28 January 2001. Thanks to Arnold Reinhold.

See related case files:

http://www.eff.org/pub/Intellectual_property/Video/
http://www.2600.com/dvd/docs
http://cryptome.org/cryptout.htm#DVD-DeCSS

UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT

Docket No. [s] : 00-9185

------------------------------------------------------ ----

UNIVERSAL CITY STUDIOS, INC., PARAMOUNT PICTURES
CORPORATION, METRO-GOLDWYN-MAYER STUDIOS INC., TRISTAR
PICTURES, INC., COLUMBIA PICTURES INDUSTRIES, INC., TIME
WARNER ENTERTAINMENT COMPANY, L.P., DISNEY ENTERPRISES
INC., TWENTIETH CENTURY FOX FILM CORPORATION,

Plaintiff - Appellees,

v.

ERIC CORLEY, also known as Emmanuel Goldstein and 2600
ENTERPRISES Inc.,

Defendant - Appellants,

SHAWN C. REIMERDES, ROMAN KAZAN,

Defendants.

------------------------------------------------------ ----

On Appeal From a Judgement of the United States District Court for the Southern District of New York

BRIEF AMICUS CURIAE OF ARNOLD G. REINHOLD, AN AUTHOR AND CRYPTOGRAPHER, IN SUPPORT OF DEFENDANT-APPELLANT 2600 ENTERPRISES

Arnold G. Reinhold
14 Fresh Pond Place
Cambridge, MA 02138
617-491-4937
Representing himself.

Table Of Authorities 1

Interest Of The Amicus Curiae 2

Argument 3

Conclusion 8

17 USC 102(a) 3

17 USC 106 5

17 USC 1201(a) 3, 4, 5

17 USC 1201(b) 5

17 USC 1201(g) 4, 6, 7, 8

17 USC 1203(b) 7

Chicago v. Morales, 527 U.S. 41 (1999) 6

Forsyth County v. Nationalist Movement, 505 U.S. 123 (1992) 2

Riley v National Federation of the Blind 487 U.S. 781 (1988) 6

Sable Communications of Cal., Inc. v. FCC, 492 U.S. 115, 126 (1989) 4

Shuttlesworth v. Birmingham, 394 U.S. 147, 150–151 (1969) 7

U.S. v Playboy, 529 U.S. ___ (2000) No. 98-1682 7

I am a cryptographer and author who writes about the Internet and cryptography and who fears that the Digital Millennium Copyright Act (DMCA, USC 17 Ch. 12) will sharply and unreasonably limit my freedom to inquire and publish. The books that I co-authored include "The Internet for Dummies Quick Reference" and "E-mail for Dummies," both of which include chapters on cryptography. I also wrote the cryptography sections of "Internet Secrets" and "More Internet for Dummies." In addition, I created and maintain two World Wide Web sites on cryptography: www.diceware.com and ciphersaber.gurus.com. I am submitting this amicus brief on my own behalf. I am in no way speaking for my publishers.

I base my request to be heard on the U.S. Supreme Court's holding in Forsyth County v. Nationalist Movement, 505 U.S. 123 (1992):

"It is well established that, in the area of freedom of expression, an overbroad regulation may be subject to facial review and invalidation, even though its application in the case under consideration may be constitutionally unobjectionable. ... the very existence of some broadly written laws has the potential to chill the expressive activity of others not before the court."

As a cryptographer and author, I wish to come before the court and make clear the breadth of DCMA and just how chilling it is to my expressive activity.

I ask this court to hold that the district court erred by failing to declare the DCMA unconstitutional on its face as an overbroad and vague restriction on freedom of expression. The DCMA says:

"No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that - (A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title..." 17 USC 1201(a)(2).

However, almost any work written today is protected from birth under Title 17. "Copyright protection subsists ... in original works of authorship fixed in any tangible medium of expression..." 17 USC 102(a). Since encryption systems convert works into a form unintelligible without a key, any encryption system arguably is a technological protection measure. Publishing negative results about any encryption system could thus be in violation of 1201(a)(2). While in the present case the defendant, 2600 Magazine, published a complete executable program for breaking CSS, a researcher publishing any information helpful to breaking an encryption system could be accused of providing a "technology, ... component, or part thereof," under 1201(a)(2)

Even methods for breaking antiquated ciphers could come under the shadow of this act. To "circumvent a technological measure" means

"to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner." 1201(a)(3)(A).

Perhaps Congress intended the law to apply only to specialized technologies used to protect movies and recorded music, but as written the law arguably covers far more. Anyone publishing encryption research results should fear this act.

"If a statute regulates speech based on its content, it must be narrowly tailored to promote a compelling Government interest." Sable Communications of Cal., Inc. v. FCC, 492 U.S. 115, 126 (1989).

The district court made no determination that a blanket ban on publishing cryptoanalytic research is needed to protect copyright owners. Common sense suggests that copyright owners will benefit in the long run from open inquiry on cryptography.

Section 1201(g) of the DCMA appears to exempt encryption research:

"(2) Permissible acts of encryption research. - Notwithstanding the provisions of subsection (a)(1)(A), it is not a violation of that subsection for a person to circumvent a technological measure as applied to a copy, phonorecord, performance, or display of a published work in the course of an act of good faith encryption research if... [Conditions A, B, C and D]"

and

"(4) Use of technological means for research activities. - Notwithstanding the provisions of subsection (a)(2), it is not a violation of that subsection for a person to -

(A) develop and employ technological means to circumvent a technological measure for the sole purpose of that person performing the acts of good faith encryption research described in paragraph (2); and

(B) provide the technological means to another person with whom he or she is working collaboratively for the purpose of conducting the acts of good faith encryption research described in paragraph (2) or for the purpose of having that other person verify his or her acts of good faith encryption research described in paragraph (2)."

However the 1201(g) exemption at most allows a researcher to perform acts of circumvention otherwise prohibited by 1201(a)(1)(A) and (a)(2), and to communicate with collaborators about methods otherwise bared under 1201(a)(2). No language in the act explicitly permits publishing the results of encryption research.

Furthermore, 1201(g) gives no safe harbor for 1201(b)(1) violations, which cover "circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner." An action that but for 1201(g) would have violated 1201(a)(2) by "circumventing a technological measure that effectively controls access to a work protected under this title," arguably will still violate 1201(b)(1), since gaining access facilitates activities protected under 17 USC 106, such as making copies in other formats or the creation of derived works.

To obtain the 1201(g) exemption, for whatever it may be worth, a cryptographer is required to make "a good faith effort to obtain authorization before the circumvention." 1201(g)(2)(C). In the likely event that the entity to whom this request is addressed objects to the research program, the cryptographer exposes himself to a chilling risk of preemptive legal action. Also such a requirement is a form of compelled speech.

"The First Amendment guarantees 'freedom of speech,' a term necessarily comprising the decision of both what to say and what not to say." Riley v National Federation of the Blind 487 U.S. 781 (1988)

In addition, any research exemption is subject to review based on a number of factors listed in 1201(g)(3). A cryptographer's right to inquire will be judged, in part, on whether his research results were disseminated. (g)(3)(A) Here dissemination is good, but in 1201(a)(2) providing is bad. What is the difference?

"Because the ordinance fails to give the ordinary citizen adequate notice of what is forbidden and what is permitted, it is impermissibly vague." Chicago v. Morales 527 U.S. 41 (1999).

The other 1201(g)(3) factors include a content-based test on the manner of dissemination:

"whether it was disseminated in a manner reasonably calculated to advance the state of knowledge or development of encryption technology, versus whether it was disseminated in a manner that facilitates infringement under this title......" (g)(3)(A),

a qualifications test:

"whether the person is engaged in a legitimate course of study, is employed, or is appropriately trained or experienced in the field of encryption technology" (g)(3)(B),

and another compelled-speech notice requirement:

"whether the person provides the copyright owner of the work to which the technological measure is applied with notice of the findings and documentation of the research, and the time when such notice is provided" (g)(3)(C).

As to the qualifications test:

"a law subjecting the exercise of First Amendment freedoms to the prior restraint of a license, without narrow, objective, and definite standards to guide the licensing authority, is unconstitutional." Shuttlesworth v. Birmingham, 394 U.S. 147, 150–151 (1969).

That these are "factors to be considered" 1201 (g)(3), rather than firm requirements, does not make them less objectionable.

"When the purpose and design of a statute is to regulate speech by reason of its content, special consideration or latitude is not accorded to the Government merely because the law can somehow be described as a burden rather than outright suppression." U.S. v Playboy, No. 98-1682.

"Factors" may well be worse than requirements. At least in a dictatorship one can submit one's work to the state censor and be told what is and what is not acceptable. Here review takes place after the fact and at great financial risk to the author. Indeed, any doubts about DCMA's potential to chill speech should be dispelled by 1203(b)(5), which says a court in "its discretion may award reasonable attorney's fees to the prevailing party." Making a researcher pay an MPAA-sized legal bill is the civil equivalent of capital punishment.

Under 1201(g) a cryptoanalytic researcher must run a gauntlet of unconstitutional requirements and even then he cannot find safe shelter, short of totally eviscerating his publications.

The DCMA, as interpreted by the district court, effectively grants to copyright holders broad censorship powers over all cryptoanalytic research, arming these private parties with both equity powers and the ability to assess massive attorney fees. Such a grant goes far beyond any demonstrated need to protect copyright holders. I urge this court to find the DMCA to be an unconstitutional abridgement of the freedom of speech.

Dated: January 23, 2001

Respectfully Submitted,

By: ____________________________

Arnold G. Reinhold
14 Fresh Pond Place
Cambridge, MA 02138
617-491-4937
617-864-3512 Fax
[email protected]