Creative Commons, Broken?

I am both an enthusiastic supporter of Open Source and photographer, these two forces collide in the form of the Creative Commons or ‘CC’; a free licensing scheme for all creative works with similar ethics and principles behind the common Open Source software licenses like the GPL or BSD.

I have been licensing my photography work under a CC-by-sa-nc for over a year (that’s creative commons, attributation, share-alike, non-commercial for those of you that are yet to be ofe with the CC) and recently ranted at my good friend Simon Hailstone about his ‘all rights reserved’ approach to his own photography. I proclaimed loudly that, given a CC-nc license your work will propagate and permutate the many layers of the internet increasing aweness of your work while protecting you to take legal action against any one revenue stream that may be abusing your work enough to fight about.

His retort was both well informed and accurate, pointing me in the direction of a number of bog proclaiming that the CC was in fact useless in the licensing of creative works. The usual FUD (fear, uncertainty and doubt) was expelled on the basis that the CC options were confusing and often mistaken, or that the CC was only a free-for-all approach to licensing work. However, one issue did interest me, it is possible to later revoke CC licenses. This does not effect those works that were obtained prior to the revocation; however it does open up the following issue:

Given the current CC suite commercial users are open to copyright trapping with the following pattern:

1. Register a work with an authority retaining non-commercial rights.
2. Publish your work under an open CC license, for instance on Flickr.
3. Await a commerical organisation to (legally) use your work for some commercial gain.
4. Revoke the CC rights for commerical use, removing evidence of previous CC licenses.
5. Accuse the commercial organisation of illegal use and file a compensation claim in the courts.

In this case the court would wrongly side with the prosecution since hard evidence can be found that the work was in fact licensed before the use of the work by the commercial organisation. This issue is that, when purchasing stock images, a company has a record in it’s financial accounts of a transaction concerning that work. Even if that transaction was or $1 it would protect the company from such claims. However, given the amount of freely available work on sites such as Flickr, a company can obtain a myriad of work for free. The issue here is that, aside from a copy of the work (perhaps with an accompanying license which is easily faked) the defence is virtually useless.

The result here is that our prosecution wins the case and awards the photographer:

• The cost of registration with the authority (<$100)
• The cost of the court case
• The earnings raised from the unlicensed use of the work
• And possibly damages depending on how the work was used.

This is not the first time this has been addressed as an issue; a while back FlickrCash.com was created in order to register a license for images on Flickr. However FlickrCash charged considerably over the odds for this service and was taken to court for abusing licenses (it wasn’t), gaining enough momentum for Flickr to force its closure.

So now we’re back at square one: only, the solution would appear to be

We need a low cost (potentially free) way of recording a work’s licensing that can be used as a winning defence in a court of law.

With my background rooted in Computer Security I propose the following registration protocol:

Note: at this stage I’ll be flummoxing into some cryptographical notation which will bore you, skip to the last paragraph if you’re not interested:

Given:

• A one way hash function H where H(Z) denotes the processing of work Z with the function H
• A PKI system with public key k and private key s
• A digital sigature scheme using the above PKI
• A work W
• A License L
• A Licensor A
• A timestamp T
• A certificate authority CA with public key CAk and private key CAs

A work W is registered by licensor A with license L at time T authenticated by certificate authority CA with the following, simple protocol:

1. A creates a key-pair Ak and As, keeping As secret.
2. A registers it’s public key Ak with the CA using a registration protocol (at a promised vetting level)
3. A sends As(A,W,L,T,H(H(A),H(W),H(L),H(T))) (where , denotes concatenation) to the CA
4. The CA verfifies the signature on A,W,L,T,H(H(A),H(W),H(L),H(T))
5. If successful the CA verifies H(H(A),H(W),H(L),H(T)) using A,W,L,T
6. If successful the CA stores and responds with CAs(A,W,L,T,H(H(A),H(W),H(L),H(T))
7. A verifies the sigature on CAs(A,W,L,T,H(H(A),H(W),H(L),H(T)) and H(H(A),H(W),H(L),H(T))

The token CAs(A,W,L,T,H(H(A),H(W),H(L),H(T)) can then be published with work W and verified simply with the CA by any potential licensee, guaranteeing it with a mathematically challenging (and supportable in court) way of proving that the work was gained legally.

The only issues here are that:

• The certificate authority must promise a certain level of vetting on the publisher of the work.
• The certificate authority must retain the keys of all registered users and work at a cost
• The ethics of an open source license is contrary to any registration protocol.

However if we take that the service is run at cost-price and supported by an organisation such as the EFF I beleive we have a sufficient level of defence and a service which may well be of use for all creative professionals publishing outside of the medium of code.

Comments would be greatly appreciated.

Update

Additionally the CA can be replaced by a Transparent Trusted Third Party with the following:

Given the same assumptions as above, replacing the CA with a TTTP with keypair TTTPk, TTTPs.

1. A registers a public key Ak with the TTTP
2. A publishes As(A,W,L,T,H(H(A),H(W),H(L),H(T))) along with Ak,A,L,T and work W.
3. The licensee verifies As(A,W,L,T,H(H(A),H(W),H(L),H(T))) with Ak
4. If successfull the licensee uses the work W

In the case of dispute the TTTP is invoked thusly:
1. Licensee passes the TTTP A,W,L,T, As(A,W,L,T,H(H(A),H(W),H(L),H(T))).
2. TTTP verifies using stored public key for A, Ak.
3. If successfull the TTTP issues to the licensee a defence token D=TTTPs(A,W,L,T,H(H(A),H(W),H(L),H(T))).

Now you can use any public signature, for instance OAuth or Ident.ca using the ‘register and forget’ mentality, if you forgive the military overtones.

Again comments welcome.

The Osmosoft Crew

Right, in order for y’all to get not only a good view of what it’s like to work inside BT via my Twitter feed I will also be showing you some of the insides of BT from my own astraged persepctive. The first is one that I hold dear to my heart, Open Source.

I’ve been involved in Open Source projects throughout my studies at University, at Undergraduate I studied the use of Eclipse for software development, the use of Apache for hosting and the use of Ant for scripting deployment. In my Masters degree I studied Internet Software Systems where I studied the use of web development using the Hibernate, JSP, Spring, Wicket and ACEGI.

While I’ve officially lost the will to code, having been a coder since the age of 8 (Sinclair Spectrum and Your Sinclair magazine anyone?) I’m whole-heartedly into the concept of community driven development and the wider subject of FOSS (Free and Open Source) liscencing, particularly the (relatively) modern Creative Commons. This interest was sparked upon first joining BT and running across Mr. Jon Lister of Osmosoft.

Enough of the pre-amble, ‘what do Osmosoft do’ I hear you cry… well… Osmosoft was purchased by BT as I joined back in 2007, at the time Osmosoft was a one man band by the name of Jeremy Ruston with a single-celled, free, open source wiki called TiddlyWiki. This greatly annoyed finance as Osmosoft had no revenue, no customers and no intellectual property… so why did they bother?

As you probably know, large scale ‘enterprises’ have been blabbing about use of Open Source for a while now, be it positively or begrudgingly, however very few of these companies are saying the right thing… por ejemplo:

• The quality of software is poor
• We should use it because it’s free
• etc etc

JP Rangaswami wrote a decent ‘nail on the head’ post about the reasons for not adopting Open Source and why they’re irrelevant over here so I won’t blab on and get on with it. The reason BT aquired Osmosoft was becasue TiddlyWiki had an open, extensible framework which had gathered a community of around 25,000 people.The reason BT want this is because

BT wants to better understand the innovation which occurs at the edges of a community

it wants to be able to make use of this innovation as much as it wants to feed it’s own development time back into the wider community.

I beleive the benefits of this approach are pretty obvious but just to spell it out, yes you may get some free development time, but more importantly it helps you understand what your customer wants and where the world is going. The classic homage paid to Open Source project ‘leaders’ are that although 90% of commits to a project are abysmal it proves that someon cares about a feature or a bug enough to try and fix it. Think about it like a amrketing survey: Survey 100 people on whether they’d buy a new brand of soft drink, assume 50% said yes they’d buy it. Now offer tham a can for sale… think 50% would still buy it?

So what have Osmosoft been doing since their inception and aquisistion. Here’s a quick hose-down

• Developed a couple of products from TiddlyWiki namely RippleRap and TeamTasks which are free and openly available.
• Lead the creation of BT’s Open Source adoption message at http://bt.com/opensource
• Lead the move of BT into contribution at FOSSBazaar http://fossbazaar.com
• Presented at a million and one events inc.
• Created some crazy-cool visual psychobabble on Open Source and the web courtesy of Paul Downey

All in all a pretty successfull year, beleive me… If I still had that hackers instinct I’d be battering down their door for a job.

XO's running TiddlyChatter

So ‘TiddlyChatter’, sounds cool? You haven’t got a clue what it’s about yet! Lets rectify that shall we? Stay with me. So, you know this facebook thing? The one that everyone loves to hate, me included. Well. The thing is, there are a LOT of areas it fails to capitalize on (and by that I don’t mean money). However, there is one little gem which, given a little cutting down and buffing up, could be a diamond. The home screen. All the information you need, one place, decentralised and relevant. This is the idea behind TiddlyChatter, brainchild of Jon Lister and it looks to be going places. Look to subscribe here using it soon. If anyone, actually, ever, reads this… who knows! Meanwhile check out Jon’s blog for more information.

Trust is mutual, listen up!

T’other week I went to a conference, it was about open source, it was all very well and good. Doc Searls was there, I had a salad for lunch and spoke to interesting people all day. However. I noticed that one point simply didn’t come up. So I bided my time, thinking ’surely someone has to drop the TCG bomb at some point’ yet no one did. So at the Q&A session the mic came my way. I didn’t like the response because I think the speakers lost track, it was the end of the day and all that. But still it bugs me. I work for an (unnamed) communications company which pushes open source development very heavily, yet our main workstation partners, HP, sit there researching usage and application for trusted computing and trusted platform modules. If you need to bone-up on the issues read the necessary materials down there. All I can say is, I’m still not happy, so I can’t wait till the next one… Which I’ll instigate.