Software protection blocking a binary code stream. Digital illustration.

I used to love working on cars. As a teenager I had a 1972 Karmann Ghia, which I could repair, MacGyver-like, with rubber bands, tinfoil, and sticks of chewing gum. But as automotive technology advanced, the prospect of making my own repairs to fuel, emission, or transmission systems dimmed. Installation of electronic control units (ECUs) wiped those prospects out altogether, not because the car’s technological protection measure (TPM) software prevented me but, well, because my own ineptitude did.

So it is that I look askance at the Electronic Frontier Foundation’s declaration of a “Victory for Users” regarding the Library of Congress’s recently promulgated rules on exemptions to anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA), effective October 28, 2015. It is crucial to understand that these exemptions are wonderful if you yourself would like to hack into your vehicle’s software and make repairs or enhancements. If you would like to engage someone else to do it for you because your skills with rubber bands and tinfoil don’t cut it anymore, you are out of luck. The Library of Congress made clear that it has authority to grant exemptions under section 1201(a)(1) of the DMCA having to do with conduct of individuals, but not under sections 1201(a)(2) or 1201(b), which relate to products and services that are used to circumvent technological barriers.

But if you are an individual gifted with software skills; a remix artist; an educational institution, faculty member, or student; or cybersecurity researcher, then the new exemptions may be a welcome clarification. The exemptions allow circumvention of TPM that would otherwise be prohibited by application of section 1201 of the DMCA. The exemptions extend to a dizzying array of different “classes,” which are categories of devices and proposed uses and circumventions. Set forth below are exemptions that extend to vehicles, motion pictures, wireless devices, smart televisions, video games, 3-D printers, medical devices, and in some instances to any consumer-facing device or machine. The following summary lays out the lines drawn by the Register of Copyrights, whose recommendations were adopted by the Library of Congress and promulgated as regulations.

The Give

  • Vehicle Exemptions (Class 21)
    • Owners of motor vehicles and agricultural vehicles are permitted to circumvent TPM to allow diagnosis, repair, or lawful modification of a vehicle function so long as such modification does not violate other applicable law (and is instituted after a delay of 12 months from the effective date of the regulation).
  • Motion Picture Exemptions (Classes 1-7)
    • Circumvention of Advanced Access Control System on Blu-ray discs for most uses that are otherwise exempt (but not, notably, for uses by K-12 educators and students).
    • Faculty of massive online open courses (MOOCs) for courses requiring close analysis of film and media excerpts under conditions specified by the TEACH Act, 17 U.S.C. 110(2) are permitted to use screen-capture software and/or circumvent TPM.
    • Educators and participants in nonprofit digital and media literacy programs offered by libraries, museums, and other educational nonprofits are permitted to use screen-capture technology for purposes of educational, face-to-face instruction.
  • Wireless Device Exemptions (Classes 11-17)
    • The pre-existing unlocking (which relates to enabling the switching of wireless carriers) exemption for used cell phones was expanded to include all-purpose tablets and wearable wireless devices such as smartwatches.
    • The pre-existing jailbreaking (which relates to enabling installation of lawful software) exemption for cell phones was extended to “portable all-purpose mobile computing device[s],” and includes most tablet and smartwatch devices, but not devices dedicated to one type of media (e-book readers, handheld video game consoles) or computer systems embedded in automobiles.
  • Smart TV Exemptions (Class 20)
    • Jailbreaking is permitted for lawfully obtained software that enables interoperability between applications and computer programs on the smart television.
  • Security Research Exemptions (Classes 22, 25, and 27A)
    • Exemptions were granted for good-faith research into security flaws within devices or machines primarily designed for use by individual consumers, motorized land vehicles, and implanted medical devices. This exemption has a 12-month delay to allow review by other government agencies, except insofar as the exception applies to voting machines (which are deemed to be a kind of machine designed for use by individual consumers). Note that the definition of “good faith security research” contains a number of limitations itself.
  • Video Game Exemptions (Class 23)
    • Circumvention of TPM is allowed to facilitate access to lawfully acquired games that cannot be played without access to remotely located servers for authentication but that were subsequently discontinued or no longer supported by the developers, but only for a) personal gameplay or b) preservation for library, museum, or archival purposes.
  • 3-D Printer Exemptions (Class 26)
    • Circumvention of TPM on 3-D printers that use chip-based verification systems to enable use of non-manufacturer-approved feedstock, but not for any commercial use that is subject to any legal, regulatory, or other certification process, or where the circumvention is otherwise unlawful.
  • Medical Device Exemptions (Class 27B)
    • Circumvention of TPM is allowed on implanted medical devices, such as pacemakers and glucose monitors, to passively monitor wireless transmissions of data (as opposed to active collection of such data, which could impact battery life) so long as such collection of data complies with other applicable laws (such as HIPAA).

The Take

  • Vehicle Exemptions (Class 21)
    • The Librarian emphasized that the circumvention exemption does not extend to activity taken “on behalf of” vehicle owners, expressing concern over creating tension with the anti-trafficking provisions of section 1201(a)(2) and (b).
    • The exemption also does not extend to software and ECUs that are chiefly designed to operate vehicle entertainment and telematics systems that protect against unauthorized access of creative and proprietary content.
  • Motion Picture Exemptions (Classes 1-7)
    • The exemption only applies to courses requiring close analysis of film and media excerpts, rejecting a request to broaden the exemption to “all educational purposes.”
    • The exemption only allows use of “short portions,” rejecting a request that the exemption be expanded to allow longer clips.
    • The Register found there was an insufficient showing that K-12 educators and students required high-quality video clips, and disallowed their use of Blu-ray discs.
    • The Register similarly disallowed circumvention by students, although she did recommend that students be allowed to use screen-capture technology for exempted activity.
    • The exemption for MOOCs extend to faculty only, and not to students.
    • Only screen-capture technology, not circumvention of TPM, is permitted for after-school and adult education media literacy programs.
    • The Register rejected a request to expand uses to any genre of multimedia e-book, limiting the exemption to film analysis.
    • The Register rejected a request to expand uses to narrative films, limiting the exemption to documentary films.
    • The exemption regarding noncommercial videos was kept as is, rejecting a request that the exemption be expanded to “primarily noncommercial videos.”
  • Wireless Device Exemptions (Classes 11-17)
    • The exemption does not apply to new phones, and does not apply to devices embedded in motor vehicles.
    • Extension of exemptions to “consumer machines,” such as smart meters, appliances, and precision-guided commercial equipment, was rejected.
    • Jailbreaking exemptions were not extended to devices dedicated to one type of media (e-book readers, handheld video game consoles) or computer systems embedded in automobiles.
  • Security Research Exemptions (Classes 22, 25, and 27A)
    • The Register rejected a request to extend the exemption to all systems and devices, finding that risks to industrial systems (e.g., highly sensitive systems such as for nuclear power plants and air traffic control) was too risky. The exemptions were limited to consumer-oriented devices and machines.
    • Research into security in medical devices is also not allowed.
    • The exemptions also tightly define “good faith security research.” Although the findings do not need to be reported to the manufacturer or system developer, the research must be carried out in a controlled environment to avoid harm to individuals or the public, and must be used primarily to promote security or safety.
  • Video Game Exemptions (Classes 19 and 23)
    • The exemptions do not extend to enabling multiplayer play and do not allow jailbreaking of console software, which is strongly associated with video game piracy (although jailbreaking consoles is allowed for preservationists when necessary to maintain a game in playable form).
  • 3-D Printer Exemptions (Class 26)
    • The exemption does not extend to any commercial use that is subject to any legal, regulatory, or other certification process, or where the circumvention is otherwise unlawful.
  • Medical Device Exemptions (Class 27A)
    • As with vehicle software, the exemption expressly forbids third parties from performing the circumvention on behalf of a patient.
  • Space-Shifting and Format-Shifting Exemptions (Classes 8 and 10)
    • These classes related to DVDs, Blu-ray discs, downloaded files, and dedicated e-book readers, seeking the ability to circumvent TPM to make backup copies or to allow play on different operating systems. The Register found there was a reluctance on the part of courts to extend fair use broadly to space-shifting arguments, and therefore found insufficient fair use justification for the proposed classes.
  • Music Recording Software (Class 24)
    • This class related to discontinued music-recording software and presumably sought circumvention to enable access to lawfully recorded music. However, no evidence was submitted in further support of this class, and the class was therefore rejected by the Register.