easier for hackers use DVR technology to generate copies of protected material? The author assesses the potential liability of DVR manufacturers against the backdrop of traditional fair use doctrines.

I. Introduction

¶           In the Age of the Digital Millennium, technological innovations continue to "revolutionize" the way we interact with the world around us. Many of these "revolutions" have been based in the entertainment industry, altering the behavior, demands, and expectations of consumers and society at large. Developments in consumer electronics and digital technologies have increased the accessibility of content such as music and videos, while allowing for virtually instantaneous copying with negligible costs to the copier.

¶           Less publicized in the societal conscience than the Napster controversy, struggles between meeting the consumer demand of personalization and preserving the rights of copyright owners are also occurring in the television industry. Controversy over technological developments and their interaction with copyright laws is not a new battle for this industry. Such a battle once raged over the advent of a device then known as video cassette recorders (VCRs). Now, a new video recording technology that has recently been released, Digital Video Recorders (DVRs)¹ is speculated to revolutionize the way consumers view television. This technology, just like its VCR predecessor, has sparked controversy over the copyright implications of its use.

II. Digital Video Recorders

¶           There have been three main players in the DVR market to date: ReplayTV, TiVo, and most recently UltimateTV.² DVRs are basically mini-PCs that allow a user to record TV broadcasts, cable, or DirectTV transmissions, depending on the model, in digital form on a hard drive located inside the recorder. Providers of DVR service require a monthly subscription fee. This allows for the device to access the companies' server, which regularly downloads program guides into the device via a modem. Thus, DVRs provide the same recording and time-shifting functions as a VCR, just in a different medium.

¶           DVRs also have another unintended feature: hackability. Computer hackers have long loved the challenge of reverse engineering and customizing computer hardware and software. DVRs are just another computer system with which they can play. Because UltimateTV is so new to the market and utilizes proprietary software of Microsoft, it's hackability is yet unknown. However, hacking of ReplayTV and TiVo is well documented. While ReplayTV's operating system is proprietary and thus more difficult to hack, TiVo uses the open-source Linux operating system and standard "off the shelf" IDE hard drives. However, the format for storing video files is proprietary.³ Hackers of ReplayTV and TiVo have added extra hard drives to the devices, allowing for more storage space for recorded programming. Some have also customized format of the user interface and menus to suit their personal needs.

¶           On one hand, hackers have been a blessing to DVR companies, developing an extremely loyal customer base when the product was relatively unknown to the population at large. Hackers regularly share their praise for the products and results of their hacking with each other at websites and chat rooms on the Internet⁴ On the other hand, the DVR companies soon may become wary of the potential results of such hacking exercises.⁵ Producers of DVRs do not endorse officially hacking activities, do not offer technical support for hacks, and make it clear that any hacking voids the warranty of the unit. Therefore, hacking has been limited to a small number of technophiles, estimated from a handful up to 1,000, who are willing to take such risks and have the skills to execute such hacks.⁶ The posted hacking FAQs are highly technical and a typical non-skilled DVR user does not have the capability to decipher posts or engage in such hacking. Any effort by such user will most likely result in a $600 paperweight.

¶           At the recent CEA Digital Download Conference in March, 2001, TiVo's General Counsel and Chief Privacy Office Matthew Zinn participated in a panel discussing the "delicate balancing act that technology creates when attempting to align the needs of the copyright owner while allowing consumers access to digital content."⁷ This notion has the potential to become particularly important to TiVo due to two new hacks growing in popularity. First is the addition of an Ethernet port to the TiVo. As purchased by the consumer, the TiVo unit accesses programming guides from the TiVo server through a modem in the unit. This modem has Ethernet capabilities, but lacks an adapter to which an Ethernet card can be attached. Hackers have now built an adapter to which they can connect a standard ISA Ethernet card.⁸ Also, at least one ReplayTV hacker has claimed to connect a DVR to a PC to access programming information through a cable modem.⁹ Second is the more recent release of ExactStream program and source code, which allows for the extraction of video from the TiVo.¹⁰ The release of ExactStream is highly controversial among hackers, some fearing this will jeopardize their relationship with TiVo.¹¹ 

¶           Depending on the uses to which these hacks are put, they may have the potential to affect content security and violate copyright laws. Hacker postings on the Internet claim the Ethernet adaptation will be used largely to access the program guides from the TiVo server, which is much faster on an Ethernet connection than a modem.¹² Another capability includes distributing compressed video within home networks for private use. The hacker writing and distributing the ExtractStream program also stresses that "the code be used only in a legal manner."¹³

¶           While content providers such as studios and broadcasters are not worried about such copying for personal use, which is fair use under Sony as discussed later in this iBrief, they are concerned that digital copies of the programming may now be retransmitted without authorization on the Internet. TiVo CEO Mike Ramsay claims, "It's one thing to record what you see onto the TiVo drive, but the format on that drive and how you get access to that drive is totally proprietary to us. It would be very difficult for somebody to actually hack into that."¹⁴ However, with the release of ExtractStream, this may become a reality. Prior to this time, the hacking community had declined to release such information, in order not to jeopardize its relationship with TiVo.¹⁵ Section IV will examine the potential liabilities of the DVR companies if hackers should extract the video files and make digital copies of programming available on websites for downloading by the general public.

III. Fair Use and Time-Shifting Under Sony

¶           In Sony Corp. of Am. v. Universal Studios, Inc., the issue before the Supreme Court was whether the sale of copying equipment (VCRs) violated rights conferred by the Copyright Act on the copyright owners of broadcasted TV programming.¹⁶ To prevail, the owners of the copyrighted programs had the burden of proving that VCR users directly infringed their copyrights, and that by selling the VCRs to consumers, Sony was liable for contributory infringement.¹⁷ The Court focused on the private home recording of TV broadcasts for later viewing, holding that such "time-shifting" of copyrighted programs was fair use under §107.¹⁸ Despite the fact that entire works were copied, the Court found that the private non-commercial viewing did not harm the market for the copyrighted work.¹⁹ "The timeshifter no more steals the program by watching it once than does the live viewer."²⁰ The district court even suggested that VCRs might increase the number of people who view the copyrighted broadcasts, thus helping the market.²¹ 

¶           The Court was also not willing to impose contributory infringement on Sony because of the VCR's substantial non-infringing uses and the limited involvement of Sony with the user after the point of sale. First, VCRs could be used to make authorized copies of sporting events, religious, and educational programming.²² The Court agreed with the district court that "an injunction which seeks to deprive the public of the very tool or article of commerce capable of some non-infringing use would be an extremely harsh remedy, as well as one unprecedented in copyright law."²³ Second, after the point of sale, Sony did not have an ongoing relationship with the VCR users and was in no position to control or have actual knowledge of their use of the VCR.²⁴ The Court found that Sony did not induce VCR users to make infringing copies. Moreover, there was no precedent in copyright law to impose contributory infringement on those who sell equipment with merely constructive knowledge that it may be used to make unauthorized copies.²⁵ 

IV. Application of Copyright Law to DVR Use and Service

¶           The typical user of a DVR uses the device for time shifting, whether she records broadcasted programming to view later or pauses live TV. The mere fact that the recording is now in digital form instead of on a tape does not change the nature of the use. Thus, under Sony, private non-commercial home viewing of DVR recordings is fair use. Neither the consumer nor a DVR company is liable for any copyright violations. However, potential copyright infringement may result from making extracted video available to the public through the addition of an Ethernet connection and the use of programs such as ExtractStream.

¶           First, it is possible that a hacker may connect the DVR to her own home network to view recorded programs as streaming video. By viewing the program on another computer, numerous "copies" are created automatically in the transmission path as it is streamed to the computer.²⁶ The copy viewed on the computer is a work of authorship as defined by the Copyright Act because it is sufficiently fixed so that it can be perceived or reproduced with the aid of the computer.²⁷ However, these copies are also viewed for time-shifting purposes and are private and non-commercial if the network is secure and only accessible to the user in her home. Thus, this is likely fair use under Sony. Since there is no direct infringement in these cases, DVR makers cannot be held liable for contributory infringement.

¶           Once a hacker is able to transfer recorded programs from a DVR and makes them available for download on a website, she has moved out from under Sony's fair use umbrella. The District Court in Sony did not consider the issues of copying cable or satellite programming, using recordings for public performances, and transferring recordings to other people, and the Supreme Court did not address those issues.²⁸ These uses go beyond private non-commercial time shifting. The hacker may be liable for violating the copyright owners' exclusive right to reproduction, distribution, and public display.²⁹ Recent cases have addressed such actions in the Internet context.

¶           In Twentieth Century Fox Film Corp. v. iCraveTV, iCraveTV captured broadcasted TV into digital form and made it available as streaming video on a website.³⁰ The court issued a preliminary injunction, holding that the plaintiff would likely succeed in showing that the defendant's transmission of the programming to the public through streaming technology on the Internet violated the copyright owners' exclusive right of public performance.³¹ The court also held that iCraveTV engaged in contributory infringement by putting programming on the Internet, with knowledge that third parties would further transmit the copyrighted programs, thus materially contributing to further violation of the right of public performance.³² The court also held that the owners of the copyrights in the TV programs would suffer an irreparable harm without the injunction: "they have lost the ability to offer particular outlets exclusive rights in particular programs or series, and they have suffered a loss of customer good will."³³

¶           In UMG Recordings, Inc. v. MP3.com, Inc., MP3.com purchased copyrighted CDs, copied them into digital files and made them available to the public on a website.³⁴ The court held this was a prima facie case of infringement and rejected MP3.com's fair use defense.³⁵ It concluded the use of the copies was commercial and "space shifting" was not transformative in nature.³⁶ Under Infinity Broadcast Corp. v. Kirkwood, copies do not qualify as transformative merely because they are retransmitted in a new medium.³⁷ Also, the works that fell in the core of intended copyright protections were being copied in their entirety.³⁸ Most importantly, the court said MP3.com's free service harmed any potential market the plaintiffs may want to create by licensing recordings for such use in a way that would protect their interests.³⁹ The court also rejected MP3.com's argument that it should be allowed as a useful service, stating this argument "amounts to nothing more than a bald claim that defendant should be able to misappropriate plaintiffs' property simply because there is a consumer demand for it. This hardly appeals to the conscience of equity."⁴⁰

¶           Another recent case yet to be decided is Metro-Goldwyn-Mayer Studios, Inc. v. RecordTV.com.⁴¹ RecordTV operated a website where users could select broadcasted and cable TV programs to be recorded, and view the programs later on their computers as streaming video. RecordTV copied these programs into digital form from its cable TV provider. David Simon, operator of RecordTV, claimed, "I wasn't offering anything they couldn't do with their own VCR."⁴² The complaint against RecordTV alleges that it was

doing nothing more innovative than using modern computer technology to make bootlegged copies and offer unauthorized public performances and public displays of Plaintiffs' works on an advertiser-supported web site. [The Defendants] have taken what is not theirs, duplicated it, and distributed it for their own commercial gain to millions of Internet users around the world.⁴³

¶           In its answer and counterclaim, RecordTV claims that the recordings were not unauthorized, but "made at the direction of Internet users [and] were legitimate extensions of legal rights in directions made available by new technology."⁴⁴ The answer claims an affirmative defense of fair use, but does not explain fully how it falls under this defense. It does state that users were required to have pre-existing rights to view the programs to be able to record them for later viewing.⁴⁵ It also claims that transmitting recorded programs to a user is not a public performance.⁴⁶ However, Columbia Pictures Industries, Inc. v. Redd Horne, Inc. held that the transmission of a performance to members of the public even in private areas constitutes a public performance.⁴⁷ Also, the House Report accompanying the 1976 revisions to the Copyright Act determined that in the case of a cable subscription, even though individuals view the broadcast privately at home, cable TV transmissions create a public performance because it is disseminated to the public.⁴⁸

¶           In light of these recent cases, if a hacker uses a DVR with Ethernet connection and video extraction program to make copyrighted programming available for viewing on the Internet, she will be liable for direct infringement. Such a service would be exactly like those offered by iCraveTV.com, MP3.com, and RecordTV.com. The second and third fair use factors are dismissed easily, because TV programs fall under the core of what the Copyright Act is meant to protect, and they would be copied in full. Whether the hacker profits or not, the use of the material is not transformative under Infinity and MP3, as required by the first factor. Most importantly, under the fourth factor, such actions could harm the market for the copyrighted programs. Just like in iCraveTV, the rebroadcast of programming robs the copyright owners of the ability to grant exclusive licenses to networks for transmission of their programs. Also, this hinders the development of any derivative "TV over the Internet" market that the copyright owners may legitimately want to develop, in terms that will protect their own rights. Such access to programs may also harm the current cable and satellite TV markets. If users were able to access cable or satellite programming for free over the Internet, then there would be no need to subscribe and pay for such services.

¶           While DVR companies⁴⁹ are not directly liable for copyright infringement, they may be liable for the hackers' actions in this scenario under the doctrine of contributory infringement. To be liable for contributory infringement (i) there must be direct infringement by the hacker, (ii) the DVR maker must induce, cause or materially contribute to the infringing activity, and (iii) the DVR maker must know or have reason to know of the infringing activity.⁵⁰ Previous analysis covers the first element. Thus, the question remains whether the DVR companies' actions meet the second two elements.

• Material Contribution

¶           Most of the contributory infringement cases dealing with downloading and streaming of copyrighted content on the Internet have examined whether third parties such as Internet Service Providers (ISPs), Bulletin Board Systems (BBSs), and website operators can be liable for content put on their systems by direct infringers. However, such service providers now have a safe harbor if they meet the statutory requirements of §512. The DVR companies are different in this scenario because they are not providing networks, servers, or sites on the Internet, to be used by hackers in uploading the programs recorded on their DVRs for others to access. Therefore, to be liable, their continuing interaction with hacking and infringing subscribers must somehow "materially contribute" to the infringing activity. In Fonovisa, Inc. v. Cherry Auction, Inc., operators of a swap meet were held to have materially contributed to the infringing acts of vendors at the swap meet who were selling pirated music recordings by providing services such as the provision of parking space, advertising and utilities.⁵¹ The Ninth Circuit concluded that such services were instrumental in creating the environment necessary to engage in infringement.⁵² 

¶           DVR companies' services are probably not enough to rise to the level of material contribution. Even though the companies are actively involved with their subscribers on a daily basis, through the uploading of program guides, the companies do not "encourage or assist" the infringement.⁵³ DVRs are similar to Napster in that both provide software that enables users to make digital copies of copyrighted content on their own hard drives. However, Napster also maintains its own servers that allow users to see directories of files, leading them to the files they want to copy. "Napster provides the site and facilities for direct infringement."⁵⁴ DVRs do not provide such a directory or site. DVR software stores the programming in proprietary or encrypted space on the hard drive. When DVRs dial into the companies' servers, they are merely accessing program schedules, providing no way for users to know what programs are stored on other users' DVRs.⁵⁵ 

¶           Moreover, hackers could post copyrighted TV programs on the Internet without having a subscription to a DVR service. The DVR itself can still be used just like a VCR to record files by manually recording at the time of a show, instead of programming the unit in advance. The subscription merely provides a user-friendlier interface with program scheduling.⁵⁶ The hacker could still use the Ethernet adaptor to access the Internet without the scheduling information, and post content on a website using the video extraction program and her own ISP.

¶           DVR opponents argue that DVR companies materially contribute by not speaking out against hacking, thus indirectly promoting infringing activities. This is especially the case for TiVo, which maintains a direct link from its website to the TiVo Community chat site maintained by AV Science Forum. This site has a forum named "TiVo Underground," which is devoted entirely to posting information on how to hack TiVos. Theoretically, if hackers post copyrighted programs extracted from their units on this website, it could amount to material contribution. However, disclaimers on the AVS Forum site have recently countered this argument: "Please take note that this site is not operated by TiVo, Inc."⁵⁷ Also, the thread with the original post for ExactStream was removed and replaced with a notice: "Due to the issues that this post has raised, this thread has been removed until further notice if not totally. AVS Forum/TiVo Community in no way had any input in this matter and had NO association to this tool or it's makers. We wish for this topic to be 100% dead on this site from this point forward."⁵⁸ TiVo could also cancel a hacker's subscription to the company's services.

• Knowledge

¶           Whether the element of knowledge is met will probably depend on the locale of the copied programs. If the programs are posted on a website affiliated with or well known by the DVR company, then the company may have actual knowledge of infringing activity. Otherwise, it would be hard for the companies to have actual knowledge of such sites unless specifically notified of the location, considering the vast structure of the web. The companies probably would have constructive knowledge that hackers were engaging in infringing activity due to the proliferation of hacking FAQ websites and chat rooms. The Ethernet adaptor kits and ExactStream program and source code are also now available online.⁵⁹

¶           The Ninth Circuit noted in the Napster decision that the Sony Court "declined to impute the requisite level of knowledge where the defendants made and sold equipment capable of both infringing and substantial non-infringing uses."⁶⁰ Even though the court held Napster had actual knowledge of acts of infringement, it did "not impute the requisite level of knowledge to Napster merely because...the technology may be used to infringe Plaintiffs' copyrights," based on Sony.⁶¹ Napster refers to this as the "staple article of commerce" doctrine derived by Sony from patent law.⁶² Religious Technology Center v. Netcom On-Line Communication also suggests that absent notification of specific infringing activity, an Internet system operator "cannot be liable for contributory infringement merely because the structure of the system allows for the exchange of copyrighted material."⁶³ If there were notification, then failure to remove the infringing material would constitute material participation, as discussed above.⁶⁴ 

¶           Thus, DVR companies with constructive knowledge do not meet the requisite level for contributory infringement. DVRs may assert the "staple article of commerce" defense because DVRs, like VCRs, are capable of substantial non-infringing use. However, actual knowledge or notification without corrective action may expose the DVR companies to contributory liability.

¶           To be liable for vicarious infringement, a DVR company must have (i) "the right and ability to supervise the infringing activity" and (ii) "a direct financial interest in such activities."⁶⁵ Unlike contributory infringement, vicarious infringement does not require knowledge of the infringing activity.⁶⁶ DVR companies probably do not have the right and ability to supervise infringing activity, but may have a financial interest in the activity as defined by recent expansive case law.

• Supervision

¶           Cases discussing the right and ability to supervise infringing activity focus on whether the defendant had the right to terminate or exclude the infringer from its services. In Fonovisa, the swap meet operators had the right to terminate vendors' operations and controlled public access to the vendors' services.⁶⁷ In Netcom the court suggested that ability and right to supervise infringing activity could be shown by control over subscribers through the ability to screen postings and terminate or suspend users' accounts.⁶⁸ Also, in Napster the Ninth Circuit held that Napster had such ability and right to supervise because it had the ability to police its system to locate infringing material and had the right to terminate users' access to its system.⁶⁹

¶           In all these cases, the defendants actually controlled the environment where the users of their services were engaging in infringing activity. Therefore, they could cut down on infringing activity by eliminating access to infringers or remove infringing copies. DVR companies probably lack the ability to control the environment in which the hackers make copyrighted TV programming available. While DVR companies maintain websites to provide customer service information, they do not allow users to upload information onto their sites. These websites aren't like a BBS, nor are they ISPs⁷⁰ However, TiVo does maintain a link to the AV Science Forum, which hosts TiVo chat rooms. If this is the site where the hackers post infringing content or hacking instructions on how to access infringing files, TiVo does not have the ability to control access or content on the site, because it is an independent site. However, to be safe TiVo should police the site and encourage AVS Forum moderators to edit or eliminate any infringing content immediately. It may also wish to either eliminate the links to the chat room or request that AV Science Forum remove the "TiVo Underground" chat site, which is devoted to discussing hacking techniques. As discussed above, there is already a disclaimer on the AV Science Forum site explaining TiVo does not operate the site. If the hackers posted infringing copies of TV programming on websites other than those maintained by the DVR companies, the companies have no right and ability to control these sites.

¶           All of the DVR companies do have the ability to cancel subscriptions of users. However, as discussed above, this will only eliminate the downloading of program guide information and software updates, and will not eliminate the ability of the DVR unit to record programs, connect to an Ethernet card, or run a video extraction program. Thus canceling a subscription and ending the continuous relationship with the user will not affect the environment in which the hacker engages in infringing activity.

• Financial Benefit

¶           Beginning with Fonovisa in the Ninth Circuit, recent caselaw has expanded the definition of financial benefit. Under this broad definition, DVR companies may have a financial benefit from the infringing activities of the hackers. In Fonovisa the court held that the swap meet operators had a financial benefit in vendors selling infringing recordings because customers paid admission to the meet, the vendors paid rentals fees, and the availability of pirated music enhanced the attractiveness of the venue.⁷¹ The court in Netcom did not hold the ISP vicariously liable for infringing posts because the court did not find any evidence that the infringing activity enhanced the ISP's service.⁷² In Napster the Ninth Circuit restated the Fonovisa definition that "financial benefit exists where the availability of infringing material acts as a draw for customers."⁷³ Also, Napster's financial business model depended on increasing its userbase, which would also increase the number of infringing recordings available for download.

¶           In the case of the DVR companies, their business model is also dependent on expanding user base. While UltimateTV is backed by Microsoft and does not have immediate financial concerns, ReplayTV left the market and TiVo has yet to break even, currently incurring a loss with every unit sold.⁷⁴ DVR companies' revenues depend on the subscription service,⁷⁵ which will not allow TiVo to break even until there is a critical mass of subscribers.⁷⁶ Therefore, these companies may have a financial benefit in selling subscriptions to infringing users to increase the userbase. However, as noted above, DVRs can record broadcast TV without a subscription. Thus, the companies would have no financial interest in a hacker without a subscription who uses a DVR to post infringing TV programs.

¶           The DVR companies may fall under Fonovisa and Napster's broad definition of financial interest because the infringing activity may enhance the attractiveness of using DVRs and subscribing to DVR service. This is especially the case for TiVo, which uses an open Linux operating system. Many hackers buy TiVo units over other systems merely for the hobby of hacking Linux machines. Also, postings on the TiVo Underground chat site show that hackers enjoy the neutral relationship with TiVo and might not continue to hack if it became antagonistic.⁷⁷ 

¶           However, hacking DVRs to make the program guides more tailored to personal preferences, adding hard drive space and increasing the speed at which the program guide can be uploaded using an Ethernet is much different from actually extracting video files and posting the content on the internet. If the DVR companies can show that only the former form of hacking, and not the latter, enhances the attractiveness of the DVRs, then they may escape meeting this element of financial benefit. The companies are taking steps to increase the protection of the copyrighted programs recorded on the units and hackers have spoken outwardly against breaking into the programming encryption and releasing programs such as ExtractStream.⁷⁸ Thus, it is probably not the ability to post shows on the web that attracts hackers to the service. Also, the average user of a DVR does not have the ability to perform such complicated hacks, and most do not purchase DVRs for this feature.

V. Conclusion

¶           In the end, it is also important to ask whether it is equitable to hold DVR makers responsible for the infringing actions of hackers, who break through proprietary software put in place by the DVR Makers to protect the storage of recorded files, alter the units to utilize an Ethernet connection, and ultimately post copyrighted TV programs on the Internet. As a spokesperson for TiVo noted, "There are people out there that will hack into anything."⁷⁹ Currently, DVRs are most frequently utilized for legal personal time shifting of programs, a substantial non-infringing use. But they have the potential to be manipulated by a small minority for infringing activities.

¶           Sony made it clear that staple articles of commerce widely used for legitimate purposes should be protected because the public has an interest in access to the article of commerce.⁸⁰ As digital technology continues to thrive in the television world, DVRs will become the new standard of recording technology.⁸¹ The public will have an interest in being able to utilize such technology. Regardless of the acts of hackers, a flat prohibition against the sale of DVRs is unlikely to occur. DVR makers, networks, copyright owners, and Congress will have to work together to find a mutually agreeable path on which to take this technological revolution.

Footnotes