Circumvention Prohibitions Reconsidered:
Why America’s Mistake is Europe’s Future
By Robin D. Gross ,Esq., IP Justice

I.  US and EU Pressured to Outlaw Consumer Circumvention

Today lawmakers all over the world are both dreaming of the opportunities and grappling with the challenges that digital technology creates for authors and distributors of intellectual property.  At the same time, consumers express excitement mixed with frustration as eBooks, CDs, DVDs, and other entertainment is increasingly distributed with digital locks restricting their lawful use. 

For years, the US copyright industry has forcefully pushed a legislative agenda on the international community of laws that outlaw the circumvention of technological restrictions controlling copyrighted works.  Confronted with claims by Hollywood that these anti-circumvention measures are necessary to prevent infringement, various national legislatures are now considering laws to prohibit bypassing digital locks on CDs, DVDs, and eBooks, even by the owner of the media who wants to engage in lawful use.  Besides preventing a substantial amount of lawful speech, these circumvention measures mark a transition away from the traditional "Sony Betamax" standard under copyright law where toolmakers could only be liable for the illegal activity they intend, to a new standard of strict liability created by the mere possibility of infringement.[1]

In 1998 US media giants persuaded the US Congress to pass the Digital Millennium Copyright Act, which outlawed the circumvention of technological access controls, even in situations where the underlying use would be a lawful fair use.[2]  The DMCA also outlawed the manufacture and provision of tools, including software and information that could help another to bypass digital locks that control use of CDs, DVDs, and eBooks.[3]  Unfortunately, the DMCA’s ban on circumvention tools is without regard for whether the use prevented would be permissible under copyright law, preventing many lawful uses of digital media, such as playing one’s "stereo-only" CD on a personal computer.

Faced with pressure by the wealthy US publishing industry, representatives of the European Union passed prohibitions against circumvention in its 2001 Copyright Directive, outlawing even more conduct and speech than the US’s controversial DMCA.[4]  However, only two of the fifteen EU countries, Greece[5] and Denmark,[6] passed national legislation implementing the EUCD’s ban on circumvention by the directive’s deadline of December 22, 2002.[7]  EU countries including the UK, Germany, France, Austria, Belgium, and Finland are currently considering national legislation implementing the directive.[8]

While the DMCA and the EUCD were originally aimed at implementing US and European treaty obligations over technological protections, both initiatives went well beyond what international copyright treaties actually require countries to pass.[9]  The EUCD’s language is so broad in what it prohibits that all facilitating and enabling activities intended to circumvent technological restrictions are outlawed, regardless of the lawfulness or necessity of the underlying use.[10]  

WIPO Copyright Treaty[11]	US DMCA[12]	EUCD[13]
* May Prohibit Providing Some Tools Capable of Circumvention	* Outlaws Making & Providing of All Tools Capable of Circumvention[14]	* Outlaws Possessing, Making, & Providing of All Tools Capable of Circumvention
* May Prohibit Some Acts of Circumvention Based on Underlying Lawfulness	* Outlaws Most Acts of Circumvention Without Regard to Underlying Lawfulness[15]	* Outlaws All Acts of Circumvention Without Regard to Underlying Lawfulness

To a large extent, EU countries have already tied their hands with respect to circumvention laws and are obligated pass national legislation that gives Hollywood an enormous degree of control over what Europeans can do with their digital media. As discussed below, if national legislatures fail to craft meaningful exceptions to the EUCD’s general ban on circumvention, European citizens will be forced to bring court challenges to the directive’s implementation in that country in order to restore consumer freedoms.[16]

II.  The US Experience with Circumvention: "DMCA Horror Story"[17]

Ironically, the US copyright industry continues to impose a restrictive intellectual property regime on the rest of the world despite the abuse and controversy such measures created in the US.  Since enactment in 1998, the DMCA has become the target of significant opposition in the US (and abroad) from groups as diverse as cryptographers, librarians, journalists, scientists, civil liberties and other public interest organizations.[18]  Widely regarded as overbroad in its prohibitions, Americans are now seriously reconsidering the circumvention measures and several efforts to amend the law’s harshest provisions have been introduced in the Congress.[19]  While the DMCA survived an early court battle in the US,[20] more recent legal challenges to the DMCA’s circumvention measures give little confidence that its broad prohibitions will withstand further Constitutional challenges.[21]

A.  DMCA Destroys Private Performance and Fair Use Rights, First Sale Privileges

One of the biggest complaints that US citizens have registered over the DMCA’s circumvention ban is the elimination of consumer rights under the traditional copyright balance.  The US Copyright Office has received hundred of letters[22] from citizens expressing frustration over the inability to bypass DVD region code restrictions,[23] or play DVDs on computers running Linux,[24] the inability to fast-forward past commercials on certain DVDs,[25] read eBooks on laptops,[26] play "stereo-only" CDs on personal computers,[27] make a personal use copy of a music CD,[28] improve the interoperability of computer games[29] and other legitimate consumer circumvention activities.  (Legally) impenetrable technological restrictions do not just prevent illegal uses, they command control over all uses of a creative work, routinely preventing lawful uses. 

Freedom of expression, fair use, first sale privileges and other important consumer rights are in jeopardy of elimination as publisher controlled technological restrictions replace copyright law as the arbiter of information rights in a digital world.[30]  US consumers face a steady stream of news accounts where US copyright holders have repeatedly abused the DMCA by using technological restrictions to take far greater control over digital media than the law ever intended.[31]   For example, lawful control over the private performance of digital media has shifted from individual-control to publisher-control in regimes that ban legitimate consumer circumvention, such as the US and EU.

B.  DMCA Useful as Powerful Weapon Against Competitor

While proponents of banning circumvention claim the laws are necessary as a shield to protect against copyright infringement, in practice, circumvention laws have proven far more useful as a powerful sword to prevent competition and silence critics.  Since the DMCA’s ban on circumvention tools is so broad, anyone who tries to build a home-made device or software capable of playing a DVD or other digital media violates the prohibition against circumvention.  Thus the circumvention prohibitions effectively create a monopoly over who can build devices capable of reading digital entertainment.

Adobe Software v. Elcomsoft & Dmitry Sklyarov eBook Reader

When Russian software company Elcomsoft attempted to provide software capable of reading Adobe eBooks, Adobe called upon the US Federal Bureau of Investigation (FBI) to prosecute its foreign competitor Elcomsoft and its cryptographer Dmitry Sklyarov under the DMCA.  Despite the many lawful uses of the Elcomsoft software (like reading eBooks on other computers, printing a page for a school report, or enabling the text-to-speech functionality so sight-impaired people can have their eBooks read to them by their computers) the DMCA proved powerful enough to jail for 6 weeks the competitor who revealed the weaknesses in its software.  In December 2002, a California jury acquitted Elcomsoft under the first criminal test of the DMCA’s circumvention prohibitions, fueling belief that the DMCA’s overbroad and anti-competitive measures will fall to future challenges.[32]

Hollywood Studios v. Johansen, 2600 Magazine, & LiVid Linux Player

When a team of open source software developers from around the world joined together in 1999 to build a DVD player for the Linux operating system, DMCA litigation quickly halted the project’s development.[33]  LiVid (Linux-Video) developers were working to build independent DVD playing software that could compete with the major studio’s monopoly on DVD players. Frustrated by the lack of DVD player software for Linux, Norwegian teenager Jon Johansen together with a German and Dutch computer programmer reverse engineered Hollywood’s Content Scrambling System (CSS) and created DeCSS, a program to unlock the movie so it can be viewed by its owner.  After Johansen published DeCSS to the LiVid project, Hollywood lawyers initiated a series of lawsuits against over 500 republishers of DeCSS, including Johansen in Norway and in the US, the head of the LiVid project, and 2600 Magazine who included the code as part of its news coverage of the controversy.[34]  Under the subsequent US court ruling[35] that banned 2600 Magazine from publishing the software,anyone who wants to build a DVD player post-DMCA must obtain a costly and restrictive license from the major studio’s licensing organization DVD-CCA.  The Hollywood studios were successful in using the DMCA’s circumvention ban to create for them a monopoly over the manufacture and distribution of DVD players.  Independent and innovative start-ups, such as the LiVid group of European developers, were locked out from competing with Hollywood’s DVD players, under the guise of preventing infringement.

A Norwegian Court was not so generous to the major Hollywood studios in its ruling[36] of January 7, 2003, acquitting Jon Johansen of all charges for his role in creating DeCSS.[37]   At Hollywood’s request[38] Johansen had been charged under Norwegian Criminal Code Section 145.2, which outlaws bypassing digital locks to steal data one is not entitled to access.  In the past, this law was used to punish those who broke into another’s property, like bank or phone records.  The studios were hoping for a legal ruling in Norway that would criminalize accessing one’s own DVD on a competing player.  Rejecting the prosecutions legal arguments, the unanimous Norwegian Court stated, "someone who buys a DVD film that has been legally produced has legal access to the film."[39]  Currently residing outside the jurisdiction of national anti-circumvention laws, Johansen can build and use his own free DVD playing software without having to purchase a costly and restrictive DVD player from the DVD-CCA cartel. However, US and EU citizens who use or publish the DeCSS code, or try to build their own homemade DVD players face liability under circumvention laws, since its illegal to bypass the controls on your own property in the US and EU now.

Lexmark v. Static Control Component Toner Cartridge

The second largest printer manufacturer in the United States, Lexmark, has filed a lawsuit under the DMCA’s circumvention laws to prevent a competitor from selling lower priced toner cartridges that are compatible with Lexmark printers.[40]  Citing the DMCA’s access control prohibitions, Lexmark claims competitor Static Control Component’s less costly printer cartridges circumvent access to the toner loading program.[41]  Thus Lexmark claims Static Control’s chips are circumvention devices prohibited by the DMCA.[42]   Within weeks of being sued by the printer giant under the DMCA, Static Control agreed to stop making its lower priced compatible chips.[43]  Circumvention prohibitions’ broad propensity for misuse as an anti-competitive tool should not be over-looked as laws intended to protect against copyright infringement, in practice, inhibit innovation and consumer choice in the printer toner cartridge industry.  The case is currently pending in US federal court in Kentucky.

Chamberlain Group v. Skylink Technology Garage Door Opener

The DMCA’s anti-competitive impact was further felt in the US when a company that manufactures automatic garage door openers invoked the DMCA to prevent its competitor from selling a universal remote control for garage door openers.[44]  By creating a compatible remote control, Chamberlain claims that Skylink defeats the "access controls" to a computer program that opens and closes the garage door in violation of the DMCA.[45]  Skylink thus risks DMCA liability simply for creating an interoperable garage door opener.[46]  Stifling innovation and competition, the DMCA’s overbroad anti-circumvention measures have proven a powerful weapon to prevent competition in ways completely unexpected when it was passed.

C. DMCA Chills Freedom of Speech and Scientific Research

A common criticism of the DMCA in the US is its ability to allow private power to chill freedom of speech and censor scientific research.[47]  The circumvention prohibitions are so broad, they outlaw providing software or other technical information that could assist bypassing digital controls.[48]  Even information that discusses a technology’s vulnerabilities has been outlawed by the DMCA’s ban on providing circumvention tools.  EU lawmakers in particular, are now faced with pressure from the US copyright industry to import this policy of censorship over technical information, despite the chill felt by the scientific community in the US. While not shown to have any effect on infringement, withholding information about technological vulnerabilities only serves to diminish public security in computer systems.[49]

One of the earliest invocations of the DMCA’s circumvention ban involved a threat letter[50] from a recording industry executive to scientists preparing to publish a paper discussing the weaknesses in the recording industry’s watermark technology to control digital music.  Since the researchers’ paper included technical information that revealed weaknesses in the technology, the paper could be read by someone who could use that information to learn how to bypass the controls and make an infringing copy, and thus risked a DMCA violation. Although the DMCA made an effort to permit circumvention for security testing, the exemption has proven far too narrow in practice to be helpful to most scientists, including Princeton Professor Edward Felten and his team.[51]  Faced with DMCA liability for providing information that could qualify as a circumvention device, the scientists withdrew the paper and its presentation from a 2001 security conference in the US.  The recording industry’s threat of DMCA litigation against Felten’s team was not withdrawn until after the scientists filed a declaratory judgment lawsuit citing their right to freedom of speech under the US Constitution.[52]  While the industry finally agreed it would not sue over that one particular publication, it reserved its right to file future litigation against the researchers if other papers or presentations reveal technical information.  Even though the public has both a right and need to know about the weaknesses of systems, the DMCA’s circumvention ban outlaws much critical information about the weaknesses of computer security systems.

US computer giant Hewlett Packard used the DMCA to threaten a group of researchers who published information about an operating system security flaw that HP had known about but never fixed.[53]  Computer security researchers are particularly vulnerable to DMCA violations since they regularly circumvent the security of computer systems for testing purposes.  In another incident, HP employee and Linux guru Bruce Perens was forced to pull his presentation at the last O’Reilly Open Source Convention because it would involve bypassing DVD access controls, and risked DMCA liability.  HP ordered Perens to withdraw his demonstration on how to get around DVD region code restrictions and subsequently fired him from HP. 

Citing the DMCA’s circumvention prohibitions, Alan Cox, a top Linux developer in the UK announced that Americans would not be given technical information about security patches in an update to an operating system since it could trigger DMCA liability for the open source developers.[54]  American developers and scientists are a significant competitive disadvantage now to those in countries where circumvention laws have not been enacted and researchers may freely discuss technical information.

The DMCA’s chill felt on scientific research and publication extends to researchers outside of the US as well.  Several prominent foreign scientists have said they are afraid to travel to the US because of past research or computer programs written that could be used to bypass technological restrictions, creating DMCA liability today.[55]  A noted Dutch cryptographer issued a statement that he is withholding research on video encryption out of fear of DMCA liability for releasing that information.[56] 

As further evidence of the stifling effect circumvention prohibitions are having on scientific research in the US, technical conferences are relocating to jurisdictions where circumvention bans have not been passed.[57]  Organizers and sponsors of technical conferences face criminal liability for circumvention under the DMCA since they provide the technical information for a profit.  Following the arrest of Dmitry Sklyarov for revealing weaknesses in Adobe software, Russia’s state department issued an official travel advisory to warn Russian computer programmers of the danger in traveling to the US since the DMCA was enacted.[58]  Scientists and technical conferences will continue to avoid the US where its not safe to discuss or publish technical information about DVDs, CDs, eBooks, and other digital media.

D.  Americans Reconsider Circumvention Prohibitions

US lawmakers have begun to respond to the growing public opposition to the DMCA’s circumvention prohibitions in the US[59].  Efforts have begun to revise the DMCA in the US Congress, the Copyright Office, and the courts.  Even executive branch officials have become publicly uncomfortable with the DMCA’s extreme ban on consumer circumvention.  While the US public was not paying attention to digital copyright matters when the legislation was before Congress in 1998, the public is beginning to demand change to the law’s broad curtailment of consumer rights now that it’s enforcement has begun.[60]

1.  US Legislative Proposals to Permit Legitimate Consumer Circumvention

Digital Media Consumers’ Rights Act (DMCRA)

One of the most vocal opponents of the DMCA, Rep. Rick Boucher introduced legislation in the US Congress intended to restore much of the traditional balance between copyright holders and the public by permitting lawful consumer circumvention and requiring proper labeling of copy-restricted CDs.[61]  The Digital Media Consumers' Rights Act (DMCRA) would amend the DMCA to permit legitimate consumer circumvention for non-infringing uses, such as reading eBooks on laptops, or circumvention of DVDs to bypass region code restrictions or to watch a movie on a Linux computer.  Co-sponsored by US Representatives John Doolittle, Spencer Bachus, and Patrick Kennedy, DMCRA also re-asserts the traditional "Sony Betamax" doctrine whereby technologies with substantial non-infringing uses cannot be stifled by copyright holders.  DMCRA has received support from national consumer and public interest organizations including endorsements from the American Library Association, Home Recording Rights Coalition, Electronic Frontier Foundation, and the Consumers Union. Industry groups such as Computer & Communications Industry Association, Sun Microsystems, Intel, and Philips also publicly support the bill’s amendment to the DMCA’s broad prohibitions as a more balanced approach to circumvention.

Digital Choice and Freedom Act (DCFA)

US Representative Zoe Lofgren said she had originally voted for the DMCA in 1998 because she believed it would be used to prevent infringement.[62]   But now that its effects are felt in practice through enforcement, she noted its been used to thwart technological development and has introduced legislation to amend the circumvention prohibitions.  Recognizing that technological control measures "threaten society’s interests in the First Amendment and fair use rights of individuals," Lofgren’s Digital Choice and Freedom Act (DCFA) of 2002 would permit legitimate consumer circumvention to engage in lawful uses of copyrighted works.

DCFA aims to restore many of the individual liberties that the DMCA’s broad ban on circumvention took away, like the ability to make lawful copies for such purposes as fair use, archiving, and reverse engineering. DCFA also ensures that consumers shall engage the same fair use rights with digital copies that they traditionally enjoyed with analogue copies.  DCFA attempts to protect traditional First Sale Privileges that permit individuals to sell or give away their property.  The proposed bill would also prohibit non-negotiable shrink-wrap licenses that take away legitimate consumer rights and expectations.  Much like the DMCRA, Lofgren’s bill has received wide populist support from civil liberties and public interest groups, even earning endorsements from industry organizations.[63]

2.  US Executive Branch Calls for DMCA Reform

Even the executive branch government in the US is calling for reform to the DMCA’s extreme ban on circumvention.  Last October, the Head of White House Cyber Security Richard Clarke called for an amendment to the DMCA because of its chilling effect on computer security research.[64]  Clarke said researchers should be allowed to share information about computer vulnerability but the DMCA’s circumvention prohibitions make their publication of flaws illegal.  The Bush Administration official said threats that made under the DMCA against researchers had been a misuse of the law and that reform was needed.  "I think a lot of people didn't realize that it would have this potential chilling effect on vulnerability research," the Administration official stated.[65]  Early discomfort from the executive branch was expressed in 2000 in a report published by the National Research Council that criticized the DMCA and recommended revising its circumvention prohibitions to provide for legitimate consumer circumvention.[66]

3.  US Courts Wrestle with DMCA Legal Challenges

While the DMCA withstood its initial legal attack against 2600 Magazine in 2000, more recent court cases indicate the public’s unwillingness to support the DMCA’s extreme prohibitions and point to the statute’s vulnerability to judicial reconstruction.  In December 2002, a California jury acquitted Elcomsoft of all charges under the DMCA for providing software that unlocks Adobe eBooks.[67]  Even though Elcomsoft was providing a circumvention tool banned by the DMCA, the need to make noninfringing fair use of eBooks persuaded the jury to find the Russian software firm not guilty.[68]

In 2002, a software company called 321 Studios filed a legal challenge to the DMCA’s ban on bypassing DVD access controls in order to make noninfringing fair use copies of DVD movies.[69]  In the Declaratory Judgment action, 321 Studios asked the court to approve of its distribution of software that enables fair use and lawful backup copying of DVDs, despite the DMCA’s ban on circumvention tools.  If successful, 321 Studios’ legal challenge could create some meaningful breathing space under the DMCA for firms who want to build software and devices that can interoperate with digital media, like DVDs.  It could also ensure consumers are able to copy and edit their music and movies as they have in the past, despite the legislative prohibitions.

Harvard University researcher Ben Edelman launched another legal attack in July 2002 that could overturn portions of the DMCA’s circumvention prohibitions.[70]  Edelman needs to gain access to lists of websites blocked by filtering software so he can report back to the public on the accuracy and effectiveness of the software.  But filtering software companies use the DMCA and encryption to block researchers such as Edelman from gaining access to the lists so they can prevent testing and discussion of results. Although the US Library of Congress issued an exemption[71] to permit circumvention to access lists of blocked websites, its still illegal under the DMCA for anyone to build a tool that could enable Edelman’s explicitly lawful circumvention.[72]  Filed by the American Civil Liberties Union (ACLU), Edelman’s legal challenge points to the inherent illogic of a law that claims to legalize conduct, but then outlaws all tools necessary to engage in that conduct.

III.  Growing International Concern Over Circumvention Prohibitions

Observers all over the world have signaled mounting discomfort with the broad prohibitions against legitimate consumer circumvention the US copyright industry is pushing on the international community.[73]  The UK Commission on Intellectual Property Rights issued a report in summer of 2002 calling attention to the threat broad circumvention bans such as the DMCA and EUCD have created for consumer rights such as fair use and First Sale privileges.[74]  The Commission’s Report recommends legislation that permits circumvention to engage in lawful use of digital media and warns other countries against passing circumvention prohibitions such as those found in the DMCA and the EUCD.[75]

National legislation implementing the EUCD will soon be put to vote by lawmakers in countries across Europe.  In hopes of restoring traditional consumer rights, local populist groups have formed to counter overbroad circumvention prohibitions, including the Campaign for Digital Rights in the UK,[76] the Institute of Legal Questions on Free and Open Source Software in Germany,[77] and Electronic Frontier Finland.[78] Other grassroots organizations have sprung up in France,[79] Belgium,[80] Austria,[81] and throughout the EU[82] to protect civil liberties against copyright’s expansion.  At the Directive’s official deadline of December 22, 2002, only two of the fifteen EU countries implemented anti-circumvention legislation, Greece[83] and Denmark.[84]  Public opposition to proposed legislation in the UK implementing the EUCD was so overwhelming that the UK Patent Office pushed back its original deadline to reconsider its consultation document.[85]  UK public interest group Consumers’ Association has called on the Patent Office to legalize personal copying in the UK.[86]

As lawmakers in the EU are confronted by Copyright Directive obligations at the same time as public opposition mounts to the prohibitions, they must craft exemptions based on freedom of information rights and create meaningful ways of enabling them.  To the extent possible, national legislators should avoid complete bans on technology and the chilling effect its shown to create in the US.  EU legislators could exercise their right to national autonomy and create exemptions that protect traditional consumer rights and leave room for innovative future uses.  Enacting measures that affirmatively legalize private non-commercial or other fair use copying would also help to restore some of the balance lost in the EU.

More likely, Europeans will be forced to bring court challenges to overbroad prohibitions based on rights to freedom of expression and information.  Article 10 of the European Convention on Human Rights guarantees a broad right to freedom of expression in any medium and provides fertile grounds for fair use limitations in European copyright law.[87]  The rights secured under Article 10 of the ECHR may be invoked directly before national courts of the states that are party to it, subject to review by the European Court.  Its possible that national courts could also give deference to freedom of expression principles over copyright under national constitutions or copyright norms.  National case law in EU countries such as Germany suggest that freedom of expression arguments could succeed against copyright claims that prevented core free speech activities.[88] 

Circumvention Reform Needed to Protect Civil Liberties in EU and US

Its truly ironic that just as Americans are trying to find ways out of the nightmare created by the DMCA, Europeans are passing even more extreme measures to outlaw even more legitimate consumer activity.  Early battles waged in the US over the proper scope of circumvention laws provide some indication of what Europeans can expect.  Certainly European court challenges to the EUCD based on freedom of expression, like the cases currently pending in the US, are inevitable.  But not all EU countries enjoy constitutional guarantees to freedom of expression that can help to bolster a legal challenge to the EUCD, so many will have to rely on a largely untested right under the ECHR.

Unless national legislators are willing to stand up and protect the rights of their fellow citizens and oppose broad circumvention prohibitions now, the EU risks slipping into a digital "dark age" with prohibitions even more extreme than those already proven disastrous in the US.[89]  Freedom of speech, fair use rights, even national sovereignty are at issue as lawmakers across Europe confront anti-circumvention laws.  Unfortunately, the EUCD implementation process in the coming months will likely evince the US copyright industry’s power to pressure other nations into passing laws shown to be against their best interests.

---