Digital Millennium Copyright Act (DMCA)
The DMCA is not often considered in a discussion of hacking and the question of information
security, but it is relevant to the area. The DMCA was passed in 1998 to implement
the World Intellectual Property Organization Copyright Treaty (WIPO Treaty).
The WIPO Treaty requires treaty parties to “provide adequate legal protection and effective
legal remedies against the circumvention of effective technological measures that
are used by authors,” and to restrict acts in respect to their works which are not authorized.
Thus, while the CFAA protects computer systems and the ECPA protects communications,
the DMCA protects certain (copyrighted) content itself from being accessed
without authorization. The DMCA establishes both civil and criminal liability for the
use, manufacture, and trafficking of devices that circumvent technological measures
controlling access to, or protection of the rights associated with, copyrighted works.
The DMCA’s anti-circumvention provisions make it criminal to willfully, and for
commercial advantage or private financial gain, circumvent technological measures that
control access to protected copyrighted works. In hearings, the crime that the anticircumvention
provision is designed to prevent was described as “the electronic equivalent
of breaking into a locked room in order to obtain a copy of a book.”
“Circumvention” is defined as to “descramble a scrambled work…decrypt an encrypted
work, or otherwise…avoid, bypass, remove, deactivate, or impair a technological measure,
without the authority of the copyright owner.” The legislative history provides that “if unauthorized
access to a copyrighted work is effectively prevented through use of a password, it
would be a violation of this section to defeat or bypass the password.” A “technological
measure” that “effectively controls access” to a copyrightedwork includes measures that, “in
the ordinary course of its operation, requires the application of information, or a process or
a treatment, with the authority of the copyright owner, to gain access to the work.” Therefore,
measures that can be deemed to “effectively control access to a work” would be those
based on encryption, scrambling, authentication, or some other measure that requires the
use of a key provided by a copyright owner to gain access to a work.
Said more directly, the Digital Millennium Copyright Act (DMCA) states that no one
should attempt to tamper with and break an access control mechanism that is put intoplace to protect an item that is protected under the copyright law. If you have created a
nifty little program that will control access to all of your written interpretations of the
grandness of the invention of pickled green olives, and someone tries to break this program
to gain access to your copyright-protected insights and wisdom, the DMCA could
come to your rescue.
When down the road you try to use the same access control mechanism to guard
something that does not fall under the protection of the copyright law—let’s say your
uncopyrighted 15 variations of a peanut butter and pickle sandwich—you would find a
different result. If someone were willing to extend the necessary resources to break your
access control safeguard, the DMCA would be of no help to you for prosecution purposes
because it only protects works that fall under the copyright act.
This sounds logical and could be a great step toward protecting humankind, recipes,
and introspective wisdom and interpretations, but there are complex issues to deal with
under this seemingly simple law. The DMCA also provides that no one can create,
import, offer to others, or traffic in any technology, service, or device that is designed for
the purpose of circumventing some type of access control that is protecting a copyrighted
item. What’s the problem? Let us answer that by asking a broader question: Why
are laws so vague?
Laws and government policies are often vague so they can cover a wider range of
items. If your mother tells you to “be good,” this is vague and open to interpretation. But
she is your judge and jury, so she will be able to interpret good from bad, which covers
any and all bad things you could possibly think about and carry out. There are two
approaches to laws and writing legal contracts:
• Specify exactly what is right and wrong, which does not allow for interpretation
but covers a smaller subset of activities.
• Write laws at a higher abstraction level, which covers many more possible
activities that could take place in the future, but is then wide open for different
judges, juries, and lawyers to interpret.
Most laws and contracts present a combination of more- and less-vague provisions
depending on what the drafters are trying to achieve. Sometimes the vagueness is inadvertent
(possibly reflecting an incomplete or inaccurate understanding of the subject),
while at other times it is intended to broaden the scope of that law’s application.
Let’s get back to the law at hand. If the DMCA indicates that no service can be offered
that is primarily designed to circumvent a technology that protects a copyrighted work,
where does this start and stop? What are the boundaries of the prohibited activity?
The fear of many in the information security industry is that this provision could be
interpreted and used to prosecute individuals carrying out commonly applied security
practices. For example, a penetration test is a service performed by information security
professionals where an individual or team attempts to break or slip by access control
mechanisms. Security classes are offered to teach people how these attacks take place so
they can understand what countermeasure is appropriate and why. Sometimes people arehired to break these mechanisms before they are deployed into a production environment
or go to market, to uncover flaws and missed vulnerabilities. That sounds great: hack my
stuff before I sell it. But howwill people learn howto hack, crack, and uncover vulnerabilities
and flaws if the DMCA indicates that classes, seminars, and the like cannot be conducted
to teach the security professionals these skills? The DMCA provides an explicit
exemption allowing “encryption research” for identifying flaws and vulnerabilities of
encryption technologies. It also provides for an exception for engaging in an act of security
testing (if the act does not infringe on copyrighted works or violate applicable law such as
the CFAA), but does not contain a broader exemption covering the variety of other activities
that might be engaged in by information security professionals. Yep, as you pull one
string, three more show up. Again, it is important for information security professionals
to have a fair degree of familiarity with these laws to avoid missteps.
An interesting aspect of the DMCA is that there does not need to be an infringement
of the work that is protected by the copyright law for prosecution under the DMCA to
take place. So if someone attempts to reverse-engineer some type of control and does
nothing with the actual content, that person can still be prosecuted under this law. The
DMCA, like the CFAA and the Access Device Statute, is directed at curbing unauthorized
access itself, but not directed at the protection of the underlying work, which is the role
performed by the copyright law. If an individual circumvents the access control on an
e-book and then shares this material with others in an unauthorized way, she has broken
the copyright law and DMCA. Two for the price of one.
Only a few criminal prosecutions have been filed under the DMCA. Among these are:
• A case in which the defendant was convicted of producing and distributing
modified DirecTV access cards (United States v. Whitehead).
• A case in which the defendant was charged for creating a software program that was
directed at removing limitations put in place by the publisher of an e-book on the
buyer’s ability to copy, distribute, or print the book (United States v. Sklyarov).
• A case in which the defendant pleaded guilty to conspiring to import, market,
and sell circumvention devices known as modification (mod) chips. The mod
chips were designed to circumvent copyright protections that were built into
game consoles, by allowing pirated games to be played on the consoles (United
States v. Rocci).
There is an increasing movement in the public, academia, and from free speech
advocates to soften the DCMA due to the criminal charges being weighted against legitimate
researchers testing cryptographic strengths (see www.eff.org/IP/DMCA/Felten_v_
RIAA). While there is growing pressure on Congress to limit the DCMA, Congress is taking
action to broaden the controversial law with the Intellectual Property Protection Act
of 2006. As of January 2007, the IP Protection Act of 2006 has been approved by the Senate
Judiciary Committee, but has not yet been considered by the full Senate.
