Google Built Its Empire Scraping The Web. Now It’s Suing To Stop Others From Scraping Google

Copyright

from the the-open-web-is-closing dept

Last week, Google filed suit against SerpApi, a scraping company that helps businesses pull data from Google search results. The lawsuit claims SerpApi violated DMCA Section 1201 by circumventing Google’s “technological protection measures” to access search results—and the copyrighted content within them—without permission.

There’s just one problem with this theory: Google built its entire business on scraping the web without asking permission first. And now it wants to use one of the most abused provisions in copyright law to stop others from doing something functionally similar to what made Google a tech giant in the first place.

The lawsuit comes on the heels of Reddit’s equally problematic anti-scraping suit from October—which we called an attack on the open internet. Reddit sued Perplexity and various scraping firms (including SerpApi), claiming they violated 1201 by circumventing… Google’s technological protections. Reddit was mad it had cut a multi-million dollar licensing deal with Google for access to Reddit content, and these firms were routing around both that deal and Google itself to provide similar results to users. The legal theory was bizarre: Reddit didn’t own the copyright on user posts, and the scrapers weren’t even touching Reddit directly—yet Reddit claimed standing to sue based on circumventing someone else’s TPMs.

So now, Google has filed its own, similar lawsuit, going after SerpApi directly, focused on how SerpApi gets around its attempts to block such scraping. Google released a blog post defending this lawsuit:

We filed a suit today against the scraping company SerpApi for circumventing security measures protecting others’ copyrighted content that appears in Google search results. We did this to ask a court to stop SerpApi’s bots and their malicious scraping, which violates the choices of websites and rightsholders about who should have access to their content. This lawsuit follows legal action that other websites have taken against SerpApi and similar scraping companies, and is part of our long track record of affirmative litigation to fight scammers and bad actors on the web.

Google follows industry-standard crawling protocols, and honors websites’ directives over crawling of their content. Stealthy scrapers like SerpApi override those directives and give sites no choice at all. SerpApi uses shady back doors — like cloaking themselves, bombarding websites with massive networks of bots and giving their crawlers fake and constantly changing names — circumventing our security measures to take websites’ content wholesale. This unlawful activity has increased dramatically over the past year.

SerpApi deceptively takes content that Google licenses from others (like images that appear in Knowledge Panels, real-time data in Search features and much more), and then resells it for a fee. In doing so, it willfully disregards the rights and directives of websites and providers whose content appears in Search.

Look, SerpApi’s behavior is sketchy. Spoofing user agents, rotating IPs to look like legitimate users, solving CAPTCHAs programmatically—Google’s complaint paints a picture of a company actively working to evade detection. But the legal theory Google is deploying to stop them threatens something far bigger than one shady scraper.

Google’s entire business is built on scraping as much of the web as possible without first asking permission. The fact that they now want to invoke DMCA 1201—one of the most consistently abused provisions in copyright law—to stop others from scraping them exposes the underlying problem with these licensing-era arguments: they’re attempts to pull up the ladder after you’ve climbed it.

Just from a straight up perception standpoint, it looks bad.

To be clear: this isn’t about defending SerpApi. They appear to be bad actors who built a business on evading detection systems. The problem is that Google chose to go after them using a legal weapon with a long history of collateral damage. When you invoke Section 1201 against web scraping, you’re not just targeting one sketchy company—you’re potentially rewriting the rules for how the entire open web functions. The choice of weapon matters, especially when that weapon has been repeatedly abused to stifle legitimate competition and could now be turned against the very openness that made the modern internet possible.

For many years, we’ve discussed the many, many problems of DMCA Section 1201. It’s the “anti-circumvention” part of the law that says merely any attempt to get around a “technological protection measure” (or even just tell someone else how to get around a technological protection measure) could be deemed to violate the law, even if the TPMs in question were wholly ineffective, and even if the intent in getting around the TPM had nothing to do with copyright infringement.

That has lead to years of abusive practices by companies who would put silly, pointless “TPMs” in place just in order to be able to use the law to limit competition. There were lawsuits over printer ink cartridges and garage door openers, among other things.

Here, Google is saying that it put in place a TPM in January of 2025 called “SearchGuard” (which sounds like an advanced CAPTCHA of some sort) to prevent SerpApi from scraping its search results, but SerpApi figured out a way around it:

When SearchGuard launched in January 2025, it effectively blocked SerpApi from accessing Google’s Search results and the copyrighted content of Google’s partners. But SerpApi immediately began working on a means to circumvent Google’s technological protection measure. SerpApi quickly discovered means to do so and deployed them.

SerpApi’s answer to SearchGuard is to mask the hundreds of millions of automated queries it is sending to Google each day to make them appear as if they are coming from human users. SerpApi’s founder recently described the process as “creating fake browsers using a multitude of IP addresses that Google sees as normal users.”

SerpApi’s fakery takes many forms. For example, when SerpApi submits an automated query to Google and SearchGuard responds with a challenge, SerpApi may misrepresent the device, software, or location from which the query is sent in order to solve the challenge and obtain authorization to submit queries. Additionally or alternatively, SerpApi may solve SearchGuard’s challenge with a “legitimate” request and then syndicate the resulting authorization, that is, share it with unauthorized machines around the world, to enable their “fake browsers” to generate automated queries that appear to Google as authorized. It also uses automated means to bypass CAPTCHAs, another aspect of SearchGuard that tests users to ensure they are humans rather than machines.

Getting around these protections eats up Google’s resources, and sure, that must be annoying for Google. But the real motivation shows up when Google gets to the economics of the situation. Google has started cutting licensing deals with content partners—most notably the multi-million dollar Reddit deal—and now those partners are pissed that SerpApi lets others access similar data without paying anyone:

For Google, SerpApi’s automated scraping not only consumes substantial computing resources without payment, but also disrupts Google’s content partnerships. Google licenses content so that it can enhance the Search results it provides to users and thereby boost its competitive standing. SerpApi undermines Google’s substantial investment in those licenses, making the content available to other services that need not incur similar costs.

SerpApi’s scraping of Google Search results also impacts the rights holders who license content to Google. Without permission or compensation, SerpApi takes their content from Google and widely distributes it for use by third parties. That, in turn, threatens to disrupt Google’s relationship with the rights holders who look to Google to prevent the misappropriation of the content Google displays. At least one Google content partner, Reddit, has already sued SerpApi for its misconduct.

This is where the 1201 theory becomes genuinely dangerous. Google’s argument, if accepted, provides a roadmap for any website operator who wants to lock down their content: slap on a trivial TPM—a CAPTCHA, an IP check, anything—and suddenly you can invoke federal law against anyone who figures out how to get around it, even if their purpose has nothing to do with copyright infringement.

The implications spiral outward quickly. If Google succeeds here, what stops every major website from deciding they want licensing revenue from the largest scrapers? Cloudflare could put bot detection on the huge swath of the internet it serves and demand Google pay up. WordPress could do the same across its massive network. The open web—built on the assumption that published content is publicly accessible for indexing and analysis—becomes a patchwork of licensing requirements, each enforced through 1201 threats.

That doesn’t seem good for the prospects of a continued open web.

Google’s legal theory has another significant problem: the requirement that a TPM must “effectively control” access. Just last week, a court rejected Ziff Davis’s attempt to turn robots.txt into a 1201 violation when OpenAI allegedly ignored its crawling restrictions. The court’s reasoning is directly applicable here:

Robots.txt files instructing web crawlers to refrain from scraping certain content do not “effectively control” access to that content any more than a sign requesting that visitors “keep off the grass” effectively controls access to a lawn. On Ziff Davis’s own telling, robots.txt directives are merely requests and do not effectively control access to copyrighted works. A web crawler need not “appl[y] . . . information, or a process or a treatment,” in order to gain access to web content on pages that include robots.txt directives; it may access the content without taking any affirmative step other than impertinently disregarding the request embodied in the robots.txt files. The FAC therefore fails to allege that robots.txt files are a “technological measure that effectively controls access” to Ziff Davis’s copyrighted works, and the DMCA section 1201(a) claim fails for this reason.

Google will argue SearchGuard is different—it’s more than a polite request, it actively challenges and blocks scrapers. But if SerpApi can routinely bypass it by spoofing browsers and rotating IPs, does it really “effectively control” access? Or is it just a slightly more sophisticated “keep off the grass” sign that determined actors can ignore?

This question matters enormously because it determines whether the statute that was supposed to prevent piracy of CDs and DVDs now also governs every attempt to access publicly-available web pages through automated means.

For decades, we’ve operated under a system where robots.txt represented a voluntary, good-faith approach to web crawling. The major players respected these directives not because they had to, but because maintaining that norm benefited everyone. That system is breaking down, not because of SerpApi, but because of the rise of scrapers focused on LLM training, mixed with other companies wanting to find licensing deals to get a cut of the money flows. Reddit and Google negotiating licensing deals over open web content was a warning sign of all of this, and now it’s spilling out into the courts with questionable 1201 claims.

Both Reddit and Google frame this as protecting the open internet from bad actors. But pulling up the ladder after you’ve climbed it isn’t protection—it’s rent-seeking. Google built an empire on the assumption that publicly accessible web content could be freely scraped and indexed. Now it wants to rewrite the rules… using Hollywood’s favorite tool to block access to information.

The real problem isn’t that Google is fighting back against SerpApi’s evasive tactics. It’s that they chose to fight using a legal weapon that, if successful, fundamentally changes how we understand access to the open web. Section 1201 has already been wildly abused to stifle competition in everything from printer cartridges to garage door openers. Extending it to cover basic web scraping because SerpApi seems sketchy threatens the foundational assumption that published web content is accessible for indexing, research, and analysis.

Google has the resources to solve this problem through better engineering or by raising the actual cost of evasion high enough that SerpApi’s business model fails. Instead, they’ve opted for a legal shortcut that, if it works, will reshape the internet in ways that go far beyond one sketchy scraping company.

The internet is changing, and legitimate questions exist about how web scraping should function in an era of large language models and AI training. But those questions won’t be answered well by stretching copyright law to cover something it was never designed for, and empowering every website operator to demand licensing fees simply by putting up a CAPTCHA.

That’s not protecting the open web. That’s closing it.

Filed Under: 1201, anti-circumvention, circumvention, copyright, dmca 1201, licensing, open web, robots.txt, webcrawling
Companies: google, reddit, serpapi

Appeals Court Can Rule That DMCA's Anti-Circumvention Rules Are Unconstitutional

Copyright

from the make-it-so dept

As you hopefully know, there are two main parts to the DMCA law that was passed in 1998. There’s DMCA 512, which is what you hear about most of the time. That’s the part that includes the rules for notice and takedown regimes for user uploaded content (among other things). It’s got problems, but in its current form has also enabled many important services to exist. The other part, which is much more problematic, is DMCA 1201, which is the anti-circumvention rules — or you could call it the “DRM” part of the law. This has no redeeming value whatsoever. Under 1201 basically any attempt to circumvent a “technological” protection measure, can be deemed infringing even if the underlying content is never infringed upon. This part of the law is not only not necessary, but it’s drafted in a manner that has been regularly abused — enabling everyone from printer manufacturers to garage door opener companies to argue that simple reverse engineering to create competition is “infringement.”

In fact, everyone — even the drafters of the DMCA — knew that 1201 went too far and would lead to massive collateral damage. Rather than not passing such a bill, Congress came up with its “escape valve” which is the triennial review process, whereby every three years, the Librarian of Congress can magically declare which things are exempt from 1201. This has exempted a few classes of important use cases, but just the fact that (1) these uses need to be renewed every three years, and (2) that you have to ask for permission that can only be granted every 3 years for things that should be perfectly legal… is a problem.

Way back in 2016, EFF brought a case challenging the constitutionality of 1201 on behalf of computer security researcher/professor Matthew Green and hardware hacker Bunnie Huang, arguing that the DMCA 1201 liability suppressed their speech by stopping security research and beneficial hacking efforts. In 2019, a court dismissed much of the constitutional challenge, while allowing other parts of the case to move forward.

However, those constitutional questions are now on appeal and the EFF recently filed its opening brief. It’s worth reading.

Appellants? research and expression would be highly valuable to society. Their work would also be perfectly lawful but for one thing?it requires circumventing digital locks and teaching others how to do the same. In the name of protecting copyrights, a federal statute, Section 1201(a) of the Digital Millennium Copyright Act (DMCA), makes it a crime to engage in or even distribute information about such circumvention, even if the circumvention serves an otherwise lawful purpose. This statute subverts the traditional contours of copyright law to criminalize speech and bar people from using information they possess for education, journalism, and expression. That, in turn, puts Section 1201(a) on a collision course with the First Amendment?one it cannot and should not survive.

Some useful and worth reading amicus briefs have also been filed in the case. Copyright scholars Pam Samuelson and Rebecca Tushnet filed a fantastic brief:

In 1998, Congress made a momentous departure from traditional copyright law by enacting Section 1201 of the Digital Millennium Copyright Act (?DMCA?). Section 1201 created a new class of right?a right to control access to legitimately acquired copies of copyrighted works that had been transferred to lawful owners, as well as a new antitrafficking right specific to access controls. 17 U.S.C. ? 1201(a). Both new rights?as well as the significant civil and criminal penalties for infringing those rights?apply well beyond the traditional contours of secondary liability for aiding infringement by others. Id. ?? 1203, 1204. Moreover, these new rights disregard and override traditional mechanisms within the Copyright Act that struck the balance between copyright protection and First Amendment interests.

The Tech Law & Policy clinic at Colorado Law highlighted how much damage 1201 and the triennial review process has done to accessibility, security, and right to repair:

The right to engage in fair use is protected by the First Amendment. The Supreme Court has concluded that fair use is one of copyright law?s essential ?built-in First Amendment accommodations? and serves as a ?traditional First Amendment safeguard.? The Supreme Court has conceptualized fair use as a safety valve that prevents copyright law from suppressing the exercise of First Amendment rights.

Section 1201 eliminates fair use?s capacity to serve as a First Amendment safeguard when copyrighted works are encumbered with TPMs. It does so by effectively prohibiting fair uses that require the circumvention of TPMs.

And then there’s an amicus brief from documentary film makers talking about how damaging 1201 has been to their own expression:

The Digital Millennium Copyright Act prevents filmmakers from exercising their First Amendment right to make fair use by making it illegal to access content on DVDs and other digital content protected by encryption. Congress intended to create a ?fail-safe? mechanism to preserve the public?s right to make fair use. But the open-ended rulemaking process it devised is unduly burdensome and has led to exemptions that leave filmmakers uncertain as to how they can make fair use safely. Amici urge this Court to issue a limiting construction that preserves their First Amendment right to make fair use. In addition, if this Court is inclined to order equitable relief in this appeal, this Court should preserve existing exemptions until a more constitutionally appropriate procedure is in place and more workable exemptions have gone into effect.

Filmmakers depend on the doctrine of fair use to make commentary, criticism, instruction, and report on current events by utilizing portions of digitized movies and other digitized content. Fair use in filmmaking has been called a paradigmatic fair use, and without it a massive range of expressive conduct would be impossible. But fair use is of little consequence if filmmakers cannot access the high-quality digital material they seek to use in the first place. Suppose a filmmaker wants to analyze how special effects in the Star Wars film franchise have evolved from 1977 to the present day, examining various clips from the past 45 years. The law is quite clear that fair use permits the use of film clips without permission or payment to the Star Wars rightsholders. To do this, however, the filmmaker will need to obtain high-quality footage, which is likely to be locked behind encryption and other technological protection measures (?TPMs?). That is a problem for filmmakers because Congress made it a crime to circumvent technologies that control access to copyrighted content when it enacted the Digital Millennium Copyright Act (?DMCA?) in 1998, now codified at Section 1201 of the copyright statute. The result is that, barring an exemption from the Librarian of Congress, filmmakers cannot access the digital content they need for fair use without a credible fear of civil and criminal liability.

This isn’t just an issue for big companies. This is about fundamental fair use rights of the public — which Congress tossed away decades ago, and tried to pave over by insisting the Librarian of Congress could swoop in every 3 years and stop the most egregious attacks on free speech. But that’s not how the 1st Amendment works.

Hopefully the court agrees.

Filed Under: 1201, bunnie huang, copyright, dmca 1201, matthew green, security research

Shocker: DOJ's Computer Crimes And Intellectual Property Section Supports Security Researchers DMCA Exemptions

Copyright

from the say-what-now? dept

Well here’s a surprise for you. The DOJ’s Computer Crime and Intellectual Property Section (CCIPS) has weighed in to support DMCA 1201 exemptions proposed by computer security researchers. This is… flabbergasting.

In case you don’t know, Section 1201 of the Digital Millennium Copyright Act (DMCA) is the “anti-circumvention” part of the law. It’s the part of the law that makes it infringement to get around any “technological measure” to lock down copyright covered material, even if breaking those locks has nothing whatsoever to do with copyright infringement. It’s a horrible law that has created all sorts of negative consequences, including costly and ridiculous lawsuits about things having nothing to do with copyright — including garage door openers and printer ink cartridges. In fact, Congress knew the law was dumb from the beginning, but rather than dump it entirely as it should have done, a really silly “safety valve” was added in the form of the “triennial review” process.

The triennial review is a process that happens every three years (obviously, per the name), in which anyone can basically beg the Copyright Office and the Librarian of Congress to create exemptions for cracking DRM for the next three years (an exemption — stupidly — only lasts those three years, meaning people have to keep reapplying). Over the years, this has resulted in lots of silliness, including the famous decision by the Librarian of Congress to not renew an exemption to unlock mobile phones a few years back. Many of the exemption requests come from security researchers who want to be able to crack systems without being accused of copyright infringement — which happens more frequently than you might think.

Historically, law enforcement has often been against these exemptions, because (in general) they often appear to dislike the fact that security researchers find security flaws. This is, of course, silly, but many like to take a “blame the messenger” approach to security research. That’s why this new comment from the DOJ’s CCIPS is so… unexpected.

Many of the changes sought in the petition appear likely to promote productive cybersecurity research, and CCIPS supports them, subject to the limitations discussed below.

Incredibly, CCIPS even points out that those who are opposed to these cybersecurity research exemptions are misunderstanding the purpose of 1201, and that it should only be used to stop activity that impacts copyright directly. This is the kind of thing we’ve been arguing for years, but many companies and government agencies have argued that because 1201 helps them, no exemptions should be granted. But here, the DOJ explains that’s not how it works:

Some comments opposing removal of any existing limitation on the security research exemption suggest, implicitly or explicitly, that the DMCA?s security research exemption itself poses a danger merely because it fails to prohibit a type of research to which the commenter objects. However, the purpose of the DMCA is to provide legal protection for technological protection measures, ultimately to protect the exclusive rights protected by copyright. As critically important as the integrity of voting machines or the safety of motorized land vehicles are the American public, the DMCA was not created to protect either interest, and is ill-suited to do so. To the extent such devices now contain copyrighted works protected by technological protection measures, the DMCA serves to protect those embedded works. However, the DMCA is not the sole nor even the primary legal protection preventing malicious tampering with such devices, or otherwise defining the contours of appropriate research. The fact that malicious tampering with certain devices or works could cause serious harm is reason to maintain legal prohibitions against such tampering, but not necessarily to try to mirror all such legal prohibitions within the DMCA?s exemptions.

There’s a lot more in the comment, but… I’m actually impressed. Of course, the letter does note that part of the reason it wants this exemption is to enable security researchers to figure out how to crack into encrypted phones, but that’s actually a reasonable position for the DOJ to take. Far better than seeking to backdoor encryption. Finding flaws is fair game.

All in all, this is a welcome development, having the DOJ’s CCIPS recognize that security research is useful, and that it shouldn’t be blocked by nonsense copyright anti-circumvention rules.

Filed Under: 1201, ccips, computer crimes, copyright, dmca 1201, doj, exemptions, security research, triennial review

Copyright Office Will Renew Previous DMCA Exemptions Without Much Fuss — But Why Is This Even Necessary?

Copyright

from the about-freaking-time dept

For years we’ve written about the idiocy of the DMCA’s 1201 triennial review. If you don’t recall, Section 1201 of the DMCA is the “anti-circumvention” part of the law, saying that anything that gets around DRM is, itself, copyright infringement. This was so obviously stupid and counterproductive when it passed, and Congress knew it was so obviously stupid and counterproductive, that it included an even stupider “safety valve” to deal with the obviously bad results of the law. That safety valve, known as the “triennial review” is that every three years, people need to beg and plead with the Copyright Office and the Librarian of Congress to make explicit exemptions from the law, where circumventing DRM won’t be considered infringing. Over the years, this lengthy and costly process has at least allowed certain key exemptions for security and academic research. Though, of course, even when exemptions are granted, it’s often a hot mess.

But, astoundingly, the exemptions only last until the following triennial review, meaning that every few years, everyone has to waste their time and go through the whole damn process again. This blew up in everyone’s face in 2012 when the Librarian of Congress rejected an exemption for phone unlocking that had been in place for the previous round. Lots of people got angry, and even the White House weighed in to say it was a mistake that should be fixed. Of course, rather than fixing Section 1201, they just passed a separate law specific to phone unblocking.

However, the whole issue got so much attention and so much interest (both from the public and politicians) that I’d be surprised if the Copyright Office ever decided to drop an exemption after it had been issued. And, indeed in the newly released notice of proposed rulemaking (NPRM) on the latest exemptions, the Copyright Office easily renews all of the old exemptions:

As detailed below, after reviewing the petitions for renewal and comments in response, the Office concludes that it has received a sufficient petition to renew each existing exemption and it does not find any meaningful opposition to renewal. Accordingly, the Register intends to recommend readoption of all existing exemptions in their current form.

That’s great, though it’s crazy that this process even needs to happen each year, wasting everyone’s time, energy and money.

Unfortunately, the Copyright Office had a chance to go further, but declined. In the Notice of Inquiry about this, the Copyright Office asked for input on regulatory language that could ease the situation for renewing existing exemptions, but in a footnote, the Copyright Office declines to make any suggestions:

Although the Office?s Notice of Inquiry stated that this NPRM would set forth proposed regulatory language for any existing exemptions the Office intends to recommend for readoption, because many of the new petitions seek to expand existing exemptions, the Office concludes that proposing regulatory language at this time would be premature; the Register may propose altering current regulatory language to expand the scope of an existing exemption, where the record suggests such a change is appropriate.

Of course, all of this still leaves open the much wider question of why do we need Section 1201 in the first place? If someone infringes on someone’s copyright, go after them for that. The whole focus on circumventing DRM is a distraction that has created numerous problems for lots and lots of people — especially security and academic researchers. 1201 was never useful and it’s time to just do away with it entirely.

Filed Under: 1201, copyright, copyright office, dmca, library of congress, security research, triennial review

Tractor Owners Using Pirated Firmware To Dodge John Deere's Ham-Fisted Attempt To Monopolize Repair

(Mis)Uses of Technology

from the you-don't-own-what-you-buy dept

We’ve been noting for a while how numerous states have been pushing so-called “right to repair” bills, which would make it easier for consumers to repair their own products and find replacement parts and tools. Not surprisingly, many tech companies have been working overtime to kill these bills. That includes Apple, which recently proclaimed that Nebraska’s right to repair bill would turn the state into a nefarious playground for hackers. Opposition also includes Sony and Microsoft, which both tend to enjoy a repair monopoly on their respective video game consoles.

Whether coming from Apple, Sony, or Microsoft, opposition to these bills usually focuses on the three (false) ideas: the bills will make users less safe, somehow “compromise” intellectual property, and open the door to cybersecurity theft.

But it’s easy to lose track of what started the recent groundswell of consumer support for these bills: the lowly tractor.

It was John Deere’s decision to implement a draconian lockdown on “unauthorized repairs” that has magically turned countless ordinary citizens into technology policy activists. A lengthy EULA the company required customers to sign last October forbids the lion-share of repair or modification of tractors customers thought they owned, simultaneously banning these consumers from suing over “crop loss, lost profits, loss of goodwill, loss of use of equipment ? arising from the performance or non-performance of any aspect of the software.”

Needless to say, most of the company’s customers weren’t particularly impressed by the restrictions, which let companies monopolize repair, but hurt farmers’ livelihoods by forcing them to visit only “authorized” repair shops that may be countless miles away from the farm. As a result, many of these folks have amusingly turned toward using unauthorized tractor firmware pirated and modified in Eastern Europe to free themselves of arbitrary, obnoxious and unnecessary restrictions on what they can do with gear they technically own:

“There’s software out there a guy can get his hands on if he looks for it,” one farmer and repair mechanic in Nebraska who uses cracked John Deere software told me. “I’m not a big business or anything, but let’s say you’ve got a guy here who has a tractor and something goes wrong with it?the nearest dealership is 40 miles away, but you’ve got me or a diesel shop a mile away. The only way we can fix things is illegally, which is what’s holding back free enterprise more than anything and hampers a farmer’s ability to get stuff done, too.”

As a result, tractor owners visit various forums to not only buy pirated and modified repair software, but the cables required to perform diagnostics and install updates. In 2015, we noted how the Library of Congress authorized some vehicle-focused exemptions allowing for this kind of legal tinkering, but saddled the exemptions will all manner of bizarre and unnecessary caveats. Right around that time, John Deere began requiring that farmers sign licensing agreements giving the company the right to sue for breach of contract (they haven’t yet).

Of course, if you ask the company why a “black market” specifically tailored for annoyed farmers has blossomed, you’re simply told there’s nothing to see here, there are no repair issues, and the company makes it perfectly easy for farmers to diagnose issues and repair their vehicles. But actual farmers and folks fighting for right to repair legislation say that’s simply not the case. For example, tractor owners who say they modify their tractors using anaerobic digesters to fuel them with pig methane, say they’re technically violating John Deere’s terms of service:

“They require buyers to accept an End User License Agreement that disallows all of the activities they say are allowed in their statement,” (Gay Gordon-Byrne, executive director of Repair.org) said. “Deere is a monopolist and has systematically taken over the role of equipment owner, despite having been paid fairly and fully for equipment. Their claims to control equipment post-purchase are inconsistent with all aspects of ownership including accounting, taxation, and transfer of products into the secondary market.”

These farmers also say they’re worried that if a company like John Deere is sold, they could wind up stuck without the ability to modify or repair older hardware they likely made a significant investment in. As a result, these annoyed farmers are the cornerstone of the right to repair push currently winding its way through the Nebraska, New York, Minnesota, Wyoming, Tennessee, Kansas, Massachusetts, and Illinois state legislatures. And the companies fighting these bills simply refuse to publicly acknowledge they’re doing so, which tells you everything you need to know about the “value” these restrictions actually provide.

Filed Under: 1201, dmca 1201, firmware, ownership, right to repair, tractors
Companies: john deere

Hey, You Can Hack Your Car Without Violating Copyright Law (For A Little While)

Copyright

from the and-you-may-still-violate-other-laws dept

In my talk last week at Wikimedia, one of the examples I gave of “copyright creep” where copyright law is being shoved into areas where it obviously doesn’t belong was that time when John Deere and GM argued that you didn’t really own parts of the vehicles you bought from them, because of copyright. The underlying issue was that these companies didn’t want the Librarian of Congress to exempt hacking cars and tractors from section 1201 of the DMCA. 1201 is the anti-circumvention provision that says that getting around technological protection measures (even if not for the purpose of infringing on copyright) is still infringement. Ridiculously, even the EPA sided with these companies arguing that hacking cars could override environmental protections. However, as we pointed out at the time, there are other laws to handle that kind of thing. Don’t abuse copyright for that purpose.

When the exemptions came out from the Librarian of Congress, we noted that the whole thing was a hot mess, in which it sort of granted the exemption on vehicle hacking… but with a bunch of weird limitations and caveats. One of those was a bizarre delay of 12 months:

Computer programs that are contained in and control the functioning of a motorized land vehicle such as a personal automobile, commercial motor vehicle or mechanized agricultural vehicle, except for computer programs primarily designed for the control of telematics or entertainment systems for such vehicle, when circumvention is a necessary step undertaken by the authorized owner of the vehicle to allow the diagnosis, repair or lawful modification of a vehicle function; and where such circumvention does not constitute a violation of applicable law, including without limitation regulations promulgated by the Department of Transportation or the Environmental Protection Agency; and provided, however, that such circumvention is initiated no earlier than 12 months after the effective date of this regulation.

It was never entirely clear why there was such a delay, but it was there. And last week the delay was finally over. Twelve months had passed, and you can now hack parts of your car without violating copyright law. But, of course, this exemption only lasts two more years and then everyone has to go through the whole stupid process again. There are also odd things like that you can only do this kind of hacking on your own vehicles, and you can’t hire someone to do it for you (again, this makes no sense). There is an effort underway to make the exemption permanent, but who knows how that will go. And, of course, as some have noted, those hacking their cars may still run into some legal issues — such as potentially violating the Computer Fraud and Abuse Act (CFAA), though that would require quite a strained reading of the law.

In the short term, the fact that you won’t be dinged for copyright infringement for merely tinkering with your car is a good thing.

Filed Under: 1201, anti-circumvention, car hacking, copyright, dmca 1201, exemptions, triennial review

My Talk At Wikimedia: Copyright Impacts Everything

Copyright

from the it-does dept

Last week, I mentioned that I was giving a talk at the Wikimedia Foundation about copyright. It was a fun time, and the video from the talk is now online. Unfortunately, the audio and the video are… not entirely great. I’d complain about the terrible microphone, but that sounds like a certain presidential candidate. The video is okay, but the colors are off, so my presentation looks a little weird. Either way, you should still be able to get the basics. There’s an introduction from Jan Gerlach at the Wikimedia Foundation, talking about all the important policy work they do, then my talk that runs about half an hour, followed by a Q&A with the audience that runs another half hour or so. It was a fun time, with a really great group of folks, and the conversation continued on after the official session ended for quite a while. Check it out:

Filed Under: 1201, censorship, copyright, dmca, free speech, impact
Companies: wikimedia

EFF Lawsuit Challenges DMCA's Digital Locks Provision As First Amendment Violation

Free Speech

from the well,-that's-interesting dept

Computer security professor Matthew Green and famed hardware hacker Bunnie Huang have teamed up with the EFF to sue the US government, challenging the constitutionality of Section 1201 of the DMCA, also known as the “anti-circumvention” clause. As we’ve discussed for many years, 1201 makes it against the law to “manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof” that is designed to “circumvent” DRM or other “technological protection measures.” There are all sorts of problems with this part of the law, including the fact that it doesn’t matter why you have that tool or why you’re circumventing the DRM. For example, it would still be considered infringement if you cracked DRM on a public domain work. That’s… insane.

The only “safety valve” on this is the ridiculous triennial review process, whereby people can beg and plead with the Librarian of Congress to “exempt” certain scenarios from being covered by 1201. The process is something of a joke, and even if you get an exemption one time, it automatically expires after three years, and the Library of Congress might not renew it.

The lawsuit, filed by EFF and some excellent lawyers from Wilson Sonsini, points out that the Supreme Court has long stated that fair use is the “safety valve” that stops copyright law from violating the First Amendment in regulating speech. But fair use isn’t an allowable defense under 1201, leading to a question of whether or not 1201 itself violates the First Amendment:

Enacted in 1998, these provisions broadly restrict the public?s ability to access, speak about, and use copyrighted materials, without the traditional safeguards?such as the fair use doctrine?that are necessary to protect free speech and allow copyright law to coexist with the First Amendment. The threat of enforcement of these provisions chills protected and noninfringing speech that relies on copyrighted works, including independent technical research into computer security systems and the discussion of that research, and accessing copyrighted works in order to shift the content to a different format, space, or time. The triennial rulemaking process by which the public may seek exemptions pursuant to 17 U.S.C. § 1201(a)(1)(C) does not alleviate these problems. To the contrary, the rulemaking is itself an unconstitutional speech-licensing regime.

The complaint highlights how both Green and Huang have been scared away from working on various projects that have nothing to do with copyright-covered content, but both of which involve circumventing technological protection measures. In Green’s case, it’s about his security research, finding computer security problems in various devices. For Huang it’s his work on a NeTVCR, an advancement on the NeTV device he created in the past. For it to work, however, he needs to get around HDCP and that, of course, would violate 1201. This presents a problem:

To the extent that the purpose of Section 1201 is ?to promote the progress of science and the useful arts,? see U.S. Const. Art I, Sec. 8, cl. 8, its restrictions are not narrowly tailored to this purpose. Rather, they sweep up a vast amount of protected speech. This includes the speech that Green, Huang, Alphamax, and users of NeTVCR would undertake, but for the fear or criminal and other penalties. It also includes the many forms of speech that have been the subjects of exemption requests, and many additional forms of speech that have not yet been the subject of an exemption request. The means chosen in Section 1201 specifically targets the communicative impact of uses of copyrighted works and speech about the circumvention of TPMs that restrict such works.

Separately, as noted in the quote above, the case argues that the triennial review process itself violates the First Amendment.

The rulemaking contemplated by Section 1201(a)(1) is a licensing regime that lacks the safeguards the First Amendment requires. The combined ban and exemption process grants excessive power to a government official to make discretionary case-by-case decisions absent sufficient controlling standards.

Section 1201 does not provide for timely review of requests for permission to speak. Applicants must wait up to three years for an opportunity to participate in the triennial rulemaking, and the Rulemaking Defendants have no deadlines governing when they must issue a rule granting or denying exemption requests.

As Huang notes in his blog post about the case, this is a really big issue. It’s both about free speech and what it means to “own” something.

Before Section 1201, the ownership of ideas was tempered by constitutional protections. Under this law, we had the right to tinker with gadgets that we bought, we had the right to record TV shows on our VCRs, and we had the right to remix songs. Section 1201 built an extra barrier around copyrightable works, restricting our prior ability to explore and create. In order to repair a gadget, we may have to decrypt its firmware; in order to remix a video, we may have to strip HDCP. Whereas we once readily expressed feelings and new ideas through remixes and hardware modifications, now we must first pause and ask: does this violate Section 1201? Especially now that cryptography pervades every aspect of modern life, every creative spark is likewise dampened by the chill of Section 1201.

The act of creation is no longer spontaneous.

Our recent generation of Makers, hackers, and entrepreneurs have developed under the shadow of Section 1201. Like the parable of the frog in the well, their creativity has been confined to a small patch, not realizing how big and blue the sky could be if they could step outside that well. Nascent 1201-free ecosystems outside the US are leading indicators of how far behind the next generation of Americans will be if we keep with the status quo.

Our children deserve better.

The argument here is compelling. 1201 has all sorts of problems, but no one has tested this First Amendment argument before. Unfortunately, our courts have been incredibly (and unfortunately) reluctant to seriously consider constitutional challenges to copyright law. The cases that have made it up through the court system have ended unfortunately badly — cases like the Eldred case challenging copyright term extension, for example. I hope that this one turns out differently, and it may become a case to watch. Again, the arguments are quite compelling to me, but I’m unfortunately skeptical that the judicial system will agree. I hope I’m wrong.

Filed Under: 1201, anti-circumvention, bunnie huang, dmca, dmca 1201, fair use, first amendment, free speech, hacking, matthew green, research, security research, triennial review
Companies: eff

Library Of Congress Releases DMCA Anti-Circumvention Exemptions… And It's A Hot Mess

Copyright

from the because-of-course dept

Well, the Library of Congress has now released its official exemptions to the DMCA’s 1201 anti-circumvention rules, the ridiculous process known as the triennial review, and as was pretty much expected, it’s a total mess. We’ll have a more thorough look at it later, but after an initial read through of the document, it appears that the Library of Congress tried to please everyone and will likely end up pleasing no one. If you’re unfamiliar with the process, under the DMCA, there’s a part of the law, section 1201, which says that it’s copyright infringement to bypass any kind of “technological protection method” (TPM) to access something, even if the reason you’re circumventing the TPM is totally non-infringing. Basically, this says that if you put a digital lock on something, even if the lock is weak or stupid or for something totally unrelated to copyright law (such as blocking competition), you can use copyright law to stop anyone from getting around it. The concept is so stupid and so broad that even Congress realized it would be abused. But rather than fix it, it gave the Library of Congress this weird authorization to declare “exemptions” once every three years. So, basically, every three years people ask for exemptions (and each exemption granted in the past needs to be re-requested, and re-supported every three years). Then the Library of Congress climbs a mountain, thinks on it for a bit, and comes down the mountain declaring what is legal and what is not. It’s an insane process.

Three years ago, things went really haywire when the Library of Congress took away the exemption it had previously granted for cell phone unlocking. This resulted in widespread protests, and eventually Congress stepping in with a bill that didn’t actually fix the underlying problem, but just reinstated the previous exemption and told the Library of Congress to be more careful next time.

You can see in the latest exemptions that the Library of Congress has taken Congress’s mocking a bit to heart — as it seems totally gun shy on just about everything. It refers repeatedly to Congress’s decision to bring back the unlocking exemption and reads more into it than is necessary. But, because of this, it seems to want to tiptoe down the line, allowing exemptions, but putting all sorts of weird restrictions on them. For example, one of the most talked about requests was the one for accessing vehicle diagnostics. You may recall that GM, John Deere and even the EPA said the Library should reject these requests, because people might get access to diagnostic info… and then break emissions controls and pollute the environment or something. Apparently, only the automakers should be allowed to do that by themselves.

Here, the Library of Congress sort of grants that exemption, but with all sorts of caveats:

Computer programs that are contained in and control the functioning of a motorized land vehicle such as a personal automobile, commercial motor vehicle or mechanized agricultural vehicle, except for computer programs primarily designed for the control of telematics or entertainment systems for such vehicle, when circumvention is a necessary step undertaken by the authorized owner of the vehicle to allow the diagnosis, repair or lawful modification of a vehicle function; and where such circumvention does not constitute a violation of applicable law, including without limitation regulations promulgated by the Department of Transportation or the Environmental Protection Agency; and provided, however, that such circumvention is initiated no earlier than 12 months after the effective date of this regulation.

Even more bizarre, in the description about this exemption, it appears to say that this exemption can only be used if you are doing the circumvention yourself — and not for hiring someone to do it for you. Absolutely ridiculously, it points to the language of the bill Congress passed to smack the Library around last time on the phone unlocking exemption:

Moreover, by passing the Unlocking Act?which amended section 1201 to allow unlocking of cellphones and other devices to be carried out by third parties ?at the direction of? device owners?Congress indicated its view that extending the reach of an exemption to cover third-party actors requires a legislative amendment.

Wha….? In the fight over the Unlocking Act, there was serious concern that early drafts of the bill would cut out companies that help individuals unlock their phones. And thus to make sure that such things weren’t excluded, Congress made it explicit that it covered third parties unlocking phones “at the direction of” device owners. And yet… now the Library of Congress is ridiculously interpreting this to mean that it cannot grant such an exemption without Congress stepping in.

That’s… wrong. And ridiculous.

And that’s not the only problem with this. The one year delay in implementation is ridiculous as well. The Library of Congress notes that this is to allow other agencies to weigh in, but we just had a whole year for agencies to weigh in and many of them did. Yet, now, they want to delay the implementation of a three year exemption by one whole year in case more of them want to weigh in after the fact? Clearly this is because the Library of Congress is gunshy about what happened with unlocking last year, but to totally upend the process and delay a necessary exemption is no way to do that.

Similarly bizarre: the Library of Congress seemed to think it’s perfectly fine to weigh outside factors in determining this issue, even though it’s supposed to be judging things entirely based on the copyright issues. So, for example, with this same exemption on car repair and diagnostics, it allows the Copyright Office to review copyright-related factors, but then seemed to indicate that it was just fine for it to also review things that have nothing to do with copyright. It notes that “serious safety and environmental issues… weigh against an exemption.” But that’s not a copyright issue. We should not be using copyright law to regulate other things. We already have safety and environmental laws, and the Copyright Office explicitly endorsing the use of copyright laws to add some sort of additional environmental law (especially one that gets it so backwards) is patently ridiculous.

There are other problems in the rules as well. Michael Weinberg takes a look at the similarly problematic rules on 3D printing, where the same basic thing happened. The overall rule seems like it’s going in the right direction, but is so full of weird and unnecessary and troubling caveats that it mostly erases the good parts of the rule.

There are similar issues in other parts as well. For example, an exemption is added for MOOCs (Massive Open Online Courses) that want to use small snippets of locked up content (usually movies or news clips) as part of their classes: classic fair use. And the Library of Congress says that’s okay… kind of. It only applies to “accredited nonprofit educational institutions.” That sounds reasonable at first, until you realize that many MOOCs are actually run through for-profit entities. For example, Coursera is one of the most popular MOOC platforms out there, but is a for-profit venture. So, the exemption here wouldn’t be usable by National Geographic, who runs its MOOC via Coursera. And there are lots of others who would be similarly blocked, even if the use is clearly fair use. (Update: Actually, it appears this would be allowed).

It really seems like the Library of Congress has made things increasingly more complex for the sake of trying to “split the baby” on things, and in part because it got slapped down so hard three years ago. But the end result is that you get a split baby that seems to go way beyond what the law was intended to allow and pisses off everyone (especially the baby). Laura Quilter, the Copyright and Information Policy Librarian at UMass Amherst summarized the mess of these rules this way:

The prolixity of this rulemaking puts it into its own special hell of inaccessible, unintelligible, crazy-making meshugaas.

This isn’t how law should be made, and it’s unclear why this is still allowed.

Filed Under: 1201, 3d printing, anti-circumvention, cars, copyright office, diagnostics, dmca 1201, dmca triennial review, epa, fair use, library of congress, repair, software, triennial review