Communications of the ACM

Legally speaking

Why the Digital Millennium Copyright Act Is a Failure of Reason

By Andrew Grosso
Communications of the ACM, February 2002, Vol. 45 No. 2, Pages 19-23
10.1145/503124.503137
Comments

Copyright is in trouble. Like many wounded creatures, however, its death throes are both a danger and a wonder to behold.

I am writing this shortly after Adobe reversed its stand on the criminal prosecution of Dimitry Sklyarov for violating the Digital Millennium Copyright Act.¹ I am sure that developments will moot whatever I might consider saying about the eventual success of that prosecution. However, Sklyarov's arrest and a legally related civil suit filed by Edward Felten² are excellent starting points to examine a severely flawed attempt to preserve historic notions of copyright in the modern age.

The Digital Millennium Copyright Act (DMCA) is of recent vintage. It was enacted by Congress in 1998 for the purpose of protecting information that is transmitted, stored, published, and otherwise used in electronic form. However, the statute goes beyond a mere restatement of prohibitions concerning misuse of another person's copyrighted work. The DMCA contains prophylactic prohibitions: it prohibits the reverse engineering and public disclosure of the means whereby someone attempts to protect copyrighted property through encryption, digital signatures, and the like. By way of analogy, the DMCA makes it a criminal or civil offense to crack the lock of a safe, in the hope that by doing so it will add further protection to the contents of that safe, here, the copyrighted work.

The flaw in this logic is the locks with which we are concerned are in themselves information, and, therefore the DMCA proscribes the otherwise legitimate study and dissemination of speech in violation of the First Amendment.

Let us briefly examine the critical provisions of the DMCA:

• No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that

• (A) is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof;
• (B) has only limited commercially significant purpose or use other than to circumvent protection afforded by a technological measure that effectively protects a right of a copyright owner under this title or in a work or portion thereof; or
• (C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof.

The Act further provides that the term to "circumvent a technological measure" means to "descramble a work, to decrypt an encrypted work, or to otherwise avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner . . . ."

---

The view embodied by the DMCA is incomplete: computer code is the expression of logic, and logic is the embodiment of thought. Thought is speech, pure and simple, and for this reason code is speech.

---

When applied to computer code, this language poses particular problems in academics and research: it restricts the communication of ideas and, as such, it violates the First Amendment.

Computer code is speech.³ This is not an easy concept for a non-technical person to understand. To a lawyer, computer code is something built into his or her computer. As such, it is part of a machine: it does something, that is, it makes the machine work. For this reason, Congress and the courts, which are populated primarily by lawyers and other non-technical professionals, view computer code as part of the hardware. For them, it is axiomatic that computer code; being part of the hardware, is not protected by the First Amendment.

It is instructive to observe how, in the DMCA, software and the scientific analysis of software were equated to the manufacture and mass production of hardware devices. Let us look at the words and phrases the Act uses: "manufacture," "offer to the public," "provide," "traffic in," "technology," "product," "service," "device," and "component."

Unfortunately, the view embodied by the Act is incomplete: computer code is the expression of logic, and logic is the embodiment of thought. Thought is speech, pure and simple, and for this reason code is speech.

If this was where the DMCA stopped, that is, by declaring the code of a program to be hardware and thus not under the protections of the First Amendment, I believe scientists and society could live with the results. After all, the New York Times, the adventure books of Harry Potter, and Star Wars movies are speech, and copyright law restricts their distribution. Society functions fairly well despite this inconvenience. However, our difficulty is that the DMCA does not stop here.

The Act prohibits the "trafficking" in anything, not merely computer code, which may be used to decrypt or otherwise circumvent copyright protection mechanisms, including those mechanisms expressed by computer code. More precisely, the Act states that no one shall "offer to the public, provide, or otherwise traffic" in such technology.

Here is the problem. To analyze an encryption algorithm is to analyze a thought. Thereafter, to discuss, communicate, debate, criticize, or collaborate on that thought is to engage in speech. Under the Act, such discussion, communication, debate, criticism, and collaboration constitute trafficking in the subject thought; offering it to the public; and, generally, providing it to third parties. Going one step further, this is so regardless of whether the thought is written entirely in English, or is embodied in a scientific presentation using a language of mathematics, such as computer code.

Back to Top

The Rub

Now we reach the heart of the scientific and academic communities' problem with the DMCA. If I want to understand a field of endeavor, I must study the latest developments in that field. For each community, as a whole, to understand these developments, the conclusions resulting from such study must be communicated to its members. This is how a field of knowledge advances. Included in these attempts to understand and to communicate are: analyses of a development's strengths and weaknesses; identification of any unique and novel ideas conceived or implemented; comparisons with other methods available or pondered; and methods of superseding, improving, or defeating new methodologies.

Put into the words of the DMCA, the community must "offer to the public, provide, or otherwise traffic" in new technology. When that new technology includes an anti-circumvention device, the scientific or academic discourse concerning that technology constitutes a violation of federal law, that is, the DMCA. Thus, we have an infringement of the First Amendment. This infringement is complete not only with the dissemination of the protected code itself, but also through discussions about that code that address its strengths, weaknesses, novelty, uniqueness, and any other aspect that might lead to a method of defeating the intent of the code, that is, its anti-circumvention feature.

Back to Top

The Civil Concern

The legal arena has provided us with concrete examples of the DMCA in action.

The first case we visit is that of Edward Felton. For our purposes the following facts are relevant: Felton and some associates intended to publish a research paper regarding encryption mechanisms being used by the recording industry to prevent the unlicensed duplication of copyrighted works. They were threatened with a civil suit by that industry, and withdrew the paper. The threatened suit would have been brought under the DMCA. Eventually, the industry withdrew the threat in writing. Nonetheless, Felton brought a lawsuit under the Declaratory Judgment Act asking a federal court to strike down the DMCA as an unconstitutional infringement of his right to free speech.

Civil enforcement of federal laws is not uncommon. Several statutes include what are known as "private inspector general" provisions, permitting an individual having some interest in the enforcement of the law involved to privately file a lawsuit seeking injunctions or penalties (or both) against the person who may be violating the law. Sometimes the statutes permits the federal government to intervene or take over the case.⁴

The U.S. Department of Justice (DOJ) eventually filed its own motion in the Felten case, asking the court to dismiss the suit. The DOJ relied upon several provisions in the DMCA which, at first glance, seem to provide exceptions or safe harbors to its prohibitions. Among these are conduct necessary to engage in encryption research; and conduct necessary to engage in security testing of a computer system.⁵ The statute also carries a catchall, stating that nothing in the Act "shall enlarge or diminish any rights of free speech or the press for activities using consumer electronics, telecommunications, or computing products." In short, the DOJ argued the DMCA provided all the protection to Felten's rights to free speech that might be necessary for him to carry on academic research. Unfortunately, this is the wrong standard to use when examining freedom of speech, and demonstrates the flaw inherent in the DMCA.

The first problem is the term "necessary" used in some of the safe harbors. Who is to determine what is necessary? The courts? Law enforcement? The U.S. Attorney General? Must a researcher obtain permission from all before he or she is safe to present a paper? In the arena of First Amendment law, the answer to these questions is clear: the statute is unconstitutional merely because the term "necessary" is ambiguous, is subject to various interpretations by parties with different interests, and serves to chill the expression of free speech before any words are ever uttered. Courts simply will not permit individuals to be afraid to talk because of a government-sanctioned threat of prosecution.

The recording industry tried to get around this problem, and avoid the risk that Felten might succeed in having the DMCA struck down. It gave Felten a letter saying the industry had changed its mind, and now did not intend to sue him if he presented his paper. From the industry perspective, removing the immediate threat of prosecution from Felten's shoulders made his lawsuit moot. Again, First Amendment protection is not so easily evaded.

There exists a principle known as the "Overbreadth Doctrine" which states: if a real threat to free speech exists for person A, then I (person B) can challenge that threat even if the threat does not apply to me. Courts consider First Amendment rights precious, they relax the normal judicial standing requirements and permit individuals not immediately threatened with harm to go to court in order to vindicate their rights based upon the impact the threat might have to third parties.⁶ As applied here, the fact the recording industry could conduct itself as a private inspector general, deciding who gets free passes and who gets civilly prosecuted under the DMCA, is itself a threat of sanction and a chill on the expression of free speech. Thus Felten has standing under the Overbreadth Doctrine to challenge the Act regardless of whether he is one of the fortunate few given a free pass from the recording industry.

Another provision of the Act is the catchall clause quoted earlier. This clause does not save the DMCA because it is too narrow. It protects free speech rights for activities using consumer electronics, telecommunications, and computing products. What we must be concerned about are matters far beyond these trivial activities, to the basic, underlying academic and scientific research on which these products and others are founded. The First Amendment does not protect my use of a computer program; it protects the speech I distribute via that program, and it protects my discussion with others as to how to build a better program and how to protect the information I manipulate using the one I have now. Again, Congress' erroneous conception that computer programs, and their code, are mere products shines through.

Back to Top

The Criminal Risk

In the criminal arena, the scope for such liability under the Act is significantly more restricted than that for civil liability. In summary, it is a criminal offense to violate the DMCA provisions "willfully and for the purposes of commercial or private financial gain." Nonprofit libraries, archives, and educational institutions are entirely exempt from criminal liability.

In some ways the restrictions make one breathe more easily. After all, there is a difference between reading a copyrighted poem to a group of friends in order to enjoy and discuss it versus making bootlegged copies of the work and then selling them for profit. In addition, the U.S. federal courts have, at various times, given and taken back greater restrictions regarding what is termed "commercial speech," usually business advertisements.

Nonetheless, the restrictions leave many troublesome potholes. Corporate, private, and commercial research in general still falls under the criminal ban. Making a brief comparison over the years between the contributions of Bell Labs with those of MIT clearly demonstrates the vitality of commercial research is no less than that of academia. Similarly, the right to exercise speech in furtherance of commercial research can be no less than that for academic research. Yet, this need is ignored by the DMCA.

The case of Dimitry Sklyarov involves a Russian programmer whose company, Elcom, wrote and marketed a computer program that invoked the wrath of Adobe Systems, Inc. The company chose to refer its concerns to the U.S. Attorney's Office in the Northern District of California rather than proceed with a private lawsuit, probably because they figured the pertinent perpetrators resided outside of the U.S. The U.S. Attorney's Office, in turn, decided to prosecute criminally.

Sklyarov and his company were each indicted for trafficking in and marketing to the public a product whose primary purpose was to circumvent a copyright protection device, specifically for selling a computer program that would enable a user to avoid the built-in, licensing-protection features of Adobe's e-book system.

The Sklyarov case differs from the Felten suit because Sklyarov is charged with distributing a finished product whose primary purpose is to enable a user to make multiple copies, and make unauthorized use, of a copyrighted work without paying for those extra copies or that unauthorized use. One might be tempted to compare the product to a Xerox copying machine, and conclude the fair-use doctrine should apply. However, to be fair, one must clarify the analogy by comparing it to the copying of negotiable instruments, such as bonds and bank checks, which have color codes embedded in them that impede duplication by copying machines, and then using a mechanism to circumvent these color codes. In this analogy, Elcom's program would be the circumvention mechanism for the color codes.

This analogy demonstrates a logic in the application of the DMCA to Sklyarov's and Elcom's activities: no First Amendment infringement is apparent, and criminal prosecution of bootlegged, copyrighted works has a long history of approval in the U.S.

Problems with the Sklyarov prosecution still exist, however, and they are twofold. First, they do not take into account the fact that, unlike paper, computer code is infinitely malleable and distributable. It invites anyone with the least understanding of how a computer operates to tamper with such code, and allows anyone with access to the Internet to globally distribute the code. To adopt another legal term, it is "an attractive nuisance." To this end, the marketplace must assign the risk of code being tampered with or distributed to the person who chooses to put that code into the stream of commerce for his or her own commercial reasons. Using criminal laws to enforce a paradigm of intellectual property rights that is technologically obsolete is an ill-advised use of law enforcement resources or the imposition of criminal penalties.

The second problem involves the global nature of Sklyarov and Elcom's activities. They reside in Russia, where the DMCA is not applicable. They market on the Internet, which transcends all state, local, and national jurisdictions. There is no allegation in the indictment that the defendants marketed their product primarily in the U.S., or sought to do so. In such circumstances, the wisdom of applying U.S. laws to global commerce—and our criminal laws to foreign nationals based solely on their Internet activities—is highly questionable if for no other reason than other countries might apply the same logic to our own citizens.

Back to Top

Conclusion

The primary problem with the DMCA is its supporters fail, or perhaps refuse, to understand that the old means of doing business no longer apply in the digital age. Moreover, attempts to maintain those old means impermissibly infringe on our fundamental freedoms, as well as upon generally accepted notions of fair play and international comity. In summary, the DMCA represents the dead hand of the past obstructing society's advance to the future. Its removal cannot come too soon.

Back to Top

Back to Top

The Digital Library is published by the Association for Computing Machinery. Copyright © 2002 ACM, Inc.

---

No entries found