IP: DMCA: Break the Crypto: Exceptions

All good rules come with exemptions. There are multiple exemptions to the anticircumvention rule. Below is a list with brief descriptions. Be sure to review the language of Sec. 1201 for the full scope of possibly applicable exemptions.

Nonprofit library, archive and educational institutions: Qualified 1201(d)(5) libraries, archives, or educational institutions, that acquire copies of works for the purpose of determining whether to buy such works, shall not be in violation of prohibition against unauthorized access (of course this seems to directly contradict the notion that it is illegal to make or make available things that can actually do this - so its not quite clear how this can be achieved). [17 U.S.C. § 1201(d)]

The Man: The anticircumvention provisions do not apply to any lawfully authorized government types engaged in law enforcement, intelligence, or information security. [17 U.S.C. § 1201(e)]

Reverse Engineering: Individuals lawfully in possession of copies of software may reverse engineer that software for the sole purpose of interoperability (but beware of software licenses that nevertheless prevent this activity - this does not give you the right to do it - it just says you wont violate the DMCA if you do it). This information can even potentially be shared with others. [17 U.S.C. § 1201(f)] [Lexmark]

Encryption Research: Researchers can seek to break digital locks in the name of the advancement of the field of encryption where it is their purpose to "identify and analyze flaws and vulnerabilities of encryption technologies applied to copyrighted works." The individual must legitimately be engaged in research and must have first attempted to get permission to circumvent. [17 U.S.C. § 1201(g)]

Note that this exception is controversial; many researchers believe that they are not able to conduct their research or publish their results as a result of the DMCA. Some researchers have stated that they have ceased work in this area for fear of prosecution. [EFF]The IEEE at one point attempted to include a disclaimer that IEEE authors indemnify the IEEE for any alleged violation of this provision (the IEEE withdrew this disclaimer). [IEEE] Richard Clarke, former head of the White House Office of Cyber Security, remarked that in an age of security concerns, the potential detrimental impact of the anticircumvention provision on national security might merit revisiting these restrictions. [Boston Globe] Nevertheless, the US Department of Commerce, which conducted a study on the impact of the anticircumvention provision, the research exception, and their impact on security research, stated that it could not conclude that there has been a detrimental impact on security research.

Personal Privacy: Where technology collects and disseminates information about a person, and the only way to get this to stop is by breaking a digital lock, and the only reason for breaking the lock is to stop this invasion of privacy, then it might be okay under this exception to give the lock a whack. [17 U.S.C. § 1201(i)]

Security Testing: An individual can test the security of a system, with the permission of the owner of that system, where such security testing would not itself constitute an infringing activity. [17 U.S.C. § 1201(j)]

Regulatory Exemptions:

Out of concern that the anticircumvention provisions of the DMCA would limit otherwise legitimate uses of copyrighted material, Congress authorized the Library of Congress to review and determine "particular classes of copyrighted works that shall be exempted from the prohibition because persons who are users of those classes of works 'are, or are likely to be in the succeeding 3-year period, adversely affected by virtue of the prohibition in their ability to make non infringing uses of that particular class of works under this title.'" [17 U.S.C. § 1201(B)]. The Library of Congress reviews these regulatory exemptions on a regular cycle.

The Library of Congress currently recognizes the following additional exemptions to the circumvention rule:

• Compilations consisting of lists of websites blocked by filtering software applications;
• Computer programs protected by dongles which are obsolete;
• Computer programs and games distributed in formats that have become obsolete; and
• Literary works published in ebook format that are not accessible to individuals with disabilities.

[37 C.F.R. § 201.40] These exemptions expire October 27, 2006.

For further information contact:

Robert Kasunic
Office of the General Counsel
Copyright GC/I&R
PO Box 70400
Southwest Station
Washington, DC 20024-0400
202 707-8380
202 707-8366 fax

Review Process:

Identification of such classes of works is made in a rulemaking proceeding conducted by the Register of Copyrights, who is to provide notice of the rulemaking, seek comments from the public, consult with the Assistant Secretary for Communications and Information of the Department of Commerce, and recommend final regulations to the Librarian of Congress. The regulations, to be issued by the Librarian of Congress, announce ``any class of copyrighted works for which the Librarian has determined, pursuant to the rulemaking conducted under subparagraph (C), that non infringing uses by persons who are users of a copyrighted work are, or are likely to be, adversely affected, and the prohibition contained in subparagraph (A) shall not apply to such users with respect to such class of works for the ensuing 3-year period.'

In the first section 1201 rulemaking, the Librarian announced that non infringing users of two classes of works would not be subject to the prohibition on circumvention of access controls. [Fed.Reg. 2000] Exemptions to the prohibition on circumvention remain in force for a three-year period and expire at the end of that period. The Librarian is required to make a determination on potential new exemptions every three years. [Fed.Reg.2003]