August 9, 1999
Office of Chief Counsel
National Telecommunications and Information Administration (NTIA)
Room 4713, U.S. Department of Commerce
14th Street and Constitution Avenue, N.W.
Washington, D.C. 20230
Office of Policy and International Affairs
U.S. Copyright Office, Copyright GC/I&R
P.O. Box 70400, Southwest Station
Washington, D.C. 20024
Re: Notice Number: RIN 0660-ZA09
Docket Number: 990428110-9110-01
Request for Comments on Section 1201(g)
of the Digital Millennium Copyright Act (DMCA)
Dear Sir or Madam:
I am writing on behalf of the Electronic Frontier Foundation (EFF) in response to the Request for Comments on Section 1201(g) of the Digital Millennium Copyright Act (DMCA). EFF is a privately funded, nonprofit organization concerned with protecting civil liberties and promoting responsible behavior in the electronic world. We would like to thank you for allowing us the opportunity to comment on the effects of the anti-circumvention provisions of the DMCA on encryption research and the development of encryption technology.
As a civil liberties organization, EFF is very concerned with the effects of the anti-circumvention provisions on encryption research and technology. For nearly a decade, EFF has been the global thought leader on the legal and societal implications of encryption research and technology. Most recently, in May 1999, the EFF successfully challenged the U.S. government's encryption export restrictions as an unconstitutional violation of free speech in the U.S. Court of Appeals for the Ninth Circuit. (Bernstein v. U.S. Dept. of Justice, Case No. 97-16686). Encryption research and technology are imperative to the security and advancement of society. As a respected scientific inquiry, encryption is used to permit quick response to viruses and other harmful code. It also allows companies to make their software products compatible with other products and is necessary to learn weaknesses in encryption code so it can be made stronger and more secure.
We believe the anti-circumvention provisions of DMCA will have a harmful effect on encryption research and technology in the U.S. Rather than address the specific concerns of WIPO, DMCA places a broad ban on both the act of circumvention and the devices and technology that enable its use with only limited exceptions. The DMCA provides a narrow definition of what activity constitutes acceptable encryption research under the statute. In so doing, it will restrict scientists' and other professionals' ability to engage in lawful encryption research. Because there are far more legitimate techniques to circumvent a technical protection system for encryption research than the DMCA expressly recognizes, the overly broad restrictions threaten a deleterious effect to the individuals and businesses who engage in and rely upon such lawful activity. While the DMCA provides a narrow exemption for the act of encryption research, the privilege is hollow because it fails to exempt the tools required to perform such research. The legislation exempts the access tools, but not the copy-control tools, despite the fact that encryption research would often require both components in order to be effective. In order to have any real meaning, the statute must also enable the implementation of the exceptions and limitations on the circumvention ban. Unless the anti-device provisions of the DMCA are narrowed, they will likely cause harmful effects on competition and innovation in the information and high technology sectors, including encryption technology and research. Also, such ambiguous and overly broad prohibitions will surely open the floodgates of litigation.
In addition to modifying the anti-device provisions to allow people to properly exercise encryption research, the DMCA should provide for more regular periodic interagency review of the effects on encryption research and technology brought about by creating new norms. In light of the considerable breadth of these digital norms and their unprecedented character, their potential impact on encryption technology is immense. The Clinton Administration endorses periodic interagency review of the effects of similar legislative initiatives affecting rights in the digital economy, such as database legislation. Such review following the law's implementation becomes crucial, considering the limited understanding of future digital environments and the evolving markets for information. It may well take some time before the impact on the anti-circumvention provisions can adequately be felt and communicated by the encryption technology and research sectors. Such post-implementation periodic interagency review would be consistent with other emerging technology and digital economy laws and would ensure the most beneficial arrangement for society.
Thus, the EFF believes that the anti-circumvention exemption for encryption research in the DMCA is far too narrow to cover all legitimate methods. As a result, it threatens to impair the ability to lawfully perform research and cripple the industry. The narrow exemption for encryption research that is provided in the statute fails to guarantee that the tools for enabling the implementation will be available, rendering the exemption on circumvention virtually meaningless. The provision should be modified to include the tools necessary to effectuate the right to perform encryption research to mitigate the ban's harmful effect on the industry. Additionally, periodic interagency review appropriate to study the ban's impact must be recognized and yielded to, given the unprecedented nature of the anti-circumvention regulations. In summary, the anti-circumvention provisions of DMCA could well prove injurious to the well-being of society's ability to conduct legitimate encryption research. It also threatens to cripple a fledgling industry that is crucial to a healthy digital economy.
Combining the low level of proof needed to maintain an action for anti-circumvention violations with the substantial remedies in the legislation, including criminal sanctions, the DMCA will surely prohibit lawful and legitimate behavior that is necessary to advance knowledge and advancement in the cryptographic sciences. For these reasons, we encourage you to convey to Congress the problems with the anti-circumvention ban as it relates to encryption research and technology with the recommendations mentioned here in mind.
Thank you for your attention to our concerns on the impact of the DMCA. Please do not hesitate to contact me at 415.436.9333 or robin@eff.org if you would like to discuss our concerns further, or if I can provide any additional information or comment.
Very truly yours,
Robin D. Gross
Staff Attorney
The Electronic Frontier Foundation