Anti-Hacking Copyright Law Scrutinized in Free Speech Challenge

A decades-old law that criminalizes hacking through digital security measures to access copyrighted work like music, movies, and software is facing a constitutional challenge by security researchers who argue it’s an impediment to free speech.

Attorneys say the case—scheduled for oral argument Monday in a Washington, D.C., federal appeals court—could have important implications for the “right-to-repair” movement, which supports allowing well-intention hackers to tinker with rightfully purchased devices and software without fear of legal consequences. Security research, accessibility, and online copyright enforcement may also be affected, they say.

The Digital Millennium Copyright Act, which revised US copyright laws in 1998 for the internet age, established criminal and civil penalties for picking a digital lock used to safeguard copyrighted work.

Digital locks, called “technological protective measures” in the statute, can include anything from password protections for viewing a movie to file encryptions on a DVD. A gamer who bypasses these locks to repair certain parts of an Xbox console or a security researcher identifying and publishing vulnerabilities in software could potentially face DMCA liability.

Matthew Green, a computer security researcher at Johns Hopkins University, and Andrew Huang, an electrical engineer and hacker, sued the Justice Department and the US Copyright Office in 2016. They argued that the circumvention ban, contained in Section 1201 of the DMCA, is an unconstitutional restriction on free speech.

Green claimed that he could face legal liability for writing and publishing a book about security flaws in computer software that includes hacking code. Huang and his company AlphaMax LLC want to create software that allows users to edit HD video, but requires circumventing certain encryption for HDMI signals.

“What are you allowed to do under fair use and what are you allowed to do in terms of circumvention under Section 1201?” said Blake Reid, a technology law professor at the University of Colorado. “And that’s why this case is so critical. It would solve all these problems out to the bounds of fair use, and give people a whole bunch more certainty.”

But the Justice Department and strong-copyright advocates including Intel Corp. and the Motion Picture Association Inc. argue that the law has allowed the digital economy to flourish. Content creators can better market their work with paywalls and other systems that protect their work from infringement.

“Congress realized that copyright owners need a safe place where they’ll want to share their works in digital form,” said Devlin Hartline, a legal fellow at the Hudson Institute who specializes in intellectual property. “The idea was that we protect these digital locks in order to prevent infringement from happening in the first place.”

Anti-Circumvention

US copyright law gives artists exclusive rights to distribute, display, and monetize their art, but the DMCA established a new class of rights.

The law’s hacking ban gives copyright owners the right to control access to their work, even when a hacker doesn’t intend to infringe the work’s copyright. In other words, a violation of the DMCA doesn’t require copyright infringement.

Critics including the Electronic Frontier Foundation, a digital rights organization representing Green and Huang in the case, argue that this new right has dramatically increased the power that manufacturers have over their products, to the detriment of consumers.

For years, the farm equipment manufacturer John Deere invoked the DMCA to prevent tractor owners from accessing software on their vehicles for repair or diagnosis.

But Congress recognized that the anti-circumvention provision’s wide-ranging power could hinder cases of fair use and other non-infringing uses of copyrighted works. In an attempt to address digital piracy without overbroad regulation, the DMCA authorized the US Copyright Office, part of the Library of Congress, to adopt rules every three years that allow for exemptions to the anti-circumvention ban.

In 2015, the Copyright Office allowed tractor and car owners to investigate their vehicle’s software under certain circumstances.

EFF and friend-of-the-court briefs argue that the rulemaking process is a “speech licensing” system that burdens those seeking to conduct circumvention for perfectly legal purposes. Reid, who filed an amicus brief in support of Green and Huang, represents a variety of organizations involved in security research, accessibility, and the right-to-repair movement.

Disability organizations shouldn’t have to go to the Copyright Office on a three-year schedule to ask permission to bypass certain protections on e-books and digital movies to make them accessible to people with seeing or hearing disabilities, Reid said.

“The amount of paperwork and filings and hours that you have to spend preparing for these exemptions is really significant,” Reid said. “It takes my student attorneys a couple of hundred man-hours over the course of a year just to do one exemption.”

In its briefs, the Justice Department argued that the rulemaking proceedings create the proper balance by both protecting fair use and preventing online infringement. It noted that Green’s request to conduct research by circumventing digital security measures was granted by the Copyright Office in 2018, and that the law already contains a variety of permanent exemptions relating to encryption research.

“There are already exemptions,” Hartline said. “And if they think there needs to be more, that’s a perfectly reasonable position to have. But that doesn’t mean striking down the entire statute on its face.”

Conduct or Speech?

The Justice Department’s primary defense against Green and Huang’s First Amendment challenge is that the anti-circumvention law is a restriction on conduct—in this case hacking—not speech.

So far, the courts have agreed. Judge Emmet G. Sullivan of the US District Court for the District of Columbia mostly dismissed the lawsuit in a 61-page opinion in 2019. Green and Huang appealed the ruling to the US Court of Appeals for the District of Columbia Circuit in 2021.

Sullivan found that although Section 1201 does implicate speech—because code is a form of speech—the statute only restricts the “functional, non-speech” aspect of code.

“There’s an expressive component of the code, but 1201 isn’t directed to the expressive component,” Hartline said. “It’s directed to the more utilitarian question of, what does the code actually do? And what the code does is bypass a digital lock.”

That position fails to recognize that the statute is a regulation on a tool used to create speech, much like a camera, according to Rebecca Tushnet, an intellectual property law professor at Harvard Law School. If the government regulates where a camera can be placed, or what it can take photos of, “we want to treat that as a speech regulation,” she said.

“Recharacterizing speech as conduct is often ‘unprincipled’ and ‘susceptible to manipulation,’” Tushnet wrote in an amicus brief supporting Green and Huang, citing precedent that “laws that restrict bookstores from selling biographies” can’t escape the First Amendment.

Green, Huang, and the EFF are arguing that because the anti-circumvention statute contains certain exemptions, the law discriminates based on the content of people’s speech. That should trigger strict scrutiny, they argue, a high standard that would bar limitation unless it furthers a compelling government interest and is narrowly tailored.

The exemption process, Tushnet said, isn’t enough to safeguard free speech.

“I’m a veteran of multiple rulemaking proceedings, so I can tell you with perfect confidence that it is not a good way to protect speech,” she said. “There’s a reason that we don’t approve of pre-licensing systems where you have to go to the government and get permission to speak.”

The case is Green v. US Dep’t of Justice, D.C. Cir., No. 21-5195, oral argument 9/12/22.