EFF Asks Court To Block The DOJ From Prosecuting Researcher For DMCA Violations

from the jumping-ahead-of-the-threat dept

A few more wrinkles have appeared in the EFF's attempted legal destruction of the DMCA's anti-circumvention clause. Back in July, the EFF -- along with researchers Bunny Huang and Matthew Green -- sued the government, challenging the constitutionality of Section 1201 of the DMCA. As it stands now, researchers are restricted by the limitations built into the anti-circumvention clause. The Library of Congress can grant exceptions, but these are only temporary, lasting three years and generally vanishing at the end of that term.

Projects and research efforts continue to be thwarted by this provision, opening up those who circumvent DRM and other protective measures to the possibility of prosecution. And their options when facing charges are severely limited. There is no "fair use" exception to Section 1201 of the DMCA -- something the EFF would like to see changed.

The threat of prosecution may be mostly existential, but it's still far from nonexistent. This is why the EFF has requested a preliminary injunction that would prevent the DOJ from trying to put its client in jail.

The Electronic Frontier Foundation (EFF) asked a court Thursday for an order that would prevent the government from prosecuting its client, security researcher Matthew Green, for publishing a book about making computer systems more secure.

[...]

But publishing the book, tentatively entitled Practical Cryptographic Engineering, could land Green in jail under an onerous and unconstitutional provision of copyright law. To identify security vulnerabilities in a device he has purchased, Green must work directly with copyrighted computer code, bypassing control measures meant to prevent the code from being accessed.

The injunction request [PDF] points out that -- in addition to the anti-circumvention clause being a form a prior restraint -- Green will be performing the sort of actions the DOJ has prosecuted people for in the past.

A rigorous and effective audit of a computer system’s security requires that Dr. Green analyze the software controlling the system. Often, secure computer systems prevent access to their software code through technological protection measures (“TPMs”) such as encryption, username/password combinations, or physical memory restrictions preventing a user from accessing certain stored information. An adversary seeking to extract information about the software code or about the system’s user, or to install their own malicious software, would seek to bypass these measures in order to maximize their ability to locate and exploit vulnerabilities.

To identify security flaws, Dr. Green must do the same; indeed, finding and reporting on the vulnerability of these access controls is a critical part of auditing the security of the system. If he does not bypass access controls in a computer system, Dr. Green’s research is significantly limited. While he may be able to discover some vulnerabilities, he cannot determine with confidence whether devices are secure against an adversary willing to circumvent access controls.

The DOJ has already responded (sort of) to some of the claims raised in the EFF's injunction request. Its motion to dismiss [PDF] -- filed the same day as the EFF's injunction request -- claims the EFF and Matthew Green have no standing to challenge Section 1201 of the DMCA. Not only that, but they cannot provide any evidence prosecution is likely if Green continues with his research work.

Plaintiffs’ claims should be dismissed in their entirety. As an initial matter, Plaintiffs lack standing to raise their First Amendment claims on a pre-enforcement basis because the assertions in their Complaint fail to establish a credible threat of prosecution, under the DMCA’s criminal enforcement provision, for engaging in constitutionally-protected activity. None of the Plaintiffs claims to have been threatened with criminal prosecution. Plaintiffs’ conclusory assertion that others have been prosecuted under the DMCA in the past, for unidentified reasons, is insufficient to establish that Plaintiffs face a credible threat, as is their assertion that third parties might bring suit against them under a separate civil private right of action. Moreover, Plaintiffs fail plausibly to assert that the acts of circumvention and trafficking that they wish to undertake qualify as speech or expressive conduct that is entitled to First Amendment protection but prohibited by the DMCA.

The DOJ's arguments roughly align with the assertions made in its motion to dismiss in a lawsuit brought by security researchers and the ACLU against the much-hated CFAA. Once again, the DOJ recognizes that Green's book may be covered by the First Amendment, but actions taken during its compilation may not be.

In both cases, though, the statutes lend themselves to punishing security researchers for performing security research. While the DOJ may have no intention of prosecuting Green for his work, the anti-circumvention clause allows it to hold onto that option for as long as it wants to. The only way to guarantee this won't happen is to obtain an injunction, but chances are the court won't be as interested in staving off the theoretical as it will be in examining the First Amendment claims.




Reader Comments

Subscribe: RSS

View by: Time | Thread


  • identicon
    Anonymous Coward, 3 Oct 2016 @ 12:03pm

    but they cannot provide any evidence prosecution is likely if Green continues with his research work.

    Having been poked, what are the chances that they are waiting for the book to be published...

    reply to this | link to this | view in chronology ]

    • identicon
      Skeeter, 3 Oct 2016 @ 4:05pm

      Re:

      This all (self-gratifyingly) came about as a result of bureaucrats jumping in and making laws for the software corporations 20+ years ago, to protect (much of which) should never been protected, or protected to the insane level that it was.

      Old 'ownership' laws (whose premise dated back thousands of years in some cases) were tossed out, the idea of 'intellectual property' was ridden like a new surfboard, and now, the 'seas of research, investigation and transparency' are about as polluted as the Pacific Gyre.

      How can you say I 'bought something', only to find out it's a 'lease'? If I buy a car, don't I own it to disassemble how I want to? Software laws applied to material products would have you locked out of disassembling your car, your motorcycle, stop you from fixing your house and more. It would be the iHouse, iCar, iCycle syndrome, where everyone gets rich while you get drained for them to service your over-priced product. You would ineffectively be left screaming for 'some competitor to affordably take them on' (implying Capitalism would thus save you) when you've stacked the laws against such a thing as Free Market Rescue)

      This is EXACTLY what you are watching play out with this case, and software (and other DRM venues) now - the companies are large, the stakes larger, they've mastered the insane laws you've given them, they aren't going to let them go - and, oh yeah, DON'T TOUCH YOUR SOFTWARE, even if you did 'lease/buy it', because they'll sue you if you do.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 3 Oct 2016 @ 12:12pm

    Why are they so interested in dismissing the protection order if the researchers have no credible threat of prosecution?

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 3 Oct 2016 @ 12:16pm

      Re:

      Because with the existing laws, there's nothing stopping the DOJ from prosecuting. The DOJ can say "we haven't said we'd prosecute, and we don't have any interest in prosecuting", but without the injunction, the moment that researcher publishes his book, the DOJ is more than free to say "after reading your book, we changed our minds. We're prosecuting."

      The researcher wants to be sure he won't end up in jail for publishing his book before he actually does, wouldn't you?

      reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 3 Oct 2016 @ 12:22pm

        Re: Re:

        Obtuse circular logic/Schrodinger's Cat/Paradox.

        Neither can know for sure, until the book is published...

        That being said... this just comes as another chilling effect of America's problem & hate for itself.

        Every Nation gets the Government it deserves!

        reply to this | link to this | view in chronology ]

        • identicon
          I.T. Guy, 3 Oct 2016 @ 12:58pm

          Re: Re: Re:

          "Every Nation gets the Government it deserves!"

          So you are saying we deserve Hills or The Donald?

          reply to this | link to this | view in chronology ]

          • identicon
            Anonymous Coward, 3 Oct 2016 @ 1:04pm

            Re: Re: Re: Re:

            Yes, that is just exactly what that means. I did misspelling something somewhere?

            reply to this | link to this | view in chronology ]

            • identicon
              I.T. Guy, 3 Oct 2016 @ 1:25pm

              Re: Re: Re: Re: Re:

              I just wanted you to clarify your absurd position. Like nation's people have a say anymore. It's an idiotic saying. Maybe way back when it applied, but today, it makes no sense whatsoever. Nations drag it's populace against it's will daily. And if you think there is a possibility that an average Joe citizen can make a difference in who gets elected or who even gets promoted to be the candidates you are living in Disney Land.

              No, you didnt misspelling something somewhere. But I can gather from your grammar you may not be from the US either. Where do you live that isn't in the same situation? What's YOUR solution to getting the 2 Presidential candidates currently offered changed to different ones?

              Oh and dont trout out the ole revolution BS because it was a novel idea when the gov had muskets and cannons. Today it would be a slaughter.

              reply to this | link to this | view in chronology ]

              • identicon
                PRMan, 3 Oct 2016 @ 1:43pm

                Re: Re: Re: Re: Re: Re:

                "And if you think there is a possibility that an average Joe citizen can make a difference in who gets elected or who even gets promoted to be the candidates you are living in Disney Land."

                Disneyland is run by a dictatorial rodent... He's been in power for over 60 years!

                reply to this | link to this | view in chronology ]

                • identicon
                  I.T. Guy, 3 Oct 2016 @ 1:55pm

                  Re: Re: Re: Re: Re: Re: Re:

                  "dictatorial rodent"
                  LOL. For some reason I pictured a Hitler Mickey.

                  reply to this | link to this | view in chronology ]

                  • identicon
                    Wendy Cockcroft, 5 Oct 2016 @ 5:46am

                    Re: Re: Re: Re: Re: Re: Re: Re:

                    That's not too far off. Damn it, now I'm seeing an old Westworld robot version of Mickey with its wires hanging out of its bullet-ravaged face.

                    That would be my fantasy: shootout at the OK Corral with Mickey as my opponent (he would be armed with a banana).

                    reply to this | link to this | view in chronology ]

          • identicon
            Anonymous Coward, 3 Oct 2016 @ 5:34pm

            Re: Re: Re: Re:

            I want two bumper stickers for my car--one (on the right, naturally) saying "DEPORT ALL ILLEGAL ALIENS (and their billionaire boy-toys)" and the other saying "SUPPORT HILLARY CLINTON (for ambassador to Libya)".

            reply to this | link to this | view in chronology ]

        • icon
          That One Guy (profile), 3 Oct 2016 @ 1:48pm

          Re: Re: Re:

          As always thanks for the chuckle Joseph.

          reply to this | link to this | view in chronology ]

        • identicon
          Skeeter, 3 Oct 2016 @ 3:57pm

          Re: Re: Re:

          They're all becoming 'one', as the sheep cheer it on.

          Enjoy Ouroboros, rumor has it, you'll get it in the end, too.

          reply to this | link to this | view in chronology ]

    • icon
      That One Guy (profile), 3 Oct 2016 @ 1:46pm

      Re:

      Yeah, their attempt to have the injunction tossed undermines their arguments against it. If they have no interest in prosecution then the injunction isn't going to affect them at all, as it would simply be telling them not to do something they had no plans on doing anyway.

      The only way the injunction would be a problem for them is if they do plan to prosecute, or at a minimum want to keep the threat of prosecution available. In either case they're being dishonest when they claim that the injunction isn't needed because the researcher doesn't need fear prosecution for his actions, as quite clearly he does.

      reply to this | link to this | view in chronology ]

      • identicon
        I.T. Guy, 3 Oct 2016 @ 1:48pm

        Re: Re:

        First thing that came to mind is:

        Just because I have a gun pointed at you doesn't mean I am going to shoot.

        reply to this | link to this | view in chronology ]

        • icon
          That One Guy (profile), 3 Oct 2016 @ 2:27pm

          Re: Re: Re:

          (It does if you're following proper gun safety practices)

          Pretty much, yeah. The DOJ is arguing that they should be allowed to point the gun at the researcher and arguing that despite this the researcher has no grounds to object because he can't prove that the DOJ plans to pull the trigger.

          Ignoring of course that if they aren't planning on 'shooting' then an injunction barring them from doing so won't affect them in the slightest, and also ignoring that at the point that the trigger has been pulled the damage has already been done.

          reply to this | link to this | view in chronology ]

  • icon
    crade (profile), 3 Oct 2016 @ 12:55pm

    "but they cannot provide any evidence prosecution is likely if Green continues with his research work."

    But prosecution is *not* likely, that is the whole problem. If they actually properly enforced the law then it have been overturned already. They will only cherry pick the sympathetic cases to build the case law in the manner of their choosing.

    In the meantime researchers can't do their research without being willing to break the law and take the risk, causing a barrier to security research (where the harm comes from)

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 3 Oct 2016 @ 5:22pm

    Our government, hard at work protecting corporate interests.

    reply to this | link to this | view in chronology ]

  • icon
    Whatever (profile), 4 Oct 2016 @ 2:30am

    From what I can tell, the court is most likely to tell them to go away, and come back when it's actually relevant (ie, he's been charged with something). For the moment, they are asking for an injunction to effectively try to re-write the law before it's even applied. Their true remedy is to deal with congress and work for change.

    reply to this | link to this | view in chronology ]

    • identicon
      Annonymouse, 4 Oct 2016 @ 4:16am

      Response to: Whatever on Oct 4th, 2016 @ 2:30am

      Wait a second. I thought it was the job of the judicial section to vet any laws passed and toss back any that smelled like rotting fish.

      So now they just have to follow orders and be absolved of any tyranny perpetrated.

      reply to this | link to this | view in chronology ]

      • icon
        Whatever (profile), 4 Oct 2016 @ 4:40am

        Re: Response to: Whatever on Oct 4th, 2016 @ 2:30am

        Generally, the courts rule when there is a case before them, you know, someone gets charged with something and then their lawyer can argue that the law is not constitutional. The courts generally deal with real cases, and not hypothetical ones.

        Generally injunctive relief is sought in this manner when inaction would lead to someone breaking the law. Say a change in business record keeping, or something of similar nature.

        What the EFF is trying to do here is get the courts to re-write or change a law before it's ever been applied. Without an actual defendant, the courts should send them packing. They have no standing and no case on which the courts can rule, only an injunction against what is a theoretical situation for the moment.

        The gentleman can publish his book, and if the authorities decides to charge him THEN the EFF might be able to come to his aid. For the moment, they are swinging at empty air.

        reply to this | link to this | view in chronology ]

        • icon
          Ninja (profile), 4 Oct 2016 @ 5:26am

          Re: Re: Response to: Whatever on Oct 4th, 2016 @ 2:30am

          No. Laws can be challenged even if they are not being used to prosecute someone. Educate yourself.

          reply to this | link to this | view in chronology ]

          • identicon
            Thad, 4 Oct 2016 @ 12:01pm

            Re: Re: Re: Response to: Whatever on Oct 4th, 2016 @ 2:30am

            I hate to agree with Whatever, but I fear he's probably right about how this is going to shake out. The government has successfully applied the "you don't have standing because you can't prove this applies to you" argument on nearly every suit that's been filed over its surveillance programs.

            I'm not saying it's *morally* right; in fact I believe strongly that it's just the opposite. But I think it's most likely what's going to happen here.

            reply to this | link to this | view in chronology ]

  • icon
    Not an Electronic Rodent (profile), 4 Oct 2016 @ 6:24am

    They have no standing and no case on which the courts can rule, only an injunction against what is a theoretical situation for the moment.
    So it's possible to get an injunction against an abusive partner without them having been arrested for anything and on the basis of previous behaviour, but it's impossible to get an injunction against an abusive government agency until you're arrested? Gotta love the double standard...

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Shop Now: I Invented Email
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.