Every three years, the U.S. Copyright Office considers whether the anti-circumvention provision of the DMCA is (or is likely to) make it difficult for people to use copyrighted works in ways that do not infringe copyright. This provision, Section 1201, makes it illegal to bypass the digital locks, sometimes called technological protection measures (TPMs) or access controls, that prevent you from accessing the computer code embedded in everything from DVDs to pacemakers. The trouble is that Section 1201 does not distinguish between circumventing TPMs to break the law and infringe copyright, and circumventing TPMs for lawful and legitimate reasons, such as unlocking a smartphone, repairing a car, or researching security vulnerabilities in voting machines and other software. So the Copyright Office conducts rulemakings to create three-year-long exemptions to Section 1201 so that people can legally access this software.
In this and the twoprevious rounds of exemptions, CDT joined computer scientists and researchers in asking the Office for a broad exemption for security research. The Office approved the exemption in 2015, paving the way for more beneficial research into the security and safety of many products containing copyrighted computer code. This exemption helped researchers by giving them more legal certainty, which had the added benefit of encouraging manufacturers to work with researchers rather than threatening them with lawsuits.
This week, CDT and others once again asked the Copyright Office to remove many of the limitations and conditions from the previous exemption so that security researchers would enjoy even greater legal clarity in the future. We asked for the removal of these conditions and limitations because they add uncertainty to the legal calculus researchers must do before starting a project, but also because the conditions and limitations do not address copyright concerns.
For example, we asked the Office to eliminate from the current exemption language that makes it unclear whether researchers could, without risking liability under Section 1201, publish their research or warn the public about unpatched security vulnerabilities in software or devices. We also asked the Office to remove a condition that could impose liability under Section 1201 if researchers commit even minor, unintentional violations of “any applicable law” in the US. The Office of course cannot make researchers exempt from other laws, but it should not expand liability under Section 1201 to encompass violations of non-copyright law– especially laws as broad and inconsistently interpreted as the Computer Fraud and Abuse Act (CFAA).
The 8th triennial rulemaking process will run through the spring of 2021. We hope the Office will grant our petition and add some much-needed certainty for researchers working in good faith to improve the security of software and devices we use every day.
British Public Oppose Secret Surveillance Powers and Want Strong Protections for Encrypted Communications
CDT released nationally representative polling data revealing that a the British public are broadly concerned about the security, privacy, and free speech consequences of allowing law enforcement to access encrypted communications.
Changing Course to Get It Right: The Advisory Committee Reviews Its AI Evidence Rule
CDT is keeping a close eye on Proposed Federal Rule of Evidence 707, which would govern when AI-generated information can be admitted as evidence in federal court — and many state courts where the federal rules are routinely adopted — without a human expert to explain it.
