AGENCY:

U.S. Copyright Office, Library of Congress.

ACTION:

Notice of proposed rulemaking.

SUMMARY:

The Copyright Office is issuing a revised proposed rule to make electronic-only books published in the United States subject to the Copyright Act's mandatory deposit provisions if they are affirmatively demanded by the Office. In response to comments received in response to the Office's April 16, 2018 Notice of Proposed Rulemaking, the revised proposed rule makes additional clarifying edits to the definition of an “electronic-only book” and adjusts the requirements related to employment of technological protection measures. This document also updates the public on developments subsequently announced by the Library of Congress related to certain questions raised in public comments with respect to its digital collection strategy and information technology security matters.

DATES:

Written comments must be received no later than 11:59 p.m. Eastern Time on July 29, 2020.

ADDRESSES:

For reasons of government efficiency, the Copyright Office is using the regulations.gov system for the submission and posting of public comments in this proceeding. All comments are to be submitted electronically through regulations.gov. Specific instructions for submitting comments are available on the Copyright Office website at https://www.copyright.gov/​rulemaking/​ebookdeposit. If electronic submission of comments is not feasible due to lack of access to a computer and/or the internet, please contact the Office using the contact information below for special instructions.

FOR FURTHER INFORMATION CONTACT:

Regan A. Smith, General Counsel and Associate Register of Copyrights, regans@copyright.gov; Kevin R. Amer, Deputy General Counsel, kamer@copyright.gov; or Mark T. Gray, Attorney-Advisor, mgray@copyright.gov. They can be reached by telephone at 202-707-3000.

SUPPLEMENTARY INFORMATION:

I. Background

A. Mandatory Deposit Under the Copyright Act Generally

Section 407 of title 17 requires that the owner of the copyright or the exclusive right of publication in a work published in the United States, within three months of publication, deposit “two complete copies of the best edition” with the Copyright Office “for the use or disposition of the Library of Congress.” ^[1] The “best edition” is defined as “the edition, published in the United States at any time before the date of deposit, that the Library of Congress determines to be most suitable for its purposes.” ^[2] These requirements are governed by section 202.19 and Appendix B of part 202 of the Office's regulations, which set forth rules and criteria, respectively, for the different types of works subject to the mandatory deposit requirement.

Under the statute, the Register of Copyrights may issue a written demand for works at any time after they have been published in the United States, and failure to deposit after a demand may subject the recipient to monetary liability.^[3] Compliance with this section is separate from the copyright registration process, but the Copyright Act provides that deposits made under section 407 may be used to satisfy the registration deposit provisions under section 408, if all other registration conditions are met.^[4]

Certain categories of works are not subject to mandatory deposit. As set out in the statute, unpublished works and foreign works that have not been published in any form in the United States do not have to be deposited. In addition, under section 407(c), the Register can, by regulation, exempt any categories of material from section 407's mandatory deposit requirements or demand only one copy to provide a “satisfactory archival record of a work.” Under this authority, the Register has excluded numerous categories of works from the mandatory deposit requirement, such as greeting cards, architectural blueprints, and three-dimensional sculptural works.^[5]

B. Regulations Regarding Mandatory Deposit of Electronic-Only Materials

In 2010, the Office issued an interim rule (the “2010 Interim Rule”) codifying its established practice of excluding from mandatory deposit requirements all “[e]lectronic works published in the United States and available only online.” ^[6] The 2010 Interim Rule referred to such works as “electronic-only.” In generally excluding electronic-only works from the mandatory deposit requirement, the Office also, however, adopted an exception to this exemption, requiring the deposit of electronic-only serials if affirmatively demanded by the Office.^[7] An electronic-only serial is “an electronic work published in the United States and available only online, issued or intended to be issued on an established schedule in successive parts bearing numerical or chronological designations, without subsequent alterations, and intended to be continued indefinitely.” ^[8] This category includes “periodicals, newspapers, annuals, and the journals, proceedings, transactions, and other publications of societies.” ^[9] The 2010 Interim Rule stated that any additional categories of electronic-only works would first be “identified as being subject to demand” through a rulemaking with notice and comment before the Office issues any actual demands for such works.^[10] The present proposed rule is one such rulemaking.

C. 2016 Notice of Inquiry Regarding Expansion of Demand-Based Deposit

In 2016, the Office issued a notice of inquiry (“NOI”) that proposed to finalize the 2010 interim rule and to add a new category of online works—electronic-only books—to the demand-based mandatory deposit scheme.^[11] The Office sought comments on four topics: (1) The efficacy of the interim rule, including whether it adequately serves the needs of the Library and other affected parties and whether it could serve as a good framework for adding additional categories of electronic works to the mandatory deposit system; (2) the Library's access policy as applied to both electronic-only serials and, potentially, to electronic-only books; (3) “information technology, security, and/or other requirements” that should apply to the receipt and storage of, and access to, electronic-only books; and (4) how the “best edition” requirements should be applied to the mandatory deposit of electronic-only books. The Office received fifteen comments on the proposed changes. While some of the comments praised the efforts to collect more works in the identified categories, others expressed reservations.

D. 2018 Proposed Rule Regarding Electronic-Only Book Deposit

In April 2018, the Office issued a notice of proposed rulemaking (“2018 NPRM”) seeking public comment on a proposal to finalize the interim rule and to extend the demand-based mandatory deposit requirements to electronic-only books.^[12] The 2018 NPRM proposed that the term “electronic-only book” be “defined broadly as an electronic literary work published in one volume or a finite number of volumes published in the United States and available only online,” with some exclusions for specific types of works such as serials, audiobooks, websites, blogs, and emails.^[13] To clarify how the rule would apply in the context of books available for print-on-demand, the definition provided that a work would be deemed available only online “even if physical copies or phonorecords have been made on demand for individual consumers, so long as the work is otherwise available only online.” ^[14]

The 2018 NPRM also addressed questions raised by commenters regarding Library access policies and information technology requirements. The Office proposed to modify existing regulations to apply the same access policies to deposited electronic-only books as those applicable to electronic deposits of newspapers: Access would be provided only to authorized users on Library of Congress premises and off-site to Library staff as part of their assigned duties via a secure connection.^[15] In response to comments expressing concern about the adequacy of the Library's technology security infrastructure, the 2018 NPRM provided information on the recent steps taken by the Library to address its information technology needs, including the appointment of a permanent Chief Information Officer, the implementation of security standards, and the use of comprehensive security testing for all Library systems.^[16]

Finally, the proposed rule established “best edition” requirements for electronic-only books, adopting provisions from the Library's Recommended Formats Statement with some clarifying language regarding the “completeness” of a work.^[17] These provisions also included a requirement that depositors remove technological measures that control access to or use of the work, as is currently required for electronic-only serials.^[18]

II. Discussion

The Office received nine comments in response to the 2018 NPRM. Commenters generally expressed agreement with the broad goal of supporting the Library's acquisition and preservation of digital materials for the benefit of the American public. The Library Copyright Alliance supported the proposed rule “because of the critical role of deposit in building the Library's collection and ensuring long-term preservation” of digital materials.^[19] Authors Guild similarly noted that the Library “cannot fulfill [its] mission today without collecting books that are published only in electronic form,” ^[20] and the Association of American Publishers stated “[p]ublishers have long supported the special privilege of the Library to collect works” through mandatory deposit.^[21] Authors Alliance supported the rule because, in its view, mandatory deposit “serve[s] the long-term interests of authors by ensuring that their creative and intellectual legacies are preserved.” ^[22]

At the same time, the comments revealed significant concern over several aspects of the proposed rule. A number of commenters requested clarification of the rule's intended scope, pointing to ambiguity in the definition of the term “electronic-only book” and uncertainty as to the collections policies that would govern acquisition decisions.^[23] Commenters also raised questions regarding the security of digital materials deposited pursuant to the rule. Some commenters urged the Office to provide additional assurances as to the adequacy of the Library's digital security practices,^[24] while others objected to the proposed requirement that deposited materials be free of technological protection measures.^[25]

The Office has carefully considered these comments and finds that they have helpfully identified several areas that would benefit from further discussion or explanation. In response to certain issues raised by commenters, the Office has made revisions to the proposed regulatory text. In addition, to further demonstrate the basis for the proposed rule, the Office is providing additional information in response to commenters' questions regarding Library collections and security policies, including to share relevant developments that occurred after the close of the initial comment period.^[26] The Office addresses each of these issues below and welcomes additional public comment. In light of the existing rulemaking record and, as noted below, the progress the Library has reported to the Office in response to the 2018 NPRM, the Office anticipates being able to reasonably move forward with finalization of the proposed rule after this round of comments.

A. Scope of Material Subject to Deposit

1. Definition of “Electronic-Only Book”

The 2018 proposed rule defined an “electronic-only book” as “an electronic literary work published in one volume or a finite number of volumes published in the United States and available only online.” ^[27] It specifically excluded “literary works distributed solely in phonorecords (e.g., audiobooks), serials (as defined in § 202.3(b)(1)(v)), computer programs, websites, blogs, and emails.” ^[28] A number of comments raised questions about the scope of materials that would be subject to mandatory deposit under this definition.

First, the National Writers Union (NWU) found certain terminology in the proposed rule ambiguous. It noted that “[t]he term `volume,' as applied to digital data, is normally used to describe a physical or virtual drive, storage device, partition, or filesystem, which can contain any number of related or unrelated files.” <sup>[29]</sup> NWU therefore believed the rule was unclear as to “which digital files or groups of files the Copyright Office considers or will deem to constitute `volumes.' ” ^[30] Additionally, NWU expressed confusion over the exclusion of “websites” and “email” from the definition, noting that “[m]ost works distributed in electronic formats are distributed either as files downloadable from the World Wide Web—i.e., as part of websites—or by email.” ^[31] Based on this interpretation, NWU reads the proposed rule to exclude, for example, all e-book files released for the Amazon Kindle because those files “can be downloaded . . . through the Amazon.com website” and thus are “part of websites.” ^[32]

After consideration of NWU's comments, the Office does not agree that the cited provisions are likely to cause confusion. When read in context, the term “volume” cannot plausibly be understood to describe a physical or digital drive that stores data. Rather, the regulatory text makes clear that the term carries its ordinary meaning as a unit in which a “literary work” is published.^[33] The language simply indicates that, for purposes of defining an “electronic-only book,” it is immaterial whether a work is published in one file or is broken into multiple files. Nor does the Office find NWU's interpretation of “websites” to be a reasonable reading. The fact that copies of a work are distributed via a website does not mean the work is part of the website. Moreover, excluding such books would be at odds with both the purpose of the rule and Copyright Office practice. As the NOI explained, this proceeding is intended to facilitate collection of “electronic books that have been published solely through online channels,” ^[34] which certainly would include books distributed through major platforms such as Amazon. Further, the Compendium of U.S. Copyright Office Practices provides that a “work that is perceptible to the user only by downloading or separately purchasing that particular work is not considered part of the website for registration purposes and must be registered separately.” ^[35]

Second, the Authors Guild noted that the proposed regulatory language did not address the length of works subject to the rule even though “books are generally defined as longer literary works.” ^[36] It recommended modifying the rule to clarify that “very short works, such as a single poem or a string of tweets,” are not covered.^[37]

Although the 2018 NPRM noted that the Library “does not intend to obtain blog posts, social media posts, and general web pages” through this rule,^[38] the Office agrees that that limitation could be made clearer in the regulatory text itself. The Office therefore proposes revising the definitional language to expressly exclude “short online literary works such as social media posts.” The Office considered the possibility of adopting a longer and more detailed list of exclusions but ultimately concluded that such an approach would be infeasible given the speed at which new online services emerge. Moreover, any attempt to further limit the subclasses of literary works subject to the rule could result in the exclusion of certain works that fall within the rule's intended scope. For example, excluding “poems” would not be advisable, as some poems are long enough to constitute a book (e.g., Paradise Lost). As noted in the 2018 NPRM, the Office recognizes that the traditional definition of a physical book “does not translate neatly to the digital environment” and that distinguishing “electronic-only books” from other types of online literary works may be difficult in certain cases at the margins.^[39] Nevertheless, the Office continues to believe that the overall definitional approach set forth in the 2018 NPRM strikes an appropriate balance between ensuring that the Library retains sufficient flexibility in its acquisition decisions, and making clear that rule's intended focus is on “textual works that are marketed or presented as `electronic books' and other monographic works such as organizational reports and long-form essays”—and not on blogs, social media posts, websites, and the like.^[40] The additional language proposed here further clarifies this distinction.

Third, the Authors Guild suggested that the proposed definition is underinclusive because the phrase “available only online” might not encompass electronic books distributed offline, such as books preloaded onto e-readers or tablets.^[41] The Authors Guild proposed instead that references to a work being “available only online” be replaced with “available in electronic form.” ^[42] The Office agrees that works of this type should be covered by the rule, but the language proposed by the Authors Guild potentially could sweep in electronic works that are also published in physical form. The Office believes that a more targeted solution is to address this situation in the section of the rule defining when a work is considered to be available only online. The revised proposed rule adds language to that definition providing that a work shall be deemed to be available only online “even if copies have been loaded onto electronic devices, such as tablets or e-readers, in advance of sale to individual consumers, so long as the work is otherwise available only online.”

Fourth, AAP raised questions about the rule's requirement that “[a]ll updates, supplements, releases, and supersessions” of the work be deposited in a timely manner. AAP requested that the Office define the terms “updates, supplements, releases, and supersessions” and sought clarification as how the Office would treat books available in print whose digital editions contain additional content or revisions.^[43] After consideration, the Office does not believe modification of the regulatory text is necessary. The language regarding updates and similar material is analogous to a longstanding requirement in the best edition regulations for printed textual matter, which require “the regular and timely receipt of all appropriate looseleaf updates, supplements, and releases.” ^[44] The deposit requirement for updates to electronic-only books will be administered in the same manner that publishers are accustomed to for printed material. Nor is revision required to accommodate books available in print with additional content in a digital version. Where a work is available in both digital and print editions, the work is not “available only online,” and thus is not subject to the rule. To the extent the digital version contains supplementary material that is not published in the physical version, the electronically enhanced version would be subject to demand if it constitutes a separate “work” under the Copyright Act and is not otherwise excluded from the rule.

Fifth, the Office has determined that the rule should be revised to further clarify when print-on-demand books are to be deemed “available only online.” The original proposed rule provided that “[a] work shall be deemed to be available only online even if physical copies have been made on demand for individual consumers, so long as the work is otherwise available only online.” ^[45] The Office proposed that definition to address commenters' concern that, in the case of books made available for printing by individual consumers, “it [would] be difficult for publishers to determine whether such works are subject to the general exemption for electronic-only works (and the demand-based mandatory deposit scheme proposed here), or whether they are subject to affirmative mandatory deposit requirements.” ^[46] The 2018 NPRM thus contemplated that a work would qualify as an e-book under the rule even if copies were “printed privately, in consumers' homes, or at kiosks at brick-and-mortar bookstores.” ^[47]

That situation, however, is distinguishable from a business model in which an author, publisher, or distributor prints copies in response to purchases by individual consumers. For example, a physical or online retailer might place orders for printed copies of a particular title only as individual requests for that title are received from customers, as opposed to ordering multiple copies from the publisher in advance of any customer purchases. These books are outside the scope of this rule, and instead remain subject to the general mandatory deposit obligation under section 407. In circumstances where a retailer provides a physical copy for sale, it is immaterial to the purchaser—and likely unknown to acquisition specialists at the Copyright Office—whether the retailer has multiple copies on hand or obtains them individually to fulfill purchases as they occur. To make this distinction clear, the Office has amended the proposed rule to more precisely refer to books made available for on-demand printing by individual consumers, as distinguished from on-demand activities performed by distributors, publishers, retailers, or others in the supply chain. The revised language provides: “A work shall be deemed to be available only online even if copies have been made available to individual consumers to print on demand, so long as the work is otherwise available only online.” ^[48]

2. The Library's Collections Policies

In discussing the scope of materials subject to deposit under this rule, a number of commenters sought additional information about the Library of Congress's specific collections policies. As the AAP put it, “[i]n providing for the transfer of said copies through mandatory deposit, Congress made clear that the Library must make demands under Section 407 with a purpose.” ^[49] The NWU stated that it “remain[ed] puzzled as to what works the Copyright Office intends to demand be deposited” under the proposed rule,^[50] and the Authors Guild desired to see a “comprehensive collection strategy” from the Library before finalization of a rule.^[51] The Copyright Alliance expressed concern that there was a “lack of a clear and cohesive digital collections strategy within the Library of Congress” and requested the opportunity to give input into that strategy.^[52] And with respect to collection and preservation of digital materials specifically, the Authors' Guild explained, “[i]t is our understanding that the Library has not yet created and adopted a comprehensive strategy for safely storing books published in electronic form, despite the fact that e-books and electronic audio books have been a significant and growing percentage of books published for over a decade.” ^[53]

As the 2018 NPRM indicates, the Copyright Office consults with the Library and relies on those discussions along with the Library's public statements in considering and responding to commenters' concerns in this area.^[54] According to the Library, the criteria used to determine what electronic materials to acquire “do not greatly differ from those used for other formats.” ^[55] The Library prepares subject-specific Collections Policy Statements (e.g., Education, Chemical Sciences, Medicine, Theater) and makes them available on its website.^[56] These policies detail what kinds of works the Library seeks to collect and at what level of comprehensiveness. For example, the Political Science statement notes that the Library seeks to “collect[ ] all the important current reference works” in the field, regardless of language, while it collects foreign textbooks “on a highly selective basis.” ^[57] The Library also maintains supplementary guidelines to assist in applying these standards to electronic works.^[58] For example, the guidelines note that criteria weighing in favor of acquisition include the at-risk nature of a work or its availability only in digital format.^[59] In general, however, the Office understands that Library acquisition decisions involving electronic materials are governed by the relevant Collections Policy Statement, as is true for works in physical format.^[60] As the Library's Collection Development Office has explained, this policy reflects the Library's effort to develop “one interdependent collection that contains both its traditional physical holdings and materials in digital formats.” ^[61]

With respect to commenters' concerns about the Library's digital strategy,^[62] the Library has provided further public information following the close of the comment period, most notably in its five-year strategic plan and in a formal digital strategy document that supports the strategic plan. The 2019-2023 strategic plan, Enriching the User Experience, notes that “being digitally enabled is paramount to [the Library of Congress's] success.” ^[63] Describing digital efforts as an “ongoing process,” the plan states that in the next five years the Library will streamline its operational capabilities and undertake efforts to identify gaps in expertise and recruit new talent to fill those gaps.^[64] The Library's digital strategy, published in April 2019, describes a five-year plan for expanding its digital collections and providing access to that material, in connection with the Library's broad goals of “throwing open the treasure chest, connecting, and investing in our future.” ^[65] It notes that the Library intends to “exponentially” expand its digital collections, provide “maximum authorized access” to material in the collection depending on the type of patron, and use “verifiable chain of custody” to ensure the authenticity of digital material and prevent digital deterioration.^[66]

The Library also has worked to implement the recommendation made in an April 2015 report by its Inspector General (“OIG”) on these issues.^[67] In March 2018, the OIG noted that the Library had made progress toward creating “an overarching, transformative eCollections Strategy for collecting electronic works” by aligning all electronic collection under a single Digital Collecting Plan.^[68] A subsequent OIG report noted that the Library has provided evidence of its efforts toward closing this recommendation, including “current Library of Congress Collections Policy Statements, which include digital content and proof that digital collecting is part of overarching Library collections strategies.” ^[69] The report further noted that the Library and OIG met in September 2019 to discuss next steps to achieve closure of the remaining e-deposit and e-collections recommendations.^[70]

The Office interprets this additional information to further clarify that the Library's plans to increase its digital collection do not reflect a shift in the content-based considerations underlying its collections policies. Rather, the Office understands that the Library's digital collections policies are substantively the same as its policies for physical works, and so an expansion of the mandatory deposit rule to electronic-only books would not significantly change the nature of the Library's collections activity.

B. Technological Protection Measures

The 2018 proposed rule provided that “technological measures that control access to or use of the work should be removed.” ^[71] In support of that requirement, the 2018 NPRM noted that while technological protection measures (“TPM”s) “provide significant security assurances, . . . encumbering deposited copies with such protections would conflict with the Library's purposes of preserving the works.” ^[72] This requirement was adopted for electronic serials in the 2010 interim rule ^[73] and, to the Office's knowledge, has functioned without issue for those deposits.

Some commenters objected to extending this requirement to electronic-only books. For example, the Authors Guild expressed concern that in some instances, the only published edition of a book may be one employing technological protection measures, and that requiring removal would force some publishers to “transfer the files to new formats or use hacking codes to remove the controls.” ^[74] This would “not only put[ ] the author's work at risk of piracy, but [would] put[ ] an unnecessary burden on publishers, especially on authors who independently publish and small publishers.” ^[75] The Copyright Alliance pointed to this requirement as heightening concerns about the Library's IT security system, arguing that the possession of unencrypted digital works greatly increases the potential harm if the Library's storage system were ever breached.^[76]

For the reasons noted in the 2018 NPRM, the Library generally prefers TPM-free editions of works to simplify and further its preservation efforts.^[77] At the same time, the 2018 NPRM noted that the statutory deposit requirement is limited to the best published edition and “does not require the publisher or producer to create a special preservation copy simply for the benefit of the Library of Congress.” ^[78] To appropriately balance these considerations, and to respond to commenters' concerns, the revised proposed rule removes the requirement that TPMs be removed from deposit copies, but updates the Best Edition regulations in Appendix B to Part 202 to reflect the Library's preference for a TPM-free edition, if such a version has been published. That is, where a publisher has published both TPM-protected and non-TPM-protected versions of an e-book, the best edition for purposes of this rule is the latter. In accordance with the general approach of Appendix B to provide alternate options in descending orders of preference, where an electronic-only book is not published TPM-free, the proposed rule would next accept a copy for which the owner has elected to remove such technological measures.

It is important to note, however, that under section 202.24, the Office's regulations already provide that deposits “must be able to be accessed and reviewed by the Copyright Office, Library of Congress, and the Library's authorized users on an ongoing basis.” ^[79] Such language is consistent with section 407 of the Copyright Act, which obligates deposit of materials for “use or disposition of the Library of Congress” in its collections.^[80] So as a floor, the proposed rule clarifies that deposits must be otherwise provided in a manner that meets the requirements of current section 202.24(a)(4). In sum, depositors must take reasonable steps to ensure that the Library is able to access the work to the extent necessary for preservation and other lawful uses.^[81] In the case of a TPM-protected work, such efforts might include providing the same access codes that are available to purchasing consumers. And as explained in the NPRM, “in the unlikely event that the Library seeks to acquire a work that is only published in a proprietary format that cannot be viewed by the Library, the Office will work with the publisher to identify a means to access the work.” ^[82]

C. Library of Congress IT Security

Several comments were directed not at the specific regulatory text in the proposed rule but instead at the Library's IT security practices and the ability of the Library to secure electronic deposits from digital theft. The 2018 NPRM briefly discussed the Library's work in this area,^[83] but in light of the level of concern expressed by commenters, and because of important developments that have occurred since the close of the prior comment period, the Office is providing additional information shared by the Library that speaks to these issues.

Many commenters from organizations representing copyright owners were reluctant to support the proposed rule without additional assurances regarding the Library's security capabilities. The Authors Guild stated that it was “premature” to finalize a rule until the Library could “ensure[ ]” the security of e-books, and requested that a full security plan be explained and “vetted with publishers.” ^[84] The Copyright Alliance requested that the Library “demonstrat[e] the adequacy of the Library's IT system” before finalizing a rule, lest the Office “put[ ] the cart before the horse” in demanding “blind faith” from copyright owners that the Library will protect deposits.^[85] And AAP said it would be “premature” and “nothing short of reckless” to issue a final rule before implementation of the recommendations of the Government Accountability Office (“GAO”) in its 2015 report on the Library's IT management.^[86]

The Copyright Office appreciates concerns about the security of digital deposits and agrees that the Office and Library occupy a position of public trust with respect to copyright deposits. It is incumbent on both organizations to operate in accordance with that trust. As the Library has stated in its digital strategy, “[p]romoting creativity and building cultural heritage collections entails protecting creators' intellectual property rights. This responsibility is salient at the Library, as the home of the United States Copyright Office.” ^[87] After consultation with the Library, the Office is sharing additional information provided to it that discusses the significant effort the Library has undertaken to revamp its IT operations and ensure the integrity of its electronic deposits and other digital material in its collections.

As an initial matter, the Library has provided assurances of its commitment to digital security, both in public statements and in consultations with the Office. As the Library's Chief Information Officer testified to Congress in December 2019, “the Library is well aware of the need to ensure the security of the digital content in [its] care.” ^[88] He also has testified that the Library is implementing encryption for electronic copyright deposits, putting such materials on the same footing as other sensitive Library data.^[89] Likewise, the Library has informed the Office that electronic deposits are given the same level of security as other highly sensitive information held by the Library, such as congressional material. According to the Library, this material is stored on a network that complies with the security standards established by the National Institute of Standards and Technology (“NIST”),^[90] including standards SP 800-53 Rev. 4 ^[91] and FIPS 140-2,^[92] among others. NIST creates these security standards as required by the Federal Information Security Management Act,^[93] which seeks to ensure that federal agencies “incorporate adequate, risk-based, and cost-effective security compatible with business processes.” ^[94] Through its systems, the Library has received tens of millions of digital files in the last decade, including over 300,000 electronic serial issues and 460,000 electronic books received under the interim rule or pursuant to special relief agreements with publishers. As the Library has reported to the Copyright Office, in no known instance has the Library's security been breached or its digital collections stolen.

Since the 2018 NPRM was published, the Library has provided additional detail on its IT security policies in several recent public statements, including congressional testimony. The Library's Chief Information Officer recently testified that the Library has “significantly increased our IT security posture over the last few years. We have implemented NIST security standards, with role based security, to ensure that users only have access to the data they are supposed to see.” ^[95] He further noted that the Library regularly conducts penetration tests of its high value assets and “are implementing encryption—at-rest and in-motion—for all sensitive Library data, including e-deposits.” ^[96] Noting that “[s]ecurity is always a top priority for all Library IT,” he further stated that the Library employs cybersecurity professionals to proactively monitor, test, and oversee security of the Library's systems.^[97]

The Librarian has similarly testified that the Library had made “significant IT security improvements” and cybersecurity enhancements “to heighten the detection of threats, thwart denial of service attacks, protect against malware and enable continuous monitoring so that issues are prevented, and if they occur, quickly identified and resolved.” ^[98] Other improvements highlighted by the Library include requiring all staff to use multi-factor authentication to access the Library's systems,^[99] upgrading the Library to a new data center that reduces the risk of service interruptions,^[100] and participating in the Legislative Branch Cyber Security Working Group, which facilitates the exchange of expertise and coordination in response to security threats.^[101]

More generally, the Library has sought to provide greater coordination by centralizing all IT efforts under the direction of the Office of the Chief Information Officer (“OCIO”). As the Librarian has explained, centralization was completed in October 2018 (after the close of the comment period), and now OCIO serves as the “single authoritative source for technology” at the Library.^[102] The Library has stated that it views IT centralization as key to enabling more efficient use of IT resources and improving IT security.^[103]

In addition, in late 2019 the Library launched a Digital Collections Management Compendium (“DCMC”), an online resource that collects the Library's policies and practices for management of its digital collections.^[104] The DCMC is intended to “broadly explain the Library's practices for managing digital content for the public.” ^[105] It includes information about how the Library keeps inventory and tracks use of digital material, who is responsible for the security of digital collections, and what policies govern user permissions and periodic reviews of staff accounts.^[106] For example, its guidance for digital collections security for stored digital content states:

To safeguard digital collections, the Library will develop and follow policies to ensure that only authorized user accounts and systems may modify digital collection content. Inventory systems maintain logs of actions on digital content by digital content managers as well as systems. No single user should be able to unilaterally move or delete digital content without following an established procedure or system protocol, which can be monitored according to the documentation and recordkeeping of actions in inventory logs.^[107]

The DCMC also sets out a set of principles to be followed by the Library in providing access to digital collections that are supplementary to the regulatory restrictions established in 37 CFR 202.18, including “communicat[ing] known restrictions” on digital works to patrons and requiring patrons seeking use of digital items to “mak[e] independent legal assessments and secur[e] necessary permissions.” ^[108]

The Library's security efforts are bolstered by oversight from the OIG, which issues public reports detailing the Library's progress. For example, the OIG's March 2019 semiannual report to Congress noted that the Library uses Security Information and Event Management (“SIEM”) functionality for “robust continuous monitoring capabilities and ongoing insight into IT security control effectiveness.” ^[109] The OIG noted that it had engaged an IT contractor to evaluate the Library's “SIEM implementation strategy and execution, internal controls, configuration, and incident detection response,” and that the Library agreed with all of the resulting recommendations.^[110] OIG also monitors the Library's security practices in connection with its April 2015 report, which recommended that the Library, in developing a comprehensive policy for digital collections, ensure that electronic collections material be protected by “robust security” to prevent “loss, alteration, and unauthorized access” ^[111] The OIG's March 2018 report stated that “the Library's IT Security Program and Systems Development Lifecycle addresses the need for robust security.” ^[112]

Further, the Library has announced significant strides toward full implementation of the GAO's 2015 recommendations.^[113] Some commenters requested that the Office wait to issue a final rule until the GAO's thirty-one public recommendations had been implemented.^[114] In late 2019, the Librarian reported to Congress that all but four of the public recommendations have been implemented and closed, and that the GAO is reviewing the Library's evidence for closing the final six (two of which are not public).^[115] Moreover, three of the four remaining public recommendations do not directly implicate security, instead involving the adoption of organizational plans for cost estimates, project scheduling, and customer satisfaction.^[116] The final outstanding public recommendation, No. 22, calls for comprehensive and effective security testing.^[117] In response, the Library advised the GAO that it has conducted monthly tests since August 2015, and in November 2019 the Library provided the GAO with security control assessments for select systems.^[118] The Library has advised Congress that it expects to achieve closure of these outstanding recommendations within the next several months.^[119]

While the Office appreciates commenters' interest in full implementation of the GAO's recommendations, it does not appear that the few remaining open items provide a basis for further delaying issuance of the proposed rule, particularly given the Library's overall efforts with respect to IT security since 2018. Collectively, those efforts support the Library's statement that it has “invested heavily in the optimization and centralization of information technology” and that “from a technological perspective, the Library of Congress today is a fundamentally different institution than it was just three short years ago.” ^[120] Further, the Library has repeatedly expressed a commitment “to ensure the security of the digital content in [its] care.” ^[121] The Office believes that these security upgrades, together with the additional IT-related information made public since the close of the prior comment period, may reasonably address the concerns raised by commenters regarding the security of digital deposits.^[122] To ensure, however, that stakeholders have an adequate opportunity to consider and respond to the information provided on this important issue, the Office invites further comment on this topic.

III. Subjects of Inquiry

After considering the comments in response to the 2018 NPRM, the Office is proposing certain revisions to the initial proposed rule. The amended rule:

(1) Redefines an “electronic-only book” to clarify that short online works, such as social media posts, are not intended to be encompassed by the rule;

(2) Clarifies that books that are preloaded onto electronic devices before those devices are sold to consumers are subject to the rule, provided they otherwise meet its requirements;

(3) Modifies the definitional language to further clarify when print-on-demand books are to be deemed “available only online”; and

(4) Removes the requirement that all technological protection measures be removed, while retaining the general requirement that deposits be able to be “accessed and reviewed by the Copyright Office, Library of Congress, and the Library's authorized users on an ongoing basis.”

The Copyright Office invites comment from the public on these proposed amendments and on the other matters discussed in this notice.

List of Subjects in 37 CFR Part 202

• Copyright

Proposed Regulations

For the reasons set forth in the preamble, the Copyright Office proposes amending 37 CFR part 202 as follows:

PART 202—PREREGISTRATION AND REGISTRATION OF CLAIMS TO COPYRIGHT

1. The authority citation for part 202 continues to read as follows:

Authority: 17 U.S.C. 408(f), 702.

2. Amend § 202.18 by:

a. Adding in paragraph (a) the words “and § 202.19, and transferred into the Library of Congress's collections,” after “under § 202.4(e)” in the first sentence;

b. Adding in paragraph (b), the words “and § 202.19” after “under § 202.4(e)” in the first sentence;

c. Adding in paragraph (c), the words “and § 202.19” after “under § 202.4(e)” in the first sentence, and d. Adding paragraph (f) to read as follows:

3. Amend § 202.19 by:

a. Revising paragraph (b)(4), and

b. Adding in paragraph (c)(5), the words “electronic-only books and” after the words “This exemption includes”.

The revisions read as follows:

4. Amend § 202.24 by:

a. Removing in paragraph (a)(2), the words “works” and adding in its place the words “electronic-only serials”.

b. Redesignating paragraphs (a)(3) and (4) as paragraphs (a)(4) and (5), respectively.

c. Adding new paragraph (a)(3).

d. Removing in paragraph (b), the words “online-only” and adding in its place the words “electronic-only”.

e. Revising paragraph (c)(3).

The addition and revision reads as follows:

6. Amend Appendix B to Part 202 by revising paragraph IX to read as follows:

IX. Electronic-Only Works Published in the United States and Available Only Online

The following encodings are listed in descending order of preference for all deposits in all categories below:

1. UTF-8.

2. UTF-16 (with BOM).

3. US-ASCII.

4. ISO 8859.

5. All other character encodings.

A. Electronic-Only Serials:

1. Content Format:

a. Serials-specific structured/markup format:

i. Content compliant with the NLM Journal Archiving (XML) Document Type Definition (DTD), with presentation stylesheet(s), rather than without NISO JATS: Journal Article Tag Suite (NISO Z39.96-201x) with XSD/XSL presentation stylesheet(s) and explicitly stated character encoding.

ii. Other widely used serials or journal XML DTDs/schemas, with presentation stylesheet(s), rather than without.

iii. Proprietary XML format for serials or journals (with documentation), with DTD/schema and presentation stylesheet(s), rather than without.

b. Page-oriented rendition:

i. PDF/UA (Portable Document Format/Universal Accessibility; compliant with ISO 14289-1).

ii. PDF/A (Portable Document Format/Archival; compliant with ISO 19005).

iii. PDF (Portable Document Format, with searchable text, rather than without; highest quality available, with features such as searchable text, embedded fonts, lossless compression, high resolution images, device-independent specification of colorspace; content tagging; includes document formats such as PDF/X).

c. Other structured or markup formats:

i. Widely-used serials or journal non-proprietary XML-based DTDs/schemas with presentation stylesheet(s).

ii. Proprietary XML-based format for serials or journals (with documentation) with DTD/schema and presentation stylesheet(s).

iii. XHTML or HTML, with DOCTYPE declaration and presentation stylesheet(s).

iv. XML-based document formats (widely used and publicly documented). With presentation stylesheets, if applicable. Includes ODF (ISO/IEC 26300) and OOXML (ISO/IEC 29500).

d. PDF (web-optimized with searchable text).

e. Other formats:

i. Rich text format.

ii. Plain text.

iii. Widely-used proprietary word processing or page-layout formats.

iv. Other text formats not listed here.

2. Metadata Elements: If included with published version of work, descriptive data (metadata) as described below should accompany the deposited material:

a. Title level metadata: Serial or journal title, ISSN, publisher, frequency, place of publication.

b. Article level metadata, as relevant/or applicable: Volume(s), number(s), issue dates(s), article title(s), article author(s), article identifier (DOI, etc.).

c. With other descriptive metadata (e.g., subject heading(s), descriptor(s), abstract(s)), rather than without.

3. Completeness:

a. All elements considered integral to the publication and offered for sale or distribution must be deposited—e.g., articles, table(s) of contents, front matter, back matter, etc. Includes all associated external files and fonts considered integral to or necessary to view the work as published.

b. All updates, supplements, releases, and supersessions published as part of the work and offered for sale or distribution must be deposited and received in a regular and timely manner for proper maintenance of the deposit.

4. Technological measures that control access to or use of the work should be removed.

B. Electronic-Only Books:

1. Content Format:

a. Book-specific structured/markup format, i.e., XML-based markup formats, with included or accessible DTD/schema, XSD/XSL presentation stylesheet(s), and explicitly stated character encoding:

i. BITS-compliant (NLM Book DTD).

ii. EPUB-compliant.

iii. Other widely-used book DTD/schemas (e.g., TEI, DocBook, etc.).

b. Page-oriented rendition:

i. PDF/UA (Portable Document Format/Universal Accessibility; compliant with ISO 14289-1).

ii. PDF/A (Portable Document Format/Archival; compliant with ISO 19005).

ii. PDF (Portable Document Format; highest quality available, with features such as searchable text, embedded fonts, lossless compression, high resolution images, device-independent specification of colorspace; content tagging; includes document formats such as PDF/X).

c. Other structured markup formats:

i. XHTML or HTML, with DOCTYPE declaration and presentation stylesheet(s).

ii. XML-based document formats (widely-used and publicly-documented), with presentation style sheet(s) if applicable. Includes ODF (ISO/IEC 26300) and OOXML (ISO/IEC 29500).

iii. SGML, with included or accessible DTD.

iv. Other XML-based non-proprietary formats, with presentation stylesheet(s).

v. XML-based formats that use proprietary DTDs or schemas, with presentation stylesheet(s).

d. PDF (web-optimized with searchable text).

e. Other formats:

i. Rich text format.

ii. Plain text.

iii. Widely-used proprietary word processing formats.

iv. Other text formats not listed here.

2. Metadata Elements: If included with published version of work, descriptive data (metadata) as described below should accompany the deposited material:

a. As supported by format (e.g., standards-based formats such as ONIX, XMP, MODS, or MARCXML either embedded in or accompanying the digital item): Title, creator, creation date, place of publication, publisher/producer/distributor, ISBN, contact information.

b. Include if part of published version of work: Language of work, other relevant identifiers (e.g., DOI, LCCN, etc.), edition, subject descriptors, abstracts.

3. Rarity and Special Features:

a. Limited editions (including those with special features such as high resolution images.)

b. Editions with the greatest number of unique features (such as additional content, multimedia, interactive elements.)

4. Completeness:

a. For items published in a finite number of separate components, all elements published as part of the work and offered for sale or distribution must be deposited. Includes all associated external files and fonts considered integral to or necessary to view the work as published.

b. All updates, supplements, releases, and supersessions published as part of the work and offered for sale or distribution must be submitted and received in a regular and timely manner for proper maintenance of the deposit.

5. Technological Protection Measures:

a. Copies published in formats that do not contain technological measures controlling access to or use of the work.

b. Copies published with technological measures that control access to or use of the work, and for which the owner has elected to remove such technological measures.

c. Copies otherwise provided in a manner that meets the requirements of § 202.24(a)(5).

Footnotes