2014 New Zealand PHP Conference

Summary of general legal concepts around specific implementations of PHP IP protection in Wellington, NZ.

DISCLAIMER: The concepts conveyed in slides are not complete on their own. The author is not a solicitor and this presentation is not professional advice of any kind. The author does not accept any liability for any detrimental reliance on the information presented herein.

Copyright © 2014 Max Milaney. All rights reserved.

Transcript

1. Protecting your brainpower Max Milaney Milaney Maher Sciences (Canada) University of Tasmania School of Medicine University of London School of Law
3. The production of too many useful things results in too many useless people. — Karl Marx
4. There once was a time when all people believed in God and the church ruled. This time was called the dark ages. — Richard Lederer
5. You're not a lawyer, kid!
7. The next pi/4 hours of your life —Legal framework in different jurisdictions —Practical methods of enforcement —Practical considerations with FOSS licenses —Implementation in PHP —Examples
8. Intellectual property —Copyright —Patents —Trademarks —Industrial designs —Trade secrets (confidential information)
10. Copyright —Computer programs as literary works (Apple v Franklin) —Easy to get ∴ hard to enforce —Usually lasts for life + ≥50 years —Programmer ≈ coder ≈ creator ≈ author —Territorial (Berne Convention)
12. Requirements for © —Permanent form (source code) —Originality —Need not be complete (Hyperion) —Adaptations —Registration not required —Specific notice not required
13. What © protects —Exclusive bundle of rights: —Production, sale, and license of copies —Reproduction and distribution (included import/export) —Creation of derivative works —Performance or display publicly —Transmission by electronic means
14. What © protects —Assignment or forfeiture of economic rights —Circumvention of protecting technology —Except for interoperability —(and sometimes abandonware when it affects commercial interests)
15. What © protects —Non-literal elements (a program's structure, sequence and organization) —"to the extent that they incorporate authorship in programmer's expression of original ideas, as distinguished from the ideas themselves."
16. European Union definition Technological measures shall be deemed 'effective' where the use of a protected work or other subject matter is controlled by the rights holders through application of an access control or protection process, such as encryption, scrambling or other transformation of the work or other subject-matter or a copy control mechanism, which achieves the protection objective.
17. What © doesn't protect —Your idea (idea/expression dichotomy) —Sales past the first transaction (first- sale doctrine) —Fair dealing (AmE: Fair use) —Private use (sometimes) —Educational use —Research —Legal advice —News reporting
18. © potential fails —Acquiescence (permission given by silence) —Implied licence (necessary for performance of existing agreement) —Countries that are not parties to Berne Convention
19. Compilations —"Sweat of the brow" —Feist v Rural —Denied copyright protection to an alphabetical phone book —Held that copyright protection requires creativity —No amount of hard work can transform a non-creative list into copyrightable subject matter
22. Authorship —Written works usually have a single author —Employees in the course of employment —Commission —Unconditional compensation (Gabrin v Universal Music)
23. Joint and collective authorship —Software rarely has a single author —Must be unable to distinguish contributions for joint —Music and lyrics analogy —What are the implications of being able to git blame? —Separate copyrights usually arise
24. Output parameter 1 Get it in writing
25. Sale —Exhausts first-sale rights —Owner of copy has some rights —Can redistribute/resell —Does not prohibit one from acts such as modifying, defacing, or destroying (except when moral rights apply)
26. Licensing —Avoids first-sale doctrine —Step-Saver v Wyse, MAI Systems v Peak Computer —EULAs are the most obvious example —Right to terminate license inalienable
27. Output parameter 2 Don't sell things, sell services and license their products
28. Moral rights —Paternity (attribution) —Integrity (no distortion or alteration that would damage the author's reputation) —Usually inalienable where they exist —Must be asserted in the UK, can be completely waived in Canada
29. Output parameter 3 Don't assign moral rights if you are allowed to and if you can help it
30. Patents —First-to-file and difficult to do so —Protects inventions (or process with an inventive step) —Expensive —Often difficult to convey programming concepts —Territorial —Patent Cooperation Treaty and TRIPs
31. Output parameter 4 Be first to market
32. Global considerations —Authorship in Indian law —Moral rights in EU —Database rights in EU —Civil (continental) law systems are 2×108 different
33. Methods of enforcement —Litigation —Prevention of breach —Compilation to bytecode —Obfuscation —SaaS
34. Now what? —Source code protected, but not process —Source code reveals process —Process can be protected, but not easily —Open court (even arbitration) is expensive
35. Output parameter 5 Do everything in secret
36. Confidential information —Not useless, vague, or immoral —Coco v Clark —Must be of a confidential nature —Communicated in circumstances importing an obligation of confidence —Breach or unauthorised use or disclosure of that information —Best created expressly in contract —Implied confidence (Stephens v Avery)
37. Trade secrets —Any information not generally known or reasonably ascertainable, by which a business can obtain an economic advantage —Equitable right of "property" over confidential information —Breach must be in "bad faith" (Saltman v Campbell)
38. Trade secrets —Legally protected whilst reasonable efforts have been made to keep the information confidential
39. Output parameter 6 Always use more than one form of protection
40. Why more than one method? —Too many jurisdictions —Commercial realities prevail —Copyright is most effective when "protected" with access or copy control measures —Protect your expression and your idea
41. Legal breaches —Infringement —Passing off —Breach of confidence —Circumvention of protection
42. Legal remedies —Damages —Injunction —Account of profits, etc.
43. Obfuscation —Deterrent —Mechanism of "protection" that cannot be circumvented —Useful when you seek practical protection —Security through obscurity
44. "Compilation" —Useful when you are targeting desktops —Need not have PHP installed if output is [semi-]native —Intrinsic speed improvement —Not quite there yet…
45. Obfuscating trade secrets —"Reasonable effort" to maintain confidentiality, but… —Does not protect against reverse engineering
46. Obfuscating trade secrets —Reverse engineering is a legitimate way of learning information, and confidential information is that which is not already known —When used with copyright, reverse engineering is protected under anti- circumvention
47. Circumvention …to circumvent a technological measure means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner
48. FOSS licenses —Most are silent on the issue —You're (apparently) unethical if you obfuscate —GPL requires redistribution of the source code that is "preferred" for editing
50. GUIs —Gray area —Design or copyright? —Expression of code or concept in and of itself? —Apple v Microsoft —Trademarks
51. PHP —The best language in the world! —ionCube / Zend Guard —Phalanger —HHVM —Project Zero (IBM WebSphere sMash)
52. ionCube & Zend Guard ioncube_encoder --encrypt "*.tpl" /project --into / encoded-projects —Commercial products —Compiles to bytecode with obfuscation —Very common —Broad platform support —Shared hosting support
53. HHVM —New(ish) —No Windows and limited Mac OS X support —Limited desktop applications, but good performance server-side —Hack language
54. Phalanger —Project started at Charles University in Prague —Supported by Microsoft, Google, Jadu, and now DEVSENSE —Limited implementation of PHP extensions, but can created "managed wrappers" of existing extension DLLs
55. Phalanger phpc /pure /target:winexe Program.php Form1.php —Compiles to CIL/MSIL for JIT compilation —.NET/Mono integration/target —Two modes —Can be decompiled to another .NET language (incidentally copying) —Windows and limited Linux support
56. Standard mode —Mostly compatible with canonical PHP —WordPress >70% page load improvement (ostensibly) —Main application is using existing packages compiled as CGI binaries
57. Pure mode —No global code or inclusions —.NET and system UI interoperability —Libraries that integrate with lower system functions —PHP extensions written in PHP
58. use System; use System\Windows\Forms; use WinForms; class Form1 extends \System\Windows\Forms\Form { private $components; public function __construct() { parent::__construct(); $this->InitializeComponent(); } public function InitializeComponent() { $this->components = new \System\ComponentModel\Container(); $this->SuspendLayout(); // ... $this->ResumeLayout(false); } } class Program { static function Main() { Application::EnableVisualStyles(); Application::Run(new Form1()); } }
60. Take home messages 1. Get it in writing. 2. Don't sell things, sell services and license their products. 3. Don't assign moral rights if you are allowed to and if you can help it 4. Be first to market. 5. Do everything in secret. 6. Always use more than one form of protection (ideas and code).
61. ❤ Thank you hello@max.codes More info: https://www.eff.org/ issues/coders/ Copyright Act 1994 (NZ), s 226 Copyright Act 1968 (Aus. Cth)