EFFecting Digital Freedom
by Jason Kelley
Unintended Consequences? Twenty Years under the DMCA
One of the consequences of the rapid pace of tech's advancement over the last 20 years is that a layer of software is in nearly everything. What used to be relatively mechanical devices like tractors and coffee makers are now "smart," filled with thousands of lines of code. Which could be very cool for coders, researchers, and anyone who wants to interrogate the technology they use - like being in a more pleasant version of The Matrix, where knowing a little bit of programming practically turns you into a superhero.
But there's a big problem with this version of the story: much of the code that powers the devices around us is hidden behind "access controls" that make it off limits. It's been this way for 20 years now, thanks to Section 1201 of the Digital Millennium Copyright Act (DMCA), an incredibly over-broad law that prohibits "circumventing" those digital locks when they control access to copyrighted works like movies, music, books, games, and software. As a result, a lot of useful and important activities are banned. If you're doing what mechanics have done for decades - taking apart your car to repair it - or if you're trying to update the software on a device that the manufacturer has stopped supporting, you're potentially wading into illegal territory. That could be true for your interaction with just about any device that's got software on it.
It's no surprise that the broadly written law - which was supposed to (for example) stop DVDs from being ripped and shared online or stop cable customers from descrambling channels they hadn't paid for - would also be used to protect phone makers who want to restrict users' carrier options, and to allow manufacturers like John Deere to stop farmers from getting independent repairs. In fact, it was so evident that the law would create a domino effect like this, impacting users of devices that hadn't even been thought of yet, that a supposed "safety valve" was built in. Every three years, Section 1201 permits the Librarian of Congress and the U.S. Copyright Office to create exemptions for important activities that would otherwise be banned by the DMCA - and that means that how it affects users like you changes fairly often.
This exemption process - known by the Game of Thrones-like title of "The Triennial Rulemaking" - has a lot of problems. To start, it turns a group of copyright lawyers into decision-makers who determine what every single user can do with their electronics. Even when exemptions are granted, they're often too narrow. In 2009, the Librarian first granted the petition exempting jailbreaking of smartphones, but other smart devices, like tablets, weren't included until 2014. So, despite their similarity, up until that point an iPhone was exempt but an iPad was not. It sounds like progress, but there was no valid reason it took so long for tablets to be included. At this year's rulemaking, we argued that the exemption should also apply to smart speakers and voice assistants - because of course it should. We received the exemption (yay!), but to understand more about why so many consider this an outrageous law, here's what the opponents - the manufacturers - argued: jailbreaking is likely to enable voice assistant devices to access pirated content, and in fact, more likely than laptops or smartphones because the devices are so "simple." The Copyright Office was unimpressed by this, but in three years we'll have to do it all over again to include whatever new "smart" devices have been popularized in the interim. Meanwhile, jailbreaking them may be off limits.
There's also no guarantee the exemptions won't expire. Despite the fact that arguments against jailbreaking your phone or remixing video snippets don't get any better, groups like EFF return every three years to defend our victories while also trying to expand the exemptions for new and nonexempt activities and devices. In 2006 and 2009, the Librarian of Congress granted an exemption for cell phone unlocking. But in 2012, the exemption was granted only for a limited window of a paltry few months - and by January 26, 2013, cell phone unlocking was once again a potential DMCA violation. Luckily, a massive public outcry convinced Congress to pass a special law effectively reversing the Librarian's decision, because practically everyone agrees that people using their phones with the carrier of their choice has nothing to do with copyright infringement.
Importantly, DMCA 1201 contains several distinct prohibitions: a ban on acts of circumvention, and a ban on the distribution of tools and technologies used for circumvention, which chills the free speech of researchers, among others. Activision, Apple, Microsoft, and HP have all threatened security researchers who wanted to share information about security flaws. Even 2600 was the subject of censorship: eight major motion picture companies brought successful DMCA claims against the magazine to stop it from publishing DeCSS, a software program that defeats the CSS encryption used on DVDs. While the law contains exceptions for encryption research and security testing, like the rulemaking exemptions, those exceptions are far too narrow and have never been successfully raised as a defense by anyone.
All of this amounts to a patchwork of changing regulations that severely hinder what should be legal, fair uses of devices. These regulations harm consumers by being used and abused to increase manufacturer control and to discourage competition; they limit accessibility by hindering applications like screen readers; they squash creativity and art which can help us critique media or create new works that build on older media; and they interfere with legitimate research.
Thanks to work by advocates, researchers, archivists, artists, and more, the latest round of exemptions, released in October, are the most expansive yet. Researchers have more freedom to investigate and correct flaws on a wider range of devices. People who repair devices, including vehicles and home appliances, have more protection from legal threats. Filmmakers, students, and ebook creators can use video clips more freely, and a small expansion for online video game preservation allows certain groups to reproduce and modify some video game server software. But the exemptions are still too narrow and too complex for most technology users.
On behalf of a security researcher and a digital entrepreneur, EFF has sued the federal government, arguing that Section 1201 and the rulemaking process are unconstitutional restraints on speech. Having finished this year's rulemaking - the Seventh Triennial - we look forward to continuing that case. Until then, EFF will continue to fight to make the world safer for those who want complete control over the devices they own.