Universal City Studios, Inc. v. Reimerdes

111 F. Supp. 2d 294 (S.D.N.Y. 2000), affirmed, Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2nd Cir. 2001)

  Up Chapter 07 Title Page Title Page Email Listserve Email Listserve

[NOTE: This case has been edited for classroom use by the omission of text, citations, and footnotes, and incorporates the court's amendments of August 17, 2001 [PDF format]. See this alternate source for the full opinion.]

U.S. Dist. Judge Lewis A. Kaplan


Plaintiffs, eight major United States motion picture studios, distribute many of their copyrighted motion pictures for home use on digital versatile disks ("DVDs"), which contain copies of the motion pictures in digital form. They protect those motion pictures from copying by using an encryption system called CSS. CSS-protected motion pictures on DVDs may be viewed only on players and computer drives equipped with licensed technology that permits the devices to decrypt and play--but not to copy--the films.

Late last year, computer hackers devised a computer program called DeCSS that circumvents the CSS protection system and allows CSS-protected motion pictures to be copied and played on devices that lack the licensed decryption technology. Defendants quickly posted DeCSS on their Internet web site, thus making it readily available to much of the world. Plaintiffs promptly brought this action under the Digital Millennium Copyright Act (the "DMCA") to enjoin defendants from posting DeCSS and to prevent them from electronically "linking" their site to others that post DeCSS. Defendants responded with what they termed "electronic civil disobedience" --increasing their efforts to link their web site to a large number of others that continue to make DeCSS available.

Defendants contend that their actions do not violate the DMCA and, in any case, that the DMCA, as applied to computer programs, or code, violates the First Amendment. This is the Court's decision after trial, and the decision may be summarized in a nutshell.

Defendants argue first that the DMCA should not be construed to reach their conduct, principally because the DMCA, so applied, could prevent those who wish to gain access to technologically protected copyrighted works in order to make fair--that is, non-infringing--use of them from doing so. They argue that those who would make fair use of technologically protected copyrighted works need means, such as DeCSS, of circumventing access control measures not for piracy, but to make lawful use of those works.

Technological access control measures have the capacity to prevent fair uses of copyrighted works as well as foul. Hence, there is a potential tension between the use of such access control measures and fair use. Defendants are not the first to recognize that possibility. As the DMCA made its way through the legislative process, Congress was preoccupied with precisely this issue. Proponents of strong restrictions on circumvention of access control measures argued that they were essential if copyright holders were to make their works available in digital form because digital works otherwise could be pirated too easily. Opponents contended that strong anticircumvention measures would extend the copyright monopoly inappropriately and prevent many fair uses of copyrighted material.

Congress struck a balance. The compromise it reached, depending upon future technological and commercial developments, may or may not prove ideal. But the solution it enacted is clear. The potential tension to which defendants point does not absolve them of liability under the statute. There is no serious question that defendants' posting of DeCSS violates the DMCA.

Defendants' constitutional argument ultimately rests on two propositions--that computer code, regardless of its function, is "speech" entitled to maximum constitutional protection and that computer code therefore essentially is exempt from regulation by government. But their argument is baseless.

Computer code is expressive. To that extent, it is a matter of First Amendment concern. But computer code is not purely expressive any more than the assassination of a political figure is purely a political statement. Code causes computers to perform desired functions. Its expressive element no more immunizes its functional aspects from regulation than the expressive motives of an assassin immunize the assassin's action.

In an era in which the transmission of computer viruses--which, like DeCSS, are simply computer code and thus to some degree expressive--can disable systems upon which the nation depends and in which other computer code also is capable of inflicting other harm, society must be able to regulate the use and dissemination of code in appropriate circumstances. The Constitution, after all, is a framework for building a just and democratic society. It is not a suicide pact.

I. The Genesis of the Controversy

As this case involves computers and technology with which many are unfamiliar, it is useful to begin by defining some of the vocabulary.

A. The Vocabulary of this Case

. . . .

2. Computer Code

. . . .

. . . [C]omputer science has developed programming languages. These languages, like other written languages, employ symbols and syntax to convey meaning. The text of programs written in these languages is referred to as source code. And whether directly or through the medium of another program, the sets of instructions written in programming languages--the source code--ultimately are translated into machine "readable" strings of 1's and 0's, known in the computer world as object code, which typically are executable by the computer.

. . . .

4. Portable Storage Media

. . . .

A CD-ROM is a five-inch wide optical disk capable of storing approximately 650 MB of data. To read the data on a CD-ROM, a computer must have a CD-ROM drive.

DVDs are five-inch wide disks capable of storing more than 4.7 GB of data. In the application relevant here, they are used to hold full-length motion pictures in digital form. They are the latest technology for private home viewing of recorded motion pictures and result in drastically improved audio and visual clarity and quality of motion pictures shown on televisions or computer screens.

5. The Technology Here at Issue

CSS, or Content Scramble System, is an access control and copy prevention system for DVDs developed by the motion picture companies, including plaintiffs. It is an encryption-based system that requires the use of appropriately configured hardware such as a DVD player or a computer DVD drive to decrypt, unscramble and play back, but not copy, motion pictures on DVDs. The technology necessary to configure DVD players and drives to play CSS-protected DVDs has been licensed to hundreds of manufacturers in the United States and around the world.

DeCSS is a software utility, or computer program, that enables users to break the CSS copy protection system and hence to view DVDs on unlicenced [sic] players and make digital copies of DVD movies. The quality of motion pictures decrypted by DeCSS is virtually identical to that of encrypted movies on DVD.

DivX is a compression program available for download over the Internet. It compresses video files in order to minimize required storage space, often to facilitate transfer over the Internet or other networks.

B. Parties

Plaintiffs are eight major motion picture studios. Each is in the business of producing and distributing copyrighted material including motion pictures. Each distributes, either directly or through affiliates, copyrighted motion pictures on DVDs. Plaintiffs produce and distribute a large majority of the motion pictures on DVDs on the market today.

Defendant Eric Corley is viewed as a leader of the computer hacker community and goes by the name Emmanuel Goldstein, after the leader of the underground in George Orwell's classic, 1984. He and his company, defendant 2600 Enterprises, Inc., together publish a magazine called 2600: The Hacker Quarterly. . . . In addition, defendants operate a web site located at http://www.2600.com ("2600.com"), which is managed primarily by Mr. Corley and has been in existence since 1995.

Prior to January 2000, when this action was commenced, defendants posted the source and object code for DeCSS on the 2600.com web site, from which they could be downloaded easily. At that time, 2600.com contained also a list of links to other web sites purporting to post DeCSS.

. . . .

D. The Appearance of DeCSS

In late September 1999, Jon Johansen, a Norwegian subject then fifteen years of age, and two individuals he "met" under pseudonyms over the Internet, reverse engineered a licensed DVD player and discovered the CSS encryption algorithm and keys. They used this information to create DeCSS, a program capable of decrypting or "ripping" encrypted DVDs, thereby allowing playback on non-compliant computers as well as the copying of decrypted files to computer hard drives. Mr. Johansen then posted the executable code on his personal Internet web site and informed members of an Internet mailing list that he had done so. Neither Mr. Johansen nor his collaborators obtained a license from the DVD Copy Control Association.

Although Mr. Johansen testified at trial that he created DeCSS in order to make a DVD player that would operate on a computer running the Linux operating system, DeCSS is a Windows executable file; that is, it can be executed only on computers running the Windows operating system. Mr. Johansen explained the fact that he created a Windows rather than a Linux program by asserting that Linux, at the time he created DeCSS, did not support the file system used on DVDs. Hence, it was necessary, he said, to decrypt the DVD on a Windows computer in order subsequently to play the decrypted files on a Linux machine. Assuming that to be true, however, the fact remains that Mr. Johansen created DeCSS in the full knowledge that it could be used on computers running Windows rather than Linux. Moreover, he was well aware that the files, once decrypted, could be copied like any other computer files.

In January 1999, Norwegian prosecutors filed charges against Mr. Johansen stemming from the development of DeCSS. n80 The disposition of the Norwegian case does not appear of record.

E. The Distribution of DeCSS

In the months following its initial appearance on Mr. Johansen's web site, DeCSS has become widely available on the Internet, where hundreds of sites now purport to offer the software for download. A few other applications said to decrypt CSS-encrypted DVDs also have appeared on the Internet.

In November 1999, defendants' web site began to offer DeCSS for download. It established also a list of links to several web sites that purportedly "mirrored" or offered DeCSS for download. . . .

F. The Preliminary Injunction and Defendants' Response

The movie studios, through the Internet investigations division of the Motion Picture Association of America ("MPAA"), became aware of the availability of DeCSS on the Internet in October 1999. The industry responded by sending out a number of cease and desist letters to web site operators who posted the software, some of which removed it from their sites. In January 2000, the studios filed this lawsuit against defendant Eric Corley and two others.

After a hearing at which defendants presented no affidavits or evidentiary material, the Court granted plaintiffs' motion for a preliminary injunction barring defendants from posting DeCSS. At the conclusion of the hearing, plaintiffs sought also to enjoin defendants from linking to other sites that posted DeCSS, but the Court declined to entertain the application at that time in view of plaintiffs' failure to raise the issue in their motion papers.

Following the issuance of the preliminary injunction, defendants removed DeCSS from the 2600.com web site. In what they termed an act of "electronic civil disobedience," however, they continued to support links to other web sites purporting to offer DeCSS for download, a list which had grown to nearly five hundred by July 2000. Indeed, they carried a banner saying "Stop the MPAA" and, in a reference to this lawsuit, proclaimed:

We have to face the possibility that we could be forced into submission. For that reason it's especially important that as many of you as possible, all throughout the world, take a stand and mirror these files.
Thus, defendants obviously hoped to frustrate plaintiffs' recourse to the judicial system by making effective relief difficult or impossible.

At least some of the links currently on defendants' mirror list lead the user to copies of DeCSS that, when downloaded and executed, successfully decrypt a motion picture on a CSS-encrypted DVD.

G. Effects on Plaintiffs

. . . .

DeCSS is a free, effective and fast means of decrypting plaintiffs' DVDs and copying them to computer hard drives. DivX, which is available over the Internet for nothing, with the investment of some time and effort, permits compression of the decrypted files to sizes that readily fit on a writeable CD-ROM. Copies of such CD-ROMs can be produced very cheaply and distributed as easily as other pirated intellectual property. While not everyone with Internet access now will find it convenient to send or receive DivX'd copies of pirated motion pictures over the Internet, the availability of high speed network connections in many businesses and institutions, and their growing availability in homes, make Internet and other network traffic in pirated copies a growing threat.

These circumstances have two major implications for plaintiffs. First, the availability of DeCSS on the Internet effectively has compromised plaintiffs' system of copyright protection for DVDs, requiring them either to tolerate increased piracy or to expend resources to develop and implement a replacement system unless the availability of DeCSS is terminated. . . .

Second, the application of DeCSS to copy and distribute motion pictures on DVD, both on CD-ROMs and via the Internet, threatens to reduce the studios' revenue from the sale and rental of DVDs. It threatens also to impede new, potentially lucrative initiatives for the distribution of motion pictures in digital form, such as video-on-demand via the Internet.

In consequence, plaintiffs already have been gravely injured. As the pressure for and competition to supply more and more users with faster and faster network connections grows, the injury will multiply.

II. The Digital Millennium Copyright Act

A. Background and Structure of the Statute

. . . .

The DMCA contains two principal anticircumvention provisions. The first, Section 1201(a)(1), governs "the act of circumventing a technological protection measure put in place by a copyright owner to control access to a copyrighted work," an act described by Congress as "the electronic equivalent of breaking into a locked room in order to obtain a copy of a book."n131 The second, Section 1201(a)(2), which is the focus of this case, "supplements the prohibition against the act of circumvention in paragraph (a)(1) with prohibitions on creating and making available certain technologies . . . developed or advertised to defeat technological protections against unauthorized access to a work."n132 As defendants are accused here only of posting and linking to other sites posting DeCSS, and not of using it themselves to bypass plaintiffs' access controls, it is principally the second of the anticircumvention provisions that is at issue in this case.n133

B. Posting of DeCSS

1. Violation of Anti-Trafficking Provision

Section 1201(a)(2) of the Copyright Act, part of the DMCA, provides that:

No person shall . . . offer to the public, provide or otherwise traffic in any technology . . . that--

(A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under [the Copyright Act];

(B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under [the Copyright Act]; or

(C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing a technological measure that effectively controls access to a work protected under [the Copyright Act].

In this case, defendants concededly offered and provided and, absent a court order, would continue to offer and provide DeCSS to the public by making it available for download on the 2600.com web site. DeCSS, a computer program, unquestionably is "technology" within the meaning of the statute. n135 "Circumvent a technological measure" is defined to mean descrambling a scrambled work, decrypting an encrypted work, or "otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner,"n136 so DeCSS clearly is a means of circumventing a technological access control measure. In consequence, if CSS otherwise falls within paragraphs (A), (B) or (C) of Section 1201(a)(2), and if none of the statutory exceptions applies to their actions, defendants have violated and, unless enjoined, will continue to violate the DMCA by posting DeCSS.

a. Section 1201(a)(2)(A)

(1) CSS Effectively Controls Access to Copyrighted Works

During pretrial proceedings and at trial, defendants attacked plaintiffs' Section 1201(a)(2)(A) claim, arguing that CSS, which is based on a 40-bit encryption key, is a weak cipher that does not "effectively control" access to plaintiffs' copyrighted works. They reasoned from this premise that CSS is not protected under this branch of the statute at all. Their post-trial memorandum appears to have abandoned this argument. In any case, however, the contention is indefensible as a matter of law.

. . . [T]he statute expressly provides that "a technological measure 'effectively controls access to a work' if the measure, in the ordinary course of its operation, requires the application of information or a process or a treatment, with the authority of the copyright owner, to gain access to a work."n138 One cannot gain access to a CSS-protected work on a DVD without application of the three keys that are required by the software. One cannot lawfully gain access to the keys except by entering into a license with the DVD CCA under authority granted by the copyright owners or by purchasing a DVD player or drive containing the keys pursuant to such a license. In consequence, under the express terms of the statute, CSS "effectively controls access" to copyrighted DVD movies. It does so, within the meaning of the statute, whether or not it is a strong means of protection.

. . . .

. . . [T]he interpretation of the phrase "effectively controls access" offered by defendants at trial--viz., that the use of the word "effectively" means that the statute protects only successful or efficacious technological means of controlling access--would gut the statute if it were adopted. . . .

(2) DeCSS Was Designed Primarily to Circumvent CSS

. . . DeCSS was created solely for the purpose of decrypting CSS--that is all it does. Hence, absent satisfaction of a statutory exception, defendants clearly violated Section 1201(a)(2)(A) by posting DeCSS to their web site.

b. Section 1201(a)(2)(B)

As the only purpose or use of DeCSS is to circumvent CSS, the foregoing is sufficient to establish a prima facie violation of Section 1201(a)(2)(B) as well.

c. The Linux Argument

. . . .

. . . [T]he question whether the development of a Linux DVD player motivated those who wrote DeCSS is immaterial to the question whether the defendants now before the Court violated the anti-trafficking provision of the DMCA. . . . The offering or provision of the program is the prohibited conduct--and it is prohibited irrespective of why the program was written, except to whatever extent motive may be germane to determining whether their conduct falls within one of the statutory exceptions.

2. Statutory Exceptions

Earlier in the litigation, defendants contended that their activities came within several exceptions contained in the DMCA and the Copyright Act and constitute fair use under the Copyright Act. Their post-trial memorandum appears to confine their argument to the reverse engineering exception. In any case, all of their assertions are entirely without merit.

a. Reverse engineering

Defendants claim to fall under Section 1201(f) of the statute, which provides in substance that one may circumvent, or develop and employ technological means to circumvent, access control measures in order to achieve interoperability with another computer program provided that doing so does not infringe another's copyrightn148 and, in addition, that one may make information acquired through such efforts "available to others, if the person [in question] . . . provides such information solely for the purpose of enabling interoperability of an independently created computer program with other programs, and to the extent that doing so does not constitute infringement . . . ."n149 They contend that DeCSS is necessary to achieve interoperability between computers running the Linux operating system and DVDs and that this exception therefore is satisfied. This contention fails.

First, Section 1201(f)(3) permits information acquired through reverse engineering to be made available to others only by the person who acquired the information. But these defendants did not do any reverse engineering. They simply took DeCSS off someone else's web site and posted it on their own.

Defendants would be in no stronger position even if they had authored DeCSS. The right to make the information available extends only to dissemination "solely for the purpose" of achieving interoperability as defined in the statute. It does not apply to public dissemination of means of circumvention, as the legislative history confirms. These defendants, however, did not post DeCSS "solely" to achieve interoperability with Linux or anything else.

Finally, it is important to recognize that even the creators of DeCSS cannot credibly maintain that the "sole" purpose of DeCSS was to create a Linux DVD player. DeCSS concededly was developed on and runs under Windows--a far more widely used operating system. The developers of DeCSS therefore knew that DeCSS could be used to decrypt and play DVD movies on Windows as well as Linux machines. They knew also that the decrypted files could be copied like any other unprotected computer file. Moreover, the Court does not credit Mr. Johansen's testimony that he created DeCSS solely for the purpose of building a Linux player. . . .

Accordingly, the reverse engineering exception to the DMCA has no application here.

b. Encryption research

Section 1201(g)(4) provides in relevant part that:

Notwithstanding the provisions of subsection (a)(2), it is not a violation of that subsection for a person to--

(A) develop and employ technological means to circumvent a technological measure for the sole purpose of that person performing the acts of good faith encryption research described in paragraph (2); and

(B) provide the technological means to another person with whom he or she is working collaboratively for the purpose of conducting the acts of good faith encryption research described in paragraph (2) or for the purpose of having that other person verify his or her acts of good faith encryption research described in paragraph (2).

Paragraph (2) in relevant part permits circumvention of technological measures in the course of good faith encryption research if:

(A) the person lawfully obtained the encrypted copy, phonorecord, performance, or display of the published work;

(B) such act is necessary to conduct such encryption research;

(C) the person made a good faith effort to obtain authorization before the circumvention; and

(D) such act does not constitute infringement under this title . . . .

In determining whether one is engaged in good faith encryption research, the Court is instructed to consider factors including whether the results of the putative encryption research are disseminated in a manner designed to advance the state of knowledge of encryption technology versus facilitation of copyright infringement, whether the person in question is engaged in legitimate study of or work in encryption, and whether the results of the research are communicated in a timely fashion to the copyright owner.n152

Neither of the defendants remaining in this case was or is involved in good faith encryption research. They posted DeCSS for all the world to see. There is no evidence that they made any effort to provide the results of the DeCSS effort to the copyright owners. Surely there is no suggestion that either of them made a good faith effort to obtain authorization from the copyright owners. Accordingly, defendants are not protected by Section 1201(g).n154

c. Security testing

Defendants contended earlier that their actions should be considered exempt security testing under Section 1201(j) of the statute. This exception, however, is limited to "assessing a computer, computer system, or computer network, solely for the purpose of good faith testing, investigating, or correcting [of a] security flaw or vulnerability, with the authorization of the owner or operator of such computer system or computer network."n156

The record does not indicate that DeCSS has anything to do with testing computers, computer systems, or computer networks. Certainly defendants sought, and plaintiffs' granted, no authorization for defendants' activities. This exception therefore has no bearing in this case.n157

d. Fair use

. . . .

. . . [C]ertain uses that might qualify as "fair" for purposes of copyright infringement--for example, the preparation by a film studies professor of a single CD-ROM or tape containing two scenes from different movies in order to illustrate a point in a lecture on cinematography, as opposed to showing relevant parts of two different DVDs--would be difficult or impossible absent circumvention of the CSS encryption. Defendants therefore argue that the DMCA cannot properly be construed to make it difficult or impossible to make any fair use of plaintiffs' copyrighted works and that the statute therefore does not reach their activities, which are simply a means to enable users of DeCSS to make such fair uses.

Defendants have focused on a significant point. Access control measures such as CSS do involve some risk of preventing lawful as well as unlawful uses of copyrighted material. Congress, however, clearly faced up to and dealt with this question in enacting the DMCA.

The Court begins its statutory analysis, as it must, with the language of the statute. Section 107 of the Copyright Act provides in critical part that certain uses of copyrighted works that otherwise would be wrongful are "not . . . infringement[s] of copyright." Defendants, however, are not here sued for copyright infringement. They are sued for offering and providing technology designed to circumvent technological measures that control access to copyrighted works and otherwise violating Section 1201(a)(2) of the Act. . . .

Congress was well aware during the consideration of the DMCA of the traditional role of the fair use defense in accommodating the exclusive rights of copyright owners with the legitimate interests of noninfringing users of portions of copyrighted works. It recognized the contention, voiced by a range of constituencies concerned with the legislation, that technological controls on access to copyrighted works might erode fair use by preventing access even for uses that would be deemed "fair" if only access might be gained. And it struck a balance among the competing interests.

The first element of the balance was the careful limitation of Section 1201(a)(1)'s prohibition of the act of circumvention to the act itself so as not to "apply to subsequent actions of a person once he or she has obtained authorized access to a copy of a [copyrighted] work. . . ."n163 By doing so, it left "the traditional defenses to copyright infringement, including fair use, . . . fully applicable" provided "the access is authorized."n164

Second, Congress delayed the effective date of Section 1201(a)(1)'s prohibition of the act of circumvention for two years pending further investigation about how best to reconcile Section 1201(a)(1) with fair use concerns. . . .

Third, it created a series of exceptions to aspects of Section 1201(a) for certain uses that Congress thought "fair," including reverse engineering, security testing, good faith encryption research, and certain uses by nonprofit libraries, archives and educational institutions.n166

Defendants claim also that the possibility that DeCSS might be used for the purpose of gaining access to copyrighted works in order to make fair use of those works saves them under Sony Corp. v. Universal City Studios, Inc.n167 But they are mistaken. Sony does not apply to the activities with which defendants here are charged. Even if it did, it would not govern here. Sony involved a construction of the Copyright Act that has been overruled by the later enactment of the DMCA to the extent of any inconsistency between Sony and the new statute.

. . . .

The policy concerns raised by defendants were considered by Congress. Having considered them, Congress crafted a statute that, so far as the applicability of the fair use defense to Section 1201(a) claims is concerned, is crystal clear. In such circumstances, courts may not undo what Congress so plainly has done by "construing" the words of a statute to accomplish a result that Congress rejected. The fact that Congress elected to leave technologically unsophisticated persons who wish to make fair use of encrypted copyrighted works without the technical means of doing so is a matter for Congress unless Congress' decision contravenes the Constitution, a matter to which the Court turns below. Defendants' statutory fair use argument therefore is entirely without merit.

C. Linking to Sites Offering DeCSS

Plaintiffs seek also to enjoin defendants from "linking" their 2600.com web site to other sites that make DeCSS available to users. . . . The dispositive question is whether linking to another web site containing DeCSS constitutes "offering [DeCSS] to the public" or "providing or otherwise trafficking" in it within the meaning of the DMCA.n171 . . .

. . . .

To the extent that defendants have linked to sites that automatically commence the process of downloading DeCSS upon a user being transferred by defendants' hyperlinks, there can be no serious question. Defendants are engaged in the functional equivalent of transferring the DeCSS code to the user themselves.

Substantially the same is true of defendants' hyperlinks to web pages that display nothing more than the DeCSS code or present the user only with the choice of commencing a download of DeCSS and no other content. . . .

Potentially more troublesome might be links to pages that offer a good deal of content other than DeCSS but that offer a hyperlink for downloading, or transferring to a page for downloading, DeCSS. If one assumed, for the purposes of argument, that the Los Angeles Times web site somewhere contained the DeCSS code, it would be wrong to say that anyone who linked to the Los Angeles Times web site, regardless of purpose or the manner in which the link was described, thereby offered, provided or otherwise trafficked in DeCSS merely because DeCSS happened to be available on a site to which one linked. But that is not this case. Defendants urged others to post DeCSS in an effort to disseminate DeCSS and to inform defendants that they were doing so. Defendants then linked their site to those "mirror" sites, after first checking to ensure that the mirror sites in fact were posting DeCSS or something that looked like it, and proclaimed on their own site that DeCSS could be had by clicking on the hyperlinks on defendants' site. By doing so, they offered, provided or otherwise trafficked in DeCSS, and they continue to do so to this day.

III. The First Amendment

Defendants argue that the DMCA, at least as applied to prevent the public dissemination of DeCSS, violates the First Amendment to the Constitution. They claim that it does so in two ways. First, they argue that computer code is protected speech and that the DMCA's prohibition of dissemination of DeCSS therefore violates defendants' First Amendment rights. Second, they contend that the DMCA is unconstitutionally overbroad, chiefly because its prohibition of the dissemination of decryption technology prevents third parties from making fair use of plaintiffs' encrypted works, and vague. They argue also that a prohibition on their linking to sites that make DeCSS available is unconstitutional for much the same reasons.

A. Computer Code and the First Amendment

. . . .

As computer code--whether source or object--is a means of expressing ideas, the First Amendment must be considered before its dissemination may be prohibited or regulated. In that sense, computer code is covered or, as sometimes is said, "protected" by the First Amendment.n186 But that conclusion still leaves for determination the level of scrutiny to be applied in determining the constitutionality of regulation of computer code.

B. The Constitutionality of the DMCA's Anti-Trafficking Provision

1. Defendants' Alleged Right to Disseminate DeCSS

. . . .

. . . [T]he question is the level of review that governs the DMCA's anti-trafficking provision as applied to DeCSS--the strict scrutiny standard applicable to content based regulations or the intermediate level applicable to content neutral regulations, including regulations of the nonspeech elements of expressive conduct.

. . . .

. . . As Congress' concerns in enacting the anti-trafficking provision of the DMCA were to suppress copyright piracy and infringement and to promote the availability of copyrighted works in digital form, and not to regulate the expression of ideas that might be inherent in particular anti-circumvention devices or technology, this provision of the statute properly is viewed as content neutral.

Congress is not powerless to adopt content neutral regulations that incidentally affect expression, including the dissemination of the functional capabilities of computer code. . . . Such a regulation will be upheld if:

it furthers an important or substantial governmental interest; if the governmental interest is unrelated to the suppression of free expression; and if the incidental restriction on alleged First Amendment freedoms is no greater than is essential to the furtherance of that interest.n200

Moreover, "to satisfy this standard, a regulation need not be the least speech-restrictive means of advancing the Government's interests."n201 "Rather, the requirement of narrow tailoring is satisfied 'so long as the . . . regulation promotes a substantial government interest that would be achieved less effectively absent the regulation.'"n202

The anti-trafficking provision of the DMCA furthers an important governmental interest--the protection of copyrighted works stored on digital media from the vastly expanded risk of piracy in this electronic age. . . . That substantial interest, moreover, is unrelated to the suppression of particular views expressed in means of gaining access to protected copyrighted works. Nor is the incidental restraint on protected expression--the prohibition of trafficking in means that would circumvent controls limiting access to unprotected materials or to copyrighted materials for noninfringing purposes--broader than is necessary to accomplish Congress' goals of preventing infringement and promoting the availability of content in digital form.

. . . .

Accordingly, this Court holds that the anti-trafficking provision of the DMCA as applied to the posting of computer code that circumvents measures that control access to copyrighted works in digital form is a valid exercise of Congress' authority. . . .

2. Prior Restraint

Defendants argue also that injunctive relief against dissemination of DeCSS is barred by the prior restraint doctrine. The Court disagrees.

. . . [A]dministrative preclearance requirements for and at least preliminary injunctions against speech as conventionally understood are presumptively unconstitutional. Yet that proposition does not dispose of this case.

. . . .

In this case, the considerations supporting an injunction are very substantial indeed. . . . [D]issemination of DeCSS threatens ultimately to injure or destroy plaintiffs' ability to distribute their copyrighted products on DVDs and, for that matter, undermine their ability to sell their products to the home video market in other forms. The potential damages probably are incalculable, and these defendants surely would be in no position to compensate plaintiffs for them if plaintiffs were remitted only to post hoc damage suits.

On the other side of the coin, the First Amendment interests served by the dissemination of DeCSS on the merits are minimal. The presence of some expressive content in the code should not obscure the fact of its predominant functional character--it is first and foremost a means of causing a machine with which it is used to perform particular tasks. Hence, those of the traditional rationales for the prior restraint doctrine that relate to inhibiting the transmission and receipt of ideas are of attenuated relevance here. . . .

To be sure, there is much to be said in most circumstances for the usual procedural rationale for the prior restraint doctrine: prior restraints carry with them the risk of erroneously suppressing expression that could not constitutionally be punished after publication. In this context, however, that concern is not persuasive, both because the enjoined expressive element is minimal and because a full trial on the merits has been held. Accordingly, the Court holds that the prior restraint doctrine does not require denial of an injunction in this case.

3. Overbreadth

Defendants' second focus is the contention that Section 1201(a)(2) is unconstitutional because it prevents others from making fair use of copyrighted works by depriving them of the means of circumventing plaintiffs' access control system. In substance, they contend that the anti-trafficking provision leaves those who lack sufficient technical expertise to circumvent CSS themselves without the means of acquiring circumvention technology that they need to make fair use of the content of plaintiffs' copyrighted DVDs.

. . . .As defendants concede, "where conduct and not merely speech is involved, . . . the overbreadth of a statute must not only be real, but substantial as well, judged in relation to the statute's plainly legitimate sweep."n241

Factors arguing against use of the overbreadth doctrine are present here. To begin with, we do not here have a complete view of whether the interests of the absent third parties upon whom defendants rely really are substantial and, in consequence, whether the DMCA as applied here would materially affect their ability to make fair use of plaintiffs' copyrighted works.

. . . .

. . . Thus, the prudential concern with ensuring that constitutional questions be decided only when the facts before the Court so require counsels against permitting defendants to mount an overbreadth challenge here.

Second, there is no reason to suppose here that prospective fair users will be deterred from asserting their alleged rights by fear of sanctions imposed by the DMCA or the Copyright Act.

Third, we do not deal here with "pure speech." Rather, the issue concerns dissemination of technology that is principally functional in nature. . . .

Finally, there has been no persuasive evidence that the interests of persons who wish access to the CSS algorithm in order to study its encryption methodology or to evaluate theories regarding decryption raise serious problems. The statute contains an exception for good faith encryption research.n247

Accordingly, defendants will not be heard to mount an overbreadth challenge to the DMCA in this context.

4. Vagueness

Defendants argue also that the DMCA is unconstitutionally vague because the terms it employs are not understandable to persons of ordinary intelligence and because they are subject to discriminatory enforcement.

. . . There can be no serious doubt that posting a computer program the sole purpose of which is to defeat an encryption system controlling access to plaintiff's copyrighted movies constituted an "offer to the public" of "technology [or a] product" that was "primarily designed for the purpose of circumventing" plaintiffs' access control system.n250 Defendants thus engaged in conduct clearly proscribed by the DMCA and will not be heard to complain of any vagueness as applied to others.

C. Linking

. . . .

. . . .[T]he constitutionality of the DMCA as applied to defendants' linking is determined by the same O'Brien standard that governs trafficking in the circumvention technology generally.

There is little question that the application of the DMCA to the linking at issue in this case would serve, at least to some extent, the same substantial governmental interest as its application to defendants' posting of the DeCSS code. Defendants' posting and their linking amount to very much the same thing. Similarly, the regulation of the linking at issue here is "unrelated to the suppression of free expression" for the same reason as the regulation of the posting. The third prong of the O'Brien test as subsequently interpreted--whether the "regulation promotes a substantial government interest that would be achieved less effectively absent the regulation"n251--is a somewhat closer call.

. . . [T]he real significance of an anti-linking injunction would not be with U.S. web sites subject to the DMCA, but with foreign sites that arguably are not subject to it and not subject to suit here. An anti-linking injunction to that extent would have a significant impact and thus materially advance a substantial governmental purpose. In consequence, the Court concludes that an injunction against linking to other sites posting DeCSS satisfies the O'Brien standard. There remains, however, one further important point.

. . .

The possible chilling effect of a rule permitting liability for or injunctions against Internet hyperlinks is a genuine concern. But it is not unique to the issue of linking. The constitutional law of defamation provides a highly relevant analogy. . . . And the solution to the problem is the same: the adoption of a standard of culpability sufficiently high to immunize the activity, whether it is publishing a newspaper or linking, except in cases in which the conduct in question has little or no redeeming constitutional value.

. . . .

Accordingly, there may be no injunction against, nor liability for, linking to a site containing circumvention technology, the offering of which is unlawful under the DMCA, absent clear and convincing evidence that those responsible for the link (a) know at the relevant time that the offending material is on the linked-to site, (b) know that it is circumvention technology that may not lawfully be offered, and (c) create or maintain the link for the purpose of disseminating that technology. Such a standard will limit the fear of liability on the part of web site operators just as the New York Times standard gives the press great comfort in publishing all sorts of material that would have been actionable at common law, even in the face of flat denials by the subjects of their stories. And it will not subject web site operators to liability for linking to a site containing proscribed technology where the link exists for purposes other than dissemination of that technology.

In this case, plaintiffs have established by clear and convincing evidence that these defendants linked to sites posting DeCSS, knowing that it was a circumvention device. . . .

IV. Relief

. . . .

B. Permanent Injunction and Declaratory Relief

Plaintiffs seek a permanent injunction barring defendants from posting DeCSS on their web site and from linking their site to others that make DeCSS available.

. . . .

Defendants argue that an injunction in this case would be futile because DeCSS already is all over the Internet. They say an injunction would be comparable to locking the barn door after the horse is gone. And the Court has been troubled by that possibility. But the countervailing arguments overcome that concern.

To begin with, any such conclusion effectively would create all the wrong incentives by allowing defendants to continue violating the DMCA simply because others, many doubtless at defendants' urging, are doing so as well. Were that the law, defendants confronted with the possibility of injunctive relief would be well advised to ensure that others engage in the same unlawful conduct in order to set up the argument that an injunction against the defendants would be futile because everyone else is doing the same thing.

Second, and closely related, is the fact that this Court is sorely "troubled by the notion that any Internet user . . . can destroy valuable intellectual property rights by posting them over the Internet."n273 n273 While equity surely should not act where the controversy has become moot, it ought to look very skeptically at claims that the defendant or others already have done all the harm that might be done before the injunction issues.

The key to reconciling these views is that the focus of injunctive relief is on the defendants before the Court. . . . If the defendant itself threatens the plaintiff with irreparable harm, then equity will enjoin the defendant from carrying out the threat even if other threats abound and even if part of the pasture already is burned.

These defendants would harm plaintiffs every day on which they post DeCSS on their heavily trafficked web site and link to other sites that post it because someone who does not have DeCSS thereby might obtain it. They thus threaten plaintiffs with immediate and irreparable injury. They will not be allowed to continue to do so simply because others may do so as well. . . . Indeed, the likelihood is that this decision will . . . contribute to a climate of appropriate respect for intellectual property rights . . . . Appropriate injunctive and declaratory relief will issue simultaneously with this opinion.

. . . .

VI. Conclusion

In the final analysis, the dispute between these parties is simply put if not necessarily simply resolved.

Plaintiffs have invested huge sums over the years in producing motion pictures in reliance upon a legal framework that, through the law of copyright, has ensured that they will have the exclusive right to copy and distribute those motion pictures for economic gain. They contend that the advent of new technology should not alter this long established structure.

Defendants, on the other hand, are adherents of a movement that believes that information should be available without charge to anyone clever enough to break into the computer systems or data storage media in which it is located. Less radically, they have raised a legitimate concern about the possible impact on traditional fair use of access control measures in the digital era.

Each side is entitled to its views. In our society, however, clashes of competing interests like this are resolved by Congress. For now, at least, Congress has resolved this clash in the DMCA and in plaintiffs' favor. Given the peculiar characteristics of computer programs for circumventing encryption and other access control measures, the DMCA as applied to posting and linking here does not contravene the First Amendment. Accordingly, plaintiffs are entitled to appropriate injunctive and declaratory relief.





131 H.R. REP. No. 105-551(I), 105th Cong., 2d Sess. ("JUDICIARY COMM. REP."), at 17 (1998).

132 Id. at 18.

133 Plaintiffs rely also on Section 1201(b), which is very similar to Section 1201(a)(2) except that the former applies to trafficking in means of circumventing protection offered by a technological measure that effectively protects "a right of a copyright owner in a work or a portion thereof" whereas the latter applies to trafficking in means of circumventing measures controlling access to a work. In addition, as noted below, certain of the statutory exceptions upon which defendants have relied apply only to Section 1201(a)(2).

136 17 U.S.C. § 1201(a)(3)(A).

138 Id. § 1201(a)(3)(B).

148 17 U.S.C. §§ 1201(f)(1), (2).

149 Id. § 1201(f)(3).

152 17 U.S.C. § 1201(g)(3).

154 In any case, Section 1201(g), where its requirements are met, is a defense only to claims under Section 1201(a)(2), not those under Section 1201(b).

156 17 U.S.C. § 1201(j)(1).

157 Like Section 1201(g), moreover, Section 1201(j) provides no defense to a Section 1201(b) claim.


164 Id.

166 17 U.S.C. §§ 1201(d), (f), (g), (j).

167 464 U.S. 417 (1984).

171 17 U.S.C. § 1201(a)(2).

186 Junger v. Daley, 209 F.3d 481, 485 (6th Cir. 2000); Bernstein v. U.S. Dept. of State, 176 F.3d 1132, 1141, reh'g granted and opinion withdrawn, 192 F.3d 1308 (9th Cir. 1999); Bernstein v. U.S. Dept. of State, 922 F. Supp. 1426, 1436 (N.D. Cal. 1996) (First Amendment extends to source code); see Karn v. U.S. Dept. of State, 925 F. Supp. 1, 10 (D. D.C. 1996) (assuming First Amendment extends to source code).

200 Turner Broadcasting System, Inc. v. FCC, 512 U.S. 622, 662 (1994) (quoting United States v. O'Brien, 391 U.S. 367, 377 (1968) (internal quotation marks omitted)).

201 Turner Broadcasting System, Inc., 512 U.S. at 662.

202 Ward v. Rock Against Racism, 491 U.S. 781, 799 (1989); (quoting United States v. Albertini, 472 U.S. 675, 689 (1985)).

241 Broadrick v. Oklahoma, 413 U.S. 601, 612 (1973).

247 17 U.S.C. § 1201(g).

250 See 17 U.S.C. § 1201(a)(2)(A).

251 Ward, 491 U.S. at 799.

273 Religious Tech. Ctr. v. Netcom On-Line Comm. Servs., Inc., 923 F. Supp. 1231, 1256 (N.D. Cal. 1995).

Top Top of Page Up Chapter 07 Title Page Title Page
  Email Listserve Email Listserve
(C) 2001-03 Tom W. Bell. All rights reserved. Fully attributed noncommercial use of this document permitted if accompanied by this paragraph.
www.tomwbell.com/NetLaw/Ch07/Universal.html - v.2003.02.28