This report is also available as an Acrobat file.

Contents
LEGAL ISSUES RELATING TO THE DEVELOPMENT AND USE OF WORLD WIDE WEB TECHNOLOGY AT EDUCATIONAL SITES

Opinion for the UK Universities and Colleges Information Systems Association on the terms of the Netscape Navigator WWW browser end user licence agreement.

DISCLAIMER: This opinion is offered without the author accepting any liability either for the accuracy or appropriateness of the contents. It is not offered in an expert capacity.

Introduction

I have been asked by Mr P. Dewar, Treasurer of the UK Universities and Colleges Information Systems Association, in a letter dated 16th December 1995, to examine the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT and provide an opinion on the EXPORT CONTROLS section of that license. The letter states the following:

"The product referred to, Netscape, is a software program which can be used to navigate the Internet from computing equipment suitably configured and attached to University computing networks (and therefore onto the international Internet). It is the intention of the United Kingdom Higher Education Institutions to make copies of this software, under the terms of the attached License, available to their institutional students and staff, so the product can be used in pursuance of academic study. The difficulty we can see is with the EXPORT CONTROLS section of the License and in particular with the practicalities of policing its terms on University campuses, since UK HE Institutions will include in their student (and staff) populations, nationals of the nominated excluded countries. There are two methods for distributing software products such as this item on an individual campus: by manual or automatic (file transfer) means. Bearing those options in mind, could you advise on the following questions."

There then follow the three questions listed here.

"1) Is there an obligation under this form of License for an Institution to maintain a record of individuals who are distributed copies of the software, and what would be the implications of not doing so ? 2) If an automated distribution method were to be used on a University campus, would it be sufficient to incorporate questions regarding the nationality of the person requesting the distribution copy and barring the copy attempt for the appropriate answer. 3) If a manual distribution method were chosen, would it be sufficient to have the individual requesting the copy sign an appropriate declaration, and if so what would the appropriate wording be ?"

Background.

It is clear both from the research that I have done in this area, anecdotal evidence available on Internet mailing lists, and a brief discussion with Mr David Shickle of Netscape Communications UK that the inclusion of an EXPORT CONTROLS clause in the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT relates primarily, if not exclusively, to the incorporation of RSA encryption software in the NETSCAPE NAVIGATOR software. Encryption software is classed in the US as 'munitions' and is thus subject to US export controls. Such controls include the banning of the passing of encryption technologies to certain blacklisted countries and individuals. The position of the US government as to the level of enforcement of these export controls is unfortunately unclear. This may be demonstrated by the recent decision of US Justice Department not to take any legal action against Philip Zimmermann, the inventor of the encryption software Pretty Good Privacy (PGP) over the release of that software to the wider Internet community.

At issue here is the problem of attempting to enforce export controls over a medium such as the Internet. In virtually all cases, when software is offered to the Internet Community via anonymous FTP, the individual, institution, or business so offering it essentially loses practical control over the future distribution by third parties.

There are possible technical solutions which may help control the initial spread of software by electronic means, including limiting access to the FTP site to users from particular Internet domains. For example, some academic sites limit distribution of software and other electronic material to users within their own institutional domain (i.e. those users within the domain <mit.edu> or <hull.ac.uk>), or to the US or UK academic domain (i.e. those users with <.edu> or <.ac.uk> addresses). However such systems do not constitute a foolproof method of preventing the spread of software outside of those domains, or indeed a method of preventing parties from blacklisted states from obtaining it. Individuals may unilaterally decide to pass on the software or electronic material to friends, relatives, and place it on wider distribution mechanisms such as Internet mailing lists or Usenet groups, irrespective of the terms and conditions of any license agreement Equally, academic institutions often have a wide range of nationalities represented within their staff and student bodies, including individuals from blacklisted countries.

With regard to the specific case of the NETSCAPE NAVIGATOR software, it appears that Netscape Communications, in its free distribution of the software from both its home site in California, and from other sites around the world, does not take any special technical precautions to prevent the export of that software to particular domains. They also do not attempt to prevent the export of that software to particular individuals (probably because this would be impossible to achieve). The only major distinction that appears to be made at their home site is between educational users and all others. At mirror sites even this distinction is blurred. Requests to mirror sites in the US, Sweden, and Austria as to their legal position vis a vis the EXPORT CONTROLS clause in the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT, and any information they may have received on this matter from Netscape Communications have so far elicited only one response, which suggested that the matter was best taken up with Netscape Communications. To this end I have initiated communications with the UK subsidiary of Netscape Communications with a request that they clarify the position with regard to the EXPORT CONTROLS clause. They have proved difficult to contact due to fax problems and thus I await further developments in this area.

With this in mind, and taking into account the fact that Netscape Navigator is widely available from a number of international sites on the WWW with few, if any, checks upon the nationality of the individual downloading it, I would be reluctant to advise the Universities and Colleges Information Systems Association to undertake potentially expensive, time consuming and otherwise onerous administrative controls on distribution, unless these are absolutely imperative reasons for doing so. The following opinion examines the law relating to this area, and outlines possible solutions regarding compliance with the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT.

Opinion

The questions asked by the UK Universities and Colleges Information Systems Association

Is there an obligation under this form of License for an Institution to maintain a record of individuals who are distributed copies of the software, and what would be the implications of not doing so ?

On the evidence available with regard to the electronic distribution methods adopted by Netscape Communications and its mirror sites, via the Internet, I am of the opinion that no such recording obligation is required by, or can be inferred from, the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT.

If an automated distribution method were to be used on a University campus, would it be sufficient to incorporate questions regarding the nationality of the person requesting the distribution copy and barring the copy attempt for the appropriate answer.

On the evidence available with regard to the electronic distribution methods adopted by Netscape Communications and its mirror sites, via the Internet, it would seem that such an approach would be unnecessary, undesirable, and might well raise issues of discrimination under UK law. The approach taken by Netscape Communications appears to be one of 'self policing':

"BY CLICKING ON THE "ACCEPT" BUTTON, YOU ARE CONSENTING TO BE BOUND BY AND ARE BECOMING A PARTY TO THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL THE TERMS OF THIS AGREEMENT, CLICK THE "DO NOT ACCEPT BUTTON AND THE INSTALLATION PROCESS WILL NOT CONTINUE"

As such, I would be of the opinion that a more practical approach would be simply to force the user to download the software via an institutional WWW page on which the terms of the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT are outlined. It would then be up to the user to decide if they could legitimately download the software, as is the case with the approach taken by Netscape Communications and its mirror sites.

If a manual distribution method were chosen, would it be sufficient to have the individual requesting the copy sign an appropriate declaration, and if so what would the appropriate wording be ?"

This seems to be a practical and not particularly onerous device, particularly if the individual were obliged to produce some method of identification (i.e. a library card, student ID card or staff card) at that point. This check would NOT be to ascertain nationality, simply to determine whether or not the individual is a legitimate educational user. Again the ultimate responsibility for deciding whether they can agree to all the terms and conditions in the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT should be left to the user.

Supplemental question

What is the position with regard to the EXPORT CONTROLS clause in the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT attached to copies of the software already distributed by members of the UK Universities and Colleges Information Systems Association?

Earlier versions of the NETSCAPE NAVIGATOR software which did not include the embedded encryption technology at issue are obviously not a problem in this regard. Copies of the beta NETSCAPE NAVIGATOR software which did include the embedded encryption technology and were available for distribution appear to have been time-limited, that is they contained instructions in the software which cause it to stop working after a certain date. Where such software has already been distributed, therefore, any potential problems attendant upon the use of such software would seem to end at the point when that time limit is reached.

Suggested Solutions

There are a variety of technical and practical solutions which can be offered as a result of the foregoing discussion. These are as follows:

All institutions wishing to supply the NETSCAPE NAVIGATOR software to their staff and students, via electronic delivery systems, may apply to Netscape Communications UK for permission to act as mirror sites for the software, subject to whatever terms and conditions Netscape Communications choose to impose. Institutions may wish to restrict FTP access to the NETSCAPE NAVIGATOR software to users at their own institution, or to users within the UK education domain. Users might be required to access a WWW page or download an electronic message outlining the terms of the NETSCAPE NAVIGATOR END USER LICENSE and their implications prior to downloading the software.
All institutions wishing to supply NETSCAPE NAVIGATOR to their staff and students via floppy disks or other electronic storage media do so on the condition that those to whom the software is supplied sign a form which states that:

I, {full name}, am a student, faculty member or staff member of {the relevant educational institution} and I agree to be bound by all terms in {the licence agreement} contained in, or attached to, the software package {name of software}.

I understand that in the event that I am unable to be bound by any of the above mentioned terms, that I have no right to install, or otherwise use, the {name of software} software.

I understand that, under the {the licence agreement}, in the event of my leaving {the relevant educational institution} and not remaining a member of an educational institution, my right to install, or use, the {name of software} software under the terms agreed for educational users is terminated.

Signature ................

So for example:

I, John Smith, am a student, faculty member or staff member of the University of Hull and I agree to be bound by all terms in the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT contained in, or attached to, the software package NETSCAPE NAVIGATOR.

I understand that in the event that I am unable to be bound by any of the above mentioned terms, that I have no right to install, or otherwise use, the NETSCAPE NAVIGATOR software.

I understand that, under the NETSCAPE NAVIGATOR END USER LICENSE AGREEMENT, in the event of my leaving the University of Hull and not remaining a member of an educational institution, my right to install, or use, the NETSCAPE NAVIGATOR software under the terms agreed for educational users, is terminated.

Signature ................

Contents

Graphics Multimedia Virtual Environments Visualisation Contents