Anti-circumvention

The following anti-circumventing rules were implemented in European Directive 2001/29/EC of the European Parliament and of the council of May 22, 2001 on the harmonisation of certain aspects of copyright and related rights in the information society.

This directive states in article 6, 'Obligations as to technological measures':

1. Member States shall provide adequate legal protection against the circumvention of any effective technological measures, which the person concerned carries out in the knowledge, or with reasonable grounds to know, that he or she is pursuing that objective.
2. Member States shall provide adequate legal protection against the manufacture, import, distribution, sale, rental, advertisement for sale or rental, or possession for commercial purposes of devices, products or components or the provision of services which:
   • (a) are promoted, advertised or marketed for the purpose of circumvention of, or
   • (b) have only a limited commercially significant purpose or use other than to circumvent, or
   • (c) are primarily designed, produced, adapted or performed for the purpose of enabling or facilitating the circumvention of, any effective technological measures.
3. For the purposes of this Directive, the expression 'technological measures' means any technology, device or component that, in the normal course of its operation, is designed to prevent or restrict acts, in respect of works or other subject matter, which are not authorised by the rights holder of any copyright or any right related to copyright as provided for by law or the sui generis right provided for in Chapter III of Directive 96/9/EC. Technological measures shall be deemed 'effective' where the use of a protected work or other subject matter is controlled by the rights holders through application of an access control or protection process, such as encryption, scrambling or other transformation of the work or other subject-matter or a copy control mechanism, which achieves the protection objective.
4. Notwithstanding the legal protection provided for in paragraph 1, in the absence of voluntary measures taken by rights holders, including agreements between rights holders and other parties concerned, Member States shall take appropriate measures to ensure that rights holders make available to the beneficiary of an exception or limitation provided for in national law in accordance with Article 5(2)(a), (2)(c), (2)(d), (2)(e), (3)(a), (3)(b) or (3)(e) the means of benefiting from that exception or limitation, to the extent necessary to benefit from that exception or limitation and where that beneficiary has legal access to the protected work or subject-matter concerned. (...)

In the United States, the Digital Millennium Copyright Act ("DMCA") has implemented the treaty provisions regarding the circumvention of some technological barriers to copying intellectual property.

Section 103 (17 U.S.C Sec. 1201(a)(1)) of the DMCA states:

No person shall circumvent a technological measure that effectively controls access to a work protected under this title.

The Act defines what it means in Section 1201(a)(3):

(3) As used in this subsection—

(A) to "circumvent a technological measure" means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner; and

(B) a technological measure "effectively controls access to a work" if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.

Thus, if there is some "technological measure that effectively controls access to a work", it is illegal to circumvent that measure. However, Section 1201 creates several exceptions to this rule, and the Library of Congress is empowered to create additional exceptions.

The Act also prohibits the distribution of tools that enable a user to circumvent access controls or controls that protect a right of the copyright holder.

17 U.S.C. Sec. 1201 (a)(2) provides:

(2) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that— (A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title; (B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or

(C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.

Distribution of tools intended to circumvent controls that protect a right of the copyright holder is also prohibited. 17 U.S.C. Sec. 1201 (b) states:

(1) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that— (A) is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof;

(B) has only limited commercially significant purpose or use other than to circumvent protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof; or

(C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof.

A rights control is defined in 17 U.S.C. Sec. 1201 (b)(2) (B):

a technological measure "effectively protects a right of a copyright owner under this title" if the measure, in the ordinary course of its operation, prevents, restricts, or otherwise limits the exercise of a right of a copyright owner under this title.

Unlike access controls, the DMCA does not ban the circumvention of rights controls. It was thought that traditional copyright law was sufficient to protect the interests of copyright holders in cases of individual acts of circumvention.[1]

The Act states that its provisions are not intended to modify a number of already existing rights. Section 1201(c) provides:

(c) Other Rights, Etc., Not Affected.—

(1) Nothing in this section shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use, under this title. (2) Nothing in this section shall enlarge or diminish vicarious or contributory liability for copyright infringement in connection with any technology, product, service, device, component, or part thereof. (3) Nothing in this section shall require that the design of, or design and selection of parts and components for, a consumer electronics, telecommunications, or computing product provide for a response to any particular technological measure, so long as such part or component, or the product in which such part or component is integrated, does not otherwise fall within the prohibitions of subsection (a)(2) or (b)(1).

(4) Nothing in this section shall enlarge or diminish any rights of free speech or the press for activities using consumer electronics, telecommunications, or computing products.

Critics of the DMCA have often noted the absence of an explicit exception for circumvention to enable fair use.[2][3][4]

Section 103(c)(1) of the DMCA (17 U.S.C. Sec. 1201 (c)(1)) does state that [n]othing in this section shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use, under this title. However, a violation of the anti-circumvention provisions of the DMCA is not itself copyright infringement and therefore it is unclear whether fair use can be raised as a defense in circumvention cases.

Courts have come out both ways on the issue. Some have held that the anti-circumvention provisions can only be violated when the circumvention has a connection to copyright infringement. For example, in Storage Tech. Corp. v. Custom Hardware Eng'g & Consulting, Inc., 421 F.3d 1307, 1318-19 (Fed. Cir. 2005) the Federal Circuit held that a copyright holder must show a connection to copyright infringement in order to succeed in a claim under the DMCA.

Similarly, in Chamberlain Group, Inc. v. Skylink Technologies, Inc. 381 F.3d 1178 (Fed. Cir. 2004) the court held that distribution of a circumvention device (in that case a garage door opener) did not violate the anti-circumvention provisions because its use did not lead to any copyright violation.

However, in a number of cases involving DVD decryption courts have held that there is no fair use defense in circumvention cases. In Universal City Studios v. Reimerdes, 111 F. Supp. 2d 294, 322 (S.D.N.Y. 2000), the court stated that "[i]f Congress had meant the fair use defense to apply to such actions, it would have said so."[5]

Sec. 103(f) of the DMCA (17 U.S.C. § 1201 (f)) says that you are allowed to reverse-engineer a protected program in order to figure out how to get it to interoperate (i.e., exchange and make use of information) with other programs.. The section states:

(f) Reverse Engineering.— (1) Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention, to the extent any such acts of identification and analysis do not constitute infringement under this title. (2) Notwithstanding the provisions of subsections (a)(2) and (b), a person may develop and employ technological means to circumvent a technological measure, or to circumvent protection afforded by a technological measure, in order to enable the identification and analysis under paragraph (1), or for the purpose of enabling interoperability of an independently created computer program with other programs, if such means are necessary to achieve such interoperability, to the extent that doing so does not constitute infringement under this title. (3) The information acquired through the acts permitted under paragraph (1), and the means permitted under paragraph (2), may be made available to others if the person referred to in paragraph (1) or (2), as the case may be, provides such information or means solely for the purpose of enabling interoperability of an independently created computer program with other programs, and to the extent that doing so does not constitute infringement under this title or violate applicable law other than this section. (4) For purposes of this subsection, the term "interoperability" means the ability of computer programs to exchange information, and of such programs mutually to use the information which has been exchanged.

• Universal v. Reimerdes
• United States v. ElcomSoft and Sklyarov

The Electronic Frontier Foundation (EFF) criticized DMCA anti-circumvention clauses, saying it "chills free expression and scientific research", jeopardizes fair use, impedes competition and innovation, and interferes with computer intrusion laws.[6]

Australia prohibits circumvention of "access control technical protection measures" in Section 116 of the Copyright Act. The law currently imposes penalties for circumvention of such measures[7] as well as the manufacturing[8] and distribution[9] of tools to enable it.

DRM may be legally circumvented under a few distinct circumstances which are named as exceptions in the law:

1. permission of the rightsholder
2. enabling interoperability with copyrighted software
3. encryption research
4. security testing
5. disabling access to private information (circumvention only)
6. national security or law enforcement
7. library acquisition decisions (circumvention only)
8. acts prescribed by regulation (circumvention only)

A person circumventing the access control bears the burden of proof that one of these exceptions apply.

Penalties for violation of the anti-circumvention laws include an injunction, monetary damages, and destruction of enabling devices.[10]

• Stevens v. Sony, holding that a device allowing PlayStations to play games with a different region code did not violate the anti-circumvention laws, because the mechanism in the PlayStation did not directly prevent the infringement of copyright.