Digital Law Online: Permitted Circumventions

A number of specific exceptions to the anticircumvention provisions are given in Subsections (d) through (j), including exceptions for libraries and educational institutions, law enforcement, reverse engineering, encryption research, and security testing. As with the DMCA safe harbor provisions, these are very specific exceptions and to fall within that exception, a work must meet all of its requirements.

IV.E.7.a. Law Enforcement, Content Filters, and Privacy

When the Administration first proposed the anticircumvention and rights management provisions, there were no exceptions. Opponents to the legislation seized on this, pointing out that the provisions would cripple law enforcement, since it would become illegal, for example, to access digital information kept by organized crime or a terrorist if it were protected by an access control mechanism.

The opponents likely felt that this would cause the proponents to drop the legislation, propose a substantially different approach, or change the legislation to allow any lawful access. Instead, the Administration simply added an exception, both to anticircumvention (Section 1201(e)) and to rights management (Section 1202(d)), directed specifically at law enforcement:

This section does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivision of a State, or a person acting pursuant to a contract with the United States, a State, or a political subdivision of a State. For purposes of this subsection, the term “information security” means activities carried out in order to identify and address the vulnerabilities of a government computer, computer system, or computer network. {FN176: 17 U.S.C. §1201(e), §1202(d)}

Another fear that was raised by the opponents is that the anticircumvention provision would somehow prevent blocking of harmful information to minors. That was then addressed by Section 1201(h):

In applying subsection (a) to a component or part, the court may consider the necessity for its intended and actual incorporation in a technology, product, service, or device, which—

(1) does not itself violate the provisions of this title; and

(2) has the sole purpose to prevent the access of minors to material on the Internet. {FN177: 17 U.S.C. §1201(h)}

Yet another horror raised by the opponents was that the anticircumvention provision would make it impossible to protect personal information. And again, an exemption addressing the problem was added, in this case Section 1201(j):

(1) Circumvention Permitted.— Notwithstanding the provisions of subsection (a)(1)(A), it is not a violation of that subsection for a person to circumvent a technological measure that effectively controls access to a work protected under this title, if—

(A) the technological measure, or the work it protects, contains the capability of collecting or disseminating personally identifying information reflecting the online activities of a natural person who seeks to gain access to the work protected;

(B) in the normal course of its operation, the technological measure, or the work it protects, collects or disseminates personally identifying information about the person who seeks to gain access to the work protected, without providing conspicuous notice of such collection or dissemination to such person, and without providing such person with the capability to prevent or restrict such collection or dissemination;

(C) the act of circumvention has the sole effect of identifying and disabling the capability described in subparagraph (A), and has no other effect on the ability of any person to gain access to any work; and

(D) the act of circumvention is carried out solely for the purpose of preventing the collection or dissemination of personally identifying information about a natural person who seeks to gain access to the work protected, and is not in violation of any other law.

(2) Inapplicability to Certain Technological Measures.—

This subsection does not apply to a technological measure, or a work it protects, that does not collect or disseminate personally identifying information and that is disclosed to a user as not having or using such capability. {FN178: 17 U.S.C. §1201(i)}

IV.E.7.b. Libraries and Educational Institutions

Perhaps the least useful exception to the anticircumvention provisions is the one provided to nonprofit libraries, archives, and educational institutions in Section 1201(d).

(1) A nonprofit library, archives, or educational institution which gains access to a commercially exploited copyrighted work solely in order to make a good faith determination of whether to acquire a copy of that work for the sole purpose of engaging in conduct permitted under this title shall not be in violation of subsection (a)(1)(A). A copy of a work to which access has been gained under this paragraph—

(A) may not be retained longer than necessary to make such good faith determination; and

(B) may not be used for any other purpose.

(2) The exemption made available under paragraph (1) shall only apply with respect to a work when an identical copy of that work is not reasonably available in another form.

(3) A nonprofit library, archives, or educational institution that willfully for the purpose of commercial advantage or financial gain violates paragraph (1)—

(A) shall, for the first offense, be subject to the civil remedies under section 1203; and

(B) shall, for repeated or subsequent offenses, in addition to the civil remedies under section 1203, forfeit the exemption provided under paragraph (1).

(4) This subsection may not be used as a defense to a claim under subsection (a)(2) or (b), nor may this subsection permit a nonprofit library, archives, or educational institution to manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, component, or part thereof, which circumvents a technological measure.

(5) In order for a library or archives to qualify for the exemption under this subsection, the collections of that library or archives shall be—

(A) open to the public; or

(B) available not only to researchers affiliated with the library or archives or with the institution of which it is a part, but also to other persons doing research in a specialized field. {FN179: 17 U.S.C. §1201(d)}

It is hard to imagine a narrower provision, and one less useful to libraries. It allows them to circumvent an access control mechanism only to determine whether they want to acquire the protected work. They can circumvent the control mechanism only to get access to the work and not to infringe any of the exclusive rights of the copyright owner, since the exception applies only to Section 1201(a)(1)(A). They have to do the circumvention all on their own, because there are no legal circumvention devices under Sections 1201(a)(2) and 1201(b). And they can’t help another library do a similar circumvention. All-in-all, a pretty useless exception.

This is probably because the library community concentrated on opposing the passage of the DMCA, rather than working to improve it with provisions that would overcome, or at least limit, the problems that they perceived, as well as suggesting approaches that would help libraries so that the overall effect of the DMCA on libraries would be positive.

For example, they could have worked for a provision that an unprotected copy of any work protected by an access control mechanism had to be deposited in the Library of Congress, so that the information would not be lost in the future if there were no longer devices that supported the access control mechanism. While such a deposit cannot be required for copyright protection under the non-formalities Berne Convention, Congress made it clear that the anticircumvention and rights management provisions of the DMCA were only related to copyright, and not to copyright protection itself.

Next section: Reverse Engineering