EFF Asks Court To Block The DOJ From Prosecuting Researcher For DMCA Violations
from the jumping-ahead-of-the-threat dept
A few more wrinkles have appeared in the EFF’s attempted legal destruction of the DMCA’s anti-circumvention clause. Back in July, the EFF — along with researchers Bunny Huang and Matthew Green — sued the government, challenging the constitutionality of Section 1201 of the DMCA. As it stands now, researchers are restricted by the limitations built into the anti-circumvention clause. The Library of Congress can grant exceptions, but these are only temporary, lasting three years and generally vanishing at the end of that term.
Projects and research efforts continue to be thwarted by this provision, opening up those who circumvent DRM and other protective measures to the possibility of prosecution. And their options when facing charges are severely limited. There is no “fair use” exception to Section 1201 of the DMCA — something the EFF would like to see changed.
The threat of prosecution may be mostly existential, but it’s still far from nonexistent. This is why the EFF has requested a preliminary injunction that would prevent the DOJ from trying to put its client in jail.
The Electronic Frontier Foundation (EFF) asked a court Thursday for an order that would prevent the government from prosecuting its client, security researcher Matthew Green, for publishing a book about making computer systems more secure.
But publishing the book, tentatively entitled Practical Cryptographic Engineering, could land Green in jail under an onerous and unconstitutional provision of copyright law. To identify security vulnerabilities in a device he has purchased, Green must work directly with copyrighted computer code, bypassing control measures meant to prevent the code from being accessed.
The injunction request [PDF] points out that — in addition to the anti-circumvention clause being a form a prior restraint — Green will be performing the sort of actions the DOJ has prosecuted people for in the past.
A rigorous and effective audit of a computer system’s security requires that Dr. Green analyze the software controlling the system. Often, secure computer systems prevent access to their software code through technological protection measures (“TPMs”) such as encryption, username/password combinations, or physical memory restrictions preventing a user from accessing certain stored information. An adversary seeking to extract information about the software code or about the system’s user, or to install their own malicious software, would seek to bypass these measures in order to maximize their ability to locate and exploit vulnerabilities.
To identify security flaws, Dr. Green must do the same; indeed, finding and reporting on the vulnerability of these access controls is a critical part of auditing the security of the system. If he does not bypass access controls in a computer system, Dr. Green’s research is significantly limited. While he may be able to discover some vulnerabilities, he cannot determine with confidence whether devices are secure against an adversary willing to circumvent access controls.
The DOJ has already responded (sort of) to some of the claims raised in the EFF’s injunction request. Its motion to dismiss [PDF] — filed the same day as the EFF’s injunction request — claims the EFF and Matthew Green have no standing to challenge Section 1201 of the DMCA. Not only that, but they cannot provide any evidence prosecution is likely if Green continues with his research work.
Plaintiffs’ claims should be dismissed in their entirety. As an initial matter, Plaintiffs lack standing to raise their First Amendment claims on a pre-enforcement basis because the assertions in their Complaint fail to establish a credible threat of prosecution, under the DMCA’s criminal enforcement provision, for engaging in constitutionally-protected activity. None of the Plaintiffs claims to have been threatened with criminal prosecution. Plaintiffs’ conclusory assertion that others have been prosecuted under the DMCA in the past, for unidentified reasons, is insufficient to establish that Plaintiffs face a credible threat, as is their assertion that third parties might bring suit against them under a separate civil private right of action. Moreover, Plaintiffs fail plausibly to assert that the acts of circumvention and trafficking that they wish to undertake qualify as speech or expressive conduct that is entitled to First Amendment protection but prohibited by the DMCA.
The DOJ’s arguments roughly align with the assertions made in its motion to dismiss in a lawsuit brought by security researchers and the ACLU against the much-hated CFAA. Once again, the DOJ recognizes that Green’s book may be covered by the First Amendment, but actions taken during its compilation may not be.
In both cases, though, the statutes lend themselves to punishing security researchers for performing security research. While the DOJ may have no intention of prosecuting Green for his work, the anti-circumvention clause allows it to hold onto that option for as long as it wants to. The only way to guarantee this won’t happen is to obtain an injunction, but chances are the court won’t be as interested in staving off the theoretical as it will be in examining the First Amendment claims.
Filed Under: anti-circumvention, copyright, dmca, dmca 1201, doj, matthew green, research
Comments on “EFF Asks Court To Block The DOJ From Prosecuting Researcher For DMCA Violations”
Having been poked, what are the chances that they are waiting for the book to be published…
This all (self-gratifyingly) came about as a result of bureaucrats jumping in and making laws for the software corporations 20+ years ago, to protect (much of which) should never been protected, or protected to the insane level that it was.
Old ‘ownership’ laws (whose premise dated back thousands of years in some cases) were tossed out, the idea of ‘intellectual property’ was ridden like a new surfboard, and now, the ‘seas of research, investigation and transparency’ are about as polluted as the Pacific Gyre.
How can you say I ‘bought something’, only to find out it’s a ‘lease’? If I buy a car, don’t I own it to disassemble how I want to? Software laws applied to material products would have you locked out of disassembling your car, your motorcycle, stop you from fixing your house and more. It would be the iHouse, iCar, iCycle syndrome, where everyone gets rich while you get drained for them to service your over-priced product. You would ineffectively be left screaming for ‘some competitor to affordably take them on’ (implying Capitalism would thus save you) when you’ve stacked the laws against such a thing as Free Market Rescue)
This is EXACTLY what you are watching play out with this case, and software (and other DRM venues) now – the companies are large, the stakes larger, they’ve mastered the insane laws you’ve given them, they aren’t going to let them go – and, oh yeah, DON’T TOUCH YOUR SOFTWARE, even if you did ‘lease/buy it’, because they’ll sue you if you do.
Re: Re: Re:
^This. And it’s not going to stop until we stop allowing them to get away with calling intellectual endeavour “intellectual property.” At lease use the scare quotes, people!
Why are they so interested in dismissing the protection order if the researchers have no credible threat of prosecution?
Because with the existing laws, there’s nothing stopping the DOJ from prosecuting. The DOJ can say “we haven’t said we’d prosecute, and we don’t have any interest in prosecuting”, but without the injunction, the moment that researcher publishes his book, the DOJ is more than free to say “after reading your book, we changed our minds. We’re prosecuting.”
The researcher wants to be sure he won’t end up in jail for publishing his book before he actually does, wouldn’t you?
Re: Re: Re:
Obtuse circular logic/Schrodinger’s Cat/Paradox.
Neither can know for sure, until the book is published…
That being said… this just comes as another chilling effect of America’s problem & hate for itself.
Every Nation gets the Government it deserves!
Re: Re: Re: Re:
“Every Nation gets the Government it deserves!”
So you are saying we deserve Hills or The Donald?
Re: Re: Re:2 Re:
Yes, that is just exactly what that means. I did misspelling something somewhere?
Re: Re: Re:3 Re:
I just wanted you to clarify your absurd position. Like nation’s people have a say anymore. It’s an idiotic saying. Maybe way back when it applied, but today, it makes no sense whatsoever. Nations drag it’s populace against it’s will daily. And if you think there is a possibility that an average Joe citizen can make a difference in who gets elected or who even gets promoted to be the candidates you are living in Disney Land.
No, you didnt misspelling something somewhere. But I can gather from your grammar you may not be from the US either. Where do you live that isn’t in the same situation? What’s YOUR solution to getting the 2 Presidential candidates currently offered changed to different ones?
Oh and dont trout out the ole revolution BS because it was a novel idea when the gov had muskets and cannons. Today it would be a slaughter.
Re: Re: Re:4 Re:
“And if you think there is a possibility that an average Joe citizen can make a difference in who gets elected or who even gets promoted to be the candidates you are living in Disney Land.”
Disneyland is run by a dictatorial rodent… He’s been in power for over 60 years!
Re: Re: Re:5 Re:
LOL. For some reason I pictured a Hitler Mickey.
Re: Re: Re:6 Re:
That’s not too far off. Damn it, now I’m seeing an old Westworld robot version of Mickey with its wires hanging out of its bullet-ravaged face.
That would be my fantasy: shootout at the OK Corral with Mickey as my opponent (he would be armed with a banana).
Re: Re: Re:2 Re:
I want two bumper stickers for my car–one (on the right, naturally) saying “DEPORT ALL ILLEGAL ALIENS (and their billionaire boy-toys)” and the other saying “SUPPORT HILLARY CLINTON (for ambassador to Libya)”.
Re: Re: Re: Re:
As always thanks for the chuckle Joseph.
Re: Re: Re: Re:
They’re all becoming ‘one’, as the sheep cheer it on.
Enjoy Ouroboros, rumor has it, you’ll get it in the end, too.
Yeah, their attempt to have the injunction tossed undermines their arguments against it. If they have no interest in prosecution then the injunction isn’t going to affect them at all, as it would simply be telling them not to do something they had no plans on doing anyway.
The only way the injunction would be a problem for them is if they do plan to prosecute, or at a minimum want to keep the threat of prosecution available. In either case they’re being dishonest when they claim that the injunction isn’t needed because the researcher doesn’t need fear prosecution for his actions, as quite clearly he does.
Re: Re: Re:
First thing that came to mind is:
Just because I have a gun pointed at you doesn’t mean I am going to shoot.
Re: Re: Re: Re:
(It does if you’re following proper gun safety practices)
Pretty much, yeah. The DOJ is arguing that they should be allowed to point the gun at the researcher and arguing that despite this the researcher has no grounds to object because he can’t prove that the DOJ plans to pull the trigger.
Ignoring of course that if they aren’t planning on ‘shooting’ then an injunction barring them from doing so won’t affect them in the slightest, and also ignoring that at the point that the trigger has been pulled the damage has already been done.
“but they cannot provide any evidence prosecution is likely if Green continues with his research work.”
But prosecution is *not* likely, that is the whole problem. If they actually properly enforced the law then it have been overturned already. They will only cherry pick the sympathetic cases to build the case law in the manner of their choosing.
In the meantime researchers can’t do their research without being willing to break the law and take the risk, causing a barrier to security research (where the harm comes from)
Our government, hard at work protecting corporate interests.
From what I can tell, the court is most likely to tell them to go away, and come back when it’s actually relevant (ie, he’s been charged with something). For the moment, they are asking for an injunction to effectively try to re-write the law before it’s even applied. Their true remedy is to deal with congress and work for change.
Re: Response to: Whatever on Oct 4th, 2016 @ 2:30am
Wait a second. I thought it was the job of the judicial section to vet any laws passed and toss back any that smelled like rotting fish.
So now they just have to follow orders and be absolved of any tyranny perpetrated.
Re: Re: Response to: Whatever on Oct 4th, 2016 @ 2:30am
Generally, the courts rule when there is a case before them, you know, someone gets charged with something and then their lawyer can argue that the law is not constitutional. The courts generally deal with real cases, and not hypothetical ones.
Generally injunctive relief is sought in this manner when inaction would lead to someone breaking the law. Say a change in business record keeping, or something of similar nature.
What the EFF is trying to do here is get the courts to re-write or change a law before it’s ever been applied. Without an actual defendant, the courts should send them packing. They have no standing and no case on which the courts can rule, only an injunction against what is a theoretical situation for the moment.
The gentleman can publish his book, and if the authorities decides to charge him THEN the EFF might be able to come to his aid. For the moment, they are swinging at empty air.
Re: Re: Re: Response to: Whatever on Oct 4th, 2016 @ 2:30am
No. Laws can be challenged even if they are not being used to prosecute someone. Educate yourself.
Re: Re: Re:2 Response to: Whatever on Oct 4th, 2016 @ 2:30am
I hate to agree with Whatever, but I fear he’s probably right about how this is going to shake out. The government has successfully applied the “you don’t have standing because you can’t prove this applies to you” argument on nearly every suit that’s been filed over its surveillance programs.
I’m not saying it’s morally right; in fact I believe strongly that it’s just the opposite. But I think it’s most likely what’s going to happen here.
So it’s possible to get an injunction against an abusive partner without them having been arrested for anything and on the basis of previous behaviour, but it’s impossible to get an injunction against an abusive government agency until you’re arrested? Gotta love the double standard…