The war against terror somewhat surprisingly provides clarity regarding the scope of protection available to databases

Forensic Telecommunications Services Limited v the Chief Constable of West Yorkshire Police and Stephen Hirst
High Court of Justice, Chancery Division, [2011] EWHC 2892 (Ch) - Arnold J

In a case regarding the extraction of deleted data from mobile phones to prove terrorist and other criminal activity, Arnold J gives valuable guidance as to when copyright in databases, the data in databases and tables and compilations will and will not subsist. He also provides guidance as to when the sui generis database right will subsist.

It is clear that, despite British Horseracing Board v William Hill, database right is not dead in the water, and (in the right circumstances) can be a valuable right. However, further guidance is required (and expected from) the Court of Justice of the European Union in relation to when copyright in databases will still subsist. The next case to consider this issue is Football Dataco v YAHOO! in which the Advocate General's opinion is expected before Christmas.

How deleted data is extracted from mobile phones

When data (for example, an SMS) is "deleted" from a mobile phone it is actually still in the non-volatile memory of the device until such memory is overwritten by new data. It is therefore possible (with the correct tools) to reconstruct deleted data, provided it has not been overwritten. The ability to reconstruct such data can be particularly important in the fight against terrorism and organised crime where phones or other devices have been seized from suspects.

Extraction of data can either be by logical extraction (with indirect access to the memory) or physical extraction (involving direct access to the memory). This case only relates to physical extraction methods.

In order to extract and reconstruct deleted data, a security service or police force will need:

1. the Physical Memory Absolute (PM Abs) addresses on the device which indicate the start and end points within the non-volatile memory in which data is stored, in order to locate such data; and
2. a method (usually software) to translate or decode the data (which is stored in hexadecimal format) into a readable message.

The PM Abs addresses for a given phone will depend on: the phone's model and the firmware version installed on the phone. The manufacturer of a phone will know the PM Abs addresses for any given phone. However, they do not publish them.

PM Abs start and end addresses can be found either through trial and error or the use of a flashbox or flasher.

Trial and error is (as might be expected) a time-consuming process. Using a flashbox will supply the PM Abs addresses, but will also delete the data from the non-volatile memory. In order to find the PM Abs addresses using a flashbox it is therefore necessary to find a mobile phone of the same model, with the same firmware version as the phone data is to be extracted from. The flashboxing process is less time consuming than the trial and error method, but finding the right phone can be difficult.

The facts giving rise to the dispute

While extracting data from mobile phones can be very important, it is clear that it is not easy to do, and that if PM Abs addresses were only discovered when needed, this would result in substantial delays. Therefore, in 2000, the claimant (FTSL), was set up to discover PM Abs addresses for mobile phones. Between 2000 and 2002 it developed manual techniques to extract and recover data. However, as these techniques were time-and labour-consuming, in 2002 FTSL set up a research and development wing to develop software to extract and recover data and record it in a database. It developed a piece of software called FTS Hex to do so, and compiled a list of PM Abs addresses (the "PM Abs List").

FTS Hex was licensed to the security services, but not to the police. The PM Abs List was provided to the security services along with FTS Hex.

In 2006 the defendants were working with a security service officer as part of "Operation Praline". The security service officer had access to FTS Hex and the PM Abs List. He supplied 30 pairs of PM Abs addresses from the PM Abs List (the "data in dispute") to the second defendant (an employee of the first defendant (WYP)).

Hirst and another employee of WYP then designed a competing product (CLiVE), and posted the data in dispute to a website they had 1.set up as an information exchange for police officers.
By an unknown path, the data in dispute then made its way to a third party US company, IDFS, which set up another competing product, Pandora's Box.

The issues requiring determination

FTSL brought an action against WYP and Hirst claiming:

1. infringement of the copyright in:
   • the PM Abs List by virtue of it being a compilation or table other than a database;
   • the individual PM Abs addresses;
   • the PM Abs List database as a whole;
2. infringement of database right in the PM Abs List; and
3. breach of confidence by use of the confidential information contained in the PM Abs List within:
   • CLiVE; and
   • Pandora's Box.

The judgment

Arnold J held that copyright did not subsist in the individual PM Abs addresses. He also found that it did not subsist in the PM Abs List, either as a compilation or table, or a database. However, he held that, if it had subsisted, it would have been infringed by WYP's actions, and WYP would not have had a fair dealing defence.

In relation to the database right, Arnold held that this did subsist, and was infringed by WYP's and IDFS' actions.

Turning to the breach of confidence claim, Arnold held that the PM Abs addresses had the necessary quantity of confidence, an obligation of confidence was imposed on WYP, and that it had breached that obligation. However, no obligation of confidence was imposed on IDFS, so Pandora's Box was not developed in breach of an obligation of confidence.

Copyright

With regard to subsistence of copyright and database right, Arnold J notes that:

• For copyright to subsist in the PM Abs addresses as a literary work, (i) skill, judgment and labour needed to have been expended in devising the form of expression of the addresses; and (ii) they needed to be an intellectual creation. Arnold J held that they were not. Skill, judgment and labour were expended in discovering the addresses but not in expressing them. To the extent that they were intellectual creations, they were the phone manufacturer's intellectual creations, not FTSL's intellectual creations.
• Copyright will only subsist in a table or compilation other than a database (for example, the PM Abs List) if "by reason of the selection or arrangement of their contents [they] constitute intellectual creations". FTSL had not, however, used any skill, judgment or labour in selecting or arranging the contents of the table. Labour had been spent in ascertaining and checking the PM Abs addresses, but this was not the right kind of labour for copyright to subsist. There was no literary judgment.
• Copyright may subsist in a "database" if it is the author's creation by virtue of the selection and arrangement of its contents. Arnold J held that the table was a "database", even though it was little more than a hard copy table, with data arranged into columns and rows. However, it was not the kind of database which attracts copyright, since the contents "were acquired as a matter of happenstance over time, and the arrangement was the most obvious and basic one possible".

However, if Arnold J was wrong in relation to subsistence of copyright, he considered that the actions of WYP and IDFS would constitute copyright infringement, because a substantial part of the copyright work had been taken.

Finally, Arnold J considered whether WYP was entitled to a fair use defence under Article 5(3)(a) of the Information Society Directive (2001/29/EC) as embodied in s.29(1) of the Copyright, Designs and Patents Act 1988. For a fair dealing defence to succeed, the defendant must show that it is using

1. the copyright material for research;
2. for a non-commercial purpose;
3. to the extent justified by the non-commercial purpose to be achieved; and
4. with sufficient acknowledgement.

Arnold J held that although the use of the addresses was for a non-commercial purpose (namely, law enforcement), it was not research, nor was the extent of the use justified by its law enforcement purpose, nor was there any acknowledgement. In particular, the fact that the defendants' acts were in competition with FTSL's commercial business was of importance in assessing the extent of justification.

Database right

Quite apart from whether a database as a whole or the individual entries are protected by copyright, the Database Directive, as implemented by regulation 13(1) of the Copyright and Rights in Databases Regulations 1997, provides a sui generis database right if there has been a "substantial investment in obtaining, verifying or presenting the contents of the database".

Infringement of the database right occurs if, without the consent of the owner, a third party either extracts or re-uses all or a substantial part of the contents of the database, or repeatedly and systematically extracts or re-uses insubstantial parts so that such behaviour is considered to be in relation to a substantial part.

Arnold J held that database right did subsist in FTSL's database, as there had been at least a substantial investment in obtaining and verifying the PM Abs List. The WYP list contained 32 entries from the PM Abs List. The judgment does not disclose the full size of the PM Abs List, but 32 entries was held to be, both qualitatively and quantitatively, a substantial part of the PM Abs list.

Breach of confidence

Arnold J also held that the PB Abs list had the necessary quality of confidence to qualify as confidential information. In reaching this decision Arnold J noted that the list was not in the public domain when it was licensed to the Security Service. Hirst knew this when he received the PM Abs List from the security officer and that was enough to import the obligation of confidence. Notwithstanding his knowledge, Hirst used the PM Abs List for his own purposes, and posted it to the information exchange website. Therefore, Hirst was liable for breach of confidence.

Comment

The decision of the Court of Justice of the European Union in British Horseracing Board v William Hill was seen by many as the death knell for the database right at a time when it was barely out of its infancy. Following the guidance given in that case, the consensus was that there would only rarely be substantial investment in obtaining, verifying or presenting the contents of a database (as opposed to creating them).

This case shows, however, that all is not lost, and that when substantial investment is made in obtaining, verifying or presenting the contents of a database, the database right can provide useful protection against extraction and re-utilisation of parts of the database. While database right can subsist alongside copyright either in the database or in the individual entries, the qualifying criteria for database right need to be distinguished from those for the other rights:

• For copyright in the database to subsist the criteria are: was the selection or arranging of the contents sufficient to make the database into the author's own intellectual creation?
• For copyright in the original items in the database to subsist the criteria are: was skill, judgment and labour expended in devising the form of expression of such items?
• For database right to subsist in the database the criteria are: was substantial investment made in obtaining, verifying or presenting the contents of a database.

Despite the different criteria, this case specifies what is not sufficient to vest copyright in a database. In terms of what is sufficient, we must wait for the judgment of the Court of Justice of the European Union in the Football Dataco v YAHOO! case (on referral from the UK Court of Appeal). This case should provide guidance on whether the law relating to copyright in the database as a whole has been harmonised, exactly what kind of "selection or arrangement" is required, and what constitutes the "author's own intellectual creation" for the purposes of creating a database attracting copyright under the Database Directive. We will keep you posted.

This analysis was prepared by Andrew Maggs, andrew_maggs@wragge.com, associate in Wragge & Co's Intellectual Property team.