UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK
| UNIVERSAL CITY STUDIOS, INC, et al., Plaintiffs
v. SHAWN C. REIMERDES, et al., Defendants |
00 Civ. 0277 (LAK) |
LEWIS A. KAPLAN, District Judge.
Plaintiffs, eight major United States motion picture studios, distribute many of their copyrighted motion pictures for home use on digital versatile disks ("DVDs"), which contain copies of the motion pictures in digital form. They protect those motion pictures from copying by using an encryption system called CSS. CSS-protected motion pictures on DVDs may be viewed only on players and computer drives equipped with licensed technology that permits the devices to decrypt and play--but not to copy--the films.
Late last year, computer hackers devised a computer program called DeCSS that circumvents the CSS protection system and allows CSS-protected motion pictures to be copied and played on devices that lack the licensed decryption technology. Defendants quickly posted [**2] DeCSS on their Internet web site, thus making it readily available to much of the world. Plaintiffs promptly brought this action under the Digital Millennium Copyright Act (the "DMCA") [FN1] to enjoin defendants from posting DeCSS and to prevent them from electronically "linking" their site to others that post DeCSS. Defendants responded with what they termed "electronic civil disobedience"--increasing their efforts to link their web site to a large number of [*304] others that continue to make DeCSS available.
Defendants contend that their actions do not violate the DMCA and, in any case, that the DMCA, as applied to computer programs, or code, violates the First Amendment. [FN2] This is the Court's decision after trial, and the decision may be summarized in a nutshell.
Defendants argue first that the DMCA should not be construed to reach their conduct, principally because the DMCA, so applied, could prevent those who wish to gain access to technologically protected copyrighted works in order to make fair--that is, non-infringing--use of them from doing so. They argue that those who would make fair use of technologically protected copyrighted works need means, such as DeCSS, of circumventing access control measures not for piracy, but to make lawful use of those works.
Technological access control measures have the capacity to prevent fair uses of copyrighted works as well as foul. Hence, there is a potential tension between the use of such access control measures and fair use. Defendants are not the first to recognize that possibility. As the DMCA made its way through the legislative process, Congress was preoccupied with precisely this issue. Proponents of strong restrictions on circumvention of access control measures argued that they were essential if copyright holders were to make their works available in digital form because digital works otherwise could be pirated too easily. Opponents contended that strong anticircumvention measures would [**4] extend the copyright monopoly inappropriately and prevent many fair uses of copyrighted material.
Congress struck a balance. The compromise it reached, depending upon future technological and commercial developments, may or may not prove ideal. [FN3] But the solution it enacted is clear. The potential tension to which defendants point does not absolve them of liability under the statute. There is no serious question that defendants' posting of DeCSS violates the DMCA.
Defendants' constitutional argument ultimately rests on two propositions--that computer code, regardless of its function, is "speech" entitled to maximum constitutional protection and that computer code therefore essentially is exempt from regulation by government. But their argument is baseless.
Computer code is expressive. To that extent, it is a matter of First Amendment concern. [**5] But computer code is not purely expressive any more than the assassination of a political figure is purely a political statement. Code causes computers to perform desired functions. Its expressive element no more immunizes its functional aspects from regulation than the expressive motives of an assassin immunize the assassin's action.
In an era in which the transmission of computer viruses--which, like DeCSS, are simply computer code and thus to some degree expressive--can disable systems upon which the nation depends and in which other computer code also is capable of inflicting other harm, society must be able to regulate the use and dissemination [*305] of code in appropriate circumstances. The Constitution, after all, is a framework for building a just and democratic society. It is not a suicide pact.
I. The Genesis of the Controversy
As this case involves computers and technology with which many are unfamiliar, it is useful to begin by defining some of the vocabulary.
A. The Vocabulary of this Case
1. Computers and Operating Systems
A computer is "a digital information processing device . . . . consisting of central processing components . . . and mass data storage [**6] . . . . certain peripheral input/output devices . . . , and an operating system." Personal computers ("PCs") are computers designed for use by one person at a time. "More powerful, more expensive computer systems known as 'servers' . . . are designed to provide data, services, and functionality through a digital network to multiple users." [FN4]
An operating system is "a software program that controls the allocation and use of computer resources (such as central processing unit time, main memory space, disk space, and input/output channels). The operating system also supports the functions of software programs, called 'applications,' that [**7] perform specific user-oriented tasks . . . . Because it supports applications while interacting more closely with the PC system's hardware, the operating system is said to serve as a 'platform.'" [FN5]
Microsoft Windows ("Windows") is an operating system released by Microsoft Corp. It is the most widely used operating system for PCs in the United States, and its versions include Windows 95, Windows 98, Windows NT and Windows 2000.
Linux, which was and continues to be developed through the open source model of software development, [FN6] [**8] also is an operating system. [FN7] It can be run on a PC as an alternative to Windows, although the extent to which it is so used is limited. [FN8] Linux is more widely used on servers. [FN9]
"Computers come down to one basic premise: They operate with a series of on and off switches, using two digits in the binary (base 2) number system--0 (for off) and 1 (for on)." [FN10] All data and instructions input to or contained in computers therefore must be reduced the numerals 1 and 0. [FN11]
"The smallest unit of memory in a computer," a bit, "is a switch with a value of [*306] 0 (off) or 1 (on)." [FN12] A group of [**9] eight bits is called a byte and represents a character--a letter or an integer. [FN13] A kilobyte ("K") is 1024 bytes, a megabyte ("MB") 1024 kilobytes, and a gigabyte ("GB") 1024 megabytes. [FN14]
Some highly skilled human beings can reduce data and instructions to strings of 1's and 0's and thus program computers to perform complex tasks by inputting commands and data in that form. [FN15] But it would be inconvenient, inefficient and, for most people, probably impossible to do so. In consequence, computer science has developed programming languages. These languages, like other written languages, employ symbols and syntax to convey meaning. The text of programs written in these languages is referred to as source code. [FN16] And whether directly or through the medium of another program, [FN17] the sets of instructions written in programming languages--the source code--ultimately are translated into machine "readable" strings of 1's and 0's, known [**10] in the computer world as object code, which typically are executable by the computer. [FN18]
The distinction between source and object code is not as crystal clear as first appears. Depending upon the programming language, source code may contain many 1's and 0's and look a lot like object code or may contain many instructions derived from spoken human language. Programming languages the source code for which approaches object code are referred to as low level source code while those that are more similar to spoken language are referred to as high level source code.
All code is human readable. As source code is closer to human language than is object code, it tends to be comprehended more easily by humans than object code.
3. The Internet and the World Wide Web
The Internet is "a global electronic network, consisting of smaller, interconnected networks, which allows millions of computers to exchange information over telephone wires, dedicated data cables, and wireless links. The Internet links PCs by means of servers, which run specialized operating systems and applications designed for servicing a network environment." [FN19]
Internet Relay Chat ("IRC") is a system that enables individuals connected to the Internet to participate in live typed discussions. [FN20] Participation in an IRC discussion requires an IRC software program, which sends messages via the Internet to the IRC server, which in turn broadcasts the messages to all participants. The IRC [*307] system is capable of supporting many separate discussions at once.
The World Wide Web (the "Web") is "a massive collection of digital information resources stored on servers throughout the Internet. These resources are typically provided in the form of hypertext documents, commonly referred to as 'Web pages,' that may incorporate any combination of text, graphics, audio and video content, software programs, and other data. A user of a computer connected to the Internet can publish a page on the Web simply by copying it into a specially designated, publicly accessible directory on a Web server. Some Web resources are in the form of applications that provide functionality [**13] through a user's PC system but actually execute on a server." [FN21]
A web site is "a collection of Web pages [published on the Web by an individual or organization] . . . . Most Web pages are in the form of 'hypertext'; that is, they contain annotated references, or 'hyperlinks,' to other Web pages. Hyperlinks can be used as cross-references within a single document, between documents on the same site, or between documents on different sites." [FN22]
A home page is "one page on each Web site . . . [that typically serves as] the first access point to the site. The home page is usually a hypertext document that presents an overview of the site and hyperlinks to the other pages comprising the site." [FN23]
A Web client is "software that, when running on a computer connected to the Internet, sends information to and receives information from Web servers throughout the Internet. Web clients and servers transfer data using a standard known as the Hypertext Transfer Protocol ('HTTP'). A 'Web browser' is a type of Web client that enables a user to select, retrieve, and perceive resources on the Web. In particular, Web browsers provide a way for a user to view hypertext documents and follow the hyperlinks that connect them, typically by moving the cursor over a link and depressing the mouse button." [FN24]
Digital files may be stored on several different kinds of storage media, some of which are readily transportable. Perhaps the most familiar of these are so called floppy disks or "floppies," which now are 3 1/2 inch magnetic disks upon which digital files may be recorded. [FN25] For present purposes, however, we are concerned principally with two more recent developments, CD-ROMs [**15] and digital versatile disks, or DVDs.
A CD-ROM is a five-inch wide optical disk capable of storing approximately 650 MB of data. To read the data on a CD-ROM, a computer must have a CD-ROM drive.
DVDs are five-inch wide disks capable of storing more than 4.7 GB of data. In the application relevant here, they are used to hold full-length motion pictures in digital form. They are the latest technology for private home viewing of recorded motion pictures and result in drastically improved audio and visual clarity and quality of motion pictures shown on televisions or computer screens. [FN26]
5. The Technology Here at Issue
CSS, or Content Scramble System, is an access control and copy prevention system for DVDs developed by the motion picture companies, including plaintiffs. [FN27] It is an encryption-based system that requires the use of appropriately configured hardware such as a DVD player or a computer DVD drive to decrypt, unscramble and play back, but not copy, motion pictures on DVDs. [FN28] The technology necessary to configure DVD players and drives to play CSS-protected DVDs [FN29] has been licensed to hundreds of manufacturers in the United States and around the world.
DeCSS is a software utility, or computer program, that enables users to break the CSS copy protection system and hence to view DVDs on unlicensed players and make digital copies of DVD movies. [FN30] The quality of motion pictures decrypted by DeCSS is virtually identical to that of encrypted movies [**17] on DVD. [FN31]
DivX is a compression program available for download over the Internet. [FN32] It compresses video files in order to minimize required storage space, often to facilitate transfer over the Internet or other networks. [FN33]
Plaintiffs are eight major motion picture studios. Each is in the business of producing and distributing copyrighted material including motion pictures. Each distributes, either directly or through affiliates, copyrighted motion pictures on DVDs. [FN34] Plaintiffs produce and distribute a large majority of the motion pictures on DVDs on the market today. [FN35]
[**18]
Defendant Eric Corley is viewed as a leader of the computer hacker community
and goes by the name Emmanuel Goldstein, after the leader of the underground
in George Orwell's classic, 1984. [FN36] He and his
company, defendant 2600 Enterprises, Inc., together publish a magazine
called 2600: The Hacker Quarterly, which Corley founded in 1984, [FN37]
and which is something of a bible to the hacker community. [FN38]
The name "2600" was derived from the fact that hackers in the 1960's found
that the transmission of a 2600 hertz tone over a long distance trunk connection
gained access to "operator mode" and allowed the user to explore aspects
of the telephone system that were not otherwise accessible. [FN39]
Mr. Corley chose the name because he regarded it as a "mystical thing,"
[FN40] commemorating something that he evidently admired.
Not surprisingly, 2600: The Hacker Quarterly has included articles on such
topics as how to steal an Internet domain name, [FN41]
access other people's e-mail, [FN42] intercept cellular
phone calls, [FN43] and break into the computer systems
[*309] at Costco stores [FN44] and Federal Express.
[FN45] One issue contains a guide to the federal criminal
justice system for readers charged [**19] with computer hacking. [FN46]
[**20] In addition, defendants operate a web site located at
Prior to January 2000, when this action was commenced, defendants posted
the source and object code for DeCSS on the 2600.com web site, from which
they could be downloaded easily. [FN48] At that time,
2600.com contained also a list of links to other web sites purporting to
post DeCSS. [FN49]
C.
The Development of DVD and CSS
The major motion picture studios typically distribute films in a sequence
of so-called windows, each window referring to a separate channel of distribution
and thus to a separate source of revenue. The first window generally is
theatrical release, distribution, and [**21] exhibition. Subsequently,
films are distributed to airlines and hotels, then to the home market,
then to pay television, cable and, eventually, free television broadcast.
The home market is important to plaintiffs, as it represents a significant
source of revenue. [FN50]
Motion pictures first were, and still are, distributed to the home market
in the form of video cassette tapes. In the early 1990's, however, the
major movie studios began to explore distribution to the home market in
digital format, which offered substantially higher audio and visual quality
and greater longevity than video cassette tapes. [FN51]
This technology, which in 1995 became what is known today as DVD, [FN52]
brought with it a new problem--increased risk of piracy by virtue of the
fact that digital files, unlike the material on video cassettes, can be
copied without degradation from generation to generation. [FN53]
In consequence, the movie studios became concerned as the product neared
market with the threat of DVD piracy. [**22] [FN54]
Discussions among the studios with the goal of organizing a unified response
to the piracy threat began in earnest in late 1995 or early 1996. [FN55]
They eventually came to include representatives of the consumer electronics
and computer industries, as well as interested members of the public, [FN56]
and focused on both legislative proposals and technological solutions.
[FN57] In 1996, Matsushita Electric Industrial Co.
("MEI") and Toshiba Corp., presented--and the studios adopted--CSS. [FN58]
CSS involves encrypting, according to an encryption algorithm, [FN59]
the digital [*310] sound and graphics [**23] files on a DVD that together
constitute a motion picture. A CSS-protected DVD can be decrypted by an
appropriate decryption algorithm that employs a series of keys stored on
the DVD and the DVD player. In consequence, only players and drives containing
the appropriate keys are able to decrypt DVD files and thereby play movies
stored on DVDs.
As the motion picture companies did not themselves develop CSS and, in
any case, are not in the business of making DVD players and drives, the
technology for making compliant devices, i.e., devices with CSS keys, had
to be licensed to consumer electronics manufacturers. [FN60]
In order to ensure that the decryption technology did not become generally
available and that compliant devices could not be used to copy as well
as merely to play CSS-protected movies, the technology [**24] is licensed
subject to strict security requirements. [FN61] Moreover,
manufacturers may not, consistent with their licenses, make equipment that
would supply digital output that could be used in copying protected DVDs.
[FN62] Licenses to manufacture compliant devices are
granted on a royalty-free basis subject only to an administrative fee.
[FN63] [**25] At the time of trial, licenses had been
issued to numerous hardware and software manufacturers, including two companies
that plan to release DVD players for computers running the Linux operating
system. [FN64]
With CSS in place, the studios introduced DVDs on the consumer market in
early 1997. [FN65] All or most of the motion pictures
released on DVD were, and continue to be, encrypted with CSS technology.
[FN66] Over 4,000 motion pictures now have been released
in DVD format in the United States, and movies are being issued on DVD
at the rate of over 40 new titles per month in addition to rereleases of
classic films. Currently, more than five million households in the United
States own DVD players, [FN67] and players are projected
to be in ten percent of United States homes by the end of 2000.
[FN68]
DVDs have proven not only popular, but lucrative for the studios. Revenue
from their sale and rental currently accounts for a substantial percentage
of the movie studios' [**26] revenue from the home video market. [FN69]
Revenue from the home market, in [*311] turn, makes up a large percentage
of the studios' total distribution revenue. [FN70]
In late September 1999, Jon Johansen, a Norwegian subject then fifteen
years of age, and two individuals he "met" under pseudonyms over the Internet,
reverse engineered a licensed DVD player and discovered the CSS encryption
algorithm and keys. [FN71] They used this information
to create DeCSS, a program capable of decrypting or "ripping" encrypted
DVDs, thereby allowing playback on non-compliant computers as well as the
copying of decrypted files to computer hard drives. [FN72]
Mr. Johansen then [**27] posted the executable code on his personal Internet
web site and informed members of an Internet mailing list that he had done
so. [FN73] Neither Mr. Johansen nor his collaborators
obtained a license from the DVD CCA. [FN74]
Although Mr. Johansen testified at trial that he created DeCSS in order
to make a DVD player that would operate on a computer running the Linux
operating system, [FN75] DeCSS is a Windows executable
file; that is, it can be executed only on computers running the Windows
operating system. [FN76] Mr. Johansen explained the
fact that he created a Windows rather than a Linux program by asserting
that Linux, at the time he created DeCSS, did not support [**28] the file
system used on DVDs. [FN77] Hence, it was necessary,
he said, to decrypt the DVD on a Windows computer in order subsequently
to play the decrypted files on a Linux machine. [FN78]
Assuming that to be true,
[FN79] however, the fact
remains that Mr. Johansen created DeCSS in the full knowledge that it could
be used on computers running Windows rather than Linux. Moreover, he was
well aware that the files, once decrypted, could be copied like any other
computer files.
In January 1999, Norwegian prosecutors filed charges against Mr. Johansen
stemming from the development of DeCSS. [FN80] The
disposition of the Norwegian [**29] case does not appear of record.
In the months following its initial appearance on Mr. Johansen's web site,
DeCSS has become widely available on the Internet, where hundreds of sites
now purport to offer the software for download. [FN81]
A few other applications said to decrypt CSS-encrypted DVDs also have appeared
on the Internet. [FN82]
[*312]
In November 1999, defendants' web site began to offer DeCSS for download.
[FN83]
It established also a list of links to several web sites that purportedly
"mirrored" or offered DeCSS for download. [FN84] [**31]
The links on defendants' mirror list fall into one of three categories.
By clicking the mouse on one of these links, the user may be brought to
a page on the linked-to site on which there appears a further link to the
DeCSS software.
[FN85] If the user then clicks on the
DeCSS link, download of the software begins. This page may or may not contain
content other than the DeCSS link.
[FN86] Alternatively,
the user may be brought to a page on the linked-to site that does not itself
purport to link to DeCSS, but that links, either directly or via a series
of other pages on the site, to another page on the site on which there
appears a link to the DeCSS software. [FN87] Finally,
the user may be brought directly to the DeCSS link on the linked-to site
such that download of DeCSS begins immediately without further user intervention.
[FN88]
F.
The Preliminary Injunction and Defendants' Response
The movie studios, through the Internet investigations division of the
Motion Picture Association of America ("MPAA"), became aware of the availability
of DeCSS on the Internet in October 1999. [FN89] The
industry responded by sending out a number of cease and desist letters
to web site operators who posted the software, some of which removed it
from their sites. [FN90] In January 2000, the studios
filed this lawsuit against [**32] defendant Eric Corley and two others.
[FN91]
After a hearing at which defendants presented no affidavits or evidentiary
material, the Court granted plaintiffs' motion for a preliminary injunction
barring defendants from posting DeCSS. [FN92] At the
conclusion of the hearing, plaintiffs sought also to enjoin defendants
from linking to other sites that posted DeCSS, but the Court declined to
entertain the application at that time in view of plaintiffs' failure to
raise the issue in their motion papers. [FN93]
Following the issuance of the preliminary injunction, defendants removed
DeCSS from the 2600.com web site. [FN94] In what they
termed an act of "electronic civil disobedience," [FN95]
however, they continued to support links to other web sites purporting
to offer DeCSS for download, a list which had grown to nearly five hundred
by July 2000. [FN96] Indeed, they carried a banner
[*313] saying "Stop the MPAA" and, in a reference to this lawsuit, proclaimed:
At least some of the links currently [**34] on defendants' mirror list
lead the user to copies of DeCSS that, when downloaded and executed, successfully
decrypt a motion picture on a CSS-encrypted DVD. [FN98]
The effect on plaintiffs
of defendants' posting of DeCSS depends upon the ease with which DeCSS
decrypts plaintiffs' copyrighted motion pictures, the quality of the resulting
product, and the convenience with which decrypted copies may be transferred
or transmitted.
As noted, DeCSS was available for download from defendants' web site and
remains available from web sites on defendants' mirror list. [FN99]
Downloading is simple and quick--plaintiffs' expert did it in seconds.
[FN100] The program in fact decrypts at least some
DVDs. [FN101] Although the process is computationally
intensive, plaintiffs' expert decrypted a store-bought copy of Sleepless
in Seattle in [**35] 20 to 45 minutes. [FN102] The
copy is stored on the hard drive of the computer. The quality of the decrypted
film is virtually identical to that of encrypted films on DVD. [FN103]
The decrypted file can be copied like any other. [FN104]
The decryption of a CSS-protected DVD is only the beginning of the tale,
as the decrypted file is very large--approximately 4.3 to 6 GB or more
depending on the length of the film [FN105] --and
thus extremely cumbersome to transfer or to store on portable storage media.
One solution to this problem, however, is DivX, a compression utility available
on the Internet that is promoted as a means of compressing decrypted motion
picture files to manageable [**36] size. [FN106]
DivX is capable of compressing decrypted files constituting a feature length
motion picture to approximately 650 MB at a compression ratio that involves
little loss of quality. [FN107] [**37] While the compressed
sound and graphic files then must be synchronized, a tedious process that
took plaintiffs' expert between 10 and 20 hours, [FN108]
the task is entirely feasible. Indeed, having compared a store-bought DVD
with portions of a copy compressed and synchronized with DivX (which often
are referred to as "DivX'd" motion pictures), the Court finds that the
loss of quality, at least [*314] in some cases, is imperceptible or so
nearly imperceptible as to be of no importance to ordinary consumers. [FN109]
The fact that DeCSS-decrypted DVDs can be compressed satisfactorily to
650 MB is very important. A writeable CD-ROM can hold 650 MB. [FN110]
0Hence, it is entirely feasible to decrypt a DVD with DeCSS, compress and
synchronize it with DivX, and then make as many copies as one wishes by
burning the resulting files onto writeable CD-ROMs, which are sold blank
for about one dollar apiece. [FN111] Indeed, even
if one wished to use a lower compression ratio to improve quality, a film
easily could be compressed to about 1.3 GB and burned onto two CD-ROMs.
But the creation of pirated copies of copyrighted movies on writeable CD-ROMs,
although significant, is not the principal focus of plaintiffs' concern,
which is transmission of pirated copies over the Internet or other networks.
[**38]
Network transmission of decrypted motion pictures raises somewhat more
difficult issues because even 650 MB is a very large file that, depending
upon the circumstances, may take a good deal of time to transmit. But there
is tremendous variation in transmission times. Many home computers today
have modems with a rated capacity of 56 kilobits per second. DSL lines,
which increasingly are available to home and business users, offer transfer
rates of 7 megabits per second. [FN112] Cable modems
also offer increased bandwidth. Student rooms in many universities are
equipped with network connections rated at 10 megabits per second. [FN113]
Large institutions such as universities and major companies often have
networks with backbones rated at 100 megabits per second. [FN114]
While effective transmission times generally are much lower than rated
maximum capacities in consequence of traffic volume [**39] and other considerations,
there are many environments in which very high transmission rates may be
achieved. [FN115] Hence, transmission times ranging
from three [FN116] to twenty minutes [FN117]
to six hours [FN118] or more for a feature length
film are readily achievable, depending upon the users' precise circumstances.
[FN119]
At trial, defendants repeated, as if it were a mantra, the refrain [**40]
that plaintiffs, as they stipulated, [FN120] have
no direct evidence of a specific occasion on which any person decrypted
a copyrighted motion picture with DeCSS and transmitted it over the Internet.
But that is unpersuasive. Plaintiffs' expert expended very little effort
to find someone in an IRC chat room who exchanged a compressed, decrypted
copy of The Matrix, one of plaintiffs' copyrighted motion pictures, for
a [*315] copy of Sleepless in Seattle. [FN121] While
the simultaneous electronic exchange of the two movies took approximately
six hours, [FN122] the computers required little operator
attention during the interim. An MPAA investigator downloaded between five
and ten DVD-sourced movies over the Internet after December 1999. [FN123]
At least one web site contains a list of 650 motion pictures, said to have
been decrypted and compressed with DivX, that purportedly are available
for sale, trade or free download. [FN124] And although
the Court does not accept the list, which is hearsay, as proof of the truth
of the matters asserted therein, it does note that advertisements for decrypted
versions of copyrighted movies first appeared on the Internet in substantial
numbers in late 1999, following [**41] the posting of DeCSS. [FN125]
The net of all this
is reasonably plain. DeCSS is a free, effective and fast means of decrypting
plaintiffs' DVDs and copying them to computer hard drives. DivX, which
is available over the Internet for nothing, with the investment of some
time and effort, permits compression of the decrypted files to sizes that
readily fit on a writeable CD-ROM. Copies of such CD-ROMs can be produced
very cheaply and distributed as easily as other pirated intellectual property.
While not everyone with Internet access now will find it convenient to
send or receive DivX'd copies of pirated motion pictures over the Internet,
the availability of high speed network connections in many businesses and
institutions, and their growing availability in homes, make Internet and
other network traffic [**42] in pirated copies a growing threat.
These circumstances have two major implications for plaintiffs. First,
the availability of DeCSS on the Internet effectively has compromised plaintiffs'
system of copyright protection for DVDs, requiring them either to tolerate
increased piracy or to expend resources to develop and implement a replacement
system unless the availability of DeCSS is terminated. [FN126]
It is analogous to the publication of a bank vault combination in a national
newspaper. Even if no one uses the combination to open the vault, its mere
publication has the effect of defeating the bank's security system, forcing
the bank to reprogram the lock. Development and implementation of a new
DVD copy protection system, however, is far more difficult and costly than
reprogramming a combination lock and may carry with it the added problem
of rendering the existing installed base of compliant DVD players obsolete.
Second, the application of DeCSS to copy and distribute motion pictures
[**43] on DVD, both on CD-ROMs and via the Internet, threatens to reduce
the studios' revenue from the sale and rental of DVDs. It threatens also
to impede new, potentially lucrative initiatives for the distribution of
motion pictures in digital form, such as video-on-demand via the Internet.
[FN127]
In consequence, plaintiffs
already have been gravely injured. As the pressure for and competition
to supply more and more users with faster and faster network connections
grows, the injury will multiply.
II. The Digital Millennium Copyright Act
A.
Background and Structure of the Statute
In December 1996, the World Intellectual Property Organization ("WIPO"),
held a diplomatic conference in Geneva that led to the adoption of two
treaties. Article 11 of the relevant treaty, the WIPO Copyright [*316]
Treaty, provides in relevant part that contracting states "shall provide
adequate legal protection and effective legal remedies against the circumvention
of effective technological measures that are used [**44] by authors in
connection with the exercise of their rights under this Treaty or the Berne
Convention and that restrict acts, in respect of their works, which are
not authorized by the authors concerned or permitted by law." [FN128]
The adoption of the WIPO Copyright Treaty spurred continued Congressional
attention to the adaptation of the law of copyright to the digital age.
Lengthy hearings involving a broad range of interested parties both preceded
and succeeded the Copyright Treaty. As noted above, a critical focus of
Congressional consideration of the legislation was the conflict between
those who opposed anti-circumvention measures as inappropriate extensions
of copyright and impediments to fair use and those who supported them as
essential to proper protection of copyrighted materials in the digital
age.
[FN129] The DMCA was enacted in October 1998
as the culmination of this process. [**45] [FN130]
The DMCA contains two principal anticircumvention provisions. The first,
Section 1201(a)(1), governs "the act of circumventing a technological protection
measure put in place by a copyright owner to control access to a copyrighted
work," an act described by Congress as "the electronic equivalent of breaking
into a locked room in order to obtain a copy of a book." [FN131]
The second, Section 1201(a)(2), which is the focus of this case, "supplements
the prohibition against the act of circumvention in paragraph (a)(1) with
prohibitions on creating and making available certain technologies . .
. developed or advertised to defeat technological protections against unauthorized
access to a work." [FN132] As defendants are accused
here only of posting and linking to [**46] other sites posting DeCSS, and
not of using it themselves to bypass plaintiffs' access controls, it is
principally the second of the anticircumvention provisions that is at issue
in this case. [FN133]
1. Violation of Anti-Trafficking [**47] Provision
Section 1201(a)(2)
of the Copyright Act, part of the DMCA, provides that:
(1) CSS Effectively Controls Access to Copyrighted Works
During pretrial proceedings
and at trial, defendants attacked plaintiffs' Section 1201(a)(2)(A) claim,
arguing that CSS, which is based on a 40-bit encryption key, is a weak
cipher that does not "effectively control" access to plaintiffs' copyrighted
works. They reasoned from this premise that CSS is not protected under
this branch of the statute at all. Their post-trial memorandum appears
to have abandoned this argument. In any case, however, the contention is
indefensible as a matter of law.
First, the statute expressly provides that "a technological measure 'effectively
controls access to a work' if the measure, in the ordinary course of its
operation, requires the application of information or a process or a treatment,
with the authority of the copyright owner, to gain access to a work." [FN138]
One cannot gain access to a CSS-protected work on a DVD without application
of the three keys that are required by the software. One cannot lawfully
gain access to the keys except by entering into a license with the DVD
CCA [*318] under authority granted by the copyright owners or by purchasing
a DVD player [**51] or drive containing the keys pursuant to such a license.
In consequence, under the express terms of the statute, CSS "effectively
controls access" to copyrighted DVD movies. It does so, within the meaning
of the statute, whether or not it is a strong means of protection. [FN139]
This view is confirmed
by the legislative history, which deals with precisely this point. The
House Judiciary Committee section-by-section analysis of the House bill,
which in this respect was enacted into law, makes clear that a technological
measure "effectively controls access" to a copyrighted work if its function
is to control access:
Finally, the interpretation of the phrase "effectively controls access"
offered by defendants at trial--viz., that the use of the word "effectively"
means that the statute protects only successful or efficacious technological
means of controlling access--would gut the statute if it were adopted.
If a technological means of access control is circumvented, it is, in common
parlance, ineffective. Yet defendants' construction, if adopted, would
limit the application of the statute to access control measures that thwart
circumvention, but withhold protection for those measures that can be circumvented.
In other words, defendants would have the Court construe the statute to
offer protection where none is needed but to withhold protection precisely
where protection is essential. The Court declines to do so. Accordingly,
the Court holds that CSS effectiely controls access to plaintiffs' copyrighted
works. [FN142]
[**54]
(2) DeCSS Was Designed Primarily to Circumvent CSS
As CSS effectively controls access to plaintiffs' copyrighted works, the
only remaining question under Section 1201(a)(2)(A) is whether DeCSS was
designed primarily to circumvent CSS. The [*319] answer is perfectly obvious.
By the admission of both Jon Johansen, the programmer who principally wrote
DeCSS, and defendant Corley, DeCSS was created solely for the purpose of
decrypting CSS--that is all it does. [FN143] Hence,
absent satisfaction of a statutory exception, defendants clearly violated
Section 1201(a)(2)(A) by posting DeCSS to their web site.
As the only purpose
or use of DeCSS is to circumvent CSS, the foregoing is sufficient to establish
a prima facie violation of Section 1201(a)(2)(B) as well.
Perhaps the centerpiece of defendants' statutory position is the contention
that DeCSS was not created for the purpose of pirating copyrighted motion
pictures. [**55] Rather, they argue, it was written to further the development
of a DVD player that would run under the Linux operating system, as there
allegedly were no Linux compatible players on the market at the time. [FN144]
The argument plays itself out in various ways as different elements of
the DMCA come into focus. But it perhaps is useful to address the point
at its most general level in order to place the preceding discussion in
its fullest context.
As noted, Section 1201(a) of the DMCA contains two distinct prohibitions.
Section 1201(a)(1), the so-called basic provision, "aims against those
who engage in unauthorized circumvention of technological measures . .
. . [It] focuses directly on wrongful conduct, rather than on those who
facilitate wrongful conduct . . . ." [FN145] Section
1201(a)(2), the anti-trafficking provision at issue in this case, on the
other hand, separately bans offering or providing technology that may be
used to circumvent technological means of controlling access [**56] to
copyrighted works. [FN146] If the means in question
meets any of the three prongs of the standard set out in Section 1201(a)(2)(A),
(B), or (C), it may not be offered or disseminated.
As the earlier discussion
demonstrates, the question whether the development of a Linux DVD player
motivated those who wrote DeCSS is immaterial to the question whether the
defendants now before the Court violated the anti-trafficking provision
of the DMCA. The inescapable facts are that (1) CSS is a technological
means that effectively controls access to plaintiffs' copyrighted works,
(2) the one and only function of DeCSS is to circumvent CSS, and (3) defendants
offered and provided DeCSS by posting it on their web site. Whether defendants
did so in order to infringe, or to permit or encourage others to infringe,
copyrighted works in violation of other provisions of the Copyright Act
simply does not matter for purposes [**57] of Section 1201(a)(2). The offering
or provision of the program is the prohibited conduct--and it is prohibited
irrespective of why the program was written, except to whatever extent
motive may be germane to determining whether their conduct falls within
one of the statutory exceptions.
Earlier in the litigation, defendants contended that their activities came
within several exceptions contained in the DMCA and the Copyright Act and
constitute fair use under the Copyright Act. Their post-trial memorandum
appears to confine their argument to the reverse engineering exception.
[FN147] In any case, all of their assertions are entirely
without merit.
Defendants claim to fall under Section 1201(f) of the statute, which provides
[*320] in substance that one may circumvent, or develop and employ technological
means to circumvent, access control measures in order to achieve interoperability
with another computer program provided [**58] that doing so does not infringe
another's copyright [FN148] and, in addition, that
one may make information acquired through such efforts "available to others,
if the person [in question] . . . provides such information solely for
the purpose of enabling interoperability of an independently created computer
program with other programs, and to the extent that doing so does not constitute
infringement . . . ." [FN149] They contend that DeCSS
is necessary to achieve interoperability between computers running the
Linux operating system and DVDs and that this exception therefore is satisfied.
[FN150]
This contention fails.
First, Section 1201(f)(3)
permits information acquired through reverse engineering to be made available
to others only by the person who acquired the information. But these defendants
did not do any reverse engineering. They simply took DeCSS off someone
else's web site and [**59] posted it on their own.
Defendants would be in no stronger position even if they had authored DeCSS.
The right to make the information available extends only to dissemination
"solely for the purpose" of achieving interoperability as defined in the
statute. It does not apply to public dissemination of means of circumvention,
as the legislative history confirms. [FN151] These
defendants, however, did not post DeCSS "solely" to achieve interoperability
with Linux or anything else.
Finally, it is important
to recognize that even the creators of DeCSS cannot credibly maintain that
the "sole" purpose of DeCSS was to create a Linux DVD player. DeCSS concededly
was developed on and runs under Windows--a far more widely used operating
system. The developers of DeCSS therefore knew that DeCSS could be used
to decrypt and play DVD movies on Windows as well as Linux machines. They
knew also that the decrypted files could be copied like any other unprotected
computer file. Moreover, the Court [**60] does not credit Mr. Johansen's
testimony that he created DeCSS solely for the purpose of building a Linux
player. Mr. Johansen is a very talented young man and a member of a well
known hacker group who viewed "cracking" CSS as an end it itself and a
means of demonstrating his talent and who fully expected that the use of
DeCSS would not be confined to Linux machines. Hence, the Court finds that
Mr. Johansen and the others who actually did develop DeCSS did not do so
solely for the purpose of making a Linux DVD player if, indeed, developing
a Linux-based DVD player was among their purposes.
Accordingly, the
reverse engineering exception to the DMCA has no application here.
Section 1201(g)(4)
provides in relevant part that:
Neither of the defendants remaining in this case was or is involved in
good faith encryption research. [FN153] They posted
DeCSS for all the world to see. There is no evidence that they made any
effort to provide the results of the DeCSS effort to the copyright owners.
Surely there is no suggestion that either of them made a good faith effort
to obtain authorization from the copyright owners. Accordingly, defendants
are not protected by Section 1201(g). [FN154]
[**63]
c. Security testing
Defendants contended earlier that their actions should be considered exempt
security testing under Section 1201(j) of the statute. [FN155]
This exception, however, is limited to "assessing a computer, computer
system, or computer network, solely for the purpose of good faith testing,
investigating, or correcting [of a] security flaw or vulnerability, with
the authorization of the owner or operator of such computer system or computer
network." [FN156]
The record does not indicate that DeCSS has anything to do with testing
computers, computer systems, or computer networks. Certainly defendants
sought, and plaintiffs' granted, no authorization for defendants' activities.
This exception therefore has no bearing in this case. [FN157]
[**64]
d. Fair use
Finally, defendants rely on the doctrine of fair use. Stated in its most
general terms, the doctrine, now codified in Section 107 of the Copyright
Act, [FN158] limits the exclusive rights of a copyright
holder by permitting others to make limited use of portions of the copyrighted
work, for appropriate purposes, free of liability for copyright infringement.
For example, it is permissible for one other than the copyright owner to
reprint or quote a suitable part of a copyrighted book or article in certain
circumstances. The doctrine traditionally has facilitated literary and
artistic criticism, teaching and scholarship, and other socially useful
forms of expression. [*322] It has been viewed by courts as a safety valve
that accommodates the exclusive rights conferred by copyright with the
freedom of expression guaranteed by the First Amendment.
The use of technological means of controlling access to a copyrighted work
may affect the ability to make fair uses [**65] of the work. [FN159]
Focusing specifically on the facts of this case, the application of CSS
to encrypt a copyrighted motion picture requires the use of a compliant
DVD player to view or listen to the movie. Perhaps more significantly,
it prevents exact copying of either the video or the audio portion of all
or any part of the film. [FN160] This latter point
means that certain uses that might qualify as "fair" for purposes of copyright
infringement--for example, the preparation by a film studies professor
of a single CD-ROM or tape containing two scenes from different movies
in order to illustrate a point in a lecture on cinematography, as opposed
to showing relevant parts of two different DVDs--would be difficult or
impossible absent circumvention of the CSS encryption. Defendants therefore
argue that the DMCA cannot properly be construed to make it difficult or
impossible to make any fair use of plaintiffs' copyrighted works and that
the statute therefore does not reach their activities, which are simply
a means to enable users of DeCSS to make such fair uses.
Defendants have focused
on a significant point. Access control measures such as CSS do involve
some risk of preventing lawful as well as unlawful uses of copyrighted
material. Congress, however, clearly faced up to and dealt with this question
in enacting the DMCA.
The Court begins its statutory analysis, as it must, with the language
of the statute. Section 107 of the Copyright Act provides in critical part
that certain uses of copyrighted works that otherwise would be wrongful
are "not . . . infringement[s] of copyright." [FN161]
Defendants, however, are not here sued for copyright infringement. They
are sued for offering and providing technology designed to circumvent technological
measures that control access to copyrighted works and otherwise violating
Section 1201(a)(2) of the Act. If Congress had meant the fair use defense
to apply to such actions, [**67] it would have said so. Indeed, as the
legislative history demonstrates, the decision not to make fair use a defense
to a claim under Section 1201(a) was quite deliberate.
Congress was well aware during the consideration of the DMCA of the traditional
role of the fair use defense in accommodating the exclusive rights of copyright
owners with the legitimate interests of noninfringing users of portions
of copyrighted works. It recognized the contention, voiced by a range of
constituencies concerned with the legislation, that technological controls
on access to copyrighted works might erode fair use by preventing access
even for uses that would be deemed "fair" if only access might be gained.
[FN162] And it struck a balance among the competing
interests.
The first element of the balance was the careful limitation of Section
1201(a)(1)'s prohibition of the act of circumvention to the act itself
so as not to "apply to subsequent actions of a person once he or she has
obtained authorized access to a copy of a [copyrighted] work. . . ." [FN163]
By doing so, it left "the traditional defenses to copyright infringement,
including fair use, . . . fully applicable" provided "the access is authorized."
[FN164]
Second, Congress delayed the effective date of Section 1201(a)(1)'s prohibition
of the act of circumvention for two years pending further investigation
about how best to reconcile Section 1201(a)(1) with fair use concerns.
Following that investigation, which is being carried out in the form of
a rule-making by the Register of Copyright, the prohibition will not apply
to users of particular classes of copyrighted works who demonstrate that
their ability to make noninfringing uses of those classes of works would
be affected [**69] adversely by Section 1201(a)(1). [FN165]
Third, it created a series of exceptions to aspects of Section 1201(a)
for certain uses that Congress thought "fair," including reverse engineering,
security testing, good faith encryption research, and certain uses by nonprofit
libraries, archives and educational institutions. [FN166]
Defendants claim also that the possibility that DeCSS might be used for
the purpose of gaining access to copyrighted works in order to make fair
use of those works saves them under Sony Corp. v. Universal City Studios,
Inc. [**70] [FN167] But they are mistaken. Sony does
not apply to the activities with which defendants here are charged. Even
if it did, it would not govern here. Sony involved a construction of the
Copyright Act that has been overruled by the later enactment of the DMCA
to the extent of any inconsistency between Sony and the new statute.
Sony was a suit for contributory infringement brought against manufacturers
of video cassette recorders on the theory that the manufacturers were contributing
to infringing home taping of copyrighted television broadcasts. The Supreme
Court held that the manufacturers were not liable in view of the substantial
numbers of copyright holders who either had authorized or did not object
to such taping by viewers. [FN168] But Sony has no
application here.
[**71] When Sony
was decided, the only question was whether the manufacturers could be held
liable for infringement by those who purchased equipment from them in circumstances
in which there were many noninfringing uses for their equipment. But that
is not the question now before this Court. The question here is whether
the possibility of noninfringing fair use by someone who gains access to
a protected copyrighted work through a circumvention technology distributed
by the defendants saves the defendants from liability under Section 1201.
But nothing in Section 1201 so suggests. By prohibiting the provision of
circumvention technology, the DMCA fundamentally altered the landscape.
A given device or piece of technology might have "a substantial noninfringing
use, and hence be immune from attack under Sony's construction of the Copyright
Act--but nonetheless still be subject to suppression under Section 1201."
[FN169] Indeed, [*324] Congress explicitly noted that
Section 1201 does not incorporate Sony. [FN170]
The policy concerns
raised by defendants were considered by Congress. Having considered them,
Congress crafted a statute that, so far as the applicability of the fair
use defense to Section 1201(a) claims is concerned, is crystal clear. In
such circumstances, courts may not undo what Congress so plainly has done
by "construing" the words of a statute to accomplish a result that Congress
rejected. The fact that Congress elected to leave technologically unsophisticated
persons who wish to make fair use of encrypted copyrighted works without
the technical means of doing so is a matter for Congress unless Congress'
decision contravenes the Constitution, a matter to which the Court turns
below. Defendants' statutory fair use argument therefore is entirely without
merit.
C.
Linking to Sites Offering DeCSS
Plaintiffs seek also to enjoin defendants from "linking" their [**73] 2600.com
web site to other sites that make DeCSS available to users. Their request
obviously stems in no small part from what defendants themselves have termed
their act of "electronic civil disobedience" --their attempt to defeat
the purpose of the preliminary injunction by (a) offering the practical
equivalent of making DeCSS available on their own web site by electronically
linking users to other sites still offering DeCSS, and (b) encouraging
other sites that had not been enjoined to offer the program. The dispositive
question is whether linking to another web site containing DeCSS constitutes
"offering [DeCSS] to the public" or "providing or otherwise trafficking"
in it within the meaning of the DMCA. [FN171] Answering
this question requires careful consideration of the nature and types of
linking.
Most web pages are written in computer languages, chiefly HTML, which allow
the programmer to prescribe the appearance of the web page on the computer
screen [**74] and, in addition, to instruct the computer to perform an
operation if the cursor is placed over a particular point on the screen
and the mouse then clicked. [FN172] Programming a
particular point on a screen to transfer the user to another web page when
the point, referred to as a hyperlink, is clicked is called linking. [FN173]
Web pages can be designed to link to other web pages on the same site or
to web pages maintained by different sites. [FN174]
As noted earlier,
the links that defendants established on their web site are of several
types. Some transfer the user to a web page on an outside site that contains
a good deal of information of various types, does not itself contain a
link to DeCSS, but that links, either directly [**75] or via a series of
other pages, to another page on the same site that posts the software.
It then is up to the user to follow the link or series of links on the
linked-to web site in order to arrive at the page with the DeCSS link and
commence the download of the software. Others take the user to a page on
an outside web site on which there appears a direct link to the DeCSS software
and which may or may not contain text or links other than the DeCSS link.
The user has only to click on the DeCSS link to commence the download.
Still others may directly transfer the user to a file on the linked-to
web site such that the download of DeCSS to the user's computer automatically
[*325] commences without further user intervention.
The statute makes it unlawful to offer, provide or otherwise traffic in
described technology. [FN175] To "traffic" in something
is to engage in dealings in it, [FN176] conduct that
necessarily involves awareness of the nature of the subject of the trafficking.
To "provide" something, in the sense used in the statute, is to make it
available or furnish it. [FN177] To "offer" is to
present or hold it out for consideration. [FN178]
The phrase "or otherwise traffic in" modifies and gives [**76] meaning
to the words "offer" and "provide." [FN179] In consequence,
the anti-trafficking provision of the DMCA is implicated where one presents,
holds out or makes a circumvention technology or device available, knowing
its nature, for the purpose of allowing others to acquire it.
To the extent that
defendants have linked to sites that automatically commence the process
of downloading DeCSS upon a user being transferred by defendants' hyperlinks,
there can be no serious question. Defendants are engaged in the functional
equivalent of transferring the DeCSS code to the user themselves.
Substantially the
same is true of defendants' hyperlinks to web pages that display nothing
more than the DeCSS code or present [**77] the user only with the choice
of commencing a download of DeCSS and no other content. The only distinction
is that the entity extending to the user the option of downloading the
program is the transferee site rather than defendants, a distinction without
a difference.
Potentially more troublesome might be links to pages that offer a good
deal of content other than DeCSS but that offer a hyperlink for downloading,
or transferring to a page for downloading, DeCSS. If one assumed, for the
purposes of argument, that the Los Angeles Times web site somewhere contained
the DeCSS code, it would be wrong to say that anyone who linked to the
Los Angeles Times web site, regardless of purpose or the manner in which
the link was described, thereby offered, provided or otherwise trafficked
in DeCSS merely because DeCSS happened to be available on a site to which
one linked. [FN180] But that is not this case. Defendants
urged others to post DeCSS in an effort to disseminate DeCSS and to inform
defendants that they were doing so. Defendants then linked their site to
those "mirror" sites, after first checking to ensure that the mirror sites
in fact were posting DeCSS or something that looked [**78] like it, and
proclaimed on their own site that DeCSS could be had by clicking on the
hyperlinks on defendants' site. By doing so, they offered, provided or
otherwise trafficked in DeCSS, and they continue to do so to this day.
Defendants argue
that the DMCA, at least as applied to prevent the public dissemination
of DeCSS, violates the First Amendment to the Constitution. They claim
that it does so in two ways. First, they argue that computer code is protected
speech and that the DMCA's prohibition of dissemination of DeCSS therefore
violates defendants' First Amendment rights. Second, they contend that
the DMCA is unconstitutionally [*326] overbroad, [**79] chiefly because
its prohibition of the dissemination of decryption technology prevents
third parties from making fair use of plaintiffs' encrypted works, and
vague. They argue also that a prohibition on their linking to sites that
make DeCSS available is unconstitutional for much the same reasons.
A. Computer Code and the First Amendment
The premise of defendants'
first position is that computer code, the form in which DeCSS exists, is
speech protected by the First Amendment. Examination of that premise is
the logical starting point for analysis. And it is important in examining
that premise first to define terms.
Defendants' assertion that computer code is "protected" by the First Amendment
is quite understandable. Courts often have spoken of certain categories
of expression as "not within the area of constitutionally protected speech,"
[FN181] so defendants naturally wish to avoid exclusion
by an unfavorable categorization of computer code. But such judicial statements
in fact are not literally true. All modes of expression are covered by
the First Amendment in the sense that the constitutionality of their "regulation
must be determined by reference to First Amendment doctrine [**80] and
analysis." [FN182] Regulation of different categories
of expression, however, is subject to varying levels of judicial scrutiny.
Thus, to say that a particular form of expression is "protected" by the
First Amendment means that the constitutionality of any regulation of it
must be measured by reference to the First Amendment. In some circumstances,
however, the phrase connotes also that the standard for measurement is
the most exacting level available.
It cannot seriously be argued that any form of computer code may be regulated
without reference to First Amendment doctrine. The path from idea to human
language to source code to object code is a continuum. As one moves from
one to the other, the levels of precision and, arguably, abstraction increase,
as does the level of training necessary to discern the idea from the expression.
Not everyone can understand each of these forms. Only English speakers
will understand English formulations. Principally those familiar with the
particular programming language will understand the source code expression.
And only a relatively small number of skilled programmers and computer
scientists will understand the machine readable object code. [**82] But
each form expresses the same idea, albeit in different ways.
[FN183]
There perhaps was a time when the First Amendment was viewed only as a
limitation on the ability of government to censor speech in advance. [FN184]
[*327] But we have moved far beyond that. All modes by which ideas may
be expressed or, perhaps, emotions evoked--including speech, books, movies,
art, and music--are within the area of First Amendment concern. [FN185]
As computer code--whether source or object--is a means of expressing ideas,
the First Amendment must be considered before its dissemination may be
prohibited or regulated. In that sense, computer code is covered or, as
sometimes is said, "protected" by the First Amendment. [**83] [FN186]
But that conclusion still leaves for determination the level of scrutiny
to be applied in determining the constitutionality of regulation of computer
code.
[**84] B. The
Constitutionality of the DMCA's Anti-Trafficking Provision
1. Defendants' Alleged Right to Disseminate DeCSS
Defendants first
attack Section 1201(a)(2), the anti-trafficking provision, as applied to
them on the theory that DeCSS is constitutionally protected expression
and that the statute improperly prevents them from communicating it. Their
attack presupposes that a characterization of code as constitutionally
protected subjects any regulation of code to the highest level of First
Amendment scrutiny. As we have seen, however, this does not necessarily
follow.
Just as computer
code cannot be excluded from the area of First Amendment concern because
it is abstract and, in many cases, arcane, the long history of First Amendment
jurisprudence makes equally clear that the fact that words, symbols and
even actions convey ideas and evoke emotions does not inevitably place
them beyond the power of government. The Supreme Court has evolved an analytical
framework by which the permissibility of particular restrictions on the
expression of ideas must determined.
Broadly speaking,
restrictions on expression fall into two categories. Some are restrictions
on the voicing [**85] of particular ideas, which typically are referred
to as content based restrictions. Others have nothing to do with the content
of the expression--i.e., they are content neutral--but they have the incidental
effect of limiting expression.
In general, "government has no power to restrict expression because of
its message, its ideas, its subject matter, or its content . . . ." [FN187]
"Subject only to narrow and well-understood exceptions, [the First Amendment]
does not countenance governmental control over the content of messages
expressed by private individuals." [FN188] In consequence,
content based restrictions on speech are permissible only if they serve
compelling state interests by the least restrictive means available. [FN189]
[**86] Content neutral restrictions,
in contrast, are measured against a less exacting standard. Because restrictions
of this type are not motivated by a desire to limit the message, they will
be upheld if they serve a substantial governmental interest [*328] and
restrict First Amendment freedoms no more than necessary. [FN190]
Restrictions on the nonspeech elements of expressive conduct fall into
the conduct-neutral category. The Supreme Court long has distinguished
for First Amendment purposes between pure speech, which ordinarily receives
the highest level of protection, and expressive conduct. [FN191]
Even if conduct contains an expressive element, its nonspeech aspect need
not be ignored.
[FN192] "When 'speech' and 'nonspeech'
elements are combined in the same course of conduct, a sufficiently important
governmental interest in regulating the nonspeech [**87] element can justify
incidental limitations on First Amendment freedoms." [FN193]
The critical point is that nonspeech elements may create hazards for society
above and beyond the speech elements. They are subject to regulation in
appropriate circumstances because the government has an interest in dealing
with the potential hazards of the nonspeech elements despite the fact that
they are joined with expressive elements.
Thus, the starting
point for analysis is whether the DMCA, as applied to restrict dissemination
of DeCSS and other computer code used to circumvent access control measures,
is a content based restriction on speech or a content neutral regulation.
Put another way, the question is the level of review that governs the DMCA's
anti-trafficking provision as applied to DeCSS--the strict scrutiny standard
applicable to content based regulations or the intermediate level applicable
to content neutral regulations, including regulations of the nonspeech
elements of expressive conduct.
Given the fact that DeCSS code is expressive, defendants would have the
Court leap immediately to the conclusion that Section 1201(a)(2)'s prohibition
on providing DeCSS necessarily is content based regulation of speech because
it suppresses dissemination of a particular kind of expression. [FN194]
But this would be a unidimensional approach to a more textured reality
and entirely too facile.
[**89] The "principal inquiry
in determining content neutrality . . . is whether the government has adopted
a regulation of speech because of [agreement or] disagreement with the
message it conveys." [FN195] The computer code at
issue in this case, however, does more than express the programmers' concepts.
It does more, in other words, than convey a message. DeCSS, like any other
computer program, is a series of instructions that causes a computer to
perform a particular sequence [*329] of tasks which, in the aggregate,
decrypt CSS-protected files. Thus, it has a distinctly functional, non-speech
aspect in addition to reflecting the thoughts of the programmers. It enables
anyone who receives it and who has a modicum of computer skills to circumvent
plaintiffs' access control system.
[**90] The reason that Congress
enacted the anti-trafficking provision of the DMCA had nothing to do with
suppressing particular ideas of computer programmers and everything to
do with functionality--with preventing people from circumventing technological
access control measures--just as laws prohibiting the possession of burglar
tools have nothing to do with preventing people from expressing themselves
by accumulating what to them may be attractive assortments of implements
and everything to do with preventing burglaries. Rather, it is focused
squarely upon the effect of the distribution of the functional capability
that the code provides. Any impact on the dissemination of programmers'
ideas is purely incidental to the overriding concerns of promoting the
distribution of copyrighted works in digital form while at the same time
protecting those works from piracy and other violations of the exclusive
rights of copyright holders. [FN196]
[**91]
These considerations suggest that the DMCA as applied here is content neutral,
a view that draws support also from City of Renton v. Playtime Theatres,
Inc. [FN197] The Supreme Court there upheld against
a First Amendment challenge a zoning ordinance that prohibited adult movie
theaters within 1,000 feet of a residential, church or park zone or within
one mile of a school. Recognizing that the ordinance did "not appear to
fit neatly into either the 'content based-or the 'content-neutral' category,"
it found dispositive the fact that the ordinance was justified without
reference to the content of the regulated speech in that the concern of
the municipality had been with the secondary effects of the presence of
adult theaters, not with the particular content of the speech that takes
place in them. [FN198] As Congress' concerns in enacting
the anti-trafficking provision of the DMCA were to suppress copyright piracy
and infringement and to promote the availability of copyrighted works in
digital form, and not to regulate the expression of ideas that might be
inherent in particular anti-circumvention devices or technology, this provision
of the statute properly is viewed as content neutral. [**92] [FN199]
Congress is not powerless
to regulate content neutral regulations that incidentally affect expression,
including the dissemination of the functional capabilities of computer
code. A sufficiently important governmental interest in seeing to it that
computers are not instructed to perform particular functions may justify
incidental restrictions on the dissemination of the expressive elements
of a program. Such a regulation will be upheld if:
[**94]
The anti-trafficking provision of the DMCA furthers an important governmental
interest--the protection of copyrighted works stored on digital media from
the vastly expanded risk of piracy in this electronic age. The substantiality
of that interest is evident both from the fact that the Constitution specifically
empowers Congress to provide for copyright protection [FN203]
and from the significance to our economy of trade in copyrighted materials.
[FN204] Indeed, the Supreme Court has made clear that
copyright p5rotection itself is "the engine of free expression." [FN205]
That substantial interest, moreover, is unrelated to the suppression of
particular views expressed in means of gaining access to protected copyrighted
works. Nor is the incidental restraint on protected expression--the prohibition
of trafficking in means that would circumvent controls limiting access
to unprotected materials or to copyrighted materials for noninfringing
purposes--broader than is necessary to accomplish Congress' goals of preventing
infringement and promoting the availability of content in digital form.
[FN206]
This analysis finds substantial support in the principal case relied upon
by defendants, Junger v. Daley. [FN207] The plaintiff
in that case challenged on First Amendment grounds an Export Administration
regulation that barred the export of computer encryption software, [**96]
arguing that the software was expressive and that the regulation therefore
was unconstitutional. The Sixth Circuit acknowledged the expressive nature
of computer code, holding that it therefore was within the scope of the
First Amendment. But it recognized also that computer code is functional
as well and said that "the functional capabilities of source code, particularly
those of encryption source code, should be considered when analyzing the
governmental interest in regulating the exchange of this form of speech."
[FN208] Indeed, it went on to indicate that the pertinent
standard of review was that established in United States v. O'Brien, [FN209]
the seminal speech-versus-conduct [*331] decision. Thus, rather than holding
the challenged regulation unconstitutional on the theory that the expressive
aspect of source code immunized it from regulation, the court remanded
the case to the district court to determine whether the O'Brien standard
was met in view of the functional aspect of code. [FN210]
Notwithstanding its adoption by the Sixth Circuit, the focus on functionality
in order to determine the level of scrutiny is not an inevitable consequence
of the speech-conduct distinction. Conduct has immediate effects on the
environment. Computer code, on the other hand, no matter how functional,
causes a computer to perform the intended operations only if someone uses
the code to do so. Hence, one commentator, in a thoughtful article, has
maintained that functionality is really "a proxy for effects or harm" and
that its adoption as a determinant of the level of scrutiny slides over
questions of causation that intervene between the dissemination of a computer
program and any harm caused by its use. [FN211]
[**98] The characterization of functionality as
a proxy for the consequences of use is accurate. But the assumption that
the chain of causation is too attenuated to justify the use of functionality
to determine the level of scrutiny, at least in this context, is not.
Society increasingly
depends upon technological means of controlling access to digital files
and systems, whether they are military computers, bank records, academic
records, copyrighted works or something else entirely. There are far too
many who, given any opportunity, will bypass those security measures, some
for the sheer joy of doing it, some for innocuous reasons, and others for
more malevolent purposes. Given the virtually instantaneous and worldwide
dissemination widely available via the Internet, the only rational assumption
is that once a computer program capable of bypassing such an access control
system is disseminated, it will be used. And that is not all.
There was a time
when copyright infringement could be dealt with quite adequately by focusing
on the infringing act. If someone wished to make and sell high quality
but unauthorized copies of a copyrighted book, for example, the infringer
needed a printing press. [**99] The copyright holder, once aware of the
appearance of infringing copies, usually was able to trace the copies up
the chain of distribution, find and prosecute the infringer, and shut off
the infringement at the source.
In principle, the digital world is very different. Once a decryption program
like DeCSS is written, it quickly can be sent all over the world. Every
recipient is capable not only of decrypting and perfectly copying plaintiffs'
copyrighted DVDs, but also of retransmitting perfect copies of DeCSS and
thus enabling every recipient to do the same. They likewise are capable
of transmitting perfect copies of the decrypted DVD. The process potentially
is exponential rather than linear. Indeed, the difference is illustrated
by comparison of two epidemiological models describing the spread of different
kinds of disease. [FN212] In a common source epidemic,
as where members of a population contract a non-contagious disease from
a poisoned well, the disease spreads only by exposure to the common source.
If one eliminates the source, or closes the contaminated well, the epidemic
is stopped. In a propagated [*332] outbreak epidemic, on the other hand,
the disease spreads from person to person. [**100] Hence, finding the initial
source of infection accomplishes little, as the disease continues to spread
even if the initial source is eliminated. [FN213]
For obvious reasons, then, a propagated outbreak epidemic, all other things
being equal, can be far more difficult to control.
This disease metaphor is helpful here. The book infringement hypothetical
is analogous to a common source outbreak epidemic. Shut down the printing
[**101] press (the poisoned well) and one ends the infringement (the disease
outbreak). The spread of means of circumventing access to copyrighted works
in digital form, however, is analogous to a propagated outbreak epidemic.
Finding the original source of infection (e.g., the author of DeCSS or
the first person to misuse it) accomplishes nothing, as the disease (infringement
made possible by DeCSS and the resulting availability of decrypted DVDs)
may continue to spread from one person who gains access to the circumvention
program or decrypted DVD to another. And each is "infected," i.e., each
is as capable of making perfect copies of the digital file containing the
copyrighted work as the author of the program or the first person to use
it for improper purposes. The disease metaphor breaks down principally
at the final point. Individuals infected with a real disease become sick,
usually are driven by obvious self-interest to seek medical attention,
and are cured of the disease if medical science is capable of doing so.
Individuals infected with the "disease" of capability of circumventing
measures controlling access to copyrighted works in digital form, however,
do not suffer from having [**102] that ability. They cannot be relied upon
to identify themselves to those seeking to control the "disease." And their
self-interest will motivate some to misuse the capability, a misuse that,
in practical terms, often will be untraceable.
[FN214]
These considerations drastically alter consideration of the causal link
between dissemination of computer programs such as this and their illicit
use. Causation in the law [**103] ultimately involves practical policy
judgments. [FN215] Here, dissemination itself carries
very substantial risk of imminent harm because the mechanism is so unusual
by which dissemination of means of circumventing access controls to copyrighted
works threatens to produce virtually unstoppable infringement of copyright.
In consequence, the causal link between the dissemination of circumvention
computer programs and their improper use is more than sufficiently close
to warrant selection of a level of constitutional scrutiny based on the
programs' functionality.
Accordingly, this Court holds that the anti-trafficking provision of the
DMCA as applied to the posting of computer code that circumvents measures
that control access to copyrighted works in digital form is a valid exercise
of Congress' authority. It is a content neutral regulation in furtherance
of important governmental [**104] interests that does not unduly restrict
expressive activities. In any case, its particular functional characteristics
are such that the Court would apply the same level of scrutiny [*333] even
if it were viewed as content based. [FN216] Yet it
is important to emphasize that this is a very narrow holding. The restriction
the Court here upholds, notwithstanding that computer code is within the
area of First Amendment concern, is limited (1) to programs that circumvent
access controls to copyrighted works in digital form in circumstances in
which (2) there is no other practical means of preventing infringement
through use of the programs, and (3) the regulation is motivated by a desire
to prevent performance of the function for which the programs exist rather
than any message they might convey. One readily might imagine other circumstances
in which a governmental attempt to regulate the dissemination of computer
code would not similarly be justified. [FN217]
Defendants argue
also that injunctive relief against dissemination of DeCSS is barred by
the prior restraint doctrine. The Court disagrees.
Few phrases are as firmly rooted in our constitutional jurisprudence as
the maxim that "any system of prior restraints of expression comes to [a]
Court bearing a heavy presumption against its constitutional validity."
[FN218] Yet there is a significant gap [**106] between
the rhetoric and the reality. Courts often have upheld restrictions on
expression that many would describe as prior restraints, [FN219]
sometimes by [*334] characterizing the expression as unprotected [FN220]
and on other occasions finding the restraint justified despite its presumed
invalidity. [FN221] Moreover, the prior restraint
doctrine, which has expanded far beyond the Blackstonian model
[FN222]
that doubtless informed the understanding of the Framers of the First Amendment,
[FN223] has been criticized as filled with "doctrinal
ambiguities and inconsistencies resulting from the absence of any detailed
judicial analysis of [its] true rationale" [FN224]
and, in one case, even as "fundamentally unintelligible." [FN225]
Nevertheless, the doctrine has a well established core: administrative
preclearance requirements for and at least preliminary injunctions against
speech as conventionally understood are presumptively unconstitutional.
Yet that proposition does not dispose of this case. [FN226]
The classic prior restraint cases were dramatically different from this
one. Near v. Minnesota [FN227] involved a state procedure
for abating scandalous and defamatory newspapers as public nuisances. New
York Times Co. v. United States [FN228] dealt with
an attempt to enjoin a newspaper from publishing [**110] an internal government
history of the Vietnam War. Nebraska Press Association v. Stuart [FN229]
concerned a court order barring the reporting of certain details about
a forthcoming murder case. In each case, therefore, the government sought
to suppress speech at the very heart of First Amendment concern--expression
about public issues of the sort [*335] that is indispensable to self government.
And while the prior restraint doctrine has been applied well beyond the
sphere of political expression, we deal here with something new altogether--computer
code, a fundamentally utilitarian construct, albeit one that embodies an
expressive element. Hence, it would be a mistake simply to permit its expressive
element to drive a characterization of the code as speech no different
from the Pentagon Papers, the publication of a newspaper, or the exhibition
of a motion picture and then to apply prior restraint rhetoric without
a more nuanced consideration of the competing concerns.
[**111] In this case, the considerations
supporting an injunction are very substantial indeed. Copyright and, more
broadly, intellectual property piracy are endemic, as Congress repeatedly
has found. [FN230] The interest served by prohibiting
means that facilitate such piracy--the protection of the monopoly granted
to copyright owners by the Copyright Act--is of constitutional dimension.
There is little room for doubting that broad dissemination of DeCSS threatens
ultimately to injure or destroy plaintiffs' ability to distribute their
copyrighted products on DVDs and, for that matter, undermine their ability
to sell their products to the home video market in other forms. The potential
damages probably are incalculable, and these defendants surely would be
in no position to compensate plaintiffs for them if plaintiffs were remitted
only to post hoc damage suits.
[**112] On the other side of
the coin, the First Amendment interests served by the dissemination of
DeCSS on the merits are minimal. The presence of some expressive content
in the code should not obscure the fact of its predominant functional character--it
is first and foremost a means of causing a machine with which it is used
to perform particular tasks. Hence, those of the traditional rationales
for the prior restraint doctrine that relate to inhibiting the transmission
and receipt of ideas are of attenuated relevance here. Indeed, even academic
commentators who take the extreme position that most injunctions in intellectual
property cases are unconstitutional prior restraints concede that there
is no First Amendment obstacle to injunctions barring distribution of copyrighted
computer object code or restraining the construction of a new building
based on copyrighted architectural drawings because the functional aspects
of these types of information are "sufficiently nonexpressive." [FN231]
[**113]
To be sure, there is much to be said in most circumstances for the usual
procedural rationale for the prior restraint doctrine: prior restraints
carry with them the risk of erroneously suppressing expression that could
not constitutionally be punished [*336] after publication. [FN232]
In this context, however, that concern is not persuasive, both because
the enjoined expressive element is minimal and because a full trial on
the merits has been held. [FN233] Accordingly, the
Court holds that the prior restraint doctrine does not require denial of
an injunction in this case.
[**114] 3.
Overbreadth
Defendants' second focus is the contention that Section 1201(a)(2) is unconstitutional
because it prevents others from making fair use of copyrighted works by
depriving them of the means of circumventing plaintiffs' access control
system. [FN234] In substance, they contend that the
anti-trafficking provision leaves those who lack sufficient technical expertise
to circumvent CSS themselves without the means of acquiring circumvention
technology that they need to make fair use of the content of plaintiffs'
copyrighted DVDs. [FN235]
[**115]
As a general proposition, "a person to whom a statute constitutionally
may be applied may not challenge that statute on the ground that it conceivably
may be applied unconstitutionally to others in situations not before the
Court." [FN236] When statutes regulate speech, however,
"the transcendent value to all society of constitutionally protected expression
is deemed to justify 'attacks on overly broad statutes with no requirement
that the person making the attack demonstrate that his own conduct could
not be regulated by a statute drawn with the requisite narrow specificity.'"
[FN237] This is so because the absent third parties
may not exercise their rights for fear of triggering "sanctions provided
by a statute susceptible of application to protected expression." [FN238]
But the overbreadth doctrine "'is 'strong medicine' . . . . employed .
. . with hesitation, and then 'only as a last resort''" because it conflicts
with "the personal nature of constitutional rights and the prudential limitations
on constitutional adjudication," including the importance of focusing carefully
on the facts in deciding constitutional questions. [FN239]
Moreover, the limited function of the overbreadth doctrine [**116] "'attenuates
as the otherwise unprotected behavior that it forbids the State to sanction
moves from 'pure speech' toward conduct and that conduct--even if expressive--falls
within the scope of otherwise valid criminal [*337] laws . . . .'" [FN240]
As defendants concede, "where conduct and not merely speech is involved,
. . . the overbreadth of a statute must not only be real, but substantial
as well, judged in relation to the statute's plainly legitimate sweep."
[FN241]
Factors arguing against
use of the overbreadth doctrine are present here. To begin with, we do
not here have a complete view of whether the interests of the absent third
parties upon whom defendants rely really are substantial and, in consequence,
whether the DMCA as applied here would materially affect their ability
to make fair use of plaintiffs' copyrighted works.
The copyrighted works
at issue, of course, are motion pictures. People use copies of them in
DVD and other formats for various purposes, and we confine our consideration
to the lawful purposes, which by definition are noninfringing or fair uses.
The principal noninfringing use is to play the DVD for the purpose of watching
the movie--viewing the images and hearing the sounds that are synchronized
with them. Fair uses are much more varied. A movie reviewer might wish
to quote a portion of the verbal script in an article or broadcast review.
A television station might want to broadcast part of a particular scene
to illustrate a review, a news story about a performer, or a story about
[**118] particular trends in motion pictures. A musicologist perhaps would
wish to play a portion of a musical sound track. A film scholar might desire
to create and exhibit to students small segments of several different films
to make some comparative point about the cinematography or some other characteristic.
Numerous other examples doubtless could be imagined. But each necessarily
involves one or more of three types of use: (1) quotation of the words
of the script, (2) listening to the recorded sound track, including both
verbal and non-verbal elements, and (3) viewing of the graphic images.
All three of these types of use now are affected by the anti-trafficking
provision of the DMCA, but probably only to a trivial degree. To begin
with, all or substantially all motion pictures available on DVD are available
also on videotape. [FN242] In consequence, anyone
wishing to make lawful use of a particular movie may buy or rent a videotape,
play it, and even copy all or part of it with readily available equipment.
But even if movies were available only on DVD, as someday may be the case,
the impact on lawful use would be limited. Compliant DVD players permit
one to view or listen to a DVD movie [**119] without circumventing CSS
in any prohibited sense. The technology permitting manufacture of compliant
DVD players is available to anyone on a royalty-free basis and at modest
cost, so CSS raises no technological barrier to their manufacture. Hence,
those wishing to make lawful use of copyrighted movies by viewing or listening
to them are not hindered in doing so in any material way by the anti-trafficking
provision of the DMCA. [FN243]
[**120] [*338] Nor does the DMCA materially affect quotation
of language from CSS-protected movies. Anyone with access to a compliant
DVD player may play the movie and write down or otherwise record the sound
for the purpose of quoting it in another medium.
The DMCA does have a notable potential impact on uses that copy portions
of a DVD movie because compliant DVD players are designed so as to prevent
copying. In consequence, even though the fair use doctrine permits limited
copying of copyrighted works in appropriate circumstances, the CSS encryption
of DVD movies, coupled with the characteristics of licensed DVD players,
limits such uses absent circumvention of CSS. [FN244]
Moreover, the anti-trafficking provision of the DMCA may prevent technologically
unsophisticated persons who wish to copy portions of DVD movies for fair
use from obtaining the means of doing so. It is the interests of these
individuals upon which defendants rely most heavily in contending that
the DMCA violates the First Amendment because it deprives such persons
of an asserted constitutional right to make fair use of copyrighted materials.
[FN245]
As the foregoing suggests, the interests of persons wishing to circumvent
CSS in order to make lawful use of the copyrighted movies it protects are
remarkably varied. Some presumably are technologically sophisticated and
therefore capable of circumventing CSS without access to defendants' or
other purveyors' decryption programs; many presumably are not. Many of
the possible fair uses may be made without circumventing CSS while [**122]
others, i.e., those requiring copying, may not. Hence, the question whether
Section 1201(a)(2) as applied here substantially affects rights, much less
constitutionally protected rights, of members of the "fair use community"
cannot be decided in bloc, without consideration of the circumstances of
each member or similarly situated groups of members. Thus, the prudential
concern with ensuring that constitutional questions be decided only when
the facts before the Court so require counsels against permitting defendants
to mount an overbreadth challenge here. [FN246]
[**123] Second, there is no reason to suppose here
that prospective fair users will be deterred from asserting their alleged
rights by fear of sanctions imposed by the DMCA or the Copyright Act.
Third, we do not
deal here with "pure speech." Rather, the issue concerns dissemination
of technology that is principally functional in nature. The same consideration
that warrants restraint in applying the overbreadth doctrine to statutes
regulating [*339] expressive conduct applies here. For reasons previously
expressed, government's interest in regulating the functional capabilities
of computer code is no less weighty than its interest in regulating the
nonspeech aspects of expressive conduct.
Finally, there has been no persuasive evidence that the interests of persons
who wish access to the CSS algorithm in order to study its encryption methodology
or to evaluate theories regarding decryption raise serious problems. The
statute contains an exception for good faith encryption research. [FN247]
[**124] Accordingly, defendants will not be heard
to mount an overbreadth challenge to the DMCA in this context.
Defendants argue also that the DMCA is unconstitutionally vague because
the terms it employs are not understandable to persons of ordinary intelligence
and because they are subject to discriminatory enforcement. [FN248]
As the Supreme Court has made clear, one who "engages in some conduct that
is clearly proscribed [by the challenged statute] cannot complain of the
vagueness of the law as applied to the conduct of others." [FN249]
There can be no serious doubt that posting a computer program the sole
purpose of which is to defeat an encryption system controlling access to
plaintiff's copyrighted movies constituted an "offer to the public" of
"technology [or a] product" that was "primarily designed for the purpose
of circumventing" plaintiffs' access control system. [FN250]
Defendants thus engaged in conduct clearly proscribed by the DMCA and will
not be heard [**125] to complain of any vagueness as applied to others.
As indicated above,
the DMCA reaches links deliberately created by a web site operator for
the purpose of disseminating technology that enables the user to circumvent
access controls on copyrighted works. The question is whether it may do
so consistent with the First Amendment.
Links bear a relationship
to the information superhighway comparable to the relationship that roadway
signs bear to roads but they are more functional. Like roadway signs, they
point out the direction. Unlike roadway signs, they take one almost instantaneously
to the desired destination with the mere click of an electronic mouse.
Thus, like computer code in general, they have both expressive and functional
elements. Also like computer code, they are within the area of First Amendment
[**126] concern. Hence, the constitutionality of the DMCA as applied to
defendants' linking is determined by the same O'Brien standard that governs
trafficking in the circumvention technology generally.
There is little question that the application of the DMCA to the linking
at issue in this case would serve, at least to some extent, the same substantial
governmental interest as its application to defendants' posting of the
DeCSS code. Defendants' posting and their linking amount to very much the
same thing. Similarly, the regulation of the linking at issue here is "unrelated
to the suppression of free expression" for the same reason as the regulation
of the posting. The third prong of the O'Brien test as subsequently interpreted--whether
the "regulation promotes a substantial government interest that would be
achieved less effectively absent the regulation" [FN251]
--is a somewhat closer call.
[**127] [*340] Defendants and, by logical extension, others
may be enjoined from posting DeCSS. Plaintiffs may seek legal redress against
anyone who persists in posting notwithstanding this decision. Hence, barring
defendants from linking to sites against which plaintiffs readily may take
legal action would advance the statutory purpose of preventing dissemination
of circumvention technology, but it would do so less effectively than would
actions by plaintiffs directly against the sites that post. For precisely
this reason, however, the real significance of an anti-linking injunction
would not be with U.S. web sites subject to the DMCA, but with foreign
sites that arguably are not subject to it and not subject to suit here.
An anti-linking injunction to that extent would have a significant impact
and thus materially advance a substantial governmental purpose. In consequence,
the Court concludes that an injunction against linking to other sites posting
DeCSS satisfies the O'Brien standard. There remains, however, one further
important point.
Links are "what unify the [World Wide] Web into a single body of knowledge,
and what makes the Web"We have to face the possibility that we could
be forced into submission. For that reason it's especially important that
as many of you as possible, all throughout the world, take a stand and
mirror these files." [FN97]
Thus, defendants obviously hoped to frustrate plaintiffs'
recourse to the judicial system by making effective relief difficult or
impossible.
"No person shall . . . offer to the public, provide
or otherwise traffic in any technology . . . that--
In this case, defendants concededly offered and provided and, absent a
court [**48] order, would continue to offer and provide DeCSS to the public
by making it available for download on the 2600.com web site. DeCSS, a
computer program, unquestionably is "technology" within the meaning of
the statute.
[FN135] [**49] "Circumvent a technological
measure" is defined to mean descrambling a scrambled work, decrypting an
encrypted work, or "otherwise to avoid, bypass, remove, deactivate, or
impair a technological measure, without the authority of the copyright
owner," [FN136] so DeCSS clearly is a means of circumventing
a technological access control measure. [FN137] In
consequence,
if CSS otherwise falls within paragraphs (A), (B) or (C) of Section 1201(a)(2),
and if none of the statutory exceptions applies to their actions, defendants
have violated and, unless enjoined, will continue to violate the DMCA by
posting DeCSS.
"(A) is primarily
designed or produced for the purpose of circumventing a technological measure
that effectively controls access to a work protected under [the Copyright
Act];
"(B) has only limited
commercially significant purpose or use other than to circumvent a technological
measure that effectively controls access to a work protected under [the
Copyright Act]; or [*317]
"(C) is marketed
by that person or another acting in concert with that person with that
person's knowledge for use in circumventing a technological measure that
effectively controls access to a work protected under [the Copyright Act]."
[FN134]"The bill does define the functions of
the technological measures that are covered--that is, what it means for
a technological measure to 'effectively control access to a work' . . .
and to 'effectively protect a right of a copyright [**52] owner under this
title' . . . . The practical, common-sense approach taken by H.R. 2281
is that if, in the ordinary course of its operation, a technology actually
works in the defined ways to control access to a work . . . then the 'effectiveness'
test is met, and the prohibitions of the statute are applicable. This test,
which focuses on the function performed by the technology, provides a sufficient
basis for clear interpretation." [FN140]
[**53] Further, the House Commerce
Committee made clear that measures based on encryption or scrambling "effectively
control" access to copyrighted works,
[FN141] although
it is well known that what may be encrypted or scrambled often may be decrypted
or unscrambled. As CSS, in the ordinary course of its operation--that is,
when DeCSS or some other decryption program is not employed-- "actually
works" to prevent access to the protected work, it "effectively controls
access" within the contemplation of the statute.
"Notwithstanding the provisions
of subsection (a)(2), it is not a violation of that subsection for a person
to--
Paragraph (2)
in relevant part permits circumvention of technological measures in the
course of good faith encryption research if:
"(A) develop and
employ technological means to circumvent a technological measure for the
sole purpose of that person performing the acts of good faith encryption
research described in paragraph (2); and
"(B) provide the
technological means to another person with whom he or she is working collaboratively
for [**61] the purpose of conducting the acts of good faith encryption
research described in paragraph (2) or for the purpose of having that other
person verify his or her acts [*321] of good faith encryption research
described in paragraph (2)." [FN152]"(A) the person lawfully obtained the encrypted
copy, phonorecord, performance, or display of the published work;
In determining whether one is engaged in good faith encryption research,
the Court is instructed to consider factors including whether the results
of the putative encryption research are disseminated in a manner designed
to advance the state of knowledge of encryption technology versus facilitation
of copyright infringement, whether the person in question is engaged in
legitimate study of or work in encryption, and whether the results of the
[**62] research are communicated in a timely fashion to the copyright owner.
[FN152a]
"(B) such act is necessary to conduct such encryption
research;
"(C) the person made a good faith effort to obtain authorization
before the circumvention; and
"(D) such act does not constitute infringement under
this title . . . ." [FN151a]"it furthers an important or substantial governmental
interest; if the governmental interest is unrelated to the suppression
of free expression; and if [**93] the incidental restriction on alleged
First Amendment freedoms is no greater than is essential to the furtherance
of that [*330] interest." [FN200]
Moreover, "to satisfy
this standard, a regulation need not be the least speech-restrictive means
of advancing the Government's interests." [FN201]
"Rather, the requirement of narrow tailoring is satisfied 'so long as the
. . . regulation promotes a substantial government interest that would
be achieved less effectively absent the regulation.'" [FN202]