What do printer cartridges, garage door openers, and universal power supply calibrations have in common? They all use copyrighted code, they all feature technological impediments to unauthorized execution of their code -- and now they've all been the focus of appellate litigation under the Digital Millennium Copyright Act (DMCA).

One of the most-litigated and most-argued provisions of the DMCA is section 1201, the "anti-circumvention" provision which forbids breaking or bypassing certain technological measures that protect copyrighted works. Broadly speaking, section 1201(a) deals with technological measures that restrict access to a copyrighted work, and 1201(b) deals with copy controls and other measures that restrict not your access to a work but what you can do with the work after accessing it. Section 1201(a) forbids both trafficking in circumvention tools and the act of circumvention itself; 1201(b) covers only trafficking. An ongoing source of controversy is whether and how closely 'access' under 1201(a) must be tied to an underlying act of copyright infringement before circumvention liability will attach. To put it another way, is what you were going to do with a work once you accessed it relevant to the question of whether you're allowed to grant yourself access? Different appellate courts have come down on opposite sides of this issue, and another circuit court just waded into the mix.

The alleged circumvention in this case, MGE UPS Systems v. GE Consumer & Industrial, out of the Fifth Circuit, involved a copyrighted computer program for servicing uninterruptable power supply ("UPS") machines, which had a two-step authentication process: before loading, the program would first check for the presence of a "dongle" connected to the computer; it would then proceed to make sure the computer was attached to a genuine MGE UPS before gathering any data. PMI, a power service company now acquired by GE, used MGE's software to service its clients' MGE power supplies, but did not have a dongle and apparently did not have a legitimate copy of the software, either. PMI employees used "hacked MGE software" to bypass the dongle's software access restrictions. The case has some interesting aspects relating to civil procedure (what do you have to prove in court to keep your case from being tossed out?) and evidence (how can you prove what your damages are?), but the meat of the opinion relates to circumvention of access controls.

One issue is that 'circumvention,' defined in section 1201, is a separate cause of action from 'infringement,' which is defined in section 501 of the Copyright Act. So. The issue is compounded by section 1201(c), which provides that nothing in 1201 "shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use". There have been two general approaches to reconciling circumvention with the limitations on infringement: one exemplified by the Federal Circuit in Chamberlain Group v. Skylink Technologies, which held that copyright owners can only withhold access when it protects their rights under the Copyright Act, taking into account the exceptions and limitations to those rights; and the other, typified by the Second Circuit's opinion in Universal City Studios v. Corley, where the court decided that 1201(c) simply means you're not automatically liable for infringement just because you circumvented an access control.

The Federal Circuit's approach takes the view that there is a "critical nexus between access and protection"; section 1201 only prohibits circumventing an access control when the circumvention implicates "a property right for which the Copyright Act permits the copyright owner to withhold authorization." Fair use is the classic example of a case where a copyright owner cannot withhold authorization--as when Roy Orbison's publisher could not withhold authorization from 2 Live Crew when they parodied "Oh, Pretty Woman"--but there are others as well, such as the right of the owner of a copy of a software program to execute that program. This view recognizes that there are explicit statutory limits on the scope of the property rights that make up copyright, and takes the approach that copyright owners cannot prohibit access when they have no recourse against the underlying conduct enabled by that access. To do otherwise would effectively be to surreptitiously expand the scope of copyright.

The Second Circuit's approach, meanwhile, is to divorce access from protection completely: "the DMCA targets the circumvention of digital walls guarding copyrighted material . . . but does not concern itself with the use of those materials after circumvention has occurred." This approach explicitly separates authorization to access a work from authorization to make any use of the work after accessing it, rejecting the argument that the DMCA "can be read to allow the circumvention of encryption technology protecting copyrighted material when the material will be put to 'fair uses' exempt from copyright liability." The Second Circuit accommodates fair use and other limitations on copyright only by stating that you're not automatically liable for infringement just because you circumvented an access control.

Interestingly, the Fifth Circuit in MGE seemingly attempts to take both approaches at once, and cites both Chamberlain and Corley approvingly. First, the court characterizes the dongle as a pure access restriction that does not prevent anybody from copying the program code. It relies on Chamberlain to hold that since "the dongle does not protect against copyright violations, the mere fact that the dongle itself is circumvented does not give rise to a circumvention violation within the meaning of the DMCA." This much is solidly in line with the Federal Circuit and some other courts, though not free from controversy.

But instead of stopping there, the court then seems to go on to hold that only the act of modifying the software to avoid the dongle could conceivably even rise to the level of 'circumvention' in the first place; merely using already-modified software is not actionable under the DMCA. The question of who circumvents is an interesting one, and the court's answer to that can coexist happily with its approach to what counts as circumvention. But while the question could be phrased as whether you avoid or bypass a technological measure every time you run a modified software program, the court appears to answer a different question: whether copyright infringement creates circumvention liability.

The court seems to base its holding that using a pre-circumvented program doesn't count as a new act of circumvention on the notion that 'use', in a copyright context, generally implicates infringement, as in "fair use". Of course infringement and circumvention are different: they're defined in different sections of the statute, the elements a plaintiff has to prove are different, the remedies are different, and so on. Yet the Fifth Circuit justifies its argument by citing Corley's discussion of fair use--while they quote a sentence that supports their immediate point, that sentence comes right on the heels of some others flatly rejecting the type of analysis undertaken in Chamberlain. Citing Corley right after going through a process it rejects, without addressing that tension, seems a bit odd.

In the end, the Fifth Circuit gives two reasons why PMI didn't circumvent an access-control measure: MGE's dongle isn't the kind of technological measure protected by the DMCA; and PMI wasn't the one who modified the software to avoid the dongle to begin with. (It's important to note that PMI didn't get off scot-free: there were consequences for its copyright infringement.) The former looks like the Fifth Circuit taking sides in the access/protection circuit split outlined above. The latter, though, is a bit different: the question of who can be considered a circumventer is a newer one, and one we likely are just seeing the beginning of.

What do printer cartridges, garage door openers, and universal power supply calibrations have in common? They all use copyrighted code, they all feature technological impediments to unauthorized execution of their code -- and now they've all been the focus of appellate litigation under the Digital Millennium Copyright Act (DMCA).

One of the most-litigated and most-argued provisions of the DMCA is section 1201, the "anti-circumvention" provision which forbids breaking or bypassing certain technological measures that protect copyrighted works. Broadly speaking, section 1201(a) deals with technological measures that restrict access to a copyrighted work, and 1201(b) deals with copy controls and other measures that restrict not your access to a work but what you can do with the work after accessing it. Section 1201(a) forbids both trafficking in circumvention tools and the act of circumvention itself; 1201(b) covers only trafficking. An ongoing source of controversy is whether and how closely 'access' under 1201(a) must be tied to an underlying act of copyright infringement before circumvention liability will attach. To put it another way, is what you were going to do with a work once you accessed it relevant to the question of whether you're allowed to grant yourself access? Different appellate courts have come down on opposite sides of this issue, and another circuit court just waded into the mix.

The alleged circumvention in this case, MGE UPS Systems v. GE Consumer & Industrial, out of the Fifth Circuit, involved a copyrighted computer program for servicing uninterruptable power supply ("UPS") machines, which had a two-step authentication process: before loading, the program would first check for the presence of a "dongle" connected to the computer; it would then proceed to make sure the computer was attached to a genuine MGE UPS before gathering any data. PMI, a power service company now acquired by GE, used MGE's software to service its clients' MGE power supplies, but did not have a dongle and apparently did not have a legitimate copy of the software, either. PMI employees used "hacked MGE software" to bypass the dongle's software access restrictions. The case has some interesting aspects relating to civil procedure (what do you have to prove in court to keep your case from being tossed out?) and evidence (how can you prove what your damages are?), but the meat of the opinion relates to circumvention of access controls.

One issue is that 'circumvention,' defined in section 1201, is a separate cause of action from 'infringement,' which is defined in section 501 of the Copyright Act. So. The issue is compounded by section 1201(c), which provides that nothing in 1201 "shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use". There have been two general approaches to reconciling circumvention with the limitations on infringement: one exemplified by the Federal Circuit in Chamberlain Group v. Skylink Technologies, which held that copyright owners can only withhold access when it protects their rights under the Copyright Act, taking into account the exceptions and limitations to those rights; and the other, typified by the Second Circuit's opinion in Universal City Studios v. Corley, where the court decided that 1201(c) simply means you're not automatically liable for infringement just because you circumvented an access control.

The Federal Circuit's approach takes the view that there is a "critical nexus between access and protection"; section 1201 only prohibits circumventing an access control when the circumvention implicates "a property right for which the Copyright Act permits the copyright owner to withhold authorization." Fair use is the classic example of a case where a copyright owner cannot withhold authorization--as when Roy Orbison's publisher could not withhold authorization from 2 Live Crew when they parodied "Oh, Pretty Woman"--but there are others as well, such as the right of the owner of a copy of a software program to execute that program. This view recognizes that there are explicit statutory limits on the scope of the property rights that make up copyright, and takes the approach that copyright owners cannot prohibit access when they have no recourse against the underlying conduct enabled by that access. To do otherwise would effectively be to surreptitiously expand the scope of copyright.

The Second Circuit's approach, meanwhile, is to divorce access from protection completely: "the DMCA targets the circumvention of digital walls guarding copyrighted material . . . but does not concern itself with the use of those materials after circumvention has occurred." This approach explicitly separates authorization to access a work from authorization to make any use of the work after accessing it, rejecting the argument that the DMCA "can be read to allow the circumvention of encryption technology protecting copyrighted material when the material will be put to 'fair uses' exempt from copyright liability." The Second Circuit accommodates fair use and other limitations on copyright only by stating that you're not automatically liable for infringement just because you circumvented an access control.

Interestingly, the Fifth Circuit in MGE seemingly attempts to take both approaches at once, and cites both Chamberlain and Corley approvingly. First, the court characterizes the dongle as a pure access restriction that does not prevent anybody from copying the program code. It relies on Chamberlain to hold that since "the dongle does not protect against copyright violations, the mere fact that the dongle itself is circumvented does not give rise to a circumvention violation within the meaning of the DMCA." This much is solidly in line with the Federal Circuit and some other courts, though not free from controversy.

But instead of stopping there, the court then seems to go on to hold that only the act of modifying the software to avoid the dongle could conceivably even rise to the level of 'circumvention' in the first place; merely using already-modified software is not actionable under the DMCA. The question of who circumvents is an interesting one, and the court's answer to that can coexist happily with its approach to what counts as circumvention. But while the question could be phrased as whether you avoid or bypass a technological measure every time you run a modified software program, the court appears to answer a different question: whether copyright infringement creates circumvention liability.

The court seems to base its holding that using a pre-circumvented program doesn't count as a new act of circumvention on the notion that 'use', in a copyright context, generally implicates infringement, as in "fair use". Of course infringement and circumvention are different: they're defined in different sections of the statute, the elements a plaintiff has to prove are different, the remedies are different, and so on. Yet the Fifth Circuit justifies its argument by citing Corley's discussion of fair use--while they quote a sentence that supports their immediate point, that sentence comes right on the heels of some others flatly rejecting the type of analysis undertaken in Chamberlain. Citing Corley right after going through a process it rejects, without addressing that tension, seems a bit odd.

In the end, the Fifth Circuit gives two reasons why PMI didn't circumvent an access-control measure: MGE's dongle isn't the kind of technological measure protected by the DMCA; and PMI wasn't the one who modified the software to avoid the dongle to begin with. (It's important to note that PMI didn't get off scot-free: there were consequences for its copyright infringement.) The former looks like the Fifth Circuit taking sides in the access/protection circuit split outlined above. The latter, though, is a bit different: the question of who can be considered a circumventer is a newer one, and one we likely are just seeing the beginning of.