The Electronic Frontier Foundation (EFF) has filed a long-awaited lawsuit (.pdf; 271KB) challenging the constitutionality of section 1201 (commonly referred to as the “anti-circumvention rule“) of the Digital Millennium Copyright Act (DMCA). This provision of the DMCA makes it illegal to break any digital rights management (DRM) implementation of access control on copyrighted works. Worse, the provision includes no exemption for fair use or unintended circumvention.
Penalties for violating (even inadvertently) the section 1201 provision are a five-year prison sentence and a US$500,000 fine. That’s a hefty penalty for something as innocuous as modifying an electronic device to play a DVD from another geographic region (or “ripping” an out-of-region DVD). Any device or implement that contains copyrighted software is covered by the section 1201 provision. All of your personal electronic devices, are of course subject to the provision; as is your automobile, medical equipment, and any medical devices that may be implanted in your body. As software provides the basis for more and more devices, the section 1201 provision becomes all that more insidious.
And this has been the law of the land for nearly 20 years.
EFF complaint on behalf of Matthew Green, Andrew Huang, et. al. filed with US District of Columbia District Court, 21 July 2016.
Library of Congress and copyright office failed to perform
In addition to challenging the constitutionality of the provision, the EFF is also arguing that the US Library of Congress and copyright office have failed to perform adequately in the ongoing section 1201(c) exemption hearings and have placed an undue burden on individuals seeking exemptions.
Every three years, the copyright office is mandated to consider requests for exemption to the section 1201 provisions.
The EFF lawsuit asks merely that the fair use exemption surpass the anti-circumvention provision in section 1201 of the DMCA and that the Library of Congress be required — under section 1201(c) — to grant exemptions for any circumvention or other behavior that is legal under copyright law.
Fair use is currently not an allowable defense under section 1201.
First Amendment infringement
Last year, the Library of Congress denied anti-circumvention exemption requests for many uses and activities that section 1201 prohibits but which copyright law specifically allows.
Accordingly, the EFF lawsuit claims that the US Supreme Court has long held that fair use is the safeguard preventing copyright law from violating the First Amendment to the US Constitution and that section 1201 provides no equivalent safeguard for the DMCA:
“… Enacted in 1998, these provisions broadly restrict the public’s ability to access, speak about, and use copyrighted materials, without the traditional safeguards — such as the fair use doctrine — that are necessary to protect free speech and allow copyright law to coexist with the First Amendment. The threat of enforcement of these provisions chills protected and noninfringing speech that relies on copyrighted works, including independent technical research into computer security systems and the discussion of that research, and accessing copyrighted works in order to shift the content to a different format, space, or time. The triennial rulemaking process by which the public may seek exemptions pursuant to 17 U.S.C. § 1201(a)(1)(C) does not alleviate these problems. To the contrary, the rulemaking is itself an unconstitutional speech-licensing regime.”
The way section 1201 is structured, researchers who discover bugs or security flaws in the underlying DRMed software of a medical device or an automobile (multiple instances of both have actually happened, by the way), they’re in violation of the anti-circumvention provision and can be prosecuted. Device manufacturers insist section 1201 gives them unilateral power to determine if their customers ever get to know about defects in the products they’ve purchased.
One of the named plaintiffs in the EFF lawsuit is Matthew Green, a professor and researcher at Johns Hopkins University. Green has discovered flaws in the underlying software managing the operation of at least three brands of automobiles and vulnerabilities in various commercial software products, services, and websites. He’s currently working under a National Science Foundation (NSF) grant to investigate the security of proprietary medical records systems. Green filed a section 1201 exemption request with the Library of Congress for this work, and in the EFF lawsuit alleges that at least one company requested that the Johns Hopkins University provost suppress his research findings.
This is an incredibly complex set of issues and will take a long time to resolve. As complex and time-consuming this is, it’s also of vital importance to the citizenry — both collectively and individually. As Cory Doctorow writing for the Guardian points out:
“Along the way, companies, entrepreneurs, members of the public and US trading partners are all going to have to decide which side they’re on, and whether it’s worth the risk of tolerating DMCA 1201 and its international cousins, or if it’s better to unlock value, to thwart rent-seeking monopolists, to bring transparency and accountability to the design of crucial products and categories of products.”