On October 28, 1998, President Bill Clinton signed Public Law 105-304, the Digital Millennium Copyright Act, a single statute that reads like two different laws because it was written as the settlement of two different fights. One fight was about locks. Copyright owners wanted the force of law behind the technological measures guarding digital works, so that defeating a lock would itself be a legal wrong rather than merely a step toward infringement. The other fight was about shelter. The companies carrying traffic and hosting user material on the early commercial internet wanted protection from crushing liability for infringements committed by their subscribers. Title I gave the first fight to the owners, writing anticircumvention rules into 17 U.S.C. 1201 through 1205. Title II gave the second fight to the intermediaries, writing conditional liability limits into 17 U.S.C. 512. Each side accepted the other’s title as the price of its own, which is why the statute carries the divided personality it has carried ever since.

The claim this article defends is the namable claim in plain form: two statutes in one title, the circumvention provisions and the safe harbor provisions serving opposite constituencies and sharing only a bill number. A reader who finishes here will be able to explain both halves of the bargain, describe the notice-and-takedown machinery that processes billions of removals a year, walk through the triennial exemption process that decides who may legally fix the devices they own, and account for the court decisions that drew the statute’s working boundaries, from the item-specific knowledge rule to the repeat infringer forfeiture. The sections that follow mirror the statute’s split, taking the locks first and the shields second, because only that structure keeps each half’s logic and each half’s constituency in view.

Passage and Statutory Identity

The Digital Millennium Copyright Act of 1998 arrived as a single public law carrying two different legislative bargains. Public Law 105-304, signed on October 28, 1998, amended title 17 of the United States Code to carry out American obligations under two international copyright treaties concluded two years earlier, and at the same time it wrote a new set of limits on the copyright liability of online service providers. The first half of the statute speaks to copyright owners who wanted legal backing for the technological locks placed on digital works. The second half speaks to the companies that carried traffic and hosted material on the early commercial internet, which wanted protection from crushing liability for infringements committed by their users. Those two halves serve opposite constituencies, and they share little beyond a bill number and an enactment date. The shape of the statute is the shape of the compromise that produced it.

The long title of the act states its formal purpose: to amend title 17, United States Code, to implement the World Intellectual Property Organization Copyright Treaty and the Performances and Phonograms Treaty, and for other purposes. It was enacted by the 105th Congress as H.R. 2281, became Public Law 105-304, and was printed at 112 Stat. 2860. President Bill Clinton signed it on October 28, 1998, and it took effect that day. The statute amended the Copyright Act of 1976, the comprehensive revision of American copyright law that had organized exclusive rights, limitations, and duration into the framework in use at the end of the twentieth century. Its short title, the Digital Millennium Copyright Act, is the name by which the five titles it contains are collectively known.

The international half of the story began in Geneva in December 1996. On December 20, 1996, a diplomatic conference convened under the auspices of the World Intellectual Property Organization adopted two treaties: the WIPO Copyright Treaty and the WIPO Performances and Phonograms Treaty. The treaties answered the spread of digital networks, which made it possible to copy and transmit works at negligible cost and across borders in seconds. Copyright owners argued that an enforcement model built around physical copies and territorial distribution could not hold in a networked environment. The treaties therefore asked member states to give legal force to the technological measures that owners used to protect works in digital form, so that defeating the lock would itself be a legal wrong and not merely a step toward infringement.

The treaty obligation at the center of the American legislation was the anti-circumvention requirement. Article 11 of the WIPO Copyright Treaty provides that contracting parties shall give adequate legal protection and effective legal remedies against the circumvention of effective technological measures used by authors in connection with the exercise of their treaty rights, where those measures restrict acts not authorized by the authors concerned or permitted by law. Article 18 of the Performances and Phonograms Treaty imposed a parallel duty for the benefit of performers and producers of phonograms. The two treaties also required remedies against the knowing removal or alteration of electronic rights management information, the data identifying a work, its author or owner, and the terms of authorized use. Together these provisions built a layered scheme: the work itself was protected by copyright, the technological lock on the work was protected by the anti-circumvention rule, and the identifying information attached to the work was protected against tampering. The treaties left each member state to choose the legislative form, and the American answer was Title I of the 1998 act.

The domestic legal setting into which the act arrived was defined by the Copyright Act of 1976. Section 106 of title 17 gives the copyright owner a defined bundle of exclusive rights, subject to the limitations stated in sections 107 through 122. The owner holds the exclusive rights to reproduce the work in copies or phonorecords, to prepare derivative works based on the work, to distribute copies or phonorecords to the public by sale or other transfer of ownership or by rental, lease, or lending, to perform the work publicly in the case of literary, musical, dramatic, and choreographic works, pantomimes, and motion pictures and other audiovisual works, and to display the work publicly in the case of those works plus pictorial, graphic, and sculptural works. Congress later added a sixth right, the right to perform sound recordings publicly by means of a digital audio transmission. Every new provision of the 1998 act presupposed this bundle: the anticircumvention rules protected the technological measures guarding these rights, and the service provider limits defined when intermediaries could be held responsible for the infringement of these rights by others.

Section 107 supplied the principal counterweight to those exclusive rights. It codified the doctrine of fair use, under which the use of a copyrighted work for purposes such as criticism, comment, news reporting, teaching, scholarship, or research is not an infringement. Courts weighed four factors: the purpose and character of the use, the nature of the copyrighted work, the amount and substantiality of the portion used, and the effect of the use on the potential market for the work. Fair use mattered to the 1998 legislation because the new anticircumvention prohibitions raised an immediate question about its reach. If defeating a technological lock was itself unlawful, persons with otherwise lawful purposes, such as scholars, journalists, or competitors studying a product, wanted to know whether the new law would close off conduct that section 107 had long permitted. Congress answered with a set of exceptions inside the anticircumvention title, and the tension between the two provisions has been litigated ever since.

Section 302 set the duration of copyright as it stood before 1998. For works created on or after January 1, 1978, protection ran for the life of the author and fifty years after the author’s death. For anonymous works, pseudonymous works, and works made for hire, the statute provided a fixed term of seventy-five years from publication. The 1998 act itself did not alter these terms. The extension of copyright duration to life plus seventy years came through separate legislation enacted the same year, the Sonny Bono Copyright Term Extension Act, and it should not be confused with the Digital Millennium Copyright Act even though the two laws are often discussed together. The 1998 act was concerned with the enforcement of rights in digital networks and with the liability of intermediaries, not with how long rights lasted.

The Supreme Court’s treatment of new copying technology framed the debate over secondary liability. In Sony Corp. of America v. Universal City Studios, Inc., 464 U.S. 417 (1984), the owners of copyrighted television programming sued the manufacturer of the Betamax videocassette recorder, arguing that Sony was contributorily liable for the unauthorized home taping done by purchasers of its machines. The Court declined to impose liability, holding that the sale of copying equipment does not constitute contributory infringement if the product is merely capable of substantial noninfringing uses. Time-shifting, the recording of a broadcast for later viewing, was itself fair use, and the machine plainly had lawful applications. The Sony rule thus gave technology makers a measure of shelter: a device with real lawful uses would not be condemned because some buyers used it to infringe. Copyright owners, by contrast, read the decision as a standing invitation to relitigate the balance with each new technology, and the internet presented the largest such test.

That test arrived in the federal courts in the middle of the 1990s, and the results unsettled everyone. In Religious Technology Center v. Netcom On-Line Communication Services, Inc., 907 F. Supp. 1361 (N.D. Cal. 1995), a district court considered whether an internet access provider could be held liable when a subscriber posted copyrighted works to a bulletin board that the provider carried. The court refused to hold the provider directly liable for copies made automatically as data moved through its system, reasoning that it made no sense to impose liability on parties whose only role was operating the machinery of the network. At the same time, the court left open contributory liability turning on the provider’s knowledge of the infringement, and it declined to resolve the provider’s fair use defense on summary judgment. The decision was only one district judge’s ruling, and other courts had reached harsher outcomes against bulletin board operators in the same period. Providers therefore faced an uncomfortable position: they were probably not direct infringers for the automatic functioning of their systems, they might be contributory infringers once warned, and no one could say in advance where the line fell. The resulting uncertainty supplied the political opening for Title II.

Two problems thus converged on Congress in 1997 and 1998. The content industries wanted the WIPO treaties implemented with strong protection for technological measures, so that digital locks would have legal teeth in the United States and American negotiators could press other countries to follow. The service provider industries, along with telephone companies, universities, and libraries, wanted a statutory rule that would let them operate networks and host user content without facing open-ended copyright exposure for the acts of subscribers. Neither side could get what it wanted without the other. The result was a single bill that gave each constituency its title and asked each to tolerate the other’s, which is why the statute reads as two laws stapled together rather than one law with a single theory.

The House vehicle was H.R. 2281, introduced on July 29, 1997, by Representative Howard Coble of North Carolina. The bill went to the House Committee on the Judiciary and the House Committee on Commerce, which each shaped the provisions within its jurisdiction, and the Committee on Ways and Means was discharged from further consideration in July 1998. On August 4, 1998, the House considered the bill under suspension of the rules, debated it for forty minutes, and passed it as amended by voice vote, with the title amended by unanimous consent and no recorded opposition. The Senate vehicle was S. 2037, the Digital Millennium Copyright Act of 1998, reported by the Senate Committee on the Judiciary as S. Rept. 105-190 and passed by the Senate in the spring of 1998. On September 17, 1998, the Senate took up H.R. 2281, struck all after the enacting clause, substituted the language of S. 2037 as amended, and passed the House bill in lieu of the Senate bill by unanimous consent. The Senate then asked for a conference to reconcile the two chambers’ versions.

The conference committee produced its report on October 8, 1998, and both chambers moved quickly. The Senate agreed to the conference report by unanimous consent on October 8, and the House agreed by voice vote on October 12. President Bill Clinton signed the enrolled bill on October 28, 1998, making it Public Law 105-304. The act therefore passed the 105th Congress with near-unanimous support: voice votes in the House, unanimous consent in the Senate, and every conferee signing the final report. That smooth passage should not be mistaken for an absence of conflict. The near unanimity reflected a negotiated truce between powerful industries, each of which had been assured that its core demands were protected in the final text, rather than a shared understanding of what the text would come to mean.

The statute’s table of contents shows the truce in structural form. It contains five titles, and the first two are the ones that define the act in public memory. Title I, the WIPO Copyright and Performances and Phonograms Treaties Implementation Act of 1998, added a new chapter 12 to title 17, codified at 17 U.S.C. 1201 through 1205. Section 103 of the act, the operative heart of the title, wrote the treaty obligations into domestic law through two linked prohibitions. Section 1201 bars the act of circumventing a technological measure that effectively controls access to a copyrighted work, and it separately bars trafficking in devices, products, or services primarily designed to defeat either access controls or the technological measures that protect the rights of the copyright owner. Section 1202 protects the integrity of copyright management information by barring its knowing removal or alteration and the distribution of works from which it has been stripped. Sections 1203 and 1204 supply civil remedies and criminal penalties, and section 1205 preserves existing defenses and rights. The title also carried a series of exceptions, for nonprofit libraries, reverse engineering to achieve interoperability, encryption research, protection of minors, personal privacy, and security testing, which marked the boundaries Congress drew around the new prohibitions.

Title II, the Online Copyright Infringement Liability Limitation Act, added 17 U.S.C. 512 and gave service providers the shelter they had sought since the Netcom era. It set out four categories of protected activity: transitory digital network communications, system caching, information residing on systems or networks at the direction of users, and information location tools such as directories and links. A provider that met the statutory conditions, including designating an agent to receive complaints, adopting and reasonably implementing a policy against repeat infringers, and accommodating standard technical measures, could not be held liable for monetary relief for infringement occurring through those functions. For material stored at a user’s direction, the title created the notice-and-takedown procedure by which copyright owners notify providers of claimed infringement and providers act expeditiously to remove or disable access to the material, with a counter-notification path for users who dispute the claim. The title expressly stated that providers had no general duty to monitor their networks for infringement. Where Title I gave owners a new weapon, Title II gave intermediaries a new shield.

The remaining three titles drew less attention but completed the legislative package. Title III, the Computer Maintenance Competition Assurance Act, amended section 117 to permit the owner or lessee of a computer to make copies of a program in the course of maintaining or repairing the machine, a narrow exception for independent service organizations. Title IV gathered miscellaneous provisions: amendments concerning ephemeral recordings, a directive on distance education, exemptions for libraries and archives, adjustments to the scope of exclusive rights in sound recordings, and provisions on the assumption of contractual obligations in transfers of motion picture rights. Title V, the Vessel Hull Design Protection Act, added chapter 13 to title 17, creating a sui generis form of protection for original designs of vessel hulls, codified at 17 U.S.C. 1301 through 1332. These titles show that the bill served as a vehicle for several unrelated copyright measures, but they do not change the act’s identity, which rests on the first two titles.

Congress also built a pressure valve into the anticircumvention title, and its history illustrates how the two halves of the bill shaped each other. The House Committee on Commerce, which shared jurisdiction over H.R. 2281 with the Judiciary Committee and reported the bill as H. Rept. 105-551, Part II, worried that a flat prohibition on defeating access controls would unjustifiably diminish lawful access to copyrighted materials. At its urging, section 1201(a)(1) created a recurring rulemaking: every three years, the Librarian of Congress, acting on the recommendation of the Register of Copyrights in consultation with the National Telecommunications and Information Administration, determines the classes of copyrighted works whose noninfringing uses are or are likely to be adversely affected by the prohibition, and exempts those classes for the succeeding three-year period. The Commerce Committee described the device as a fail-safe, a way to monitor the marketplace and selectively waive the prohibition where it threatened lawful uses the permanent exceptions did not reach. The prohibition on the act of circumventing access controls itself did not take effect until two years after enactment, so that the first rulemaking could run before the ban bit. The mechanism was a concession to the same constituencies, libraries, educators, researchers, and technology firms, that had demanded Title II, and it remains one of the statute’s most distinctive structural features.

The committee split that produced the rulemaking also explains the statute’s divided personality. The Judiciary Committees in both chambers owned the copyright core of the bill: the treaty implementation, the anticircumvention prohibitions, and the copyright management information protections. The Commerce Committee owned the communications and electronic commerce dimensions: the liability limits for service providers, the conditions attached to those limits, and the safeguards for lawful access. Each committee reported its portion, each constituency negotiated with the committee that understood its business, and the conference committee stitched the portions into a single enrolled bill. The result was not a unified theory of copyright in the digital age but a jurisdictional settlement, with each half bearing the imprint of the committee and the industry coalition that wrote it. Readers who find the statute internally contradictory are noticing this fact: it was drafted by two sets of hands answering to two sets of masters.

That identity is best stated as the article’s central claim: two statutes in one title, where the circumvention provisions and the safe harbor provisions serve opposite constituencies and share only a bill number. Title I arms copyright owners. It makes the defeat of technological locks actionable in itself, backs that prohibition with civil and criminal remedies, and guards the identifying information attached to works. Title II arms service providers. It limits their exposure for the infringements of others, conditions that protection on cooperation with copyright owners, and channels disputes into a private notice-and-takedown system rather than into courtrooms. Each constituency accepted the other’s title as the price of its own. The content industries took the safe harbors as the cost of legal protection for digital locks, and the provider industries took the anticircumvention rules as the cost of limits on liability. The article that follows is therefore organized to mirror the statute’s split, treating the two halves as distinct legislative acts that happen to have been enacted together, because only that structure keeps each half’s logic and each half’s constituency in view.

Two points of precision about Title I should be fixed at the outset, since they govern everything the later sections say about it. First, the act did not criminalize all circumvention. Criminal liability under 17 U.S.C. 1204 attaches only to a person who violates section 1201 or 1202 willfully and for purposes of commercial advantage or private financial gain, with stated fines and prison terms for first and subsequent offenses, and the criminal provision does not apply at all to nonprofit libraries, archives, educational institutions, or public broadcasting entities. Civil liability reaches further than criminal liability, and the statute’s exceptions further narrow what counts as a violation, so the common shorthand that the DMCA made breaking digital locks a crime overstates what Congress wrote. An act of circumvention can be civilly actionable without being criminal, and it can fall within an exception without being actionable at all.

Second, the act implemented treaty obligations rather than inventing them. The duty to provide adequate legal protection and effective legal remedies against circumvention came from Article 11 of the WIPO Copyright Treaty and Article 18 of the Performances and Phonograms Treaty, adopted in December 1996, and the parallel duty concerning rights management information came from the companion articles of the two treaties. Congress chose the American mechanism for carrying out those duties: the distinction between access controls and copy controls, the separate treatment of the act of circumvention and the trafficking in circumvention tools, the civil and criminal remedy scheme, and the catalog of exceptions. Other treaty members made different choices in their own implementing laws. The DMCA is therefore best understood not as the source of the international anti-circumvention norm but as the United States’ particular legislative translation of it, written to fit the preexisting structure of title 17 and the political bargain of 1998.

Seen as a whole, the Digital Millennium Copyright Act is a statute of passage and identity in equal measure. Its passage tells how two industries with opposing interests each won a title in the same bill, moving from H.R. 2281 and S. 2037 through voice votes and unanimous consent to the President’s signature on October 28, 1998. Its identity is that of a compromise codified at 17 U.S.C. 1201 through 1205 and 17 U.S.C. 512, with supporting provisions on copyright management information, computer maintenance and repair, miscellaneous amendments, and vessel hull designs. The sections that follow take up each half on its own terms, beginning with the locks and then turning to the shields, because the statute itself is two laws sharing one number.

What two bargains did the single public law carry?

Public Law 105-304 carried two bargains. Title I implemented the WIPO treaties by giving legal force to technological locks on works, which copyright owners wanted. Title II limited the liability of online service providers for infringements committed by their users, which the companies carrying traffic wanted. Each constituency accepted the other’s title as the price of its own.

What did Article 11 of the WIPO Copyright Treaty require member states to provide?

Article 11 requires contracting parties to give adequate legal protection and effective legal remedies against the circumvention of effective technological measures used by authors in connection with their treaty rights, where those measures restrict acts the authors have not authorized or the law does not permit. Article 18 imposed the parallel duty for performers and phonogram producers.

Which decisions left provider liability uncertain before Title II?

In Sony (1984), the Supreme Court refused to hold a device maker contributorily liable where the product was capable of substantial noninfringing uses. In Netcom (1995), a district court refused direct liability for automatic copying but left contributory liability open once a provider knew of infringement. Between the two, providers could not tell in advance where liability would fall.

Why did the ban on circumventing access controls take effect two years late?

The prohibition in section 1201(a)(1) was delayed for two years after enactment so the first triennial rulemaking could run before the ban applied. The House Committee on Commerce had urged the rulemaking as a fail-safe, letting the Librarian of Congress exempt classes of works whose lawful uses the prohibition would otherwise injure.

Which committees wrote the two halves of the bill?

The Judiciary Committees owned the copyright core: treaty implementation, the anticircumvention prohibitions, and protection for copyright management information. The House Committee on Commerce owned the communications side: the service provider liability limits, their conditions, and the safeguards for lawful access. A conference committee stitched the two portions into a single enrolled bill.

The Anticircumvention Half: What Section 1201 Actually Prohibits

Section 1201 of title 17 is the statute that most people mean when they say “the DMCA,” and it punishes something different from copyright infringement itself. Enacted on October 28, 1998, as part of the Digital Millennium Copyright Act, Public Law 105-304, it created a new category of violation, sometimes called “paracopyright,” that sits alongside traditional infringement without depending on it. A person can violate section 1201 without infringing any copyright, and can infringe a copyright without violating section 1201. The core idea was simple enough to state and far harder to apply: if copyright owners were going to distribute works wrapped in technological locks, Congress would make it unlawful to pick those locks, and unlawful to sell lockpicks. Everything else in the section, the exceptions, the rulemaking process, and the repair controversies that followed, flows from how Congress drew the lines around that idea.

The statute begins by defining its two key terms, and those definitions matter because they determine the reach of every prohibition that follows. To “circumvent a technological measure” means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner. A technological measure “effectively controls access to a work” if, in the ordinary course of its operation, it requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work. The word “effectively” does real work here: the measure need not be strong, clever, or resistant to a determined attacker. Courts have generally treated any measure that in its normal operation gates access behind some authorization step as effective, even when the underlying encryption is trivially broken. A password prompt, a region code on a disc, the authentication handshake between a game console and a cartridge, and the encryption wrapping a downloaded ebook all qualify, so long as getting past them without permission is required to reach the work.

With that definition in place, subsection 1201(a)(1) states the first and most direct prohibition: no person shall circumvent a technological measure that effectively controls access to a work protected under title 17. This is the ban on the act of circumvention itself, applied to what lawyers call access controls. Note the precision of the target. The prohibition reaches the person who descrambles the scrambled movie, decrypts the encrypted song, or bypasses the authentication check on the game console. It does not matter whether the person then does anything infringing with the work. Watching a lawfully purchased film through a region-free workaround, reading a textbook chapter one owns on an unapproved device, or unlocking a phone one fully paid for to move it to another carrier can each fall within the literal scope of the act prohibition, because the wrong the statute defines is the bypassing, not the copying or the viewing. The statute also provides that this prohibition took effect two years after enactment, which meant the act ban became enforceable in October of 2000, giving the Copyright Office time to set up the exemption process described below.

The second access-control prohibition, subsection 1201(a)(2), reaches one step further out. It makes it unlawful to manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof that falls into any of three categories: primarily designed or produced for the purpose of circumventing an access control; having only limited commercially significant purpose or use other than to circumvent an access control; or marketed by that person, or by another acting in concert with that person with that person’s knowledge, for use in circumventing an access control. Any one of the three prongs suffices. The first prong looks at design intent, the second at whether the tool has real legitimate uses, and the third at how the tool is promoted. Together they are meant to capture the commercial ecosystem of circumvention without sweeping in general-purpose technology that happens to be capable of misuse. A locksmith’s pick set is not banned because locks exist; a device whose only plausible function is defeating DVD encryption is. In practice, this trafficking ban has been the more heavily litigated half of the access-control scheme, because acts of circumvention are usually private and hard to detect, while the distribution of circumvention tools is commercial and visible.

Subsection 1201(b) then introduces the parallel trafficking ban for the other kind of technological measure, and this is where the statute’s most misunderstood distinction lives. Subsection (b)(1) makes it unlawful to manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof that is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner, or that has only limited commercially significant purpose or use other than such circumvention, or that is marketed for such circumvention. The definitions shift accordingly: to “circumvent protection afforded by a technological measure” means avoiding, bypassing, removing, deactivating, or otherwise impairing a technological measure, and a measure “effectively protects a right of a copyright owner” if, in the ordinary course of its operation, it prevents, restricts, or otherwise limits the exercise of a right of a copyright owner under title 17. These are copy controls, as opposed to access controls: measures like the copy-generation management that stops a lawfully viewed program from being duplicated, rather than the encryption that stops an unauthorized viewer from watching at all.

Here is the asymmetry that the brief flags, stated as precisely as the statute allows. Subsection 1201(b) contains no prohibition on the act of circumvention. Congress banned trafficking in tools that defeat copy controls, but it did not ban the act of defeating a copy control. Put the other way around: the statute prohibits the act of circumventing an access control under subsection (a)(1), and prohibits trafficking in tools for circumventing either kind of control under subsections (a)(2) and (b)(1), but it leaves the act of circumventing a copy control unprohibited. That gap is deliberate, not an oversight, and summaries that describe section 1201 as a blanket ban on all circumvention misstate the law. The reason for the gap lies in the traditional scope of the copyright owner’s exclusive rights. Copying a work can be lawful when it is fair use, a parody, a backup, a format shift, or one of the other privileged uses the Copyright Act preserves. If Congress had banned the act of bypassing every copy control, it would have made the mechanism of exercising fair use unlawful even where the use itself was lawful. By banning only the trafficking in copy-control circumvention tools, Congress aimed to starve the market for piracy-enabling devices while leaving individuals technically free to defeat a copy control for a legitimate purpose, provided they could do so without a banned tool. Whether that compromise was realistic is a separate question, and it is the question the repair movement has been litigating ever since, because the person who can build their own circumvention tool from scratch is rare, while the person who downloads or buys one is common. The statute’s own definitions reinforce the asymmetry in a subtle way. The access-control definition of circumvention includes the phrase “without the authority of the copyright owner,” which makes the absence of permission part of the violation itself. The copy-control definition in subsection (b)(2) omits that phrase, defining circumvention as avoiding, bypassing, removing, deactivating, or otherwise impairing a technological measure, full stop. The omission reflects the provision’s focus: subsection (b) polices the tools, and a tool primarily designed to strip copy protection is treated as contraband regardless of whose hands it is in. Readers should also keep the two trafficking bans distinct from each other. Subsection (a)(2) reaches tools aimed at access controls, subsection (b)(1) reaches tools aimed at copy controls, and a single device can implicate both where a single measure performs both functions. What neither subsection reaches is the unassisted individual who defeats a copy control with their own ingenuity, a narrow permission that the trafficking bans effectively confine to people with the skills to exercise it.

The tension becomes clearer when one considers how the two kinds of controls overlap in real products. Many devices and media use a single technological measure that functions as both an access control and a copy control: the encryption on a commercial DVD both gates viewing to authorized players and, through the same mechanism, prevents duplication. The statute treats the two functions separately even when one mechanism performs both, and courts have had to sort out which prohibition applies to which act. For the reader trying to understand repair restrictions, the practical upshot is simpler: the act of bypassing a lock on a device you own, where that lock controls access to the copyrighted software inside, falls squarely within subsection (a)(1)(A)’s act ban, regardless of whether the bypass is done for repair, diagnosis, modification, or any other noninfringing purpose. The statute does not ask why you picked the lock. It asks only whether the measure effectively controlled access and whether you circumvented it without authority.

Congress did not leave this scheme without safety valves. Subsection 1201(a)(1) itself contains the most important one: a triennial rulemaking conducted by the Librarian of Congress, on the recommendation of the Register of Copyrights, who consults with the Assistant Secretary for Communications and Information of the Department of Commerce. Every three years, the Librarian examines whether users of copyrighted works are, or are likely to be in the succeeding three-year period, adversely affected in their ability to make noninfringing uses of a particular class of works by virtue of the act prohibition, weighing factors that include the availability of works, nonprofit archival and educational uses, the impact on criticism, comment, news reporting, teaching, scholarship, and research, the effect of circumvention on the market for copyrighted works, and any other factors the Librarian considers appropriate. Classes of works for which the adverse effect is found are published, and the act prohibition does not apply to users of those classes for the ensuing three-year period. The exemptions are temporary by design and must be re-argued every cycle, which is why repair advocates, accessibility groups, educators, and security researchers return to the Copyright Office every three years to defend the permissions they won. Two limits on this process deserve emphasis. First, an exemption excuses only the act of circumvention under subsection (a)(1); the statute expressly provides that neither the exemption nor the rulemaking determination may be used as a defense in any action to enforce any other provision of title 17, which means a trafficking violation under subsection (a)(2) or (b)(1) cannot be defended by pointing to a triennial exemption. Second, the rulemaking addresses only the act ban, so the market for repair tools remains constrained even when the act of repairing is exempted.

Beyond the rulemaking, the statute builds in a set of permanent exceptions, each carefully bounded. Subsection 1201(f) permits reverse engineering for interoperability. A person who has lawfully obtained the right to use a copy of a computer program may circumvent an access control on a particular portion of that program for the sole purpose of identifying and analyzing those elements necessary to achieve interoperability of an independently created computer program with other programs, where those elements were not previously readily available and the analysis does not itself constitute infringement. The information so acquired, and the means used to acquire it, may be shared with others solely to enable interoperability of an independently created program, to the extent doing so does not constitute infringement or violate other law. Interoperability is defined as the ability of computer programs to exchange information and mutually to use the information exchanged. This exception protects the traditional practice of making programs work together, but its conditions are narrow: lawful acquisition, sole purpose of interoperability, and no resulting infringement. The statute goes one step further for the tools themselves: subsection (f)(2) permits a person to develop and employ technological means to circumvent an access control for the purpose of the permitted reverse engineering, and subsection (f)(3) permits sharing the acquired information and the means with others solely to enable interoperability of an independently created program, so long as the sharing does not constitute infringement or violate other law. This is one of the few places in the section where making and sharing a circumvention tool is expressly allowed, which is why software developers seeking to build compatible products have relied on it more than on any other provision.

Subsection 1201(g) addresses encryption research. It permits a person to circumvent a technological measure as applied to a copy, phonorecord, performance, or display of a published work in the course of good faith encryption research, defined as activities necessary to identify and analyze flaws and vulnerabilities of encryption technologies applied to copyrighted works, conducted to advance the state of knowledge in encryption technology or to assist in developing encryption products. The researcher must have lawfully obtained the encrypted work, must have made a good faith effort to obtain authorization before circumventing, and must meet the statute’s balancing factors: how the findings were disseminated (to advance knowledge versus to facilitate infringement), whether the researcher is legitimately engaged in the field, and whether the copyright owner received notice of the findings. The provision also allows sharing technological means with collaborators working on the same research. Subsection 1201(j) similarly protects security testing, defined as accessing a computer, computer system, or computer network solely for the purpose of good faith testing, investigating, or correcting a security flaw or vulnerability, with the authorization of the owner or operator. The testing must not constitute infringement or violate any other law, and the statute points expressly to the Computer Fraud and Abuse Act as an example of other law that still applies. A person may also develop, produce, distribute, or employ technological means for the sole purpose of such security testing, provided those means do not otherwise violate the trafficking ban. Subsection 1201(h) gives courts discretion, when applying subsection (a) to a component or part, to consider the necessity of its incorporation in a technology, product, service, or device that does not itself violate title 17 and whose sole purpose is to prevent minors’ access to material on the internet. Two further exceptions, not always listed in summaries, are worth noting for completeness: subsection 1201(d) allows nonprofit libraries, archives, and educational institutions to gain access to a commercially exploited work solely to make a good faith determination whether to acquire it, under strict conditions, and subsection 1201(e) preserves lawfully authorized investigative, protective, information-security, and intelligence activities of government officers and their contractors.

Subsection 1201(c) then contains a cluster of savings clauses, one of which has become central to the repair debate. Paragraph (c)(1) provides that nothing in the section affects rights, remedies, limitations, or defenses to copyright infringement, including fair use, under title 17. Paragraph (c)(2) provides that nothing in the section enlarges or diminishes vicarious or contributory liability for copyright infringement in connection with any technology, product, service, device, component, or part. And paragraph (c)(3) contains the “no mandate” rule: nothing in the section requires that the design of, or the design and selection of parts and components for, a consumer electronics, telecommunications, or computing product provide for a response to any particular technological measure, so long as the part, component, or product does not otherwise fall within the trafficking prohibitions of subsection (a)(2) or (b)(1). In other words, manufacturers are not required to build their products to honor someone else’s digital locks. Paragraph (c)(4) adds that nothing in the section enlarges or diminishes rights of free speech or the press for activities using such products. The no-mandate rule was meant to reassure the technology industry that section 1201 would not become a design mandate, but repair advocates have read it as evidence of congressional intent: the statute regulates circumvention, not the ordinary manufacture of interoperable or repairable products, and a device that does not fall within the trafficking prongs should be free to ignore technological measures entirely.

Violations of section 1201 carry both civil and criminal consequences, set out in the two sections that follow it. Under section 1203, any person injured by a violation may bring a civil action. The court may grant injunctions to prevent or restrain violations, impound offending devices and products, and award either actual damages plus the violator’s attributable profits, or, at the complaining party’s election made any time before final judgment, statutory damages. For violations of section 1201, the statutory award ranges from not less than $200 to not more than $2,500 per act of circumvention, device, product, component, offer, or performance of service, as the court considers just. Where a violator commits another violation within three years after a final judgment was entered for an earlier violation, the court may increase the award up to triple. The court may reduce or remit damages for innocent violators who prove they were not aware and had no reason to believe their acts constituted a violation, and must remit damages for qualifying nonprofit libraries, archives, educational institutions, and public broadcasting entities that make the same showing. Costs and attorney’s fees are available as well. Under section 1204, criminal liability attaches to any person who violates section 1201 or 1202 willfully and for purposes of commercial advantage or private financial gain. A first offense carries a fine of not more than $500,000, imprisonment for not more than five years, or both; a subsequent offense carries a fine of not more than $1,000,000, imprisonment for not more than ten years, or both. Nonprofit libraries, archives, educational institutions, and public broadcasting entities are exempt from the criminal provision.

Those constraints are the reason section 1201 became the principal federal obstacle to repairing devices that their owners ostensibly own. The mechanism is straightforward and follows directly from the prohibitions described above. Modern equipment, from phones and tablets to tractors, automobiles, medical devices, and home appliances, embeds copyrighted software behind access controls: authentication handshakes that verify replacement parts, encrypted diagnostic interfaces, and firmware locks that refuse to run unless every component presents an authorized signature. To diagnose a fault, install a third-party part, reset a maintenance counter, or install alternative firmware, the owner or an independent repair shop must bypass such a measure, which is an act of circumvention under subsection (a)(1)(A) regardless of the purpose. Distributing or selling the software, dongle, or instructions that perform the bypass is trafficking under subsection (a)(2), and if the measure also functions as a copy control, under subsection (b)(1). The fact that the underlying repair is noninfringing does not help, because a section 1201 violation does not require infringement, and the fair-use savings clause in subsection (c)(1) preserves fair use as a defense to infringement claims, not to section 1201 claims. The result is a legal regime in which the owner of a device may lawfully tinker with its unprotected hardware while being barred from touching the software that makes the hardware work, and in which the tools that would make lawful repair practical cannot be lawfully distributed.

That is why repair advocates have targeted section 1201 itself, and specifically the triennial exemption process, rather than trying to win repair rights case by case in court. The exemption rulemaking is the only standing forum where the public can argue, on a record, that the act ban is blocking noninfringing uses, and where the Librarian can grant relief class by class. It is also the only safety valve calibrated to the statute’s actual structure: the rulemaking can excuse the act of circumventing an access control, which is the precise conduct that diagnosing and repairing a locked device requires, and it does so through an administrative record rather than through the uncertain course of litigation over what counts as a technological measure or as circumvention. The burden, however, is deliberately heavy. Proponents must show actual or likely adverse effects on noninfringing uses, must define the class of works with precision, and must return every three years to do it again, because each exemption expires unless renewed. Across successive rulemaking cycles, repair proponents have sought and in several rounds obtained exemptions covering activities such as diagnosing, maintaining, and repairing motorized land vehicles and other categories of devices, alongside the better-known exemptions for unlocking mobile phones. Each grant is temporary, each renewal must be re-litigated with fresh evidence of adverse effects, and each exemption covers only the act of circumvention, leaving the trafficking bans intact, so the repair community wins the right to do the work while still being restricted in how the necessary tools can be shared. The pattern illustrates both the function and the limits of the compromise Congress struck in 1998: a statute that bans the picking of digital locks, tolerates the lockpicks only for narrowly defined research and security purposes, and channels every other plea for relief into a three-year administrative cycle where the burden of proof rests on the people asking to fix what they own.

The triennial exemption process and its advocacy history

The access-control prohibition in section 1201(a)(1)(A) of the Copyright Act took effect in 2000, two years after the Digital Millennium Copyright Act became law. Congress understood that the ban would reach lawful conduct, so it built a release valve directly into the statute. Subparagraph (B) spares users of a copyrighted work that falls in a particular class of works when those users are, or in the succeeding three-year period are likely to be, adversely affected by the prohibition in their ability to make noninfringing uses of that class. Subparagraph (C) commands the Librarian of Congress, acting on the recommendation of the Register of Copyrights, to decide in a rulemaking held during each succeeding three-year period which classes of works qualify. The Register must consult the Assistant Secretary for Communications and Information of the Department of Commerce, who reports views on the recommendation. Subparagraph (E) adds a boundary: neither an exemption nor a determination in the rulemaking may be raised as a defense in any action to enforce any other provision of the Copyright Act. The design is deliberate. The prohibition is permanent; the exemptions are temporary, conditional, and reviewable on a fixed calendar.

A cycle opens with a notice of inquiry from the Copyright Office. Petitioners file proposals for classes of works to be exempted. The Office then holds rounds of written comments, typically giving proponents, opponents, and reply commenters each a turn, followed by public hearings. After the record closes, the Register writes a recommendation that can run to several hundred pages, and the Librarian issues a final rule published in the Federal Register; the 2018 final rule ran to 85 pages. The governing question in every cycle is the statutory one: whether the prohibition on circumventing access controls is adversely affecting, or is likely to affect during the next three years, the ability of users to make noninfringing uses of a particular class of copyrighted works. The statute directs the Librarian to weigh five factors: the availability of copyrighted works for use; the availability of works for nonprofit archival, preservation, and educational purposes; the prohibition’s impact on criticism, comment, news reporting, teaching, scholarship, and research; the effect of circumvention on the market for or value of copyrighted works; and any other factors the Librarian considers appropriate. Final rules have generally taken effect in late October of the rulemaking year, with the Librarian sometimes delaying particular classes, as with the vehicle repair and security research exemptions of 2015. In the 2015 cycle the Office also added a streamlined renewal track, letting proponents of existing exemptions file shorter petitions when no opponent contests the renewal, and the Librarian has used it to carry forward uncontroversial classes without a full re-litigation of the record. Two features define the proceeding’s character. Each cycle begins de novo, so no exemption carries a presumption of renewal and every proponent must prove the adverse effect again from scratch. And the Office defines classes functionally, pairing a category of work with the noninfringing purpose, as in computer programs that operate smartphones when circumvention is needed for diagnosis, maintenance, or repair.

The rulemaking is the only mechanism in the statute that requires a periodic re-examination of the prohibition. When Congress wrote the law, it described the purpose of the exemption procedure as keeping circumvention protection from diminishing the public’s access to copyrighted works for lawful uses, including activities protected by the fair use doctrine. Every three years, the proceeding becomes the one forum where ordinary users, librarians, filmmakers, disability advocates, farmers, and security researchers can ask the government to bless conduct the statute otherwise punishes with substantial civil and even criminal penalties. Participation has grown with the stakes. Across the rulemakings from 2000 through 2012, the Office received roughly 750 public comments touching on repair; in the 2015 cycle alone, repair petitions drew on the order of 40,000 comments. The docket has become the principal venue where repair advocates, libraries, and security researchers seek relief, because no other door in the statute opens on schedule. Repair advocates call it the statute’s escape hatch, the one place where citizens can petition for adjustments to the law every three years.

The proceeding has produced its own specialized advocacy bar. The Electronic Frontier Foundation has petitioned in nearly every cycle since 2000, winning jailbreaking, repair, and security research exemptions. The Library Copyright Alliance returns for preservation and accessibility. iFixit and the Repair Association have made the docket a front in the right-to-repair movement, and filmmaker groups, disability organizations, and security researchers each maintain standing petitions. Opposition is equally professional: automakers, device manufacturers, publishers, and content-industry groups file detailed objections, often arguing that broad classes would enable piracy or that market solutions have cured the harm, as carriers argued in the unlocking fight of 2012. The 2015 repair docket drew opposition from the Auto Alliance, Global Automakers, General Motors, John Deere, the Business Software Alliance, and the National Association of Manufacturers, among others, each filing objections to the proposed classes. The adversarial rhythm, petition, comment, reply, hearing, is the point. Library groups have described the proceeding as burdensome, lengthy, and at times adversarial, and the statute asks the Librarian to judge an evidentiary record, not to set technology policy, and the record arrives one exemption at a time.

The accessibility exemption is the oldest and most instructive lineage. In the inaugural 2000 rulemaking, the Librarian granted an exemption for literary works distributed electronically when technological measures blocked read-aloud functions or interfered with screen readers and other assistive technologies, provided the user had lawfully obtained the work. Disability-rights advocates advanced the exemption in every cycle afterward, and the Librarian renewed it each time. The 2012 renewal drew no opposition; the Association of American Publishers told the Office it did not object, and the 2015 rules renewed the exemption again. Over the cycles its wording widened, from blind readers to persons who are blind, visually impaired, or print-disabled, and from e-books to previously published musical works fixed in text or notation. The 2024 rulemaking kept the exemption in place for literary works used with assistive technologies. The lineage also illustrates the proceeding’s burden. Blind readers win the right to break e-book locks, then must defend it again three years later, mounting the same evidentiary showing to keep what they already proved necessary. Library groups have responded by drafting proposals asking Congress to write a permanent accessibility exception into section 1201, covering both the act of circumvention and the tools that make it possible, for all disability types and content formats, so that the most sympathetic users in the system no longer have to litigate their reading every three years.

The cellphone unlocking saga made the process famous. In the 2006 cycle, the Librarian exempted computer programs in the form of firmware that enabled wireless telephone handsets to connect to a wireless network, when circumvention served the sole purpose of lawful connection. The exemption was renewed in 2010 on a petition from the Electronic Frontier Foundation. In the 2012 cycle, the Librarian declined to renew it for phones, reasoning that the largest carriers had liberal, publicly available unlocking policies and that unlocked phones were freely available from third-party sellers. Phones purchased within 90 days of the rule’s October 28, 2012 effective date kept the benefit; phones purchased later fell back under the prohibition. The decision drew more than 114,000 signatures on a White House petition in early 2013, and the White House said consumers who had paid for their devices and were no longer bound by service agreements should be able to use them on another network. The Register’s reasoning in the earlier grants had been blunt: the locks existed mainly to bind consumers to their networks rather than to protect copyright owners in their capacity as owners. Congress answered with the Unlocking Consumer Choice and Wireless Competition Act, signed into law on August 1, 2014 as Public Law 113-144. The statute reinstated the unlocking exemption for wireless telephone handsets, allowed unlocking by the device owner, by another person at the owner’s direction, or by a wireless provider at the owner’s direction, barred any reading that would permit bulk resale of unlocked devices, and directed the Librarian to decide whether to extend the exemption to other categories of wireless devices. In the 2015 rulemaking, the Librarian restored the exemption and expanded it to tablets, mobile hotspots, and wearable wireless devices such as smartwatches and fitness trackers. The 2018 cycle extended unlocking to new phones, a change aimed partly at recyclers handling unopened consumer returns. The episode stands as the clearest example of the statute’s safety valve working as designed, up to a point: the rulemaking answered the consumer harm, Congress had to step in when the rulemaking stopped answering it, and the relief still expires on schedule.

A parallel line covers jailbreaking, the circumvention that lets a device run lawfully obtained software applications. The Librarian granted it in 2010 for wireless telephone handsets, on a petition from the Electronic Frontier Foundation supported by organizations including Mozilla and the Free Software Foundation. The 2012 cycle kept the exemption for smartphones but left tablets out. The 2015 rulemaking extended jailbreaking to tablets and other all-purpose mobile computing devices and to smart TVs. The 2018 cycle added voice assistant devices, so owners could jailbreak smart speakers, and the 2024 cycle added routers and dedicated network devices. Each extension followed the same pattern: a defined class of hardware, a defined purpose of interoperability, and a fresh evidentiary record.

The proceeding also absorbs technologies that did not exist when Congress wrote the statute. The 2015 rulemaking granted an exemption for the firmware of 3D printers, so owners could use alternative feedstock rather than the manufacturer’s cartridges, and later cycles retained it. The 2021 cycle added an exemption for text and data mining of motion pictures and e-books for scholarly research and teaching, and the 2024 cycle widened it to let researchers affiliated with other nonprofit institutions of higher education use corpora hosted on an institution’s servers, and to adjust the rules on security measures and on viewing the contents of works within a corpus. Both lines show the rulemaking doing quiet, incremental work far from the headlines: a researcher building a corpus, a hobbyist printing a part, each needing a three-year permission slip for conduct that infringes nothing.

Repair advocates arrived later and changed the proceeding’s character. In the 2015 cycle, the Electronic Frontier Foundation petitioned for an exemption covering computer programs that control motorized land vehicles, including personal automobiles, commercial vehicles, and agricultural machinery, for diagnosis, repair, or modification. Farmers and farm organizations petitioned separately for agricultural machinery. Supporters included AAA, the Auto Care Association, the Specialty Equipment Market Association, the National Corn Growers Association, iFixit, and more than 2,500 individuals. The Librarian granted an exemption for computer programs controlling motorized land vehicles for diagnosis, repair, and lawful modification, but set its effective date twelve months out, to October 28, 2016, and excluded telematics and entertainment systems. The 2018 rulemaking then expanded the vehicle exemption in three ways: it eliminated the requirement that the circumvention be performed by the vehicle owner, so independent repair shops could act; it removed the telematics and entertainment exclusion, because vehicle computer systems had grown too integrated to separate, and the Register was persuaded that keeping the exclusion could impede noninfringing uses that only incidentally touched those systems; and it created a new exemption for firmware controlling smartphones, home appliances, and home systems such as refrigerators, thermostats, and HVAC systems, for diagnosis, maintenance, or repair. The 2021 and 2024 cycles renewed and broadened the repair classes further, reaching marine vessels, medical devices and systems, retail-level commercial food preparation equipment, and the operational and telematics data of vehicles and vessels, while continuing to exclude certain video game consoles. The repair docket shows the process at its best and its strangest: it delivered real relief to farmers and independent shops, but only in three-year increments, only for named device categories, and only after years of expert testimony about tractor firmware in a copyright proceeding.

Security research followed a similar arc from denial to acceptance. Before 2015, researchers who probed car firmware or medical-device software risked liability under section 1201 even when their purpose was to expose vulnerabilities. In the 2015 rulemaking, the Librarian granted an exemption for good-faith security research on computer programs operating devices and machines primarily designed for individual consumers, including voting machines, motorized land vehicles, and implanted medical devices. The proposal had drawn opposition from auto and medical device industry groups, without success. The exemption took effect twelve months later, except for voting machines, where it took effect immediately. In the 2018 cycle, the Office broadened the exemption substantially. The device limitation fell away: the 2018 final rule extended the exemption to cover research on any computer, computer system, or computer network, so long as the circumvention is undertaken with the authorization of the owner or operator and in an environment designed to avoid harm to individuals or the public. The Justice Department’s Computer Crime and Intellectual Property Section endorsed the expansion, and the National Telecommunications and Information Administration supported enabling more good-faith research. The 2024 cycle clarified the exemption further by removing the condition that the research comply with other laws, so a researcher’s violation of another statute no longer automatically revives liability under section 1201. The security research exemption matters because it protects the act of testing, not just the right to publish results. Researchers had argued for years that section 1201 let manufacturers threaten those who found flaws; the rulemaking gave them a three-year shield, renewed in each cycle since, while leaving every other law fully in force.

Filmmakers and remixers built another long-standing line. In 2010 the Librarian exempted circumvention of DVDs to obtain short portions of motion pictures for criticism or comment, for defined users: college and university faculty and students, documentary filmmakers, and noncommercial video creators. Later cycles extended the exemption to Blu-ray discs and streaming sources, widened the roster of covered users to include faculty of massive open online courses and participants in nonprofit digital literacy programs, including faculty and students in film studies and other courses requiring close analysis of film and media excerpts, and added neighboring categories for multimedia e-books and for captioning and audio description prepared by disability services offices for students with disabilities. The exemptions define the boundary in fine print, naming exactly which users may circumvent, which works they may touch, and for which purposes, and each renewal revisits those lines. The remix line shows how the proceeding translates fair use from principle into permission: criticism and commentary are noninfringing uses the statute’s factors explicitly protect, but turning that protection into a working exemption requires advocates to return every three years with a fresh record that the locks are still standing in the way.

Libraries, archives, and museums have pressed a preservation line. The 2015 rulemaking granted an exemption for video games whose outside server support had been discontinued, allowing individual play by gamers and preservation by libraries, archives, and museums, including the console jailbreaking necessary for preservation uses. The 2024 rulemaking kept that relief and added video games that never required server support, alongside a broader exemption for the preservation of computer programs and computer program-dependent materials by eligible institutions. The preservation exemptions sit close to the statute’s heart: one of the factors the Librarian must weigh is the availability of works for nonprofit archival and preservation purposes. They also show the proceeding’s habit of granting relief in the smallest workable slice, with conditions on who may act and how the preserved copies may be used, and the same three-year fuse as everything else.

The ninth rulemaking, concluded in 2024, shows how wide the roster has grown. The Librarian renewed the unlocking exemption for wireless devices; jailbreaking for smartphones, tablets and portable all-purpose mobile computing devices, smart TVs including streaming devices, voice assistant devices, and routers and dedicated network devices; repair exemptions for motorized land vehicles, marine vessels and agricultural vehicles or vessels, consumer devices, and medical devices and systems; good-faith security research; excerpts of audiovisual works for criticism or comment, including nonfiction multimedia e-books, documentary films, and noncommercial videos; educational uses by college, university, K-12, and massive open online course faculty and students; captioning and audio description for students with disabilities; preservation of video games and computer programs by libraries, archives, and museums; access to medical-device-generated data; text and data mining for scholarly research; repair of retail-level commercial food preparation equipment; access to vehicle operational and telematics data; alternative feedstock for 3D printers; and investigation of potential infringement of free and open-source software. Nearly every line traces back to a petition filed by someone the statute would otherwise punish.

The limits are structural. An exemption lasts three years from the final rule’s effective date, then vanishes unless a petitioner proves the adverse effect all over again. The Office reads each proceeding de novo, so advocates must repeatedly demonstrate the continuing need and justification for relief they have already won. An exemption also waives only the act of circumvention under section 1201(a)(1)(A). It does not touch the separate bans on manufacturing or trafficking in circumvention tools in sections 1201(a)(2) and 1201(b)(1), a gap that repair advocates call the process’s central defect: the law permits a farmer to bypass a tractor’s lock while forbidding anyone to sell the farmer the means to do it. And subparagraph (E) confines each determination to the circumvention proceeding itself, so an exemption cannot be raised as a defense against any other copyright claim. The Office has also kept the classes narrow by design. The 2018 rulemaking denied a game-console repair petition; the 2024 consumer-device repair class excludes certain video game consoles; the unlocking statute barred any construction that would permit bulk resale. Each denial reflects the same logic: the Librarian may excuse the act, but may not rewrite the prohibition.

When the rulemaking’s narrowness fails, only Congress can supply the missing piece. The 2014 Unlocking Act did exactly that, reinstating the phone exemption by statute and extending the relief to third parties acting at the owner’s direction, a step the Office had read the statute as forbidding it to take on its own. The Office itself has told Congress that some problems outrun the triennial tool. In a 2017 study of section 1201, the Office said repair disputes were better addressed through laws outside the Copyright Act, and library and disability groups have drafted proposals for permanent statutory exceptions covering accessibility and preservation. The 2024 cycle’s denial of a proposed exemption for research into the trustworthiness of artificial intelligence systems offered a reminder of the Office’s jurisdictional modesty: the Register concluded the proposal concerned third-party control of online platforms more than the access controls on copyrighted works that section 1201 governs. The proceeding remains what Congress built it to be, a periodic adjustment mechanism for a permanent prohibition, and its history shows both halves of that design. It has given blind readers, filmmakers, farmers, mechanics, and security researchers a recurring forum to win back the noninfringing uses the locks swallowed, and it has done so only in three-year increments, only for named classes, and only for the act of circumvention itself.

The arrangement reflects a compromise Congress struck in 1998 and has never revisited in full. The prohibition is categorical and permanent; the exceptions are specific, temporary, and procedurally expensive. Defenders of the design say the temporary character is the point, forcing a fresh evidentiary showing as technology changes. Critics answer that the burden falls on exactly the users least able to bear it: blind readers, farmers, independent mechanics, and academic researchers, who must hire lawyers and marshal evidence every three years to keep doing what the law already calls noninfringing. The record of the rulemakings gives both sides evidence. The process has repeatedly delivered relief that Congress never wrote into the statute, and it has delivered that relief only in installments, always expiring, always renewable, never quite settled. The ninth rulemaking, concluded in 2024, gave no sign that the rhythm is slowing.

The Safe Harbor Half: Section 512 and the Notice-and-Takedown Machinery

Title II of the Digital Millennium Copyright Act, codified at 17 U.S.C. 512 and titled the Online Copyright Infringement Liability Limitation Act, was the legislative compromise that made the modern platform economy possible. Copyright owners wanted a fast, court-free way to remove infringing material from networks they did not operate. Service providers wanted assurance that they would not face crushing secondary liability for the conduct of millions of subscribers. Section 512 gave each side something and made the concessions conditional. A provider that satisfies the statutory conditions is shielded from monetary relief, including damages, for infringement arising from specified functions, and faces only a narrow band of injunctive relief. A provider that fails the conditions keeps all of its ordinary copyright defenses, but it gets no special protection. The statute created four distinct limitations on liability, one for each of four kinds of network function, and each carries its own set of qualifying conditions rather than a single shared standard. Understanding the machinery means walking through the harbors one by one and then following the notice-and-takedown and counternotice sequence that operates on top of them.

The first harbor, at 512(a), covers transitory digital network communications, which is the statute’s term for the basic conduit function of an internet access provider. When a provider acts as a mere data pipe, moving bits chosen by others between points chosen by others, the harbor applies if five conditions are met. The transmission must have been initiated by a person other than the provider. It must be carried out through an automatic technical process without selection of the material by the provider. The provider must not select the recipients of the material except as an automatic response to the request of another person. No copy of the material made in the course of the process may be maintained on the system or network in a manner ordinarily accessible to anyone other than the anticipated recipients, and no such copy may be kept for a period longer than is reasonably necessary for the transmission. Finally, the contents of the material as transmitted must not be modified. Together these conditions describe a carrier that neither chooses what it carries nor keeps it, and the protection is correspondingly strong: a qualifying conduit is sheltered from liability for the infringement it merely transmits. The Fourth Circuit’s 2018 decision in the Cox Communications litigation was litigated in part under this harbor, because Cox was acting as a conduit internet service provider for subscribers engaged in peer-to-peer file sharing, and the court’s analysis of Cox’s failure to meet a separate threshold condition, discussed below, denied it the shelter of 512(a).

The second harbor, at 512(b), covers system caching, the automatic, intermediate, temporary storage of material that a provider retains to make later access more efficient. The conditions are more detailed than those of 512(a). The material must have been made available online by a person other than the provider and transmitted to a subscriber at the subscriber’s direction. The storage must be carried out through an automatic technical process for the purpose of making the material available to subscribers who subsequently request it. The provider must comply with rules concerning the refreshing, reloading, or other updating of the material when those rules are specified by the person who made the material available online under generally accepted industry standard data communications protocols. The provider must not interfere with the standard technical measures used by copyright owners to protect and identify their works, and must respect access conditions, such as paywalls or passwords, imposed by the originating site. And if the material has been removed or disabled at the originating site, or if a court has ordered its removal, the provider must remove or disable access to the cached copy upon receiving a proper notification. The harbor thus protects caching that is genuinely subordinate to the original posting and that evaporates when the original does.

The third harbor, at 512(c), is the one that governs the great bulk of platform disputes, because it covers information residing on systems or networks at the direction of a user. Video hosting services, social media platforms, file storage services, auction and marketplace sites, and comment sections all store material that users put there, and 512(c) is the shelter they invoke. Its conditions are the most litigated in the statute, and they are best taken in the order the brief states them. First, the provider must have designated an agent to receive notifications of claimed infringement, and must have registered that agent with the Copyright Office, while also providing the agent’s contact information on its website. Congress later directed the Copyright Office to maintain this registry electronically, and providers that registered under the old paper system had to re-register online to keep the designation effective. A takedown notice sent to the wrong place, when a proper agent was designated and published, does not trigger the provider’s obligations.

Second, upon receiving a notification that substantially complies with the statutory form, the provider must respond expeditiously to remove, or disable access to, the material claimed to be infringing. Expeditiousness is measured from receipt of a conforming notice, not from the provider’s first suspicion, which is why the completeness of the notice matters so much. Third, the provider must not have actual knowledge that the material or an activity using the material on the system is infringing. Fourth, in the absence of such actual knowledge, the provider must not be aware of facts or circumstances from which infringing activity is apparent. Courts call this second prong red-flag knowledge. A provider that genuinely does not know of infringement keeps the harbor, but a provider confronted with facts that would make infringement apparent to a reasonable person cannot hide behind the absence of a formal notice. The statute adds, in the same subparagraph, that upon obtaining such knowledge or awareness the provider must act expeditiously to remove or disable access to the material. Fifth, the provider must not receive a financial benefit directly attributable to the infringing activity in a case where the provider has the right and ability to control such activity. This is the statute’s vicarious-liability filter. Advertising revenue that flows to a provider regardless of whether the material infringes, without more, does not satisfy it, and the Second Circuit in the YouTube litigation held that the right and ability to control requires something more than the mere technical capacity to remove or block access, such as exerting substantial influence over users’ activities. Finally, the provider must have adopted and reasonably implemented a policy that provides for the termination in appropriate circumstances of subscribers and account holders who are repeat infringers, as required by 512(i), and must accommodate standard technical measures used to identify and protect copyrighted works.

The repeat-infringer condition proved to be the harbor’s sharpest teeth. Section 512(i)(1)(A) applies to all four harbors, not only to 512(c), and it demands both adoption and reasonable implementation of a termination policy. In BMG Rights Management v. Cox Communications, decided by the Fourth Circuit on February 1, 2018, the court held that Cox was not entitled to the safe harbor because its repeat-infringer policy failed the implementation requirement. Cox had operated a graduated “thirteen-strike” system under which no realistic prospect of termination arose before thirteen notices, only one notice per subscriber per day counted, the strike counter reset every six months, and terminated accounts were routinely reactivated to preserve subscriber revenue. The court also rejected Cox’s argument that “repeat infringers” meant only subscribers adjudged infringers by a court, holding that the term covers anyone who infringes more than once. The district court had granted summary judgment to BMG on the safe-harbor defense, a jury then found Cox liable for willful contributory infringement and awarded 25 million dollars in statutory damages, and the Fourth Circuit affirmed the denial of the harbor while remanding for a new trial on the contributory-liability instructions.

The fourth harbor, at 512(d), covers information location tools, which is the statute’s category for search engines, directories, indexes, reference services, pointers, and hyperlinks. Its conditions closely mirror those of 512(c): no actual knowledge of infringement, no awareness of facts or circumstances from which infringement is apparent, expeditious removal or disabling of access upon obtaining such knowledge, no direct financial benefit attributable to the infringing activity where the provider has the right and ability to control it, and, upon receiving a conforming notification, expeditious removal of the reference or link. There is one structural difference worth noting. The designated-agent registration requirement is specific to 512(c)(2), but notifications under 512(d) are effective when sent to the designated agent if one exists, or otherwise to the provider’s publicly available contact information, which in practice pushed search providers to maintain designated agents as well. The 512(d) harbor is the provision that Google invokes for its search index, and it is the reason the notice-and-takedown machinery reaches far beyond hosted content into the pointers and links that make material findable. The machinery that runs on top of these harbors is the notice-and-takedown and counternotice sequence, and its details matter because they allocate the risk of error. A notification of claimed infringement under 512(c)(3) must contain six elements. It must carry a physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed. It must identify the copyrighted work claimed to have been infringed, or, if a single notice covers multiple works, a representative list of those works. It must identify the material claimed to be infringing and give information reasonably sufficient to permit the provider to locate it, which in practice means specific URLs or equivalent locators. It must give information reasonably sufficient to permit the provider to contact the complaining party, such as an address, telephone number, and electronic mail address. It must include a statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law. And it must include a statement that the information in the notification is accurate and, under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

The statute anticipates sloppy notices. Under 512(c)(3)(B), a notification that fails to comply substantially with all six elements is not effective, with one exception: if it substantially complies with the identification-of-work, identification-of-material, and contact-information elements, the provider must promptly attempt to contact the complaining party or take other reasonable steps to assist in receiving a fully compliant notice. A notice that lacks even those core elements imposes no duty at all. This substantial-compliance rule is a frequent battleground, because automated sending systems generate enormous numbers of notices and many arrive with defective identifying information.

The counternotice and put-back procedure at 512(g) gives the user whose material was removed a path back online. A counternotice must contain five elements: a physical or electronic signature of the subscriber; identification of the material that was removed or disabled and the location where it appeared before removal; a statement under penalty of perjury that the subscriber has a good faith belief that the material was removed or disabled as a result of mistake or misidentification; the subscriber’s name, address, and telephone number; and a statement that the subscriber consents to the jurisdiction of the Federal District Court for the judicial district in which the address is located, or, if the address is outside the United States, for any judicial district in which the provider may be found, along with a statement that the subscriber will accept service of process from the original complainant. The consent-to-jurisdiction element is the counternotice’s price of admission: to get material restored, the user must agree to be sued in federal court, which deters counternotices from users who fear litigation even when they are not infringing.

Upon receiving a conforming counternotice, the provider must promptly give the original complainant a copy and inform that complainant that the removed material will be replaced in ten business days. The provider must then replace the material not less than ten and not more than fourteen business days after receipt of the counternotice, unless the designated agent first receives notice from the original complainant that the complainant has filed an action seeking a court order to restrain the subscriber from engaging in infringing activity. The complainant thus gets roughly two weeks to go to court; silence means the material goes back up. The statute separately protects providers that remove material in good faith. Under 512(g)(1), a provider is not liable to any person for any claim based on its good-faith disabling of access to, or removal of, material in response to a notification, whether or not the material ultimately proves to be infringing. The provider that follows the procedure is thus insulated from both sides: from the copyright owner if it takes material down, and from the user if it acts in good faith on a notice.

The counterweight to this complainant-friendly structure is 512(f), which imposes liability on any person who knowingly materially misrepresents, in a notification, that material or activity is infringing, or, in a counternotice, that material was removed by mistake or misidentification. A party injured by such a misrepresentation, as the result of the provider relying on it to remove or disable material, may recover any damages, including costs and attorneys’ fees, incurred as a result. The knowledge requirement is strict. In Rossi v. Motion Picture Association of America, decided by the Ninth Circuit in 2004, the court held that the good-faith-belief statement in a notice is judged subjectively: a copyright owner that forms an honest belief of infringement, even a mistaken one, has not misrepresented anything knowingly. That reading made 512(f) claims difficult to win, since a complainant could defeat liability by showing it genuinely believed the use was infringing.

The 2015 decision in Lenz v. Universal Music Corp. added a meaningful qualification. The case began in 2007, when Stephanie Lenz posted a twenty-nine-second home video of her toddler dancing to Prince’s “Let’s Go Crazy” on YouTube, and Universal Music sent a takedown notice for the audio. Lenz, represented by the Electronic Frontier Foundation, sued under 512(f), arguing that Universal had misrepresented infringement because her use was fair. On September 14, 2015, the Ninth Circuit held that a copyright holder must consider fair use in good faith before sending a takedown notification. The reasoning ran through the notice’s own language: the complainant must state a good faith belief that the use is not authorized by the copyright owner, its agent, or the law, and fair use under 17 U.S.C. 107 is a use authorized by law, not merely an affirmative defense to infringement. A holder that never considers fair use cannot have formed the required belief. The court preserved the subjective standard, however. To “consider” fair use, the holder need only form a subjective good faith belief that the use is not fair; courts will not second-guess that belief even if they would have reached the opposite conclusion, and a plaintiff must show the holder subjectively knew the use was fair or was willfully blind to an obvious fair use. Lenz therefore gave users a real but narrow shield: automated notice systems that never pause to ask whether a use might be fair sit on the wrong side of the rule, but a complainant that gives the question even cursory honest thought remains protected by the subjective standard. The most consequential judicial gloss on the knowledge conditions came from the litigation between Viacom and YouTube. Viacom sued in 2007 over tens of thousands of clips of its programming uploaded to YouTube, and the district court granted YouTube summary judgment under 512(c). On April 5, 2012, the Second Circuit affirmed in part, vacated in part, and remanded. The court held that the district court had applied the correct standard on knowledge: to lose the harbor under 512(c)(1)(A), a provider must have knowledge or awareness of specific and identifiable instances of infringement, not merely a general awareness that infringement occurs somewhere on the service. At the same time, the court held that the common-law doctrine of willful blindness could, in appropriate circumstances, supply that specific knowledge: a provider that deliberately avoids confirming infringement it strongly suspects may be treated as knowing. The court also corrected the district court’s treatment of the financial-benefit condition, holding that the “right and ability to control” infringing activity does not require item-specific knowledge of the infringement; a provider may exert the requisite control, and thus fail the condition, without knowing of the particular infringing act. On remand, the district court again granted YouTube summary judgment, finding no evidence of item-specific knowledge or willful blindness as to the clips in suit, and the parties settled in 2014, ending the seven-year dispute without a final appellate resolution of the remanded questions.

One further statutory detail rounds out the picture. Section 512(m) provides that eligibility for the safe harbors may not be conditioned on a provider monitoring its service or affirmatively seeking facts indicating infringing activity, except to the extent consistent with the standard technical measures the statute elsewhere requires providers to accommodate. Congress deliberately rejected a duty to police, which is why the knowledge standard and the notice system carry so much weight: the provider need not go looking, but must act once it knows or is told.

Takedown notices number in the billions per year. Google’s transparency figures, as reported in September 2025, showed rightsholders asking Google to remove five billion URLs from its search results over the preceding year, with the all-time cumulative count since 2012 past fourteen billion. Google forwards copies of the notices it receives to the Lumen database, a public archive maintained in partnership with Harvard’s Berkman Klein Center, which is how researchers and journalists can study the flow.

That machinery is overwhelmingly automated. Sending systems file notices in batches so large that human review of the targeted content often drops out of the process, receiving platforms process them with comparable automation, and the automation has produced documented over-removal and abuse. A 2016 study by researchers at Columbia University’s American Assembly and Berkeley, titled Notice and Takedown in Everyday Practice, examined more than 108 million takedown requests sent to Google and found that 28.4 percent had characteristics raising clear questions about their validity, including notices targeting pages with no infringing content, notices aimed at sites that had been defunct for over a year, improperly formatted notices, and subject matter outside the takedown guidelines. The study’s co-author Joe Karaganis attributed the pattern to “notice sending robots talking to notice receiving robots,” with the step of actually looking at the targeted content dropping out of the equation. Because providers act on the great majority of notices they receive, a large share of questionable requests are implemented. The Electronic Frontier Foundation and other watchdogs have catalogued individual abuses as well: notices used to suppress criticism, political speech, and journalism, and to target competitors. The honest account of the system is therefore two-sided. It processes an enormous volume of genuine infringement claims at a cost per notice that no court-centered system could match, and that cheapness is exactly what enables documented over-removal, because the sender bears almost no cost for an erroneous or abusive notice while the recipient of the notice faces the risk of litigation if it counternotices.

One final piece of the architecture explains why section 512, rather than the internet’s other famous immunity provision, is the law that matters for copyright. Section 230 of the Communications Decency Act, at 47 U.S.C. 230, shields interactive computer services from liability for third-party content, but 230(e)(2) expressly provides that nothing in the section shall be construed to limit or expand any law pertaining to intellectual property. The Ninth Circuit, in Perfect 10 v. CCBill, read that carve-out to cover federal intellectual property law, which includes copyright. The consequence is that a platform sued over user-posted copyright infringement cannot invoke section 230; its immunity, if any, must come from the DMCA’s own safe harbors. That is why the 512 conditions, the notice-and-takedown sequence, and the case law construing them have become the operating constitution of copyright on the commercial internet. Congress built a private enforcement system in which rightsholders send notices, providers remove first and ask questions later, users may object at the price of submitting to federal jurisdiction, and courts intervene only at the margins. The system’s defenders point to the billions of infringing copies removed without litigation. Its critics point to the billions of notices sent without human review and the lawful speech swept up along the way. Both claims are supported by the record, and both flow from the same statutory design.

Litigation Record, Verdict, and Closing

The Digital Millennium Copyright Act arrived in 1998 as a negotiated text, and negotiated texts get their meaning in court. In the years that followed, federal judges drew the lines that the statute’s drafters had left blurry, and the pattern of those decisions tells the story of the law better than any single provision can. The safe harbor cases defined what a service provider must know before it loses shelter. The repeat infringer cases showed that the shelter’s conditions have teeth. The misrepresentation cases put the first real check on careless takedowns. And the anticircumvention cases split over a question that Congress never answered cleanly: whether the ban on breaking digital locks reaches conduct that has nothing to do with piracy.

The knowledge question went to the Second Circuit in Viacom International v. YouTube. Viacom sued YouTube in 2007, seeking a billion dollars in damages, and the case became the first great test of section 512(c). Internal YouTube emails showed employees were aware that infringement was widespread on the site. The district court granted YouTube summary judgment anyway, and the Second Circuit’s 2012 opinion in Viacom International, Inc. v. YouTube, Inc., 676 F.3d 19, explained why while narrowing the opening Viacom needed. Knowledge under section 512(c)(1)(A), the court held, must be knowledge of specific and identifiable infringements. A general awareness that the platform teemed with unauthorized copies did not count, and neither did knowledge that particular works existed somewhere on the site without knowing where. Red flag awareness, the statute’s alternative trigger, was specific too. The burden of identifying infringement stayed where Congress had put it, with the rights holder.

The same opinion added a second doctrine that kept the knowledge rule from becoming a license for studied ignorance. Willful blindness, the court held, could in appropriate circumstances demonstrate the knowledge that section 512(c)(1)(A) requires. Section 512(m) relieves service providers of any duty to monitor their services, but the court reasoned that this provision limits rather than abrogates the common law doctrine, because willful blindness is not the same thing as an affirmative duty to monitor. A provider that deliberately avoids confirming specific infringements it has reason to suspect cannot hide behind the resulting ignorance. The court also clarified the neighboring provision: section 512(c)(1)(B), which strips the harbor from a provider with the right and ability to control infringing activity from which it directly profits, does not require specific knowledge, only something more than the bare ability to remove or block access. On remand, the district court again granted YouTube summary judgment in 2013, finding Viacom had tied its evidence of knowledge to no specific clip in suit, and the parties announced a settlement in 2014 that reportedly sent no money to Viacom. The litigation ended, but the standard it produced endured: specific and item-related knowledge, or deliberate blindness to the same.

The Second Circuit also protected YouTube’s automated functions, holding that transcoding uploaded video into a standard format, playing it on watch pages, offering related videos, and syndicating clips to third parties all fell within infringement occurring by reason of the storage at the direction of a user. On the control question, Viacom won a point in theory: the right and ability to control infringing activity under section 512(c)(1)(B) requires something more than the bare ability to remove or block access, though it does not require specific knowledge. The district court on remand found no such something more, since YouTube had not induced its users to infringe. The decision left platforms free to run automated systems without those systems counting against them.

If Viacom taught providers what knowledge they needed to avoid, BMG Rights Management v. Cox Communications taught them what a repeat infringer policy had to actually do. BMG, a music publisher, sued Cox, a major internet access provider, in 2014 over subscriber file sharing on peer to peer networks. As a conduit provider, Cox sought shelter under section 512(a), but every harbor is conditioned on section 512(i), which requires the provider to have adopted and reasonably implemented a policy for terminating the accounts of repeat infringers in appropriate circumstances. The district court held on summary judgment that Cox had forfeited the harbor entirely, and the Fourth Circuit agreed in BMG Rights Management (US) LLC v. Cox Communications, Inc., 881 F.3d 293 (2018). Cox had a nominal thirteen strike process that in practice ran to functionally thousands of strikes, and it routinely reinstated subscribers it had nominally terminated. The appeals court found that Cox had formally adopted a policy but made every effort to avoid reasonably implementing it, and determined not to terminate subscribers who repeatedly violated it. A paper policy, the court made clear, satisfies nothing. The trial record added an unflattering motive: court filings included an internal email from Cox’s manager of customer abuse operations suggesting that enforcement against infringing subscribers be delayed so the company could collect a few extra weeks of payments on their accounts.

The damages phase of Cox showed how costly that failure could be. In December 2015 a federal jury in Virginia found Cox liable for willful contributory copyright infringement and awarded BMG $25 million in statutory damages covering 1,397 works. The Fourth Circuit affirmed the denial of safe harbor protection but vacated the verdict and ordered a new trial, because the trial judge had instructed jurors that Cox could be liable if it knew or should have known of the infringement. That negligence standard, the appeals court held, was too low: contributory infringement requires intentional inducement or knowledge, and willful blindness means conscious avoidance of learning about specific instances of infringement, not mere failure to notice. The verdict fell, but the safe harbor ruling stood, and the message to access providers was unmistakable. Section 512(i) is not a formality. Lose it, and the harbor is gone.

The first meaningful judicial check on the sender’s side of the takedown system came from a 29 second home video. In 2007 Stephanie Lenz posted footage of her toddlers dancing in a kitchen to Prince’s “Let’s Go Crazy,” and Universal Music sent YouTube a takedown notice for it under section 512(c). The notice had been issued through a review process that considered no question of fair use. Lenz sued under section 512(f), which penalizes knowing material misrepresentation in a takedown notice. Represented by the Electronic Frontier Foundation, she pursued the case for years: a district judge ruled in 2008 that copyright holders must consider fair use before sending a notice, rejected Universal’s affirmative defenses in 2010 while noting that her damages appeared nominal, and in January 2013 denied both sides’ motions for summary judgment, sending the dispute to the Ninth Circuit. The Ninth Circuit decided Lenz v. Universal Music Corp., 801 F.3d 1126, in September 2015. Copyright holders, the court held, must consider fair use in good faith before sending a takedown notification, because fair use is not infringement at all but a use authorized by the law, and the required good faith statement in section 512(c)(3)(A)(v) covers authorization by law. Failure to consider fair use raises a triable issue on whether the sender formed the subjective good faith belief the statute requires.

The court was careful about how high the bar stayed. Following Rossi v. Motion Picture Association of America, liability under section 512(f) requires actual knowledge that the notice contained a material misrepresentation, not merely an objectively unreasonable mistake, and the court allowed that willful blindness could satisfy that knowledge requirement in a proper case. It also held that a plaintiff could recover nominal damages for a section 512(f) violation. Under Rossi, the 2004 Ninth Circuit decision the court followed, a sender’s honest but mistaken belief defeats liability even when a court later deems the belief objectively unreasonable. Lenz put senders on notice that the takedown machinery carries a duty of care, even if proving breach of that duty remains difficult. An honest but wrong call about infringement does not trigger liability, but sending notices through a system designed to never ask the fair use question at all creates a jury question about good faith.

The anticircumvention half of the statute, section 1201, produced its own lineage, and its early chapters read broadly. In Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001), the court upheld the anti trafficking provisions against a First Amendment challenge and barred the posting of DeCSS, the program that decrypted the Content Scramble System protecting DVD movies, as well as knowing links to sites offering it. The defendants said the program existed so that DVDs could be played on Linux computers, but the court held that subjective intent did not matter under section 1201, and that fair use, a defense to copyright infringement, was no defense to the separate wrong of circumvention. The opinion treated the anticircumvention provisions as doing what Congress intended: protecting digital works at the lock, not merely at the point of copying. The dispute had begun in the Southern District of New York as Universal City Studios v. Reimerdes, where Judge Lewis Kaplan ruled after a 2000 trial that DeCSS violated the anti trafficking provisions and enjoined both its posting and knowing links to it; the Second Circuit affirmed in November 2001.

Then courts began to ask what happened when the lock had nothing to do with piracy. In Chamberlain Group, Inc. v. Skylink Technologies, Inc., 381 F.3d 1178 (Fed. Cir. 2004), a maker of garage door openers sued the seller of universal transmitters that bypassed its rolling code security system, alleging a violation of section 1201(a)(2). The Federal Circuit upheld summary judgment for the defendant. Section 1201, the court held, creates a new cause of action, not a new property right, and a plaintiff must demonstrate a reasonable relationship between the circumvention and the protections the Copyright Act actually grants. Homeowners who bought Chamberlain’s openers were authorized to access the embedded software, so no such relationship existed, and the statute could not be used to control the aftermarket for garage door parts. The court also placed the burden of proof on the plaintiff, rejecting the argument that Skylink had to prove its innocence. The DMCA creates new grounds for liability, the opinion explained; it does not create a property right that shifts the burden to the accused.

The same year brought the printer cartridge dispute. In Lexmark International, Inc. v. Static Control Components, Inc., 387 F.3d 522 (6th Cir. 2004), Lexmark had equipped its printers with an authentication sequence that rejected toner cartridges not made or refilled by Lexmark, and a competitor sold microchips that defeated the lock. The Sixth Circuit held that the circumvention did not violate the DMCA, because the measure did not effectively control access to a copyrighted work: it restricted one route while leaving another wide open, like a lock on the back door of a house whose front door has no lock. The court also wrestled with whether the tiny programs at issue were even copyrightable. The chip’s purpose was to let competing cartridges work in Lexmark printers, not to pirate anything, and the court declined to let section 1201 become a tool for locking up the market in toner. One concurring judge pushed the point further, warning that the holding should not be read as limited to the facts at hand. Companies should not be able, the concurrence argued, to use the DMCA to manufacture monopolies in ordinary goods by wrapping trivial lock out code in a copyright claim, because the statute’s purpose was to stop piracy of works like movies, music, and software, not to police competition in printer supplies.

Not every court accepted the nexus reading, and a split developed between the circuits that required a connection to copyright infringement and those that treated section 1201 as an independent prohibition regardless of infringing purpose. The practical effect was that the scope of the anticircumvention provisions depended on geography. The same conduct could be lawful interoperability in one circuit and unlawful trafficking in another, and the statute’s text offered no clean resolution. The dispute confirmed that section 1201’s reach was the most contested question in the DMCA’s second decade.

The verdict on the statute, stated plainly, is that there are two statutes in this title, and they serve opposite constituencies. Title I, the anticircumvention provisions, is a rights holder’s instrument: it creates liability independent of infringement, it survived constitutional challenge, and in its broadest readings it reached from DVD decryption to the control of aftermarket parts. Title II, the safe harbors, is an intermediary’s shield: it conditions survival on expeditious takedowns and real repeat infringer policies, but it demands item specific knowledge before a platform forfeits protection, and it preserves the provider’s freedom from any duty to monitor. Both halves were enacted in 1998 as a single negotiated package, and neither was an afterthought. The bargain was explicit: stronger locks for owners, stronger shelter for the networks, each side accepting the other’s gain as the price of its own.

Congress had described the two aims plainly in 1998: give service providers the legal certainty to let the networked economy grow without the threat of ruinous liability for user conduct, and protect the legitimate interests of authors against rampant, low barrier online infringement. The Copyright Office’s 2020 report measured the distance between that design and the result, and found the balance askew. The cases are the record of which parts of the design survived contact with reality.

That is why readings of the DMCA so often talk past each other. Read the statute as a rights holder’s tool, and the eye falls on Corley, on the forfeiture in Cox, on the sheer scale of infringement the safe harbors still permit. Read it as an intermediary’s shield, and the eye falls on Viacom’s specific knowledge rule, on the Chamberlain and Lexmark limits, on the absence of any monitoring duty. Both readings describe the actual law, because the law contains both halves. A verdict that credits only one of them misdescribes the enactment. The statute is the package, and the package was the point.

The litigation strategies follow the same divide. Plaintiffs reach for Title I when they want the lock itself to do the work, and for the conditions of Title II when they want to strip the shelter away, as BMG did with Cox. Defendants reach for Viacom’s specificity rule, for the absence of any monitoring duty, and for the Chamberlain and Lexmark limits on the lock. Each side litigates its half as if the other half were the exception, and the courts have generally refused to let either half swallow the other.

The same discipline applies to the takedown system itself, which neither simply works nor simply fails. On the evidence of scale, it processes infringement claims at a volume and speed no court system could match. Google’s public transparency figures, as analyzed by the trade press, show rights holders asking for the removal of more than a billion URLs from search results in a single twelve month period by 2016, with more than ninety percent removed. The cumulative totals kept climbing: four billion URLs by early 2019, the five billionth notice processed in 2021, and roughly ten billion by 2025. For rights holders, the system offers a cheap, fast, extrajudicial remedy. For providers, compliance at that scale became a core operational function, and major platforms added fingerprinting and filtering tools that go beyond anything the statute requires. On those terms, the machine runs.

On the evidence of accuracy, the machine runs with documented error. The most careful study of the system, Notice and Takedown in Everyday Practice, published in 2016 by Jennifer Urban and Brianna Schofield of the University of California with Joe Karaganis of Columbia University, examined a random sample drawn from more than 100 million notices sent over six months and found that nearly thirty percent of the Google Web Search notices raised questions about validity. In one case in twenty five, the targeted content did not match the identified work at all, a fundamental flaw. Another fifteen percent insufficiently identified the allegedly infringed work. A separate sample of Google Image Search notices was worse: seventy percent raised serious questions about validity, including improper non copyright claims and fair use concerns. The study found that almost all of the high volume notices were generated by automated systems with little human review, and that the counter notice procedure meant to correct errors was described by providers as impractical and infrequently used. The researchers also described a positive feedback loop between automated sending and automated processing: as rights holders deployed bots to generate notices, large providers answered with bots to process them, raising the cost and complexity of the system while leaving little room for human review or discretion. Company published figures pointed the same way: Twitter reported that roughly a third of the notices it received were ineffective, and WordPress put the figure for its own service at sixty percent. The researchers added an unexpected finding: despite large scale infringement, many smaller providers received relatively few notices and still processed them by hand. The strain of automation concentrated at the largest platforms, where notice and takedown had effectively become a machine to machine process.

The Copyright Office weighed in after a five year study. Its report on section 512, released May 21, 2020, concluded that the balance Congress had intended had tilted askew, with aspects of the system operating in favor of online service providers at the expense of rights holders. The Office noted that despite millions of takedown notices submitted daily, the scale of online infringement remained a significant problem, in part because removed material reappeared under new addresses as fast as notices went out, a cycle the recording industry’s chief executive likened to reliving the same day endlessly. At the same time, the report recorded the providers’ view that the harbors had let the internet economy grow without debilitating litigation, and user groups’ complaint that speakers whose lawful material was mistakenly removed had no adequate redress. The Office recommended fine tuning rather than wholesale revision, identifying the repeat infringer definition, the knowledge standards, and notice specificity as areas Congress might clarify.

Both accounts are true at once, and that is the honest assessment the record supports. The takedown system clears infringement at a scale and speed that make enforcement possible at all, and it does so at low cost to the senders. It also removes lawful material through automated error, buries speakers who lack the resources to fight back, and leaves rights holders chasing the same files across new addresses day after day. The statute’s drafters built a compromise machine and got compromise results: a system that neither side loves and that the internet cannot do without.

That is the final shape of the Digital Millennium Copyright Act. It is a rights holder’s sword and an intermediary’s shield bound in one cover, and the courts spent two decades deciding where the sword ends and the shield begins. Knowledge must be specific. Blindness must be willful. Policies must be real. Fair use must be considered. Locks that guard nothing copyright protects are not the statute’s business. None of those rules was in the text in plain form; all of them are the text as lived. The act endures because the bargain endures: protection strong enough for the owners, shelter broad enough for the networks, and a litigation record that keeps both sides honest about the price.

The safe harbor conditions table

Harbor	Activity covered	Conditions attached	What forfeits protection
512(a) transitory digital network communications	Acting as a conduit, moving bits chosen by others between points chosen by others	Transmission initiated by another person; automatic technical process with no selection of material; no selection of recipients except as automatic response to another’s request; no copies kept beyond anticipated recipients or longer than reasonably necessary for transmission; no modification of contents	Choosing or altering the material, retaining copies beyond transmission, or failing the threshold conditions of section 512(i)
512(b) system caching	Automatic intermediate temporary storage retained to make later access more efficient	Material made available online by another person and transmitted at a subscriber’s direction; storage through an automatic technical process; compliance with refresh rules under accepted industry standard protocols; respect for standard technical measures and originating-site access conditions; removal of the cached copy upon proper notice when the original is removed or ordered removed	Ignoring refresh or access rules, interfering with standard technical measures, keeping the cached copy after the original is gone, or failing the threshold conditions of section 512(i)
512(c) information residing on systems at user direction	Storing material users put on the system, the harbor behind video hosting, social media, file storage, and marketplaces	Registered designated agent with the Copyright Office and contact information on the provider’s website; expeditious removal or disabling on a substantially compliant notice; no actual knowledge of infringement and no awareness of facts making infringement apparent, with expeditious removal once such knowledge is obtained; no direct financial benefit from infringing activity the provider has the right and ability to control; adoption and reasonable implementation of a repeat infringer termination policy; accommodation of standard technical measures	A defective designated agent, actual or red-flag knowledge without expeditious removal, profiting from infringement the provider can control, or a paper repeat infringer policy that is never reasonably implemented
512(d) information location tools	Directories, indexes, search engines, pointers, and hyperlinks	No actual knowledge of infringement and no awareness of facts making infringement apparent, with expeditious removal or disabling once such knowledge is obtained; no direct financial benefit from infringing activity the provider has the right and ability to control; expeditious removal of the reference or link on a conforming notification sent to the designated agent or publicly available contact	Knowledge or red-flag awareness without expeditious removal of the link, profiting from infringement the provider can control, or failing the threshold conditions of section 512(i)

Verdict: the package was the point

The verdict the record supports can be stated without hedging: two statutes in one title, and the arguments about this law talk past each other precisely because readers keep judging one half by the other’s logic. Title I is a rights holder’s instrument. It creates liability that does not depend on infringement, it survived constitutional challenge in the DVD decryption cases, and in its broadest readings it reached from the trafficking of lockpicking tools to attempted control of the aftermarket for garage doors and printer cartridges, until courts drew a line requiring a real relationship between the lock and the copyright interest it guards. Title II is an intermediary’s shield. It conditions survival on designated agents, expeditious takedowns, and repeat infringer policies with real teeth, as the Cox litigation showed, while demanding item-specific knowledge before a platform forfeits protection and refusing to impose any duty to monitor.

Neither half was an afterthought, and neither has stood still. The triennial exemption process has become the statute’s standing adjustment mechanism, returning every three years to carve relief for blind readers, filmmakers, farmers, mechanics, and security researchers out of a prohibition that would otherwise reach them all. The takedown system has become the operating constitution of copyright on the commercial internet, clearing infringement at a volume no court system could match while generating documented over-removal through automated sending and receiving.

That design is best placed in its wider context. For why copyright needed its own conditional harbor rather than relying on the internet’s other great liability regime, see the comparison between section 230 and the DMCA’s safe harbors and the intellectual property exclusion that keeps copyright claims out of section 230. For the constitutional challenges the anticircumvention provisions survived, see the internet law cases that tested them. For the broader federal pattern of steering innovation through intellectual property policy, see the Bayh-Dole guide, and for the citation conventions used throughout this article, see how to read a federal statute. Readers who want to work through the statute’s structure with notes and drills can use this legislation study notebook.

Frequently asked questions

Q: What does the Digital Millennium Copyright Act actually require?

It requires two different things for two different audiences. Title I, the anticircumvention provisions at 17 U.S.C. 1201 through 1205, bars the act of circumventing a technological measure that effectively controls access to a copyrighted work, bars trafficking in tools designed to defeat access controls or the measures protecting a copyright owner’s rights, and protects copyright management information against knowing removal or alteration. Title II, the safe harbors at 17 U.S.C. 512, requires nothing of service providers on its own, but it conditions their shelter from monetary liability on cooperation: designating an agent with the Copyright Office, removing material expeditiously on a proper notice, holding no knowledge or red-flag awareness of infringement, taking no direct financial benefit from infringement they can control, adopting and reasonably implementing a repeat infringer policy, and accommodating standard technical measures. The statute also built a triennial rulemaking in which the Librarian of Congress may exempt classes of works from the circumvention ban.

Q: What is section 1201 of the Digital Millennium Copyright Act?

Section 1201 is the anticircumvention core of Title I. Subsection (a)(1) prohibits the act of circumventing a technological measure that effectively controls access to a work protected under title 17, a ban that took effect in October 2000, two years after enactment. Subsection (a)(2) prohibits manufacturing, importing, or trafficking in tools primarily designed for, having only limited legitimate use besides, or marketed for circumventing access controls. Subsection (b) contains the parallel trafficking ban for tools that defeat copy controls, measures that protect a copyright owner’s rights, but it contains no ban on the act of circumventing a copy control. That asymmetry is the section’s most misunderstood feature. The section also carries permanent exceptions for reverse engineering for interoperability, encryption research, security testing, minors, privacy, libraries, and law enforcement, plus the triennial exemption rulemaking and savings clauses preserving fair use and denying any design mandate. Civil remedies sit in section 1203 and criminal penalties in section 1204.

Q: What are the four safe harbors in the Digital Millennium Copyright Act?

Section 512 sets out four separate limitations on liability, one per network function, each with its own conditions. Subsection 512(a) covers transitory digital network communications, the conduit function of an access provider moving bits chosen by others, protected when the transmission is initiated by another person, carried out automatically without selecting material or recipients, with no retained copies and no modification. Subsection 512(b) covers system caching, automatic temporary storage for efficiency, protected when subordinate to the original posting and removed when the original disappears. Subsection 512(c) covers information residing on systems at the direction of users, the harbor behind hosting platforms, marketplaces, and social media. Subsection 512(d) covers information location tools such as search engines and links. All four are conditioned on the threshold duties of section 512(i): a reasonably implemented repeat infringer policy and accommodation of standard technical measures.

Q: How does notice and takedown work under the Digital Millennium Copyright Act?

A copyright owner sends the provider’s designated agent a notification containing six elements: a signature, identification of the work, identification of the infringing material with locating information, contact information, a good faith belief statement, and an accuracy and authority statement under penalty of perjury. On receiving a substantially compliant notice, the provider must act expeditiously to remove or disable access to the material. The subscriber whose material was removed may then send a counternotice with five elements, including consent to federal court jurisdiction, and the provider must restore the material in not less than ten nor more than fourteen business days unless the original complainant files suit. Providers acting in good faith on a notice are insulated from liability to the user, and section 512(f) punishes knowing material misrepresentation in either direction. There is no general duty to monitor; the system runs on notices.

Q: Can you be sued for a false Digital Millennium Copyright Act notice?

Yes, under section 512(f), which imposes liability on anyone who knowingly materially misrepresents that material is infringing in a takedown notice, or that material was removed by mistake in a counternotice. An injured party may recover damages, including costs and attorney’s fees. Winning is difficult because courts read the knowledge requirement subjectively. In Rossi v. Motion Picture Association of America, the Ninth Circuit held in 2004 that an honest but mistaken belief of infringement defeats liability, even if a court later deems the belief unreasonable. Lenz v. Universal Music Corp. added in 2015 that a sender must consider fair use in good faith before sending a notice, since fair use is a use authorized by law, but the court kept the subjective standard: the sender need only form an honest belief, and willful blindness is the narrow exception. Automated systems that never ask the fair use question face a jury issue; senders who give it honest thought stay protected.

Q: What is a repeat infringer policy under the Digital Millennium Copyright Act?

Section 512(i)(1)(A) requires every provider invoking any of the four safe harbors to have adopted and reasonably implemented a policy providing for the termination, in appropriate circumstances, of subscribers and account holders who are repeat infringers. Both adoption and reasonable implementation are required; a paper policy satisfies nothing. In BMG Rights Management v. Cox Communications, the Fourth Circuit held in 2018 that Cox forfeited the harbor because its thirteen-strike system made termination practically impossible, counted only one notice per subscriber per day, reset strikes every six months, and reactivated terminated accounts. The court also held that repeat infringers means anyone who infringes more than once, not only subscribers adjudged infringers by a court. The district court had granted summary judgment to BMG on the harbor defense, and although the jury verdict was later vacated on instructional error, the safe harbor ruling stood.

Q: Does the Digital Millennium Copyright Act block device repair?

It is the principal federal obstacle to it. Section 1201(a)(1) bans the act of circumventing an access control on copyrighted software, and modern devices embed such controls everywhere: authentication handshakes verifying replacement parts, encrypted diagnostic interfaces, firmware locks requiring authorized component signatures. Diagnosing a fault or installing a third-party part requires bypassing those measures, which is circumvention regardless of the noninfringing purpose, because a section 1201 violation needs no infringement and fair use is no defense to the circumvention claim itself. The trafficking bans then block the distribution of repair tools. Relief comes only through the triennial exemption process, which has granted repair classes for motorized land vehicles, consumer devices, medical devices, and more, but each exemption is temporary, must be re-proved every three years, covers only the act of circumvention, and leaves the tool bans intact.

Q: What exemptions does the Librarian grant under the Digital Millennium Copyright Act?

Under section 1201(a)(1)(B) through (E), the Librarian of Congress, on the recommendation of the Register of Copyrights who consults the National Telecommunications and Information Administration, decides every three years which classes of works may be exempted from the circumvention ban. The test is whether the ban adversely affects, or is likely to affect in the next three years, users’ ability to make noninfringing uses of a class, weighed against five statutory factors including archival and educational availability and the effect on criticism, teaching, and research. The roster has grown across nine rulemakings through 2024: phone unlocking, jailbreaking, accessibility for blind readers, excerpts for criticism and teaching, preservation by libraries, security research, device repair, text and data mining, 3D printer feedstock, and medical device data. Each cycle begins de novo, each exemption expires unless renewed, and each excuses only the act of circumvention, never trafficking.

Q: Do you have to infringe copyright to violate section 1201?

No. Section 1201 creates what lawyers call paracopyright, liability independent of copyright infringement. A person can violate the section without infringing any copyright, and can infringe a copyright without violating the section. The wrong the statute defines is the bypassing of a technological measure or the trafficking in circumvention tools, not the copying or use of the work. Watching a lawfully purchased film through a region-free workaround or unlocking a phone you fully paid for can fall within the literal scope of the act ban, even though no infringement occurs. In Universal City Studios v. Corley, the Second Circuit held in 2001 that fair use, a defense to infringement, is no defense to the separate wrong of circumvention. The statute’s exceptions and the triennial exemptions define the relief available, not the fair use doctrine.

Q: What is the difference between an access control and a copy control under the DMCA?

An access control is a technological measure that effectively controls access to a work, meaning it requires authorization, a password, decryption key, or authentication handshake, to reach the work at all. A copy control is a measure that effectively protects a right of a copyright owner, meaning it prevents, restricts, or limits the exercise of a section 106 right such as reproduction, even after access has been granted. Section 1201(a) governs access controls: it bans both the act of circumventing them and trafficking in tools to do so. Section 1201(b) governs copy controls: it bans trafficking in circumvention tools but contains no ban on the act of circumventing a copy control, a deliberate asymmetry meant to leave room for fair use. One measure can serve both functions, as with DVD encryption, and courts have had to sort which prohibition applies to which act.

Q: What penalties does the DMCA impose for circumvention?

Both civil and criminal consequences attach. Under section 1203, an injured person may sue for injunctions, impoundment of devices, and either actual damages plus the violator’s attributable profits or, at the plaintiff’s election before final judgment, statutory damages of not less than 200 dollars and not more than 2,500 dollars per act of circumvention, device, product, component, offer, or performance of service, tripled for a repeat violation within three years of a final judgment. Courts may reduce damages for innocent violators and must remit them for qualifying nonprofit libraries, archives, educational institutions, and public broadcasters. Under section 1204, criminal liability requires a willful violation for commercial advantage or private financial gain: up to 500,000 dollars and five years for a first offense, up to one million dollars and ten years for a subsequent offense, with nonprofit institutions exempt.

Q: What must a takedown notice contain to be valid under section 512(c)(3)?

Six elements. A physical or electronic signature of a person authorized to act for the owner of an exclusive right allegedly infringed. Identification of the copyrighted work claimed infringed, or a representative list when one notice covers multiple works. Identification of the material claimed infringing, with information reasonably sufficient to locate it, in practice specific URLs. Contact information for the complaining party, such as an address, telephone number, and email. A statement of good faith belief that the complained-of use is not authorized by the copyright owner, its agent, or the law. And a statement that the information is accurate and, under penalty of perjury, that the complaining party is authorized to act for the owner. A notice failing substantial compliance is ineffective, except that a provider receiving one that substantially meets the three core elements, work, material, and contact information, must promptly attempt to help the sender complete it.

Q: What is a counternotice, and when does content get put back?

A counternotice under section 512(g) is the subscriber’s path back online after a takedown. It must contain five elements: the subscriber’s signature; identification of the removed material and where it appeared; a statement under penalty of perjury of good faith belief that removal resulted from mistake or misidentification; the subscriber’s name, address, and telephone number; and consent to the jurisdiction of the federal district court where the address is located, or any district where the provider may be found if the address is outside the United States, plus agreement to accept service of process from the complainant. On receiving a conforming counternotice, the provider forwards a copy to the complainant and must restore the material in not less than ten and not more than fourteen business days, unless the complainant first notifies the designated agent that it has filed suit seeking a restraining order.

Q: Must online services monitor their platforms for infringement?

No. Section 512(m) provides that safe harbor eligibility may not be conditioned on a provider monitoring its service or affirmatively seeking facts indicating infringing activity, except as consistent with the standard technical measures the statute requires providers to accommodate. Congress deliberately rejected a duty to police, which is why the knowledge standard and the notice system carry the enforcement weight: the provider need not go looking but must act once it knows or is told. In Viacom v. YouTube, the Second Circuit held in 2012 that this provision limits rather than abrogates the common law doctrine of willful blindness, so a provider that deliberately avoids confirming specific suspected infringements may still be treated as knowing. The result is a specific-knowledge regime: general awareness that infringement occurs somewhere on a service does not cost the harbor, but deliberate blindness to identifiable instances can.

Q: What is the reverse-engineering exception in section 1201(f)?

Section 1201(f) permits circumventing an access control on a particular portion of a computer program for the sole purpose of identifying and analyzing the elements necessary to achieve interoperability of an independently created program with other programs. Three conditions apply: the person must have lawfully obtained the right to use the copy, the analyzed elements must not have been previously readily available, and the analysis itself must not constitute infringement. Information acquired, and the means used to acquire it, may be shared with others solely to enable interoperability of an independently created program, to the extent the sharing does not constitute infringement or violate other law. Subsections (f)(2) and (f)(3) go further, expressly permitting the development and sharing of circumvention tools for this purpose, one of the few places in the section where making and distributing a tool is allowed. Interoperability means programs exchanging information and mutually using what they exchange.

Q: What is the copyright management information rule in section 1202?

Section 1202 implements the treaties’ parallel duty concerning rights management information, the data identifying a work, its author or owner, and the terms of authorized use. It bars knowingly removing or altering copyright management information, and bars distributing copies of works knowing the information has been removed or altered, with knowledge that the conduct will induce, enable, facilitate, or conceal infringement. Like the anticircumvention rules, it protects a layer around the work rather than the work’s copying: the identifying information attached to a work must not be stripped or falsified. Violations carry the same civil remedies under section 1203 and criminal penalties under section 1204 as section 1201 violations. The provision answers the digital problem the treaties named: in a networked environment, works circulate far from their authors, and the metadata telling users who owns a work and on what terms becomes the owner’s first line of enforcement.

Q: What two international treaties did the DMCA implement?

The WIPO Copyright Treaty and the WIPO Performances and Phonograms Treaty, both adopted on December 20, 1996, at a diplomatic conference in Geneva convened by the World Intellectual Property Organization. Article 11 of the Copyright Treaty required member states to give adequate legal protection and effective remedies against circumvention of effective technological measures used by authors in connection with the exercise of their rights, and Article 18 of the Performances and Phonograms Treaty imposed a parallel duty for performers and producers of phonograms. Companion articles required remedies against knowing removal or alteration of electronic rights management information. The treaties left each member state to choose its legislative form; Title I of the 1998 act was the American answer, translating the obligations through the access-control and copy-control distinction, the act and trafficking structure, the civil and criminal remedy scheme, and the catalog of exceptions that other treaty members implemented differently in their own laws.

Q: What is the Copyright Office’s designated agent directory for?

Section 512(c)(2) requires a provider invoking the user-storage harbor to designate an agent to receive notifications of claimed infringement, register that agent with the Copyright Office, and publish the agent’s contact information on its own website. The directory is the registry Congress later directed the Office to maintain electronically; providers that had registered under the old paper system were required to re-register online to keep their designations effective. Its function is procedural but decisive: a takedown notice sent to the wrong place, when a proper agent was designated and published, does not trigger the provider’s duty to act expeditiously, and notifications under the information-location-tools harbor are effective when sent to the designated agent if one exists. The directory tells copyright owners exactly where a valid notice must go, and tells courts whether a provider met the harbor’s threshold conditions.

Q: Does the DMCA apply to conduct outside the United States?

The statute is American law amending title 17 of the United States Code, and its treaty obligations were implemented separately by each member state in its own legislation, so the DMCA itself governs within the American legal system. The statute’s machinery nonetheless reaches across borders in defined ways. The counternotice procedure in section 512(g) expressly contemplates subscribers whose addresses are outside the United States, requiring them to consent to jurisdiction in any federal district where the provider may be found and to accept service of process from the complainant as the price of getting material restored. Copyright owners worldwide use the notice system against American providers because the safe harbors condition American providers’ shelter on responding to notices, wherever the complaining owner sits. Conduct purely abroad, with no American nexus, is governed by the implementing law of the country where it occurs.

Q: Can a company use the DMCA to block aftermarket competition?

Companies have tried, and courts have split on how far the statute lets them go. In Chamberlain Group v. Skylink Technologies, the Federal Circuit held in 2004 that section 1201 creates a new cause of action, not a new property right, and a plaintiff must show a reasonable relationship between the circumvention and the protections copyright actually grants; homeowners were authorized to access the opener’s software, so the statute could not control the aftermarket for garage door parts. In Lexmark International v. Static Control Components, the Sixth Circuit held the same year that a printer’s authentication sequence did not effectively control access to a copyrighted work, like a lock on a back door with the front door wide open, and declined to let section 1201 police the toner market. A concurring judge warned companies should not manufacture monopolies in ordinary goods by wrapping trivial lockout code in a copyright claim. The statute stops piracy, not competition.