Anticircumvention (DMCA)

The DMCA includes an exemption for both the circumvention and the circumvention device ban for programs whose sole purpose is to assist individuals to prevent minors from accessing objectionable material on the Internet. [1201(h)] This exemption is unfortunately too narrow because the technological mechanisms protecting these materials may also be used to protect other types of materials on the Internet. Developing and distributing a program that is designed for the protection of minors is vulnerable to legal liability for other uses that can be made of such a product.

The Digital Millennium Copyright Act (DMCA) is the latest amendment to copyright law, which introduced a new category of copyright violations that prohibit the "circumvention" of technical locks and controls on the use of digital content and products. These anti-circumvention provisions put the force of law behind any technological systems used by copyright owners to control access to and copying of their digital works.

The DMCA contains four main provisions:

1. a prohibition on circumventing access controls [1201(a)(1)(A)];
2. an access control circumvention device ban (sometimes called the "trafficking" ban) [1201(a)(2)];
3. a copyright protection circumvention device ban [1201(b)]; and,
4. a prohibition on the removal of copyright management information (CMI) [1202(b)].

The first provision prohibits the act of circumventing technological protection systems, the second and third ban technological devices that facilitate the circumvention of access control or copy controls, and the fourth prohibits individuals from removing information about access and use devices and rules. The first three provisions are also distinguishable in that the first two provisions focus on technological protection systems that provide access control to the copyright owner, while the third provision prohibits circumvention of technological protections against unauthorized duplication and other potentially copyright infringing activities.

The stated purpose of the DMCA is to ensure the protection of copyrighted works in the digital world by fortifying the technological blocks on access and copying of those works within a legal framework. This amendment to title 17 (the Copyright Act) was signed into law on October 28, 1998 as the United States implementation of the World Intellectual Property Organization (WIPO) Copyright Treaty adopted by countries around the world two years earlier. The DMCA implemented these recommendations in a much stricter fashion than required, giving copyright owners broader protection than was intended in the international treaty.

The shift towards the distribution of copyrighted materials in digital form has been accompanied by new methods of protection. Through the use of "digital locks," technological systems behind which these copyrighted materials are protected, producers and manufacturers are able to automate fine grained control over who can access, use, and/or copy their works and under what conditions. Producers insist these "digital locks" are necessary to protect their materials from being pirated or misappropriated. But, these new technological systems, and the DMCA provisions making it a crime to bypass them, undermine individuals ability to make "fair use" of digital information, and essentially replace the negotiation of the terms of use for those products with unilateral terms dictated by copyright owners. These self-help technical protection mechanisms are generally not evident to the purchaser or user until after the sale. In some cases, producers who use these technical locks to enforce limits on access and use of their works fail to disclose the terms of use to the purchasers or licensees of their products.

The defenses and exemptions to the circumvention prohibition and circumvention device bans included in the law are fatefully narrow. As a result, the legitimate activities of scientists, software engineers, journalists, and others have been chilled. The DMCA has been used by copyright holders and the government to prevent the creation of third-party software products, silence computer scientists, and prosecute journalists who provide hypertext links to software code.

Technological protection systems are already in place in DVDs, eBooks, video game consoles, robotic toys, Internet streaming, and password-protected sections of web sites. The fact that a digital protection may be really weak and easy to circumvent has not prevented courts from applying this law to punish those who bypass them.

The DMCA defines an access control mechanism as a measure which "in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work. See Section 1201(a)(3)(B) of the Copyright Act. An access control is a technology, like a password or encryption that controls who or what is able to interact with the copyrighted work. It is a violation of the DMCA to circumvent access controls, but it is also a violation to provide tools to others that circumvent access controls (including selling, distributing free of charge, and possibly even linking to a site with such technology).

While there is a difference in the types of activities controlled by these technological protection measures, some copyright owners try to merge access and use controls in the implementation of these systems. For example, in trying to implement a "pay-per-use" business model, some copyright owners use a single persistent control system that charges separately for the different uses of a work even after someone pays for access.

Circumvention, according to Section 1201(a)(3)(A), means "to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner." While the full scope of activities and practices that would fall under this definition has not yet been examined by the courts, any act of undoing a "lock" or "block" in a digital system may well be considered circumvention.

The prohibited tools under the DMCA are the programs which are primarily designed or produced for the purpose of circumvention of an access [1201(2)(a)] or copy control [1201(b)(1)(A)] mechanism. These programs can come in various forms including products, services, devices, or components. The DMCA includes in its definition of circumvention tools that these devices have limited commercially significant purposes other than circumvention or are marketed to be used for circumvention [1201(2)(B-C)], 1201(b)(1)(B-C)].

Congress intended the circumvention device bans to be analogous to laws that specifically prohibit the manufacture or distribution of descrambler boxes that allow access to cable television and satellite services without payment. However, the broad definition of circumvention tools in the DMCA creates numerous situations in which non-infringing uses of copyrighted works are prohibited as well merely because the technology necessary to engage in those legitimate uses is illegal under the circumvention device ban.

Section 1201(a)(2) defines distribution as the "manufacture, import, offer to the public, provide, or otherwise traffic" of circumvention tools. This definition can be interpreted extremely broadly as evident in the court's analysis in the DVD encryption Universal v. Corley case. In its decision, the court considered not only making the source code of a program for free a type of distribution, but also found that merely linking to a web site containing illegal tools can constitute "trafficking."

It depends. In general, the anti-circumvention provisions of the DMCA reserve broad authority for copyright holders to determine who can circumvent their systems.

For example, while the DMCA contains an encryption research exemption, to come under the exception, a researcher must request the permission from the copyright holder to engage in circumvention in order to be exempted [1201(g)(2)(C)]. In addition, under the DMCA only individuals who are studying, trained, or employed in encryption research are likely to be considered legitimate researchers under the law [1201(g)(3)(B)]. Finally, an encryption researcher is required to immediately notify the creator of the protection system when she breaks it. [1201(g)(3)(C)] The security testing exemption is even more restrictive in its rules about obtaining authorization from the copyright owner, requiring individuals engaged in security testing to not only request, but must actually obtain the authorization. [1201(j)(1)] On the other hand, the exemption relating to law enforcement, intelligence, and other government purposes have no such requirements to notify copyright owners of their activities. [1201(e)]

One important limitation to the control given to copyright owners is that manufacturers and developers of consumers electronics, telecommunications, or computing products are not required to design their products to respond to the digital protection systems implemented by copyright owners in their works. [1201(c)(3)] In this limitation, the DMCA anticipated the excessive control that copyright owners might exercise over the products used to play their works in addition to the works themselves.

It depends. In general, the anti-circumvention provisions of the DMCA reserve broad authority to copyright holders to determine who can circumvent their systems.

For example, while the DMCA contains an encryption research exemption, to come under the exception, a researcher must lawfully obtain the work and request the permission from the copyright holder to engage in circumvention in order to be exempted [1201(g)(2)(C)]. In addition, under the DMCA only individuals who are studying, trained, or employed in encryption research are likely to be considered legitimate researchers under the law [1201(g)(3)(B)]. Finally, an encryption researcher is required to immediately notify the creator of the protection system when she breaks it. [1201(g)(3)(C)] The security testing exemption is even more restrictive in its rules about obtaining authorization from the copyright owner. It requires individuals engaged in security testing to not only request, but must actually obtain the authorization. [1201(j)(1)] On the other hand, the exemption relating to law enforcement, intelligence, and other government purposes have no such requirements to notify copyright owners of their activities. [1201(e)]

One important limitation to the control given to copyright owners is that manufacturers and developers of consumers electronics, telecommunications, or computing products are not required to design their products to respond to the digital protection systems implemented by copyright owners in their works. [1201(c)(3)] In this limitation, the DMCA anticipated the excessive control that copyright owners might exercise over the products used to play their works in addition to the works themselves.

There are seven exemptions built into section 1201 of the DMCA, some of which permit the circumvention of access and copy controls for limited purposes, some of which allow for the limited distribution of circumvention tools in particular circumstances. These seven exemptions are for:

• Libraries, archives, and educational institutions for acquisition purposes; [1201(d)]
• Law enforcement and intelligence gathering activities; [1201(e)]
• Reverse engineering in order to develop interoperable programs; [1201(f)]
• Encryption Research; [1201(g)]
• Protecting minors from material on the Internet; [1201(h)]
• Protecting the privacy of personally identifying information; [1201(i)]
• Security Testing; [1201(j)]

In addition to these seven exemptions, the Library of Congress is required every three years to exempt the circumvention of measures that prevent the "fair use" of copyrighted works. [1201(a)(1)(B-E)] The DMCA also contains provisions that ensure that the traditional rights of copyright law still apply to the DMCA. Section 1201(c)(1) provides that the rights, remedies, limitations, or defenses to claims of copyright infringement still apply. Section 1201(c)(4) states that these provisions should not affect the rights to free speech or freedom of the press for activities using electronics, telecommunications, or computing products.

The DMCA provides an exemption for nonprofit libraries, archives, and educational institutions to circumvent a system protecting a copyrighted work in order to make a determination of whether or not to acquire the work. [1201(d)] This exemption limits qualifying institutions from conducting circumvention only to those circumstances where access to such a work is not made available in another medium. [1201(d)(2)] In addition, the exemption limits circumvention only to the time it takes the institution to make the decision whether or not to acquire the work. [1201(d)(1)(A)]

Libraries, educational institutions, and similar organizations are concerned that these technical protection systems and the laws supporting them give too much control to the copyright owner, and threaten the general public's ability to access these works. The ban on the distribution of circumvention devices also means that libraries seeking to use this exemption can’t do so independently but must employ cryptographers to do so - a luxury most libraries can't afford.

The DMCA permits law enforcement or intelligence agencies to circumvent technological protection systems in order to identify and address the vulnerabilities of government computer systems or networks.

Section 1201(f) allows software developers to circumvent technological protection measures of a computer program that was lawfully obtained in order to identify the elements necessary to achieve the interoperability of an independently created computer program with other programs. A software developer may reverse engineer the program only if:

• the elements necessary to achieve interoperability are not readily available and
• reverse engineering is otherwise permitted under the copyright law.

Software engineers are permitted to develop and employ circumvention devices for the purpose of achieving interoperability. [1201(f)(2)] Reverse engineers are exempt from the circumvention device ban only for the purpose of achieving interoperability, and not for gaining access to protected works for infringing purposes. [1201(f)(2)]

The encryption research exemption is intended to protect circumvention that advances the state of knowledge in the field of encryption technology or assists in the development of encryption products. Circumvention in encryption research may be allowed, when done in good faith, if the following conditions are met:

• the researcher lawfully obtained the copyrighted work (ie. this exemption applies only to copy controls, not access controls); [1201(g)(2)(A)]
• circumvention is necessary for the encryption research; [1201(g)(2)(B)]
• the researcher tried to obtain authorization from the copyright owner before the circumvention; [1201(g)(2)(C)] and
• circumvention is otherwise permissible under the applicable laws. [1201(g)(2)(D)]

In addition to the above factors, the DMCA directs courts to consider three other factors in determining whether or not to apply the exemption in a particular case:

• whether the discovered information was disseminated, and if so, whether it was disseminated in a manner "reasonably calculated to advance" research or encryption technology development, or in a "manner that facilitates infringement"; [1201(g)(3)(A)]
• whether the researcher is engaged in a legitimate course of study, is employed, or is appropriately trained or experienced in the field of encryption technology; [1201(g)(3)(B)] and
• whether the researcher notifies the copyright owner in a timely fashion of the findings and documentation of the research. [1201(g)(3)(C)]

Encryption researchers may develop, employ, and provide to collaborating researchers circumvention devices for the sole purpose of performing acts of good faith encryption research.

Leading cryptographers have criticized the exemption for covering too broad a range of activities and vaguely defining the permitted activities of researchers. Most significantly, cryptographers fear that the publication of their research findings may be considered the distribution of circumvention devices. Their vulnerability to being sued for the publication of their research is increased due to the requirement that they report their findings to the copyright owners, most likely before their findings can get published.

The exemption for the protection of personally identifying information permits the circumvention of a technological measure that collects personal information, such as the "cookie" feature on a browser. However, the exemption is limited to circumstances in which:

• there was not adequate notice to the user that the technological measure is used to collect or disseminate personally identifying information; [1201(i)(1)(B)]
• the circumvention has no other effect other than the ability to identify the collection or dissemination of information; [1201(i)(1)(C)] and
• the act of circumvention is carried out solely for the purpose of identifying such information. [1201(i)(1)(D)]

The exemption allowing circumvention of personal information gathering technologies, though, is of limited use to the average consumer as a means to protect their privacy since the ban against circumvention devices does not exempt the distribution of privacy protection tools. Individuals must therefore have the expertise to analyze and manipulate computer source code in order to protect their privacy on the Internet if digital protection systems are used in information gathering technologies.

The DMCA permits circumvention that is conducted in the course of testing security systems if it is otherwise legal under the law. [1201(j)] Security testing is defined in the DMCA as "obtaining access, with proper authorization, to a computer, computer system, or computer network for the sole purpose of testing, investigating or correcting a potential or actual security flaw, or vulnerability or processing problem." [1201(j)(1)] In determining whether this exception is applicable, the DMCA requires the court to consider whether the information derived from the security testing was used solely to improve the security measures or whether it was used to facilitate infringement. The DMCA also permits the development, production or distribution of technological means for the sole purpose of circumvention devices for the sole purpose of performing permitted acts of security testing.

The DMCA requires analog video cassette recorders to conform to the two forms of copy control technology that are in wide use in the market today - the automatic gain control technology and the colorstripe copy control technology. In addition, the DMCA prohibits the redesigning of video recorders or the use of "black box" devices or "software hacks" to circumvent these copy controls.

The anti-circumvention provisions may hinder innovation in information technology by limiting the ability of potential competitors to reverse engineer the technological protection system behind which the original manufacturer hides their product. Reverse engineering is a traditional method used by industry to understand how systems work and create interoperable products. While the DMCA has an exception that permits reverse engineering to create interoperable products, as discussed below, it may only permit reverse engineering for interoperability between programs, but not for the purpose of making a program available in other platforms. A strict interpretation of the DMCA may prohibit reverse engineering, regardless of whether or not copyright infringement occurs in the process.

Conspicuously missing from the exemptions provided for circumvention activities is the average consumer's right to use and explore the products and services they purchase. The only provisions aimed at consumers directly, exempt the circumvention of: a) technologies that collect personal information (the privacy exemption); and, b) technologies used to protect minors from access to certain web sites. These exemptions, like the others, are extremely narrow. For example, the privacy exemption only allows circumvention to defeat the data collection activity of the technical protection measure. If by defeating the data collection element you defeat other aspects of the technical protection measure you

The act of circumvention provision calls for a review of the prohibition on circumventing access controls every three years. [1201(a)(1)(B)] The rulemaking proceedings conducted by the Copyright Office are supposed to document whether noninfringing uses of particular kinds of copyrighted works are hampered by the prohibition. After the Copyright Office makes its recommendations, the Library of Congress can create "classes of works" that users may access through circumvention without obtaining authorization from the copyright owner. [1201(a)(1)(B)]

This amendment is intended to transform the prohibition of circumvention into a form of regulation that monitors developments in the marketplace for circumstances in which certain copyrighted materials become less available to the general public. This regulation system may be ineffective if the Copyright Office's findings also affect the circumvention device ban because of the necessity of using some sort of tool in order to engage in the exempted acts.

The Copyright Office issued the following classes of works as exemptions to the circumvention activity ban at the conclusion of its first rulemaking proceedings:

1. Compilations consisting of lists to websites blocked by filtering software applications; and
2. Literary works, including computer programs and databases, protected by access control mechanisms that fail to permit access because of malfunction, damage, or obsoleteness. Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies, 37 C.F.R.

The Copyright Office interpreted a class of works as a subset of the broad categories of works or authorship in copyright law. The categories of authorship referred to include: literary works; musical works; dramatic works; pantomimes and choreographic works; pictorial, graphic, and sculptural works; motion pictures and other audiovisual works; sound recordings; and architectural works. The useful implementation of the Copyright Office's findings based on such categorization does not necessarily correspond to the the digital protection mechanisms developed by the entertainment, electronics, and computer industries. The encryption systems developed may be implemented in the protection of various kinds of works in different types of media.

The determination of exempted works must be based on a finding of the "adverse effects" digital protection systems have on users. The criteria that the Copyright Office is directed to consider in evaluating these effects are:

Lists of web sites filtered by software programs, generally designed to restrict Internet users from visiting certain web sites and protect children from inappropriate material, were exempted. The Copyright Office found that the criticism and commentary on the efficacy of such software is impossible without the ability to circumvent those programs. Many of these "blocked sites" are identified in encrypted lists within the software. In order for a party to learn if their site is one of the "blocked sites" it is necessary for these lists to be accessed and searched. The Copyright Office noted that there was no other legitimate way to obtain access to this information other than in digital form.

Due to the incidences of software and electronics products manufacturers that go bankrupt or do not respond to customer service complaints, it is not a violation of the DMCA to circumvent malfunctioning, damaged or obsolete software programs that use access control mechanisms. The Copyright Office noted that such circumvention is reserved for only those circumstances where an individual sought, but failed to receive assistance from the copyright owner.

Section 1201(c)(1) explicitly provides that: "Nothing in this section shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use." Substantial question remains over whether or not courts will interpret the traditional defenses to copyright infringement as defenses to the anti-circumvention provisions as well. Recent court decisions have not found the fair use defense to apply to violations of the anti-circumvention provisions of the DMCA. By making the circumvention prohibitions distinct from copyright infringement, defendants can be held liable for circumventing an access control measure even if the uses made of the work are held not to infringe on the rights of the copyright owner. Disengaging the anti-circumvention provisions from the traditional fair use analysis effectively limits use of copyrighted materials to solely what is explicitly permitted by the copyright owner. The concept of fair use remains, but for all practical purposes only those uses sanctioned by the copyright owner are permissible. The anti-circumvention provisions of the DMCA essentially replaces the broad contextual defense of fair use, discussed below, with a narrow set of carve outs to an otherwise absolute right of the copyright owners to control access and use of their works.

Section 1201(c)(1)

As more information migrates toward digital storage and distribution, the ability to quote, criticize, and make other "fair uses" of a large amount of our cultural artifacts may be practicably lost.

Collections of works that contain only a limited amount of copyrightable subject matter, made up mostly of facts, or that contain other significant public domain materials, are vulnerable to being locked up by copyright owners behind technological protection systems. The protection of these "thin copyrights" behind access control mechanisms gives copyright owners control over works that are not intended to be protected by copyright law.

First Sale is an important protection for the public in copyright law. The first sale doctrine permits individuals who buy products containing copyrighted information to choose whether to sell, share, rent or simply give them away. As more information migrates toward digital storage and distribution, copyright owners prefer licensing, rather than selling, copyrighted material. These licensed products often contain technical protection measures that control access and copying. The concern is that the trends toward digital distribution, licensing, and technical locks, coupled with the prohibitions of the DMCA will undermine the protections for the public found in the first sale doctrine.

The tension between the DMCA and the First Amendment is at the heart of several ongoing lawsuits. [Felten v. RIAA; Universal v. Corley] The mere posting of a link to a computer program that can be used to circumvent technical protection measures was held to be a violation of the DMCA. [Universal v. Corley (2nd Circuit Court)] The Recording Industry Association of America used the threat of a DMCA action to silence a professor whose research paper discussed circumvention of a technical protection measure. The professor subsequently mounted a legal challenge to the DMCA on First Amendment grounds and presented his paper. While courts in both of these cases have found in favor of the copyright industries, these cases are being appealed and the state of the law is yet to be determined.

The DMCA allows for both civil remedies and criminal penalties for violations under the anti-circumvention provisions. If the violations are determined to be willful and for commercial purposes or private financial gain, the court can order significant fines and/or imprisonment.

Civil cases are brought in federal district court where the court has broad authority to grant injunctive and monetary relief. Injunctions can be granted forbidding the distribution of the tools or products involved in the violation. The court may also order the destruction of the tools or products involved in the violation. The court can also award actual damages, profits gained through infringement, and attorney's fees. If an individual held in violation of the DMCA commits another such violation within the three-year period following the judgment, the court may increase the damages up to triple the amount that would otherwise be awarded.

In circumstances involving innocent violators, it is up to the courts to decide whether to reduce damages. But, in the case of nonprofit library, archives or educational institutions, the court must remit damages if it finds that the institution did not know of the violation.

If the circumvention violations are determined to be willful and for commercial or private financial gain, first time offenders may be fined up to $500,000, imprisoned for five years, or both. For repeat offenders, the maximum penalty increases to a fine of $1,000,000, imprisonment for up to ten years, or both. Criminal penalties are not applicable to nonprofit libraries, archives, and educational institutions.

[not yet answered]