Substantial Similarity

The 09 f9 story is practically geriatric in internet age, but after reading Fred’s legal primer and Ed’s reductio, I had a couple of thoughts.

First, does the posting of a key really violate 1201? And if so, which part?

Section 1201(a)(2) provides:¹

No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that—

(A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;

(B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or

(C) is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.

Is a key like 09 f9 a “technology, product, service, device, component, or part thereof”? Reasonable minds could differ, but I think a key itself is best considered a “part thereof” for section 1201 purposes. If so, do the disjunctive tests for 1201 violations apply to the “part” itself or do they apply to the technology, product or device of which the “part” is, well, a part? The consequences of this distinction could be important.

If 1201 is violated by trafficking in a “part” of a device, where the device was designed or produced to circumvent but the “part” itself was not, things look bad for the 09 f9ers under 1201(a)(2)(A). But if the DMCA requires that the part itself must have been designed or produced to circumvent, there is a solid argument that, at least under sub-paragraph (A), no violation has occurred. After all, the key was neither designed nor produced to circumvent, but rather to control access. Similar logic would apply to sub-paragraph (B). 09 f9 certainly has, or at least had, a commercially significant purpose other than circumvention. But it’s not all good news for the 09 f9 crowd, this sort of thinly sliced statutory interpretation is unlikely to get anyone out of subparagraph (C). But other more fact-sensitive defenses could apply there.

The second question: which of these interpretations should we favor? Ed’s key generator points to one good reason to focus on the component itself. Theoretically, we could run out of numbers in a land grab for keys. Maybe the eventual monopolization of 128-bit integers doesn’t strike you as a cause for concern. But let’s consider, as a thought experiment, the implications of a somewhat unlikely shift in DRM technology. Assume a content owner adopts a string of text, one undoubtedly in the public domain, as its key. To take the most obvious example:

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.²

Assume this text qua key is incorporated into a technology or device that satisfies sub-paragraphs (A) or (B). If we consider only whether the technology that incorporates the part violates (A) or (B), distribution of the text would violate the DMCA. But if we take the part-centric view, anyone is free to continue to distribute this bit of text, so long as its not advertised for its usefulness in circumvention. This interpretation should go a long way towards allaying some, but certainly not all, of the concerns raised by 09 f9.

1. The text of 1201(b) sets out an equivalent test for copy controls. The occasionally nonsensical line drawing between access and copy controls is a topic for another day. [↩]
2. Granted, it’s not a particularly strong key, but that hasn’t stopped any DRM system yet. [↩]