Monday 23 April 2012

T 2/09 – Big Brother Is Reading You



This test case complements T 1553/06 (see the preceding post), in particular by considering whether the contents of e-mails are made publicly available by the fact that e-mails can be intercepted.

I2 refers to a webpage entitled “Display Device” allegedly found at URL http://www.gironet.nl/home/morozov/CIE/D1SPLAY_DEVICE on 12 January 2000, on the basis of the keyword string “three cathodes and phosphor screen and convergence” entered in the Altavista search engine as a webpage dated “12-1-00”, as certified in a notarial record A2 dated January 13, 2000 at the request of DSM N.V. (DSM Patents & Trademarks).

C3 refers to an e-mail from Mr de Vries (AkzoNobel) to Mr Mooij (acting for the opponent), sent encrypted on 17 January 2000 at 20:45,as certified in a notarial record dated 18 January 2000, at the request of DSM N.V.

C5 refers to an e-mail from Mr de Vries to Mr Mooij, sent unencrypted on 25 January 2000 at 21:44, as certified in a notarial record dated 31 January 2000 at the request of DSM N.V.

The filing date of the impugned patent was February 1, 2000.

Background

[4.1] The Opposition Division (OD), in the decision under appeal, held that, out of the documents that the opponent had submitted, i.e. I2, C3 and C5, document I2 was the only available prior art before the filing date of the patent in suit (hereinafter also referred to as “the filing date”). The division held that the subject-matter of claim 1 differed from the device of I2 […] in that it included the (additional and final) feature dealing with the relationship between the light output L and the signal level V. The problem to be solved by the addition of this feature to the device known from I2 was regarded as to provide a display which yielded a brightness distribution that was very comfortable for studying images on the screen […]. I2 did not disclose this feature or render it obvious. The board notes that the content of e-mail C5 corresponds to the final feature of claim 1.

The opponent, in the statement of grounds of appeal, contended that the subject-matter of claim 1 was not inventive in view of I2 and C5. The board will assume arguendo that the OD was right in considering I2 to be publicly available before the filing date and will assess below whether C5 was also made available to the public.

Pursuant to A 54(2) EPC 1973:
The state of the art shall be held to comprise everything made available to the public by means of a written or oral description, by use, or in any other way, before the date of filing of the European patent application.
According to the case law of the boards of appeal, information is “available to the public” if only a single member of the public is in a position to gain access to it and understand it, and if said member of the public is under no obligation to maintain secrecy (see T 1081/01 [5], affirmed by T 1309/07, [3.2.1]). Whether or not a member of the public has actually accessed the information is irrelevant (see T 84/83 [2.4.2]) .

The relevant facts and arguments submitted by the opponent

[4.2] […] The opponent’s latest position includes the following:
  • the e-mail was routed inside the E.U. and possibly the U.S. (the opponent relied on Article 5 of Directive 97/66/EC and on a map of the inter-regional Internet backbone),
  • at the filing date, it was in principle unlawful in both the E.U. and the U.S. to intercept e-mails,
  • if, exceptionally, interception was done lawfully in the E.U. or the U.S., then there was no obligation to the interceptor to keep the content of an e-mail secret, provided that the interceptor recognised from its content and context that the e-mail was not confidential (“proportionality” test),
  • in the E.U., interception was legally authorised for Internet Service Providers (ISPs) in particular for law-enforcement purposes (U.K.: see RIPA act),
  • in the U.S., interception was legally authorised for ISPs without restrictions.
While in the oral proceedings (OPs) the opponent’s focus was on the above indents, the board considers that the opponent has not abandoned its view that the e-mail might also have been routed through territories other than the E.U. or the U.S., in particular through territories where, at the filing date, it had not been unlawful to intercept e-mails.

Whether C5 forms prior art because it was communicated 
to the opponent’s representative (recipient stage)

[4.3] The parties admitted that there was a substantial level of co-operation between them and other professional representatives in order to create a test case. For the board, this explains why it was possible that e-mail C5 corresponding to the final feature of current claim 1, i.e. the feature of claim 5 of the parent application (just like C3 corresponding to current claim 3, i.e. the feature of claim 7 of the parent application), could be sent on 25 January 2000 (C3: 17 January 2000), i.e. before the filing date of the parent application on 1 February 2000, from Mr de Vries of AkzoNobel to Mr Mooij, the representative of the opponent DSM IP Assets B.V. and also of DSM N.V. (DSM Patents & Trademarks) on whose behalf notarial records were drawn up.

Access by Messrs de Vries and Mooij to the information in e-mail C5 before the filing date, however, did not put this information into the public domain. This is because a non-disclosure agreement (NDA) not to divulge the respective information and binding on these two persons, among others, had been concluded. The then applicant mentioned in its letter of 10 October 2000 in the proceedings up to grant of the parent application, before the divisional application from which the patent in suit originated had been filed, that “both Mr De Vries and Mr Mooij were bound to a non-disclosure agreement pertaining to the subject-matter of the present European Patent application” […]. In the OPs before the board the opponent acknowledged that Mr Mooij was bound by a confidentiality agreement relating to the exchange of the e-mail C5, but that the subject-matter of that agreement was not clear. In any case, the board must infer from the test-case nature of the present proceedings that disclosure of the content of e-mail C5 by either Mr de Vries or Mr Mooij was not permitted because otherwise the test case would have become largely moot.

Whether C5 was transmitted over the Internet

[4.4] The board notes that the opponent, in support of its contention that C5 (like C3) was transmitted over the Internet, filed the original of a corresponding notarial record by a Dutch notary public at the OPs (such original was also filed for C3). This record certifies that C5 (and another notarial record certifies that C3) was opened in his presence at a certain date and time. This original bears the signature and stamp of the notary public, and C5 and the attached notarial record were bound in one folder (idem for C3 and the further notarial record).

The discrepancy between the notarial record pertaining to e-mail C5 saying that the message was on one page and the fact that in reality the e-mail consisted of two pages is regarded by the board as an obvious mistake. What is decisive for the board is the fact that the substantive content of the e-mail was indeed on one page. The board considers the opponent’s statements to be credible given that this is a test case and transmission of C5 (and C3) is a precondition for enabling the board to deal with the gist of the test case.

In the light of the foregoing, the board considers that the opponent has proven beyond reasonable doubt that C5 (like C3) was transmitted over the Internet at the date and time indicated in the notarial record. […]

Whether C5 forms prior art because the notary saw it

[4.5] As stated, it has been proven that a Dutch notary opened e-mail C5 (and C3) . However, the board does not consider that the content of C5 (or C3) was divulged to the public by the fact that the notary public saw it before the filing date. This is because from the test nature of the present case it must be concluded that the notary was under a duty to keep this content confidential. Otherwise the test case would be largely moot.

Whether C5 forms prior art because it might have 
been intercepted from the Internet: in general

Disclosures via the Internet: 
the technical differences between webpages and e-mails

[4.6.1] In its submission of 11 March 2011 the patentee said:
The purpose of the present patents (parent and divisional) was and is to assess if and to what extent disclosures via the Internet would fall under the prior art as defined in A 54. (Emphasis added.)
At the outset the board draws the attention to a basic factual difference present at the filing date between two types of “disclosures via the Internet”, i.e. between content that exists on the World Wide Web (also referred to as “the Web”), a part of the Internet, on a webpage at a specific URL (Uniform Resource Locator) and content that is transmitted over the Internet by e-mail.

Content on the Web can, in principle, be accessed and read via its URL, which may have been found by the public at large with the help of a public search engine if the content in question has been indexed with keywords (electronic “pull type” technology, i.e. where the request for a transaction is initiated by the receiver) .

An e-mail is a communication from a sender to one or several recipients (in case of a large number of recipients, sending is sometimes dubbed “broadcasting”). A (private) communication takes place between senders and receivers, who may be individuals or groups of persons, possibly members of the public (electronic “push type” technology, i.e. where the request for a given transaction is initiated by the sender). E-mails are not placed in an unrestricted area of the Internet, such as the Web. The board is not aware that they would be accessible by entering an address that may have been found with the help of keywords entered in a public search engine. An e-mail can only be read by a member of the public (who is not a recipient of the e-mail) if extraordinary measures, such as intercepting it on a computer network, are used. The opponent submitted that such interception was taking place in practice and that e-mails could be filtered according to keywords. It should be added that e-mails transmitted over the Internet are generally divided into packets and later reassembled. Document D1 […] , submitted by the opponent, explains email transmission in greater detail as follows:

… given the dynamic nature of the Internet, it is impossible to absolutely predict exactly what path network traffic will follow. One e-mail message that you send could take an entirely different path to reach the recipient than another that you send to the same person. In fact, it is even worse than that: for the sake of efficiency, e-mail messages and other network traffic are typically broken down into smaller little chunks, or packets, before they are sent across the network, and automatically re-assembled on the other side. Each of these individual packets may in fact follow a different path to get to the recipient! (In actual practice, a given path tends to get reused until the operational parameters of that or other related paths have significantly changed.)

The net result of all this is that your message, or at least little chunks of your message, travels through an indeterminate set of systems and network devices, each of which offers a point of interception.

Implications of the test for public availability 
of a document on the World Wide Web

[4.6.2] In parallel case T 1553/06 the board developed a test for assessing the public availability of a document stored on the World Wide Web which could be found via a public web search engine on the basis of keywords. In devising this test the board started from its finding that the mere theoretical possibility of having access to a means of disclosure did not make it become available to the public within the meaning of A 54(2) EPC 1973. What was required, rather, was a practical possibility of having access, i.e. the requirement of “direct and unambiguous access”, set out in G 1/92 and T 952/92) applied not only to access by the skilled person to information derivable from a means of disclosure, but also to access by a member of the public to the means of disclosure (see T 1553/06 [6.5.4]). The test is as follows (see T 1553/06 [6.7.3]):

If, before the filing or priority date of the patent or patent application, a document stored on the world Wide Web and accessible via a specific URL (1) could be found with the help of a public web search engine by using one or more keywords all related to the essence of the content of that document and (2) remained accessible at that URL for a period of time long enough for a member of the public, i.e. someone under no obligation to keep the content of the document secret, to have direct and unambiguous access to the document, then the document was made available to the public in the sense of A 54(2) EPC 1973.

The board in T 1553/06 also made clear that if any of conditions (1) and (2) is not met, the above test does not permit to conclude whether or not the document in question was made available to the public. In case T 1553/06 the board analysed inter alia whether two webpages labelled I1 and I2 (the same I2 as in the present appeal) formed prior art. I1 and I2 were considered to have existed on the Web. Their contents were proven to have been found several times by a Dutch notary public after entering keywords in a public search engine. The opponent had furnished corresponding notarial records as evidence to that effect. The board held that the above test was complied with in relation to both these documents and therefore that both of them formed prior art.

As for further document I3, for which no notarial record had been submitted, the board left the question as to whether that document existed on the Web unanswered. In any case, since the board found that I3 had neither been indexed by a web crawler nor could be found by guessing its URL, the board arrived at the conclusion that there was no direct and unambiguous access to I3 and that it thus did not form prior art. The board notes that in the present case even a superficial comparison between access to webpages and access to e-mails transmitted via the Internet before the filing date reveals marked differences, including the following:
  • It is disputed between the parties whether illegal interception (“hacking”) of e-mails was commonly possible for the skilled person in the field of the present invention.
  • It is also disputed and there is no evidence that, before the filing date of the opposed patent, e-mails could be found on the basis of keywords with the help of a public search engine.  
  • Even assuming that it might have been possible, along the route that an e-mail takes, to retrieve it as a whole, i.e. that the packets into which it had been divided were reassembled at the point of interception, then, in the absence of an existing equivalent to a public web search engine, it would seem that the e-mail would have had to be searched for at a plethora of ISP mail servers and MX hosts […] all over the world and on the networks of a multitude of ISPs that were independent of one another. The opponent itself alleged that as the e-mail addresses for AkzoNobel (from which C5 was sent) and DSM(where it was received) had a top-level domain “.com” and both entities were large multinational companies there was no certainty that e-mails from and to these addresses were sent externally from a company server located in the Netherlands. It was possible that they could have been sent first via an internal network (intranet) within each company to any location in the world where that company had a server and thence externally (via the Internet) from that country.
In addition, the opponent confirmed that it was not alleging any specific instance of disclosure to any third party of the e-mail C5 sent from Mr de Vries of AkzoNobel to Mr Mooij acting for the opponent. In contrast thereto it should be recalled that, in case T 1553/06, the fact that webpages I1 and I2 were retrieved from the Internet was certified by a Dutch notary public.

In the light of the above, the board has doubts as to whether public availability of e-mails transmitted via the Internet can reasonably be established at all if the technical conditions of the above test for public availability of webpages were to be applied mutatis mutandis, i.e. whether e-mails transmitted over the Internet could be accessed and searched in a way comparable to that of webpages, independent of whether or not access to and disclosure of the content of the email were lawful. The board rather is of the opinion that the differences between webpages and such e-mails make a strong prima facie case against public availability of the latter.

The board however does not deem it necessary for purposes of the present case to embark on a more thorough enquiry into this issue. This is because it will be shown below that, on the basis of legal considerations relating to the lawfulness of access and/or disclosure of e-mails sent over the Internet, email C5 cannot be deemed to have been publicly available before the filing date. More specifically, the legal condition of the above test, applied mutatis mutandis to e-mail transmission via the Internet, of access by “a member of the public, i.e. someone under no obligation to keep the content of the document secret”, is not complied with. Legal considerations outside the areas of European patent law and fundamental rights are based on the parties’ submissions and may or may not reflect the actual state of the law at the relevant points in time.

In the following the board will assume arguendo that technical conditions of a test for public availability of e-mails transmitted via the Internet could still be devised that such e-mails could meet.

Breakdown of the legal analysis

[4.6.3] The subsequent discussion is based on the board’s understanding that the opponent, in essence, addresses the legal issues relating to the lawfulness of access and/or disclosure of e-mails sent over the Internet under two distinct hypotheses:
  • an individual, i.e. a person to whom the task of monitoring e-mail traffic has not been entrusted, might have intercepted e-mail CS; and
  • an ISP might have performed such an act, either for operational purposes or to comply with governmental requests .
Considering the distinction between individuals and ISPs to be expedient, the board will proceed with its analysis accordingly (see points [4.7] and [4.8] below). For the reasons given in its analysis below, the board is of the view that
  • in the case of an individual, the question is whether access and disclosure are lawful,
  • in the case of ISPs, assuming access to be lawful under certain circumstances, the question is whether disclosure would then also be lawful.
For the sake of simplicity, the board will assume arguendo, apparently in line with the opponent’s submissions, that any ISP through whose installations email C5 was routed had the technical means to reassemble an e-mail if necessary.

Whether C5 forms prior art because an individual might have intercepted it from the Internet

Summary

[4.7.1] Even under the assumption that technical conditions of a test for public availability of e-mails transmitted via the Internet could be devised that such e-mails could meet, however, e-mail transmission via the Internet would still not have rendered e-mail C5 publicly available for legal reasons connected with such interception. This follows from the considerations set out below.

Unlawfulness analogous to confidentiality agreement

[4.7.2] In the communication annexed to the summons, the board considered that interception of e-mail C5 might have been unlawful in the relevant territories. The board described the legal consequences of this possibility, drawn by analogy, as follows :

According to established case law, information covered by a confidentiality agreement is not considered to be publicly available, provided that it has been kept confidential. For the board, it might follow by analogy that information that is legally prohibited from being accessed, let alone disclosed, is not publicly available either, unless it has actually been disclosed before the filing date of the application. In the case of a confidentiality agreement a person is in possession of certain information but, because of that agreement, not allowed to disclose it. On the other hand, a legal prohibition of access does not permit a person to obtain knowledge of certain information. Should that person still obtain such knowledge in breach of the law, then the prohibition of access might also imply a prohibition of disclosure of that knowledge and the question of any legal impact of a confidentiality notice might be left unanswered. (See paragraph bridging pages 25 and 26)

In the above communication the board mentioned a number of legal provisions according to which, at the filing date, intercepting e-mails might have been illegal both under Dutch (telecommunications and criminal) law and under the law of the then European Union, i.e. of the “E.U.-15” (the E.U., at that time, consisted of 15 Member States: ~ustria, Belgium, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Spain, Sweden and the United Kingdom). As for E.U. law, the board, more specifically, referred to Directive 97/66/EC.

As a consequence, the board issued the following invitation to the opponent:
The opponent is invited to show that email C5 was routed via one or several territories in which it was lawful to intercept it and to disclose its contents. […]
In this context the statement by the opponent relating to the question of how to determine whether the content of an e-mail could be deemed public […] is also of relevance. According to the opponent, this question had to be considered at several stages: (i) at the sender, (ii) during message transmission and (iii) at the recipient.

The opponent went on to say:
If at any one of these stages at least one reader could (not did) have accessed its contents and had a reasonable belief that he was free to repeat its contents to another person then the contents of the email must be deemed made available to the public.
For the board it would follow that, under this view, if the reader held no such reasonable belief (based on the law of confidence), then the e-mail had to be deemed not made available to the public.

Moreover, the opponent argued that a reader reading an e-mail by unlawful interception (hacking) might reasonably assume its content was, in principle, confidential. For the board it would follow from this assumption that an e-mail that was intercepted unlawfully was,’ in principle, not publicly available either.

Thus the board considers that the opponent’s assumptions also lead in principle to the board’s preliminary conclusion above regarding the analogous consequences of prohibition of access and disclosure by law and by contract (NDA). The board now confirms this conclusion.

The law in the territories through which C5 was routed

(a) Whether the territories are of legal significance

[4.7.3] In reply to the board’s communication annexed to the summons to OPs, the patentee observed that, in the view expressed therein, the dividing line between public and non-public was strongly dependent on “technical issues how the e-mail was actually sent” and on a wealth of national legislation on e-mail privacy. Such a practice would never provide certainty to users of the European patent system and to the public at large. The opponent, in its reply, considered the board’s invitation (reproduced above, at point [4.7.2]), referred to as a “test” by the opponent, to be both unreasonable and unnecessary - only to, in essence, apply the letter of that “test” in that very reply, and later again during the OPs. The opponent relied, in particular, on a map of the inter-regional Internet backbone (document 08) to show the likelihood that the e-mail was routed through the U.S.

Apparently, the opponent, like possibly the patentee as well (referring to “technical issues how the e-mail was actually sent”), considered that the board, in its invitation, was requesting the opponent to furnish email header information. The board, however, had made no such express request. The fact that the opponent itself relies on the territories through which the e-mail was routed and attempts to establish that route (via the U.S.) on the basis of a map of the inter-regional Internet backbone […] implies that, in the opponent’s opinion, proof of the e-mail’s route might be established by means other than header information. (The board however does not mean to exclude the possibility that header information might constitute an appropriate means of evidence to that effect.)

In this context the board again notes the opponent’s reference in the notice of opposition to Directive 2002/58/EC requiring E.U. Member States to bring into force the provisions necessary to comply with this Directive. At the patentee’s request, the opponent furnished a copy of the Directive, and the patentee, in the proceedings before the OD, discussed its implications […]. Against this backdrop, the patentee’s latest stance denying the usefulness of taking (national) legislation into account amounts to an about-face.

The board considers that, in line with the parties’ position before the OD and the opponent’s (at least implied) position before the board, the law in force in the territories through which an email is routed naturally does play a role because all the activities on the territory of a sovereign state are, as a simple consequence of that sovereignty, subject to the state’s laws, unless the state has lost its jurisdiction on certain subject-matter, in particular because it has transferred it e.g. to an international organisation. E-mail traffic being routed across the globe, such transfer would have had to be made on a global scale, e.g. by entrusting the corresponding tasks to a global international organisation. It has not been claimed by any party that this has taken place.

The conclusion that the law in force in the territories through which an e-mail was routed is of legal significance does not exclude, however, that interception by an individual may, across the whole world, not lead to public availability within the meaning of A 54(2) EPC 1973 of the e-mail intercepted. This is because it might be possible to break down the world into territories in which interception was unlawful and territories in which interception was lawful but such lawfulness could not be taken into account for legal reasons. These questions are being dealt with in points (b) and (c) below, respectively.

The legal significance of routing C5 within the E.U. and possibly the U.S.

(b) While it was the opponent’s original assertion that C5 formed prior art for the sole reason that it was transmitted over the Internet, the opponent’s submissions in the OPs, as already set out above, were focused on the allegation that e-mail C5 was routed within the then E.U.-15 and possibly the U.S. and that in both territories it was illegal for an individual (but not for an ISP) to intercept e-mails.

The board considers that it is the opponent’s duty to state the facts and also, in principle, foreign or international law concerning its case (see above, point [3.1]). The board therefore sees no reason to make enquiries of its own, especially given that the patentee made no objections to the opponent’s submissions in this regard in the OPs. The board notes that an e-mail transmitted over the Internet before the filing date of 1 February 2000 in either the European Union (then comprising 15 Member States) or the United States was, according to the parties1 submissions, prohibited from being intercepted, whatever the pertinent legal provisions may have been’. In this respect the board refers to its analogy made in the communication annexed to the summons (see above at point [4.7.2]), according to which information that is legally prohibited from being accessed, let alone disclosed, is not publicly available either, unless it has actually been disclosed before the filing date of the application. It follows from this analogy that transmission of e-mail C5 via the territories of the E.U. and possibly the U.S. does not, by itself, make the content of that e-mail publicly available. In other words, the legal condition of the test developed in T 1553/06 (see point [4.6.2] above), applied mutatis mutandis to e-mail transmission via the Internet, of access by “a member of the public, i.e. someone under no obligation to keep the content of the document secret”, is not complied with.

Thus, the question as to whether the inter-regional Internet backbone map 08 alone, showing the situation as of September 2000, established that e-mail C5 was indeed routed via the U.S. need not be answered.

(c) The legal significance of any routing of C5 outside the E.U.-15 and the U.S.

However, even if e-mail C5 had been routed beyond the borders of the E.U.-15 and the U.S., the same result would ensue from the aforementioned analogy.

The opponent has made no specific indications as to any countries outside the E.U.-15 and the U.S. through which e-mail C5 might have been routed. The opponent relying on a certain report to the U.S. Congress as evidence […] only indicated that, in April 2010, a substantial amount of e-mail traffic was diverted from the U.S. to China, without, however, providing evidence that this was also the case before the filing date. For that reason alone, the allegation that e-mail C5 might also have been routed to China is pure speculation. In the absence of pertinent evidence, the question as to the standard of proof under which such evidence would have to be assessed does not arise.

Furthermore, the opponent alleged that it was possible that e-mail C5 sent by Mr de Vries of AkzoNobel could have travelled first via AkzoNobel’s internal network (intranet) to any location in the world where that company had a server and thence externally (via the Internet) from that country, depending on the quickest path available, again to any location in the world where the receiving company had a server. Yet, again, no evidence has been filed as to any specific circumstances under which e-mail C5 was thus routed. Thus, once more, these submissions as to a possible routing outside the E.U. and possibly the U.S. are mere speculation.

However, the board will still assume arguendo that email C5 did traverse at least one territory outside the E.U. and the U.S. and that in that territory it was not unlawful to intercept C5. Even under this hypothesis the board would not accept any ensuing public availability of C5. This is because, in the board’s view, the practical and effective protection of the fundamental rights enshrined in Article 8 of the European Convention of Human Rights and Fundamental Freedoms (ECHR) would be jeopardised if information obtained in violation of this provision could be relied on to the detriment of those for whom the rights were designed.

The ECHR is relevant for the purposes of the EPC (see T 1465/07 [8] and the cases cited there). Article 8 ECHR reads:
1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
The European Court of Human Rights held in Liberty and Others v. The United Kingdom (no. 58243/00, 1 July 2008, paragraph 56) :
Telephone, facsimile and e-mail communications are covered by the notions of “private life” and “correspondence” within the meaning of Article 8 (see Weber and Saravia v. Germany (dec.), no. 54934/00, § 77, 29 June 2006, and the cases cited therein).
The Court has also consistently held that:
[w]hile the essential object of Article 8 is to protect the individual against arbitrary interference by the public authorities, it does not merely compel the State to abstain from such interference: in addition to this negative undertaking, there may be positive obligations inherent in effective respect for private or family life. These obligations may involve the adoption of measures designed to secure respect for private life even in the sphere of the relations of individuals between themselves (see X and Y v. the Netherlands, 26 March 1985, § 23, Series A no. 91, and Armoniene, cited above [Armoniene v. Lithuania, no. 36919/02, 25 November 20081, § 36). (See Von Hannover v. Germany (no. 21, nos. 40660/08 and 60641/08), Grand Chamber, 7 February 2012, paragraph 98; emphases added.)
Against the backdrop of the above case law, it is the board’s view that the right to the protection of private life and correspondence may be interpreted as requiring Member States of the Council of Europe to adopt measures prohibiting the violation of individuals’ rights by the interception by other individuals of their e-mails sent over the Internet, subject to the exceptions mentioned in Article 8(2) ECHR.

As for the E.U.-15 the board, in this context, refers to Directive 97/66/EC that the opponent considered to be the law. Recital (2) of that Directive states:
… confidentiality of communications is guaranteed in accordance with the international instruments relating to human rights (in particular the European Convention for the Protection of Human Rights and Fundamental Freedoms) and the constitutions of the Member States.
Furthermore, Article 5 (and 14) of that Directive which the opponent also relied on (in the OPs the opponent no longer insisted on the fact that, according to Article 15(1), the last implementation date of this article was 24 October 2000, i.e. after the filing date) read :
Article 5 Confidentiality of the communications

1. Member States shall ensure via national regulations the confidentiality of communications by means of a public telecommunications network and publicly available telecommunications services. In particular, they shall prohibit listening, tapping, storage or other kinds of interception or surveillance of communications, by others than users, without the consent of the users concerned, except when legally authorised, in accordance with Article 14 (1).

Article 14 - Extension of the scope of application of certain provisions of Directive 95/46/EC 1.

Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in [Article 5] … , when such restriction constitutes a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the telecommunications system, as referred to in Article 13(1) of Directive 95/46/EC.
The board thus considers that the E.U.-15 did adopt measures to protect individuals’ rights against interception of their e-mails sent over the Internet, not only in respect of governmental requests to ISPs to monitor e-mails but also against violations by individuals, such as hackers, of the rights of other individuals, i.e. senders of e-mails.

The board notes in this respect that a distinction was made in recital 13 of the Directive between “the fundamental rights of natural persons” and “the legitimate interests of legal persons”. As far as the protection of e-mails against interception is concerned, the board however believes that the obligation to grant protection by the law exists irrespective of whether emails are sent by a natural person or by such person on behalf of a legal person. This is because the rights of both natural and legal persons in respect of the secrecy of the content of their e-mails should be afforded equal weight. Interception must be prohibited indiscriminately, subject to exceptions such as those set out in Article 8 ( 2 ) ECHR or in Article 14(1) of Directive 97/66/EC (both provisions were reproduced above).

(Regarding the right to “respect for … his home” protected by Article 8(1) ECHR, the Court held in Société Colas Est and others v. France (no. 37971/97, 16 April 2002, paragraph 41) that:
in certain circumstances the rights guaranteed by Article 8 of the Convention may be construed as including the right to respect for a company’s registered office, branches or other business premises.
It should be noted that on the filing date of 1 February 2000 not only the E.U.-15 but all EPC Contracting States were also Member States of the Council of Europe, with the exception of Monaco that joined the Council on 5 October 2004. In the light of the above, the question as to any impact of e-mail diversion to China […] has become moot also because even if it had been lawful in China to intercept e-mails the board could not take that fact into account. It should also be noted that the opponent has offered no evidence to this effect, and indeed has not even expressly alleged any instance of lawful access.

(d) Conclusion

As a consequence, C5 does not form prior art because an individual might have intercepted it from the Internet, no matter in which territory of the world.

The opponent, in the OPs, in any case focused more specifically on alleged lawful interception of e-mails by ISPs in the U.S., on the one hand, and of ISPS, as the case may be, in conjunction with law enforcement personnel in the E.U. on the other hand. Accordingly, the board relying arguendo on such lawfulness of interception will discuss the legal implications separately for each region below. In this context the board will assume, again favourably for the opponent, that it would be possible to devise technical conditions of a test that do not a priori exclude public availability of e-mails sent via the Internet and that ISPs were able, before the filing date, to intercept emails and search them on the basis of keywords […].

Whether C5 forms prior art because an ISP might have intercepted it from the Internet

The situation in the U.S.

(a) The opponent’s proposed approach

[4.8.1] Assuming lawfulness of interception of an e-mail by an ISP, the opponent proposed to assess the content of the information transmitted and its context in order to decide whether an e-mail should be deemed confidential. Such a finding would imply a duty, based on the law of confidence, for an ISP to keep the content of the e-mail secret, which, in turn, would rule out its public availability. The opponent’s proposed approach is explained in greater detail below.

The opponent asserted in the OPs that ISPs in the U.S. were, at the filing date of 1 February 2000, not required to keep data confidential because the E.U. “safe harbor” provisions had only been adopted in July 2000, i.e. after the filing date (under the Safe Harbor Agreement, U.S. signatories promise to handle the data of European citizens according to E.U. rules). The supporting evidence for the legal situation before that date, which the opponent supplied in the OPs, consists of the two documents “Opinion 1/99” and “Data Protection” […].

The “Data Protection” article of 1998 written by U.S.- based authors identifies a sharp contrast between privacy and data protection policies in the U.S. and in Europe. Where the U.S. approach had been to provide specific and narrowly applicable legislation, in Europe most countries had implemented unified supra-national policies with omnibus legislation. The article provides the following, more specific information:
The European legislation outlines a set of rights and principles for the treatment of personal data, without regard to whether the data is held in the public or private sector. In the United States, the legal tradition is much more concerned with regulating data collected by the federal government. […]

The United States has largely avoided legislation governing the treatment of sensitive personal information in records systems held by sources other than the federal government. […]
A European point of view is expressed in the paper “Opinion 1/99” by the “Working Party on the Protection of Individuals with regard to the Processing of Personal Data” (established by Article 29 of Directive 95/46/EC):

1. Privacy and data protection.in the United States is found in a complex fabric of sectoral regulation, at both federal and state level, combined with industry self-regulation. Considerable efforts have been made during recent months to improve the credibility and enforceability of industry self-regulation, particularly in the context of the Internet and electronic commerce. Nevertheless, the Working Party takes the view that the current patchwork of narrowly-focussed sectoral laws and voluntary self-regulation cannot at present be relied upon to provide adequate protection in all cases for personal data transferred from the European Union.

2. Given the complexity of the US system of privacy and data protection, the establishment in the US of an agreed “benchmark” standard of protection in the form of a set of “safe harbor” principles offered to all economic actors and US operators is a useful approach …
One may conclude from the above two documents, especially the excerpts just quoted, that data protection and privacy standards in the U.S., apart from data collected by the U.S. Federal government, were less restrictive than in the E.U. when those documents were published, i.e. in 1998 and 1999 respectively, and thus before adoption of the Safe Harbor Agreement in July 2000. Nevertheless, it must be pointed out that these two documents do not expressly establish that ISPs in the U.S. were free to disclose data to which they had access; in fact they do not mention ISPs at all.

The opponent itself has anyway acknowledged that there were restrictions on an ISP’s freedom to disclose the contents of e-mails read in transit imposed by the law of confidence, giving examples including the following:
  • an ISP administrator could reasonably expect no prohibition on passing the information in a press release to a friend,
  • but a message sent from a managing director to his board of directors which included financial information about the company and a request to store paper copies in a locked cabinet would be deemed confidential. Accordingly, both the nature and context of the information transmitted had to be assessed before a lawful reader in transit (such as an ISP administrator) could decide whether the content of an e-mail was deemed confidential and so to be treated as such.
The following excerpt from document D1 submitted by the opponent makes it clear that, at the filing date, ISPs in the U.S. were indeed prohibited by law, even though no specific legal basis is indicated, from disclosing certain information that they can access to third parties:
Most ISPs are highly ethical and have the best interests of their customers at heart; however, there have been instances of less scrupulous ISPs taking advantage of the trust their users place in them. There was a case in San Francisco where an ISP was charged with multiple counts of intercepting email traffic between January and June 1998 from one of their business customers, namely Amazon.com, and forwarding the insider information contained therein to a competitor. They settled the case with prosecutors in November 1999. There have been other instances of this type of behavior, but these cases are frequently settled with relatively little press. his is not just limited to small ISPs however, in the case of a large ISP it is much more likely that it is a renegade employee intercepting messages than the ISP itself, but the ease of interception is just the same.
The question therefore is whether the board should draw upon the opponent’s proposal to assess the content of the information transmitted and its context in order to decide whether an e-mail should be deemed confidential, thereby implying a duty, based on the law of confidence, for an ISP to keep its content secret (in the OPs the parties said that breach of confidence might amount to a tort, but did not enter into greater detail). Where content and context of the information transmitted suggested no such duty, then the ISP would be free to pass it on to anybody (referred to by the opponent as the “proportionality” test; see below, under point (b)(i)) . Then the information would have to be considered publicly available within the meaning of A 54(2) EPC 1973. In dealing with this topic, the board, as stated, assumes arguendo that any ISP involved in the transit of e-mail C5 was indeed able, at a relevant date before the filing date, to assemble the various e-mail packets into a complete e-mail and to search e-mails on the basis of keywords. The opponent’s submissions obviously imply that it was generally not unlawful for U.S. ISPs to intercept e-mails, and the following analysis is based on this assumption.

(b) The board’s position regarding the opponent’s approach

The board is not convinced that the opponent’s proposal reflects the right approach.

(i) The lack of relevance of intent

Content and context cannot be considered to be decisive for determining whether an e-mail is to be treated as confidential. Content and context thus cannot serve as a basis for drawing a distinction between e-mails with publicly available and non-available content. This follows from the considerations below.

The “proportionality” test suggested by the opponent is not convincing. In reality, this is a (binary) threshold test, i.e. whether the information attains a certain threshold of confidentiality, so the person reading it lawfully would decide that he was not permitted to disclose it. (Given that “proportionality” is the relationship of two variables whose ratio is constant, a genuine proportionality test would establish the degree of disclosure permitted to be made depending on the degree of confidentiality.) In determining whether that threshold has been reached, the content and context would be decisive because they would make it possible to identify the sender’s intent […]. The patentee also expressly suggested relying on intent to assess confidentiality.

Consequently, this test involves a subjective element for determining whether an e-mail is to be treated as confidential and thus, under the law of confidence, in the parties’ submissions, is prohibited from being disclosed. The decision of the Enlarged Board of Appeal in case G 1/92 [2.1], however, meant to exclude a subjective element from the assessment of novelty. Novelty thus implies an entirely objective assessment. This must take into account the nature of e-mail communication as point-to-point or point-to-multipoint transmission, not to the public at large, and the ISPs’ role as transmission facilitators, not forwarders of single messages to indiscriminate addressees. For that reason alone the e-mails that ISPs can access must be treated as one single set of confidential messages. Given that, according to the opponent’s submissions, the law of confidence (whatever the specific rules may be) prohibits their disclosure, the e-mails must all be deemed to be non-public, unless a specific instance of divulgation has been proven. Therefore, in this context, there is no need to assess any impact of disclaimers indicating confidentiality of e-mail content, no matter how they are phrased (e.g. whether personal to the sender or added automatically).

In addition, an intent-based approach would on balance not be more practical, as the patentee contends, than identifying the e-mail route and the law in the territories traversed. This is because such an approach would involve a large grey area where intent could not be readily identified. What about, for instance, company financial information presented like a press release, but confidential? Furthermore, a person lawfully reading an e-mail would have to know the applicable specific rules of the law of confidence in order to be able to decide whether or not disclosure of the content of a specific e-mail was lawful.

The board wishes to point out that the considerations under this point (i) not only apply to ISPs in the U.S. but .also to individuals intercepting e-mail traffic lawfully anywhere in the world. This scenario has not been taken into consideration above in relation to the E.U.-15 and the U.S. because the parties considered that interception was prohibited in those territories (see point 4.7.3 (b) above). Thus, even if in the U.S. (or elsewhere in the world) it had been lawful for the public at large to intercept e-mails before the filing date, then they would have had to make the’same assessment as ISPs to ascertain whether the e-mail in question had been intended by its author to be kept confidential. Because of this necessarily subjective element that G 1/92 had sought to exclude, e-mail traffic as a whole must be rated confidential. It is also for this reason, in addition to those given above, at point [4.7.3 (c)], that C5 does not form prior art because an individual might have lawfully intercepted it. from the Internet.

(ii) ISPs being in a situation analogous to that of an NDA

The board notes that, in exploring the issue of public prior use in T 809/95, the board deciding that case addressed the question of whether the persons who had tested the allegedly prior used product had had an interest of their own in secrecy. In this regard, the board relied on T 830/90 [3.2.2]. The present board takes the view that, where such a party’s own interest in secrecy can be established, then the situation will be analogous to that of a nondisclosure agreement between the parties involved.

In this respect, the board considers that, at the date of transmission of C5 (or C3) before the filing date of 1 February 2000, independent of any applicable data protection and privacy or tort law, there generally was an expectation not only among e-mail users in the E.U., where, according to the opponent, stricter rules applied than in the U.S., but also among many e-mail users in the U.S., that not only e-mail messages which a lawful reader could rate as confidential, but also those that were clearly non-confidential would not be freely forwarded to third parties, irrespective of any legal prohibition against doing so.

As already mentioned, the two documents “Opinion 1/99” and “Data protection” are silent as to ISPs’ duties relating to data protection and privacy. Furthermore, the opponent, while referring to “typical terms and conditions in an ISP contract” has not provided any such boilerplate agreement. The opponent has therefore not established that, even assuming freedom to forward a non-confidential e-mail to anybody for lack of prohibition under data-protection and privacy law, or tort law relating to confidence, an ISP was likewise allowed to pass on e-mails to third parties for lack of prohibition by contractual provisions. Nor has the opponent proven that, in the absence of such contractual provisions, there was also no general expectation on the part of e-mail users that ISPs would not forward emails. It would have been for the opponent to adduce appropriate evidence to that effect. Again, it is not for the board to make enquiries as to the state of the pertinent U.S. law and practice at the date of transmission of C5.

Given that forwarding e-mails to third parties might be detected, this might hurt the ISP’s reputation, which in turn would bring about the danger of losing customers. The board therefore concludes that an ISP had a business interest of its own in keeping secret the e-mails to which it had access.

On the other hand, the board does not deny that there may have been several possible ways for ISPs to exploit e-mail content that might not have been frowned upon by many customers in the U.S. An example may be the use of e-mail content for drawing up profiles of the consumption habits of holders of e-mail accounts and selling those profiles to advertisers for targeting email senders with advertising corresponding to those habits. Obviously, however, from such profiles no advertiser could derive the content of a specific e-mail such as C5.

In conclusion, applying the rationale derived from T 809/95 and T 830/90, the ISP’s identified business interest in keeping e-mails secret creates a situation analogous to that of a non-disclosure agreement between the ISP and its customers. The fact that an ISP, through staff members instructed accordingly, might lawfully have read e-mails in transit has not therefore made those e-mails publicly available, independent of whether or not there were legal provisions (of data-protection and privacy law, or tort law) prohibiting the forwarding of those e-mails.

Regarding the role of ISP employees acting on their own behalf, the board notes the following. As indicated in the above quote from the document “Data Protection” there may be renegade ISP employees passing on e-mails to third parties. To that extent the considerations above relating to ISP companies apply mutatis mutandis. Employees also have a business interest in keeping the e-mails secret, because otherwise their companies and themselves might have to face severe consequences and thus ISP employees might lose their jobs. Nothing more need be said here, and nothing more can be said failing access to copies of typical employment contracts between ISPs and their employees which the opponent has not furnished.

(c) Conclusion

In the light of the above findings made under the assumption that U.S. ISPs were entitled to lawfully intercept e-mails transmitted over their networks, email C5 has not become publicly available for that reason alone if it passed via the U.S. The opponent would have had to prove a specific instance of disclosure of that e-mail.

The situation in the E.U.

(a) Disclosure by ISPs

[4.8.2] As a preliminary matter the board notes that since lawful access to e-mails by U.S. ISPs at the filing date did not put e-mails into the public domain, this must be true a fortiori for the E.U. on the basis of the opponent’s submissions, according to which U.S. ISPs had greater leeway than E.U. ISPs in dealing with e-mail content that had been lawfully intercepted. It is therefore only for the sake of completeness that the board will now discuss below the opponent’s submissions on the E.U. situation.

The opponent argued that, as in the U.S., no general prohibition to intercept e-mail applied to ISPs in the E.U.-15 at the filing date of 1 February 2000. Article 5 of Directive 97/66/EC prohibited interception within the E.U. “except when legally authorised”, i.e. in accordance with Article 14(1) of that Directive (the pertinent part of which is reproduced above, at point [4.7.3(c)]). Administrators at an ISP would routinely access random e-mails to check that ISP policies were being complied with or address technical issues or comply with government requests. ISPs in the E.U.-15 were not generally allowed to disclose e-mail content. However, it was likely that at least one ISP administrator in the E.U. had not inferred any duty of confidence from the content and context of the e-mail C5 Hence, the content of e-mail message C5 had to be deemed made available to the public.

The board has already dismissed the analogous reasoning in relation to U.S. ISPs above under points 4.8.l(b), which applies mutatis mutandis. As for the situation in the E.U.-15. the board in addition refers to its discussion of Article 8(1) ECHR in the context of interception by a member of the public, at point [4.7.3 (c)] above. here the board concluded that the right to the protection of private life and correspondence may be interpreted as requiring the adoption of measures prohibiting the violation of individuals’ rights by other individuals by the interception of their e-mails sent over the Internet, subject to the exceptions mentioned in Article 8(2) ECHR. The board is of the opinion that Article 8(1) ECHR also requires the adoption of measures prohibiting the disclosure by ISPs, independent of content and context, of e-mails which, under these exceptions, they may have lawfully intercepted. In this context the board recalls that, pursuant to Article 5 of Directive 97/66/EC, E.U.- 15 “Member States shall ensure via national regulations the confidentiality of communications by means of a public telecommunications network and publicly available telecommunications services.”

The board is of the opinion that ISP employees must generally be considered to be law-abiding, i.e. to heed legal prohibitions of disclosure of e-mails, until the opposite has been proven in a specific case. Under these circumstances. to establish disclosure of an e-mail to the public by ISPs in the E.U., the above-mentioned legal situation lends additional weight to the conclusion that it would have been for the opponent to prove a specific instance of such disclosure.

(b) Disclosure by law-enforcement personnel

As for the-situation in the E.U., the opponent not only relied on ISPs’ lawful activities, but also on those of law-enforcement personnel. In the OPs, the opponent focused on exceptions in Directive 97/66/EC for law enforcement, arguing that, in this respect, the “proportionality” test applied to the prosecutor issuing requests to an ISP, not to ISP personnel.

The opponent more specifically referred to the situation in the U.K. under the Regulation of Investigatory Powers Act (RIPA) concerning encryption. These submissions are based on document 09 […], where it was stated that the RIP Bill was introduced in particular “to comply with the new Human Rights Act” (see 09, second paragraph of section 7, at page 53). The British Chamber of Commerce (BCC) expressed concerns that interception under RIPA having been lawful (i.e. permitted by Directive 97/66/EC) there was a potential danger that critical company information could be published.

According to 09 (at point 7, first full paragraph), the regulatory intents regarding encryption were first mentioned in 1996, but Royal Assent to RIPA was given only in July 2000. The filing date of the patent in suit is 1 February 2000. The board therefore is at a loss to see how RIPA could conceivably be of relevance for the present case.

It is therefore needless to say that more than 10 years had passed since adoption of RIPA when the opponent first relied on RIPA in its submission of 11 March 2011, without providing any indication as to whether the BCC’s misgivings were justified in the light of experience with interception on the basis of RIPA.

Favourably for the opponent, the board still supposes that law-enforcement authorities in both the U.K. and the other fourteen Member States of the E.U. on 1 February 2000, were, under certain circumstances, entitled to request ISPs to intercept non-encrypted information. In this respect, no evidence has been submitted as to which information would have been divulged in such circumstances. The board therefore considers that law-enforcement personnel must be presumed to have acted lawfully unless the opposite is proven in a specific case.

ISPs outside the U.S. and the E.U.-15

[4.8.3] In the absence of pertinent submissions by the parties, the board assumes that the considerations made for U.S. ISPs apply mutatis mutandis. 

Conclusion

[4.8.4] E-mail C5 has not become publicly available for the sole reason that an ISP in the U.S., in the E.U.-15 or in other territories of the world may have lawfully intercepted it and that in the E.U.-15 law-enforcement personnel may have lawfully obtained access to intercepted e-mails at their request. For a finding of public availability of e-mail C5 it would have been necessary for the opponent to establish that e-mail C5 had been disclosed by ISP or law enforcement personnel to the public in at least one single instance. The opponent however expressly confirmed in the OPs that it was not making such an assertion. 

Overall conclusion regarding claim 1

[4.9] Given the above findings, C5 does not form prior art, and from I2 alone the skilled person would not arrive at the subject-matter of claim 1 without an inventive step. The opponent has not based its challenge to inventive step on a combination other than I2 and C5. The subject-matter of claim 1 is thus inventive. The same applies to claim 2 which depends on claim 1.

To download the whole decision or have a look at the file wrapper, click here.

NB: I like the concise (French) summary of this decision on Le blog du droit européen desbrevets.

0 comments: