EFF Asks Court To Block The DOJ From Prosecuting Researcher For DMCA Violations

from the jumping-ahead-of-the-threat dept

A few more wrinkles have appeared in the EFF’s attempted legal destruction of the DMCA’s anti-circumvention clause. Back in July, the EFF — along with researchers Bunny Huang and Matthew Green — sued the government, challenging the constitutionality of Section 1201 of the DMCA. As it stands now, researchers are restricted by the limitations built into the anti-circumvention clause. The Library of Congress can grant exceptions, but these are only temporary, lasting three years and generally vanishing at the end of that term.

Projects and research efforts continue to be thwarted by this provision, opening up those who circumvent DRM and other protective measures to the possibility of prosecution. And their options when facing charges are severely limited. There is no “fair use” exception to Section 1201 of the DMCA — something the EFF would like to see changed.

The threat of prosecution may be mostly existential, but it’s still far from nonexistent. This is why the EFF has requested a preliminary injunction that would prevent the DOJ from trying to put its client in jail.

The Electronic Frontier Foundation (EFF) asked a court Thursday for an order that would prevent the government from prosecuting its client, security researcher Matthew Green, for publishing a book about making computer systems more secure.


But publishing the book, tentatively entitled Practical Cryptographic Engineering, could land Green in jail under an onerous and unconstitutional provision of copyright law. To identify security vulnerabilities in a device he has purchased, Green must work directly with copyrighted computer code, bypassing control measures meant to prevent the code from being accessed.

The injunction request [PDF] points out that — in addition to the anti-circumvention clause being a form a prior restraint — Green will be performing the sort of actions the DOJ has prosecuted people for in the past.

A rigorous and effective audit of a computer system’s security requires that Dr. Green analyze the software controlling the system. Often, secure computer systems prevent access to their software code through technological protection measures (“TPMs”) such as encryption, username/password combinations, or physical memory restrictions preventing a user from accessing certain stored information. An adversary seeking to extract information about the software code or about the system’s user, or to install their own malicious software, would seek to bypass these measures in order to maximize their ability to locate and exploit vulnerabilities.

To identify security flaws, Dr. Green must do the same; indeed, finding and reporting on the vulnerability of these access controls is a critical part of auditing the security of the system. If he does not bypass access controls in a computer system, Dr. Green’s research is significantly limited. While he may be able to discover some vulnerabilities, he cannot determine with confidence whether devices are secure against an adversary willing to circumvent access controls.

The DOJ has already responded (sort of) to some of the claims raised in the EFF’s injunction request. Its motion to dismiss [PDF] — filed the same day as the EFF’s injunction request — claims the EFF and Matthew Green have no standing to challenge Section 1201 of the DMCA. Not only that, but they cannot provide any evidence prosecution is likely if Green continues with his research work.

Plaintiffs’ claims should be dismissed in their entirety. As an initial matter, Plaintiffs lack standing to raise their First Amendment claims on a pre-enforcement basis because the assertions in their Complaint fail to establish a credible threat of prosecution, under the DMCA’s criminal enforcement provision, for engaging in constitutionally-protected activity. None of the Plaintiffs claims to have been threatened with criminal prosecution. Plaintiffs’ conclusory assertion that others have been prosecuted under the DMCA in the past, for unidentified reasons, is insufficient to establish that Plaintiffs face a credible threat, as is their assertion that third parties might bring suit against them under a separate civil private right of action. Moreover, Plaintiffs fail plausibly to assert that the acts of circumvention and trafficking that they wish to undertake qualify as speech or expressive conduct that is entitled to First Amendment protection but prohibited by the DMCA.

The DOJ’s arguments roughly align with the assertions made in its motion to dismiss in a lawsuit brought by security researchers and the ACLU against the much-hated CFAA. Once again, the DOJ recognizes that Green’s book may be covered by the First Amendment, but actions taken during its compilation may not be.

In both cases, though, the statutes lend themselves to punishing security researchers for performing security research. While the DOJ may have no intention of prosecuting Green for his work, the anti-circumvention clause allows it to hold onto that option for as long as it wants to. The only way to guarantee this won’t happen is to obtain an injunction, but chances are the court won’t be as interested in staving off the theoretical as it will be in examining the First Amendment claims.

Filed Under: , , , , , ,
Companies: eff

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “EFF Asks Court To Block The DOJ From Prosecuting Researcher For DMCA Violations”

Subscribe: RSS Leave a comment
Skeeter says:

Re: Re:

This all (self-gratifyingly) came about as a result of bureaucrats jumping in and making laws for the software corporations 20+ years ago, to protect (much of which) should never been protected, or protected to the insane level that it was.

Old ‘ownership’ laws (whose premise dated back thousands of years in some cases) were tossed out, the idea of ‘intellectual property’ was ridden like a new surfboard, and now, the ‘seas of research, investigation and transparency’ are about as polluted as the Pacific Gyre.

How can you say I ‘bought something’, only to find out it’s a ‘lease’? If I buy a car, don’t I own it to disassemble how I want to? Software laws applied to material products would have you locked out of disassembling your car, your motorcycle, stop you from fixing your house and more. It would be the iHouse, iCar, iCycle syndrome, where everyone gets rich while you get drained for them to service your over-priced product. You would ineffectively be left screaming for ‘some competitor to affordably take them on’ (implying Capitalism would thus save you) when you’ve stacked the laws against such a thing as Free Market Rescue)

This is EXACTLY what you are watching play out with this case, and software (and other DRM venues) now – the companies are large, the stakes larger, they’ve mastered the insane laws you’ve given them, they aren’t going to let them go – and, oh yeah, DON’T TOUCH YOUR SOFTWARE, even if you did ‘lease/buy it’, because they’ll sue you if you do.

Anonymous Coward says:

Re: Re:

Because with the existing laws, there’s nothing stopping the DOJ from prosecuting. The DOJ can say “we haven’t said we’d prosecute, and we don’t have any interest in prosecuting”, but without the injunction, the moment that researcher publishes his book, the DOJ is more than free to say “after reading your book, we changed our minds. We’re prosecuting.”

The researcher wants to be sure he won’t end up in jail for publishing his book before he actually does, wouldn’t you?

I.T. Guy says:

Re: Re: Re:3 Re:

I just wanted you to clarify your absurd position. Like nation’s people have a say anymore. It’s an idiotic saying. Maybe way back when it applied, but today, it makes no sense whatsoever. Nations drag it’s populace against it’s will daily. And if you think there is a possibility that an average Joe citizen can make a difference in who gets elected or who even gets promoted to be the candidates you are living in Disney Land.

No, you didnt misspelling something somewhere. But I can gather from your grammar you may not be from the US either. Where do you live that isn’t in the same situation? What’s YOUR solution to getting the 2 Presidential candidates currently offered changed to different ones?

Oh and dont trout out the ole revolution BS because it was a novel idea when the gov had muskets and cannons. Today it would be a slaughter.

That One Guy (profile) says:

Re: Re:

Yeah, their attempt to have the injunction tossed undermines their arguments against it. If they have no interest in prosecution then the injunction isn’t going to affect them at all, as it would simply be telling them not to do something they had no plans on doing anyway.

The only way the injunction would be a problem for them is if they do plan to prosecute, or at a minimum want to keep the threat of prosecution available. In either case they’re being dishonest when they claim that the injunction isn’t needed because the researcher doesn’t need fear prosecution for his actions, as quite clearly he does.

That One Guy (profile) says:

Re: Re: Re: Re:

(It does if you’re following proper gun safety practices)

Pretty much, yeah. The DOJ is arguing that they should be allowed to point the gun at the researcher and arguing that despite this the researcher has no grounds to object because he can’t prove that the DOJ plans to pull the trigger.

Ignoring of course that if they aren’t planning on ‘shooting’ then an injunction barring them from doing so won’t affect them in the slightest, and also ignoring that at the point that the trigger has been pulled the damage has already been done.

crade (profile) says:

“but they cannot provide any evidence prosecution is likely if Green continues with his research work.”

But prosecution is *not* likely, that is the whole problem. If they actually properly enforced the law then it have been overturned already. They will only cherry pick the sympathetic cases to build the case law in the manner of their choosing.

In the meantime researchers can’t do their research without being willing to break the law and take the risk, causing a barrier to security research (where the harm comes from)

Whatever (profile) says:

From what I can tell, the court is most likely to tell them to go away, and come back when it’s actually relevant (ie, he’s been charged with something). For the moment, they are asking for an injunction to effectively try to re-write the law before it’s even applied. Their true remedy is to deal with congress and work for change.

Whatever (profile) says:

Re: Re: Response to: Whatever on Oct 4th, 2016 @ 2:30am

Generally, the courts rule when there is a case before them, you know, someone gets charged with something and then their lawyer can argue that the law is not constitutional. The courts generally deal with real cases, and not hypothetical ones.

Generally injunctive relief is sought in this manner when inaction would lead to someone breaking the law. Say a change in business record keeping, or something of similar nature.

What the EFF is trying to do here is get the courts to re-write or change a law before it’s ever been applied. Without an actual defendant, the courts should send them packing. They have no standing and no case on which the courts can rule, only an injunction against what is a theoretical situation for the moment.

The gentleman can publish his book, and if the authorities decides to charge him THEN the EFF might be able to come to his aid. For the moment, they are swinging at empty air.

Thad (user link) says:

Re: Re: Re:2 Response to: Whatever on Oct 4th, 2016 @ 2:30am

I hate to agree with Whatever, but I fear he’s probably right about how this is going to shake out. The government has successfully applied the “you don’t have standing because you can’t prove this applies to you” argument on nearly every suit that’s been filed over its surveillance programs.

I’m not saying it’s morally right; in fact I believe strongly that it’s just the opposite. But I think it’s most likely what’s going to happen here.

Not an Electronic Rodent (profile) says:

They have no standing and no case on which the courts can rule, only an injunction against what is a theoretical situation for the moment.

So it’s possible to get an injunction against an abusive partner without them having been arrested for anything and on the basis of previous behaviour, but it’s impossible to get an injunction against an abusive government agency until you’re arrested? Gotta love the double standard…

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...