Long-overdue rules protecting security research and vehicle repair have finally taken effect, as they should have done last year. Though the Copyright Office and the Librarian of Congress unlawfully and pointlessly delayed their implementation, for the next two years the public can take advantage of the freedom they offer. Despite their flaws, the exemptions will promote security, innovation, and competition – and also help the next generation of engineers continue to learn by taking their devices apart to see how they work.
Two years ago, EFF and a variety of public interest groups asked the Copyright Office and the Librarian of Congress to issue exemptions protecting security research and vehicle repair, along with a host of other beneficial activities threatened by Section 1201, the anti-circumvention provision of the Digital Millennium Copyright Act (DMCA). We were joined by thousands of you – members of the public who shared a desire for the freedom to tinker. Many of you provided stories about exactly what Section 1201 was keeping you from doing: everything from tweaking a vehicle to work in the extremes of Alaska, to fixing systems when dealers messed them up, to adding new features to vehicle computers, reconfiguring distracting display systems, and building diagnostic tools to help mechanics figure out how to fix your car.
Together, via the “triennial rulemaking” process, we convinced the Copyright Office that exemptions were necessary to protect some forms of vehicle repair and security research. But the exemptions were limited and subjected to a one-year delay in implementation. Those limits were a result of opponents’ claims that removing DMCA liability for security researchers and vehicle owners who tinker with their own cars (or merely look at the code inside) would lead to a host of unlawful and undesirable activity, from auto theft, to spying, to safety violations and destruction of the environment.
The Copyright Office and the Librarian obviously have no expertise and no lawful role as regulators of automotive safety, environmental policy, or personal injury. And each of those concerns is already addressed by specific laws and agencies – not via copyright policy. The DMCA rulemaking requires the Librarian to issue exemptions if the ban on circumvention is adversely affecting the ability to make non-infringing uses of copyrighted works. Tinkerers and researchers need to access the copyrighted software in their devices, and there was no credible argument that they would infringe any copyright. The DMCA also does not permit the Librarian to delay an exemption by a year for any reason, let alone non-copyright reasons. If there are adverse effects on noninfringing uses, the exemption must issue immediately.
The Copyright Office officials wrongly imagined that other agencies had been depending upon the DMCA for environmental, medical, and auto safety policy and delayed the implementation of the exemptions for one year to give them time to “respond” to the change (a change in a rule those agencies likely had never before considered, let alone relied upon).
To evaluate the “response” of other agencies, EFF submitted Freedom of Information Act requests to the Environmental Protection Agency, the Food and Drug Administration, the Department of Transportation, and the California Air Resources Board, asking for records of any action they were taking in response to the DMCA exemptions, and any record that they relied upon the DMCA in regulating their domains. They have provided no such records.
To the contrary, the FDA’s draft cybersecurity guidance [PDF] explicitly recognizes the importance of independent security research. And without such independent research, Senator Markey, the National Highway Traffic Safety Administration, and the public would not have known how urgently they needed to put pressure on auto manufacturers to improve.
The one year delay, then, was not only a violation of law, not only pointless, but actively counterproductive, just as we (and thousands of you) told the Copyright Office and the Librarian.
DMCA 1201, and the rulemaking process, create unconstitutional restraints on speech, and need to be struck down by a court or fixed by Congress. In the meantime, the head of the Copyright Office and the Acting Librarian who conducted the last rulemaking have both departed, and the new Librarian is choosing a new head for the Copyright Office. We hope that they learn from the mistakes of the past; the restrictions in the DMCA must not be used as an all-purpose, discretionary tool to restrict noninfringing conduct and speech.
