Electronic Frontier Foundation brings suit over anti-circumvention provisions in the DMCA

by White & Case LLP

White & Case LLP

On July 21, 2016, the Electronic Frontier Foundation ("EFF") filed a complaint against various agencies and members of the U.S. government over Section 1201 of the Digital Millennium Copyright Act ("DMCA") [1], arguing that this law is overbroad and is in violation of the First Amendment and the constitutional right to freedom of expression.[2]

What is Section 1201?

Section 1201, entitled the "circumvention of copyright protection systems", makes it illegal to bypass systems that are in place to protect copyrighted works. This includes the manufacturing, and importation of any service, device or component of a technological measure that has been primarily designed for circumventing another piece of technology that controls access to copyrighted works.[3] Circumvention of a technological measure is defined as something that may "descramble a scrambled work, […] decrypt an encrypted work, or otherwise […] avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner." [4] The section was designed primarily for protecting against the infringement of musical and video works and the circumvention of the security measures used to protect them, although its catch-all nature makes anybody who circumvents such a protective system liable for circumvention irrespective of the reason for which they are bypassing that particular system.

On a triennial basis, the Librarian of Congress is granted the ability to publish specific exemptions to the rule.[5] For example, the Librarian has previously granted exemptions for the creation of eBooks discussing media analysis, certain types of security research, and the restoration of lawfully acquired video games where such games were no longer supported by the creator.[6] Members of the public put in a request to the Copyright Office that a particular activity be exempt, after which the Copyright Office may provide a recommendation to the Librarian. It is the Librarian who is instructed to consider statutory factors, and makes the ultimate decision as to whether to grant any exemption.[7] Once granted, an exemption will be valid for only three years, after which it will expire.[8]

Critics have deemed this section "unnecessarily harmful"[9] because they believe that speech that could be valuable and useful for society is instead being repressed.

The Facts of the Dispute

The EFF filed its complaint on behalf of Matthew Green, an Assistant Professor at the John Hopkins Information Security Institute, and Andrew "Bunnie" Huang, an electrical engineer, inventor, and owner of audiovisual media company, AlphaMax.

Green's work tests computer security measures and electronic systems, and he advises manufacturers of internet-based vulnerabilities and how to fix these. Green has discovered serious flaws in anti-theft systems used in the automotive industry and uncovered flaws in encryption powering various websites. He has been writing a book in which he goes into detail on how to circumvent security systems and find weaknesses in the coding of devices surrounding us in our everyday lives. Green expects to earn royalties on the sale of this book.

Huang and his company, AlphaMax, research and create tools to legally capture and edit videos. The technology allows users to save content to view at a later time, or move content to another device or format. In order to create this device, Huang will need to circumvent certain pre-existing technologies.

Both plaintiffs have been chilled from engaging in their work for fear that they would be susceptible to the fines imposed by the DMCA of $500,000 and up to five years imprisonment if they continue with their good-faith research.[10]

The complaint claims that Section 1201 has an adverse impact on speech, and lists multiple activities for which applicants have been denied exemptions. This includes format shifting, educational uses by museums, libraries and nonprofits, and educational uses by students outside of a school environment, like adult education programs.[11] The complaint states that the law is overbroad and "burdens a substantial range of protected speech that is disproportionate to its legitimate sweep."[12] The plaintiffs focus on how the law fails to properly balance the interests of copyright and the First Amendment law by considering the application of the doctrine of fair use.

Furthermore, the complaint argues that not only is the triennial exemption process unfair in that expiration after three years has meant that exemptions have failed to be renewed, including "an exemption to research Internet block lists and an exemption to test certain TPMs for malicious software,"[13] but that the rulemaking defendants themselves have imposed "a variety of onerous requirements on applicants seeking exemptions under this procedure"[14] which have not appeared anywhere in the DMCA. An example of this is the defendants requiring evidence that there is a widespread impact on noninfringing uses, rather than a simple showing of impact on the applicant's personal speech.

The government defendants on September 29, 2016, moved to dismiss the complaint and that motion is pending.[15] The primary arguments advanced in favor of a dismissal are that there has been no threat of prosecution against the defendants so they currently lack standing and that the DMCA as drafted and applied do not violate the constitution. On the same day, the EFF asked for a court order that would prevent the government from prosecuting Green for publishing his book on computer security.[16]


The plaintiffs have sought a declaration that the DMCA's circumvention rules violate the First Amendment, and an injunction from being subject to criminal enforcement for violation of the prohibitions under the rules. Further briefing and argument on the government's motion to dismiss lie ahead and should be monitored. When a decision is reached, the impact of this case could be of great importance to the effectiveness of technological safeguards used to protect works from copyright infringement. Copyright owners may lose some of the scope of the protections previously afforded by the circumvention rules if the plaintiffs prevail.

[1] - 17 U.S. Code § 1201
[2] -  Complaint for Declaratory and Injunctive Relief, Green et al v. U.S. Department of Justice, et al, No. 1:16-cv-01492 (D.D.C. Jul. 21, 2016)
[3] - 17 U.S. Code § 1201(a)(2)
[4] - Id. at § 1201(a)(3)
[5] - Id. at § 1201(a)(1)(b)-(c)
[6] - Supra note 2, at para. 41.
[7] - Supra note 1, at § 1201(a)(1)(c)
[8] - Id. at § 1201(a)(2)
[9] - A. Robinson, The EFF is suing over one of the worst US copyright rules, The Verge (Jul. 21, 2016), (last accessed on Aug. 8, 2016)
[10] - Id. at § 1204(a)(1)
[11] - Supra note 2, at 39
[12] - Id. at 117
[13] - Id. at 35
[14] - Id. at 33
[15] - Memorandum in Support of Defendants' Motion to Dismiss, Green et al v. U.S. Department of Justice, et al, No. 1:16-cv-01492 (D.D.C. Sep. 29, 2016)
[16] - Memorandum of Points and Authorities in Support of Motion for Preliminary Injunction on Behalf of Plaintiff Matthew Green Pursuant to Fed. R. Civ. P. 65(a), Green et al v. U.S. Department of Justice, et al, No. 1:16-cv-01492 (D.D.C. Sep. 29, 2016)

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© White & Case LLP | Attorney Advertising

Written by:

White & Case LLP

White & Case LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.