On the Content-Neutrality of the DMCA

A number of courts, most recently the Federal District Court for the Northern District of California, have ruled that despite code being speech, the DMCAs anti-circumvention restrictions are "content-neutral". This subjects them to only "intermediate" scrutiny, where the First Amendment is not violated if the government has written its prohibitions in a manner narrowly tailored to addresss a legitimate government aim. The usual example of 'content-neutral' regulations are "time, place, and manner" restrictions. A regulation forbidding anyone from making a speech through a bullhorn at 2am in a residential neighborhood is not unconstitutional. A regulation forbidding the same speech if and only if it contains advocacy of pacifism is.

The DMCA-supporting courts have come up with another supposedly content-neutral category, that of function. To them, speech may be forbidden if its function is to direct a computer to circumvent a technological protection measure, regardless of its content. This is pure sophistry. The function of a computer program is defined by its content. Here is an example of an decryption algorithm implemented in the C programming language:

void tea_decode(long* v,long* k)  {
  unsigned long n=32, sum, y=v[0], z=v[1],
               delta=0x9e3779b9 ;

  sum=delta<<5 ;
                       /* start cycle */
  while (n-->0) {
    z-= (y<<4)+k[2] ^ y+sum ^ (y>>5)+k[3] ; 
    y-= (z<<4)+k[0] ^ z+sum ^ (z>>5)+k[1] ;
  sum-=delta ;  }
                       /* end cycle */
  v[0]=y ; v[1]=z ;  }

  long key[4];
  long data[2] = {0,0};
  int n;

  read(0, key, 16);
  while ((n = read(0, data, 8)) > 0) {
    tea_decode(data, key);
    write(1, data, 8);
    data[0] = data[1] = 0;

Here is another decryption algorithm, also written in C

#define m(i)(x[i]^s[i+84])<<
unsigned char x[5],y,s[2048];
main(n) {
  for(read(0,x,5);  read(0,s,n=2048);  write(1,s,n))
    int i=m(1)17^256+m(0)8,k=m(2)0,j=m(4)17^m(3)9^k*2-k%8^8,a=0,c=26;

Aside from content, what's different about these two? Certainly their place is the same; they are both right here on this page. Their manner is the same; they are both machine-readable source code written in the C language (though arguably the language is also content -- would a law forbidding speaking Spanish be a permissible content-neutral regulation?). And their time is the same; they are both available whenever this web server is up.

The real difference between these two is that the former is legal and the latter is illegal. The former is the reference implementation of the decryption part of the Tiny Encryption Algorithm by David Wheeler and Roger Needham at Cambridge (I added a 'main' to do the I/O.. it's not tested). The latter is the smallest known C implementation (ignoring whitespace, which I added) of the infamous CSS decryption algorithm, by Charles M. Hannum and available through David Touretzky's Gallery of CSS Descramblers.

Since the only difference between these pieces of code is content, and the DMCA forbids one but not the other, it follows that the DMCA is not a content neutral regulation. Non-content-neutral regulations of speech are generally subject to the highest scrutiny: The restriction must be necessary to serve a compelling state interest. Is the absolute protection of technological protection schemes designed to prevent copying a "compelling state interest"? It certainly wouldn't seem so, when restrictions on speech which could lead to or assist in actual killings have been found unconstituional under that standard. Hopefully some court will see the light or we're in for a long period of darkness. And, at least codewise, silence.

A note on "conduct"

It should be clear from the above examples that a computer program is not "conduct". It's just sitting there. Certainly writing a computer program is conduct. Reading a program is conduct too. As is selling a program, or giving it away. All these are forms of conduct that, with any other form of speech, would be protected by the First Amendment. With a program is there is one more form of conduct: executing, or running the program. This may arguably not be protected. But the DMCA goes beyond forbidding running the program to forbidding its production and sale and forbidding giving it away.

The reason for this is clear: a law forbidding only running the program would be practically unenforcable in most situations. And pointless, too -- if the authorities could get the people actually circumventing the technological measures, they could go beyond that, examine their particular act of circumvention, and determine if the circumvention was for a purpose otherwise forbidden by copyright laws. The excuse of forbidding circumvention entirely because there's no way of knowing whether circumvention was for legal use or infringing use would no longer apply.

However, this does not excuse the DMCA from scrutiny. The fact that the government wants to ban an unprotected action, but finds it impractical to enforce such a ban, does not give it carte blanche to ban a whole category of protected actions in order to get at those unprotected actions. Particularly not when the DMCA device provisions are not one but two steps removed from the government interest at the heart of the matter: protection of a copyright holder's exclusive rights.

One further note: I don't believe that given a fair analysis, the DMCA can survive even intermediate scrutiny. It is not at all narrowly tailored, despite the opinion of the Elcomsoft court. Quite the opposite; it is sweeping in scope. It bans any act of circumvention, and any circumvention device, regardless of the legality of the underlying act the circumvention was designed to enable. The only thing narrowly tailored about it is the exceptions, and they are so narrowly tailored as to be practically nonexistent. Unfortunately, the courts feel differently.