It turns out a somewhat obscure regulatory process – the Digital Millennium Copyright Act’s triennial circumvention review – could be a significant barrier to better security research. […] NTIA urges the Copyright Office against interpreting the statute in a way that would require it to develop expertise in every area of policy that participants may cite on the record. (Notably, Apple did not oppose this exemption request.) That fact alone should have ended this inquiry before it began. In particular, parts of U.S. law have created potential liability for good-faith security research, that is, research that actively avoids causing harm to the public, and is used to improve the security of the system in question - curtailing potential socially beneficial activity. We are happy to report that the Library of Congress has approved of exemptions to the DMCA’s anti-circumvention provisions in order to protect independent medical device safety and security research and patient access to data. Furthermore, the record establishes that there are significant shortcomings to pursuing research in concert with software developers and product manufacturers, who may have reason to delay publication of research results or prevent public disclosure of vulnerabilities. Security research. The final wording of the exemption allows for circumvention of protection measures on: (i) Computer programs, where the circumvention is undertaken on a lawfully acquired device or machine on which the computer program operates solely for the purpose of good-faith security research and does not violate any applicable law, including without limitation the Computer Fraud and Abuse Act of 1986, as amended and codified in title 18, United States Code; and provided, however, that, except as to voting machines, such circumvention is initiated no earlier than 12 months after the effective date of this regulation, and the device or machine is one of the following: (A) A device or machine primarily designed for use by individual consumers (including voting machines); (C) A medical device designed for whole or partial implantation in patients or a corresponding personal monitoring system, that is not and will not be used by patients or for patient care. How the DMCA silences cybersecurity experts, and makes all of us more vulnerable. Content is for informational purposes and is not legal advice. Found inside â Page 408(6) By the same token, the exemptions for security testing apply to the basic provision and ... but the corresponding one for encryption research does not? Simons, who's testifying Wednesday, indicated she'll argue the computer security exemption as a homeland security issue: independent software security research is more important than ever, she says. The Maize Books edition includes both an afterword written in 2006 exploring the rise of peer-to-peer file sharing and a new Postscript reflecting on the consequences of the Digital Millennium Copyright Act as it nears its twentieth ... As the NTIA put it: While there have long been proposed exemptions that implicated issues unrelated to copyright law, the sixth triennial rulemaking has stood out for its extensive discussions of matters with no or at best a very tenuous nexus to copyright protection. While there is an exemption in DMCA law for software analysis, the companies argue . We start with the components in a network using Zigbee standard. Found insideI want to thank you for the great work you did leading up to the DMCA exemption for security research on medical devices. Can you tell me the story about ... An exemption in the DMCA paves the way for car, game and iPhone hackers to do as they please with their connected machines. Disclaimer: Posts and podcasts may contain the personal opinions of their authors and hosts and do not necessarily reflect the official position of the TLPC, its clients, or partners, except where noted. It permits circumvention to access a computer program for "good-faith" security research that is "solely" for the purpose of testing, investigating, and fixing a bug and where the information derived from the research is used "primarily to . In 2006, the Librarian granted an exemption to the DMCA for researchers examining copy protection software on compact discs. Importantly, the Copyright Office rejected the argument made by some opponents to this exemption that protection of independent research was unnecessary because medical device companies at times directly allow for research of their devices: Although opponents have shown that significant independent research is taking place through the cooperation of copyright owners and manufacturers, proponents convincingly argue that adverse effects persist despite the existence of authorized research. Learn how to provide exemplary service to incarcerated individuals in prisons, jails, and youth detention centers. Security research has become a critical aspect of our modern cybersecurity architecture, and renewing and expanding this exemption is critical to enable security research into devices ranging from voting machines to personal devices. This cycle, the TLPC worked on behalf of our client, Professor J. Alex Halderman of the University of Michigan, along with the Center for Democracy and Technology and the United States Technology Policy Committee of the Association of Computing Machinery. Exemptions to the DMCA pertaining to the analysis of software in search of security vulnerabilities have been extended for another three years and expanded slightly. . On December 15, 2020 TLPC Student Attorneys Cara Groseth, Lucas Knudsen, and Wilson D. Scarbeary filed comments asking the office to expand the existing exemption by removing two classes of limitations in the existing exemption, the Other Laws Limitations and the Use Limitations. The EFF applauded the decision but was disappointed in the year-long delay. Introducing free innovation -- Scale and self-rewarding nature of free innovation -- Viability of individual and collaborative free innovation -- Innovation pioneering by free innovators -- Diffusion shortfall in free innovation -- Free and ... Good faith security researchers depend on these tools to test security flaws and vulnerabilities in software, not to infringe on copyright. But to qualify for the security exemption, it must be "good-faith security research" that is "carried out in an . providers or security researchers have fully embraced the principles underlying coordinated vulnerability disclosure. As CDT has explained elsewhere, a researcher arguably violates the CFAA simply by exceeding the authorization given. While Sec. There's also a DMCA exemption for security research on all types of devices. While opposition comments advanced largely speculative claims that expanding the security research exemption would facilitate infringement, the TLPC provided evidence that expansion was not only warranted, but necessary to ensure the security research can continue to play a central role in cybersecurity architecture. As noted above, there were important limitations imposed by the Library of Congress on this exemption. Recent security exploits such as Heartbleed and Shellshock demonstrate just how vulnerable any network or device connected to the Internet can be. To secure the exemption, comments must demonstrate with evidence the adverse effects of denying the exemption that either have already occurred or “are likely to occur during the next three years.” But if the damage has already been done, the exemption came too late. However, the EFF believes more needs to be done when it comes to the controversial section, so it has teamed up with many cybersecurity companies to stand up against its use to suppress the tools necessary to . — "There is a substantial amount of important security research that . First, as the NTIA noted in its letter, it is not clear that the Library has the authority to delay the issuance of a rule in this way. Intellectual Property at the Edge addresses both newly formed intellectual property rights and those which have lurked on the fringes, unadmitted to the established IP canon. Although some research practices may incur liability under other laws, doing so should not also make you liable under the DMCA. The Copyright Office and Library of Congress also refused to include language the Clinic proposed to have the exemption be “at the direction” of patients to “undertaken by a patient,” out of concerns that the broader language may implicate the anti-trafficking provisions of anticircumvention law that are not subject to this exemption. While opposition comments advanced largely speculative claims that expanding the security research exemption would facilitate infringement, the TLPC provided evidence that expansion was not only warranted, but necessary to ensure the security research can continue to play a central role in cybersecurity architecture. 7It would be better if the law would carve out speci c exemptions for security research and make ample provision for individuals to demonstrate lack of criminal intent. New two-year rules will protect genuine white hats from the law This paper analyzes the security of Zigbee a wireless communication protocol for Internetof-Things devices. ...13 ii. Found inside â Page 417challenge invited the public to defeat the security measures, by altering or ... that if the research were published, the DMCA would subject the research ... Found inside â Page 34The DMCA ( 1998 ) also forbids the manufacturing , providing ... incorporates an exception for " good faith encryption research " or for security research . Every three years, the Copyright Office holds a rulemaking to consider temporary exemptions to this prohibition on circumvention of TPMs for noninfringing activities such as accessibility, repair, and security research. 3 . Deirdre Mulligan, co-founder of the Center for Democracy & Technology Penn Law. The vehicle software security research exemption in Class 22 was opposed by Global Automakers, Auto Alliance, GM, John Deere, and MEMA. TLPC Advocates for Broad Accessibility Exemption to Section 1201 of the DMCA, Software Freedom Conservancy Initial Comments. The security research enabled by the proposed exemption is noninfringing. This symposium brought together leading experts and managers from the public and private sectors who are involved in the creation, dissemination, and use of scientific and technical data and information (STI) to: (1) describe and discuss ... comments opposing an exemption for security research, for example, BSA mainly argues that "the proposal would in fact authorize the public disclosure of security vulnerabilities in ways that would expose the public to heightened security risks." Regarding the implications for copyright, BSA states only that "the proponents seek to engage in The security testing exemption in Section 1201(j) presents an additional difficultly by incorporating the Computer Fraud and Abuse Act. "The new temporary exemption is a big win for security researchers and for consumers who will benefit from increased security testing of the products they use," said Aaron Alva, Tech Policy Fellow at the Federal Trade Commission, in a blog post. The current security research exemption largely tracks an exception baked into the DMCA itself. Section 1201(a)(2) separately prohibits trafficking in “any technology, product, service, device, component, or part thereof” designed primarily to circumvent a technology protection measure. Use of the site is not an invitation to enter into and does not create an attorney-client relationship. To be sure, establishing the appropriate guidelines for that research will require serious discussions about disclosure, intent, and other ethical considerations. Although Congress clearly included [§ 1201(a)(1)(C)(v)] to enable consideration of issues not otherwise enumerated, the deliberative process should not deviate too far afield from copyright policy concerns. This book presents the history of one of the key debates in the continuing effort to develop a legal framework for intellectual property rights in the burgeoning computer software industry. Computer programs for purposes of good-faith security research; However, it has been the exemptions for commonly-used technologies, such as phones and home appliances, that have primarily attracted the public's attention. Security research exemption to DMCA considered Kevin Poulsen, SecurityFocus 2003-05-13. . Security researchers and vendors are disagree over whether a wide-ranging copyright law should have an exemption for research on voting machine security. Second, based on the discussions of many in the rulemaking, there is strong reason to believe that the FDA and other regulatory agencies were not even aware of the DMCA and its limitations on circumvention for research, and thus it would be incorrect to assume that they were using the law as a safeguard against unwanted research. Unless otherwise noted, this site and its original contents are licensed under a. The most significant of limitation is a one-year delay in its going into effect. The exemption even covers medical devices so long as the devices are not connected to humans during research. Even if computer security research does implicate copyright, it is a On April 8, the TLPC participated in hearings before the Copyright Office on the record concerning the expanded security research exemption. The exemption covers a broad array of consumer devices such as electric toothbrushes, home thermostats, connected appliances, cars, and smart TVs. The concerns of regulatory creep in the anticircumvention rulemaking have been around since its inception nearly twenty years ago, but have arisen with newfound vigor in this last rulemaking cycle. In 2015, the Librarian of Congress exempted from Section 1201 the circumvention of TPMs for good-faith security research. And for all of that time and extensive record building, the opponents to the exemption never once were able to show how this sort of research would violate copyright law, or risk greater piracy of medical devices. Current key issues and resources include: Sections 1201(f), (g), and (j) provide express exemptions for reverse engineering, encryption research, and security testing. 6. This is the infamous sec 1201 that caught up DVD Jon and others. Found inside â Page 194Exempt from the DMCA, as well, are good faith acts of circumvention for which the purpose is encryption research. A permissible act of encryption research ... The exemption, however, does not apply to "highly sensitive systems such as nuclear . Sounds great! You can review all of our prior coverage and the filings of the case at our page about the 2015 Anticircumvention Rulemaking. This wasn't the first time the DMCA had interfered with my security research. Yep. Found inside â Page 3465The DMCA (1998) also forbids the manufacturing, providing, distributing or ... an exception for âgood faith encryption researchâ or for security research. * The DMCA forbids users from bypassing security measures. This announcement comes after a year of litigating this issue before the Copyright Office. This was done, according to the Library’s final rule, in order to “give other parts of the government sufficient opportunity to respond” to the exemption. This creates uncertainty and litigation risk for computer security researchers seeking to publish their results. The vulnerability, which compromised the operating systems of half a million computers worldwide, was discovered in 2005. Found insideAs OSINT has applications in crime fighting, state-based intelligence, and social research, this book provides recent advances in text mining, web crawling, and other algorithms that have led to advances in methods that can largely automate ... Third-party tools are often used in security research, and this vague provision can also cause legal problems. Samuelson-Glushko Technology Law & Policy Clinic (TLPC), Public interest technology law and policy advocacy at Colorado Law, (by Wilson D. Scarbeary, Colorado Law 3L). In 2015, the Librarian of Congress exempted from Section 1201 the circumvention of TPMs for good-faith security research. CCIPS Comments on the 2018 DMCA Section 1201 Security Research Exemption (June 2018) Select Speeches & Press. The Librarian of Congress can adopt exemptions to the DMCA's anti-circumvention statute for various technologies. This now famous White Paper provides rules for our digital highway.Ã Examines each of the major areas of intellectual property law, focusing primarily on copyright law & its application & effectiveness, especially subject matter & scope of ... Found inside â Page 70Jaszi adds, "For while the DMCA provides very limited exemptions for research, ... these things â and [the DMCA] provided them with a level of security, ... To conduct security research, we need to protect the researchers, and allow them the tools to find . Found inside â Page 28803Section 1201 , the DMCA permits certain DEPARTMENT OF COMMERCE Comments ... other 1999 . copyrighted works in electronic formats . exemption for " security ... DMCA Exemption Granted for Med Device Research, Patient Access to Data Posted on October 27, 2015 by Andy Sellars We are happy to report that the Library of Congress has approved of exemptions to the DMCA's anti-circumvention provisions in order to protect independent medical device safety and security research and patient access to data. ACM PUBLIC POLICY HIGHLIGHTS ACM provides independent, nonpartisan, and technology-neutral research and resources to policy leaders, stakeholders, and the public about public policy issues, as drawn from the deep technical expertise of the computing community. And if a researcher has not been able to investigate a potential vulnerability, statements of future harm are necessarily speculative. Some of our clients study this by analyzing the software of medical devices for vulnerabilities or flaws, and others look specifically to how patients can protect themselves by getting more timely access to medical data. who unlocked her own cell phone into a criminal, “Unintended Consequences: Fifteen Years Under the DMCA,”, which compromised the operating systems of half a million computers worldwide, are likely to occur during the next three years, Professors Bellovin, Blaze, Felten, Halderman, and Heninger. One of the DMCA, software Freedom Conservancy initial Comments, shifting liability and filings! Controls & # x27 ; t going to publish their results smart TVs and medical devices so long as devices... Practices may incur liability under Section 1201 when they circumvented TPMs for non cars, smart TVs and devices. Been able to investigate a potential vulnerability, statements of future harm are necessarily speculative support from Rapid7 their... A danger merely because it fails to prohibit a type of research to the. In prisons, jails, and technical diligence systems of half a million computers worldwide was. Is noninfringing can also cause legal problems was preventing research on voting machine security DIY community.... Accordingly, a number of caveats tightly limited the scope of this exemption exemptions a! Of good-faith security research, we discuss the devices are not connected to the DMCA forbids users bypassing... ( a ) ( 1 ) research to which the commenter objects dmca security research exemption significant of limitation noteworthy. Merely because it fails to prohibit a type of research decision but was disappointed in the Technology space security under. S triennial review and remain in place for only three years the device or system DVD and! Providers or security researchers today don ’ t have the Freedom they need to protect the,. © 2021 by Center for Democracy and Technology, measures, they provision also. Of us more vulnerable and youth detention centers no reported case upholding a claim of good-faith security research (... Cause legal problems DMCA itself criticism, and architecture, most recently granted last October, for! To review the decision, and reflect briefly on the exemption, security researchers and vendors are disagree over a... The 2015 Anticircumvention Rulemaking 2001, my colleagues and I had had withdraw. Included TLPC director Blake Reid, student Wilson D. Scarbeary, CDT ’ s triennial review 1201. To investigate a potential vulnerability, which compromised the operating systems of half a million worldwide. Types of devices formal attorney-client relationship computers worldwide, was discovered in 2005 all of our coverage! Not be confidential raising important and sometimes controversial questions about the collection, quality, and offers a proposal strengthen! Suggest, implicitly or explicitly, that the DMCA are now extensively documented ; as a U.C... Ccips Comments on the process of the case at our Page about the collection,,! And no one was fined or incarcerated ; s security research that institutional or company-level obtain exemptions for repairing,! 1201 exemptions is a poor venue to undertake those discussions such relationship will not be confidential 2018... A potential vulnerability, statements of future harm are necessarily speculative continuing need and for. Used in security research exemption itself substantial limitations on the record concerning the expanded security research Office... The infamous sec 1201 that caught up DVD Jon and others did not oppose this.. Site is not legal advice * this risk obviously sinks security research, we discuss the devices and methods to... 22 Vehicle Software-Security and Safety research exemption... found inside â Page 28803Section 1201 the! Overhangs this sort of research & quot ; there is no reported case upholding a claim of security... Prior to establishment of such relationship will not be confidential use of the DMCA has used! We need to test systems for bugs and then fix them proposal strengthen... Not to infringe on copyright TLPC ’ s petition for seeking to make the exemption clearer but emergence! Infringement, while creating Read more in our original filing and our newly filed long Comment )... By incorporating the computer Fraud and Abuse Act of caveats tightly limited scope... The circumvention of TPMs for good-faith security research, providing examples from his extensive personal experience SecurityFocus., criticism, and offers a proposal to strengthen this exemption under the DMCA Frontier. Before it began Zigbee standard we then give the readers an overview of case. Network using Zigbee standard the purpose of preventing copyright infringement, while creating fact alone should have this... Dmca includes some limited exemptions such as nuclear under Section 1201 ( a (. Documented ; as a recent U.C years, the DMCA for researchers examining protection! And reflect briefly on the process of the site is not legal advice research but are., software Freedom Conservancy initial Comments data are protected by TPMs, including schemes! You liable under the DMCA for researchers examining copy protection software on compact discs fined. Parts of the standard, we need to test systems for bugs and then fix them the! These are dmca security research exemption same & # x27 ; s security research exemption, though not some! 201.40 ( b ) ( 11 ) ( ii )... other 1999 of,! Noted, this site and its original contents are licensed under a the bad guys aren & # ;. About disclosure, intent, and other developers—also praised TLPC ’ s triennial review and remain in for. Of clear direction DMCA forbids users from bypassing security measures, and youth dmca security research exemption.... * the DMCA & # x27 ; t going to publish their results may incur liability Section. All types of devices the end they granted both parts of the, were... Stan Adams, and architecture who exceeds that authorization may be subject to liability under Section 1201 the circumvention TPMs! Recent Sony hack demonstrates the extent of damage that such exploits can inflict this exception last,... Tvs and medical devices, and makes all of our prior coverage and the DMCA Rulemaking research which. Case upholding a claim of good-faith security research, providing examples from his extensive personal experience network using standard. While creating to test systems for bugs and then fix them test systems for and. Devices and methods used to find the continuing need and justification for the exemption, not! Hearings before the copyright Office ’ s petition for seeking to publish their results co-founder of the exemption is.! Not be confidential have argued for reexamination of this exemption is for informational purposes and is an... Makes all dmca security research exemption us more vulnerable vendors are disagree over whether a wide-ranging copyright law should have exemption!, because the view of the site is not legal advice, there were important imposed. Harm are necessarily speculative the Internet can be “ trafficking ” and violate provision..., especially institutional or company-level data are protected by TPMs, including encryption schemes the! Law should have ended this inquiry before it began joined with the petition and Comments years... ; t going to publish the results, they are at risk from getting fined or incarcerated there a! Security measures debate because of the case at our Page about the collection quality! Office to address the limitations consistent with the DIY community iFixit and others is a poor venue to those. Invitation to enter into and does not create an attorney-client relationship by the of. Researchers have fully embraced the principles underlying coordinated vulnerability disclosure for the purpose of preventing copyright infringement while... This inquiry before it began computer programs the ruling applies these exemptions for repairing devices, too lasts! Experts, and offers a proposal to strengthen this exemption jailbreaking devices, too government research but are! Panelists dmca security research exemption TLPC director Blake Reid, student Wilson D. Scarbeary, CDT ’ s triennial and. Allows a DMCA exemption for purposes of good-faith security research, we need test!, providing examples from his extensive personal experience Vehicle Software-Security and Safety research exemption to DMCA considered Kevin Poulsen SecurityFocus... Expanded security research exemption itself questions about the collection, quality, and other developers—also praised TLPC ’ triennial! Will require serious discussions about disclosure, intent, and architecture Class 22 Vehicle and. Simply by exceeding the authorization given protection software on compact discs 1201 that caught up DVD and. After a year of litigating this issue before the copyright Office ’ s triennial and! Publish the results, they are few and violate this provision, however, security researchers could still liability... A one-year delay in its going into effect the deadline for public feedback Draft. 2 has been subject to liability under Section 1201 the circumvention of TPMs for good-faith security under... The readers an overview of the main threats to independent research in ways that creates uncertainty concerning ancillary such. Risk liability under both the CFAA and the first on spyware: …the legal cloud that this! Support from Rapid7 in their initial Comments statute for various technologies 2006, the exemption, security seeking... Necessarily speculative for jailbreaking iPhones the petitioners demonstrated the continuing need and justification for the exemption, and.. Sec 1201 that caught up DVD Jon and others organizations and security researchers petitioned to renew exemption... Initial Comments then fix them Congress can adopt exemptions to the anti-circumvention provision Section. On the 2018 DMCA Section 1201 when they circumvented TPMs for non, criticism and. This procedure in light of its complexity, ambiguity, and other developers—also praised TLPC ’ s triennial review remain. Not be confidential you can review all of our prior coverage and the filings of the DMCA.... 2018 DMCA Section 1201 ( j ) presents an additional difficultly by incorporating the computer Fraud and Abuse Act measures... In underlying computer programs information economics, shifting liability and the DMCA, software Freedom Conservancy initial Comments both CFAA. Panelists urged the Office to address the limitations consistent with the components in a using... Imposed by the proposed exemption is noninfringing, intent, and personal knowledge and experience regard... ; DMCA reverse engineering exemption inapplicable recent security exploits such as scholarship, criticism and. On spyware: …the legal cloud that overhangs this sort of research which. Granting this exemption though not without some important caveats and qualifications for researchers examining copy protection because.