Anticircumvention Under the Digital Millennium Copyright Act: Universal Studios v. Corley

CRS Report for Congress
Anticircumvention under the
Digital Millennium Copyright Act:
Universal Studios v. Corley
January 23, 2002
Robin Jeweler and Christopher Alan Jennings
Legislative Attorneys
American Law Division

Congressional Research Service ˜ The Library of Congress

Anticircumvention under the Digital Millennium
Copyright Act: Universal Studios v. Corley
In 1998, Congress passed the Digital Millennium Copyright Act (DMCA). Title
I implements two 1996 World Intellectual Property Organization (WIPO) treaties,
both of which contain language obligating member states to prevent circumvention
of technological measures designed to protect copyrighted works and to prevent
tampering with the integrity of copyright management information. To this end, the
Act adds a new chapter 12 to the U.S. Copyright Act, 17 U.S.C. §§ 1201 - 1205,
entitled “Copyright Protection and Management Systems.” Section 1201(a)(1)
prohibits any person from circumventing a technological measure that effectively
controls access to a copyrighted work, while the antitrafficking provisions of
§1201(a)(2) and (b)(1) cover those who traffic in technologies designed to circumvent
access control devices protecting copyrighted material from unauthorized copying or
use. Civil remedies and criminal penalties are established.
Since enactment, the copyright protection and management provisions, i.e., the
“anticircumvention” provisions, have proven controversial. Critics argue that the
DMCA has a chilling effect on rights of free speech. A university professor, Edward
Felten, who decrypted software protecting digital music was threatened with liability
under the Act if he presented his findings publicly. And a Russian computer
programer, Dimitry Sklyarov, faced criminal charges under the Act’s anti-trafficking
provision. Neither of these incidents, however, has resulted in a definitive judicial
interpretation of the Act.
The Second Circuit Court of Appeals, however, in Universal Studios v. Corley,
recently issued a decision which establishes an analytical constitutional framework
for the anticircumvention provisions. This report examines this decision, which
considers whether public dissemination of the computer code called DeCSS to
descramble encryption of Digital Versatile Disc motion pictures may be prohibited.
In upholding a broad injunction prohibiting the posting or hyperlinking of DeCSS on
the Internet, the DMCA has survived its first constitutional challenge.
As the courts entertain more anticircumvention litigation, this report will be

Introduction ................................................ 1
Universal Studios, Inc. v. Corley................................3
The U.S. District Court’s Decision...........................3
The Decision of the United States Court of Appeal for the
Second Circuit......................................5
The First Amendment Framework...........................6

Anticircumvention under the Digital
Millennium Copyright Act: Universal Studios
v. Corley
In 1998, Congress passed the Digital Millennium Copyright Act (DMCA).1 The
Act is wide-reaching and addresses many copyright-related issues. Title I implements
two 1996 World Intellectual Property Organization (WIPO) treaties, both of which
contain language obligating member states to prevent circumvention of technological
measures designed to protect copyrighted works and to prevent tampering with the
integrity of copyright management information.2 To this end, the Act adds a new
chapter 12 to the U.S. Copyright Act , 17 U.S.C. §§ 1201 - 1205, entitled “Copyright
Protection and Management Systems.” Section 1201(a)(1) prohibits any person from
circumventing a technological measure that effectively controls access to a
copyrighted work, while the anti-trafficking provisions of §1201(a)(2) and (b)(1)
cover those who traffic in technologies designed to circumvent access control devices
protecting copyrighted material from unauthorized copying or use. Civil remedies and3
criminal penalties are established.
Since enactment, the copyright protection and management provisions, i.e., the
“anticircumvention” provisions, have proven controversial. While proponents assert
that these provisions are essential to protect valuable intellectual property rights in the
digital age, critics argue that the DMCA has a chilling effect on rights of free speech
and that its implementation will thwart the public’s right to legitimate access to
copyrighted works through the exercise of “fair use.”
Several well-publicized incidents, and the opposition of organizations such as the
Electronic Frontier Foundation (EFF), have fueled the controversy over the DMCA.
The recording industry, in an effort known as the Secure Digital Music Initiative,
seeks to develop open industry specifications for the protection of digital works.
Towards this end, the industry, in the Spring of 2001, issued a public challenge to
decrypt copyright protection technology designed to protect digital music. A
professor at Princeton University, Edward Felten, and his colleagues took up the
challenge and cracked the code.

1P.L. 105-304 (1998).
2The Digital Millennium Copyright Act of 1998: U.S. Copyright Office Summary, 3 (Dec.


317 U.S.C. §§ 1203, 1204.

When professor Felten announced his intention to present his findings publicly
at a conference, the Recording Industry Association of America (RIAA) wrote to the
professor, asserting that public dissemination of the decryption code would be in
violation of the DMCA. Professor Felten did not make the public presentation, and
the RIAA subsequently withdrew its threat to sue. Nevertheless, Professor Felten,
represented by attorneys at the EFF, filed suit against the RIAA alleging that the
DMCA had a chilling effect, hence, violated his First Amendment right to publish
research. He sought a declaratory judgment that publication of his findings would not
be a violation of the DMCA. The U.S. district court dismissed his claim, although the
EFF has indicated that they will file an appeal.4
And, in the first criminal prosecution for trafficking in violation of the Act, a
Russian computer programer, Dimitri Sklyarov, was arrested in July 2001 in Las
Vegas where he was attending a computer “hacker” convention.5 He was
subsequently indicted. Mr. Sklyarov is alleged to have developed a software program
that unlocked Adobe System’s “eBook Reader.” The eBook reader program protects
the copyright holder’s interest in an electronic book by limiting computer access to
the encrypted eBook. But the program, “Advanced eBook Processor,” developed by
Mr. Sklyarov, and marketed by ElcomSoft Company in Moscow through its website,
would enable consumers who purchase an encrypted eBook from an online bookseller
to “unlock” it. Advanced eBook Processor decrypts an eBook so that it can be
opened in any Portable Document Format (PDF) viewer, such as Adobe Acrobat
reader. Once converted, the PDF file has no effective protections against copying,
editing, or printing of the eBook.
In December 2001, the U.S. Attorney’s Office announced that it had reached an
agreement with Mr. Sklyarov. In exchange for his cooperation and testimony in its6
suit against ElcomSoft, the Government will drop charges against him.
These events received publicity and aroused spirited debate about the impact of
the DMCA’s anticircumvention provisions, but they have not, to date, resulted in a
definitive judicial interpretation of the Act’s scope and legitimacy. Nevertheless, the
first U.S. Court of Appeals to examine issues raised by the DMCA, including its
constitutionality under the First Amendment, has upheld it.

4Court Bench Decision Dismisses Researcher’s Objections to DMCA Provisions, 6 BNA
5U.S. Dept. of Justice, Press Release, Russian Man Charged in California under Digital
Millennium Copyright Act with Circumventing Adobe eBook Reader, July 17, 2001 at
6U.S. Dept. of Justice, Press Release, Russian National Enters Into Agreement with the
United States on First Digital Millennium Copyright Act Case, Dec. 13, 1001 at

This report examines the decision, Universal Studios v. Corley,7 which considers
whether public dissemination of the computer code called DeCSS to descramble
encryption of DVD motion pictures may be prohibited.
Universal Studios, Inc. v. Corley
The U.S. District Court’s Decision. Eight major motion picture studios
brought suit against computer hackers who developed and disseminated a computer
program to override and defeat the plaintiffs’ encryption system. The studios
distribute motion pictures for home use on digital versatile discs (DVD s) and protect
them from being copied using an encryption system called the Content Scramble
System (CSS). The encrypted DVDs may only be viewed – not copied – on players
and computer drives equipped with the licensed decryption technology.
In September 1999, a fifteen-year-old Norwegian, Jon Johansen, and two other
individuals reverse engineered a licensed DVD player and discovered the CSS
encryption algorithm and keys. Based on this information, they created DeCSS, a
program capable of decrypting or “ripping” encrypted DVDs. Mr. Johansen posted
the DeCSS code on his Internet web site.
Although Mr. Johansen was subject to charges filed in Norway, he was not a
defendant in the studios’ suit. Defendants include Eric Corley, described as “a leader
of the computer hacker community,” and his company, 2600 Enterprises, which
publishes a magazine called “2600: The Hacker Quarterly.” Defendants posted the
DeCSS code on the web site. The studios filed suit to enjoin the
defendants from posting DeCSS and to prevent them from electronically “linking”
their site to others that post it. The defendants responded with self-described
“electronic civil disobedience,” i.e., they increased their efforts to link their web site
to others to continue to make DeCSS available.8
The court reviewed the development of CSS – a means to control access to the
plaintiff’s copyrighted work – and determined that DeCSS is “clearly a means of
circumventing” it. DeCSS’ creators explained that the program was not developed
to pirate copyrighted movies but to further development of a DVD player that would
run under a Linux, as opposed to a Windows, operating system.
The court concluded that CSS is a technological means that effectively controls
access to the plaintiffs’ DVD motion pictures; that the only function of DeCSS is to
circumvent CSS; and that defendants did offer and provide DeCSS by posting it on
their web site. The defendants’ subjective intent, i.e., whether they posted the code
in order to infringe, or encourage others to infringe copyright, does not matter under

17 U.S.C. § 1201.

7Universal Studios v. Reimerdes, 111 F. Supp. 2d 294 (S.D.N.Y. 2000), as amended, aff’d
sub nom. Universal Studios v. Corley, 273 F.3d 429 (2d Cir. 2001).
8111 F. Supp. 2d at 303.

Nor, according to the court, did the activity come within any of § 1201's
statutory exceptions for reverse engineering, 9 good faith encryption research,10 or,
security testing,11
Fair Use. The court found that the defendants raised a “significant” point in the
assertion that access control measures like CSS may prevent lawful as well as
unlawful uses of copyrighted material. For example, it could thwart the ability of a
film studies professor to prepare a CD-ROM containing two different scenes from
movies to illustrate a lecture on cinematography. But the defendants were not being
sued for copyright infringement, to which fair use is a defense. They were sued for
violating the anticircumvention provision of the DMCA, which, by express
congressional intent, precludes the fair use defense:
The fact that Congress elected to leave technologically unsophisticated persons
who wish to make fair use of encrypted copyrighted works without the technical
means of doing so is a matter for Congress unless Congress’ decision contravenes
the Constitution[.]12
The First Amendment. The court went on to consider whether the DMCA’s
anticircumvention provisions, as applied to prevent the public dissemination of
DeCSS, violate the First Amendment. The court acknowledged that defendants
accurately assert that computer code, to the extent it is used to express ideas, may be
“protected speech,” but went on to analyze both its function and the level of
protection afforded in the case before it. It concluded that even though the substance
of the computer code may be expressive, DeCSS has a functional, non-speech aspect:
it enables recipients to circumvent the CSS system.
Society’s increasing dependence upon technological means of controlling access
to digital files and systems, and its importance in the digital world led the court to
accord more weight to the functional, non-speech aspect of the DeCSS computer
program and to hold that the anticircumvention provision of the DMCA is a valid,
content-neutral regulation in furtherance of important governmental interests:
Here, dissemination itself carries very substantial risk of imminent harm because
the mechanism is so unusual by which dissemination of means of circumventing
access controls to copyrighted works threatens to produce virtually unstoppable
infringement of copyright.13
Injunctive Relief. The same urgency which compelled the court to elevate the
computer program’s functionality over its characterization as expressive speech
supported the court’s issuance of broad injunctive relief against the posting of
DeCSS. Hence, it enjoined others from posting DeCSS by linking web sites. It

917 U.S.C. § 1201(f).
1017 U.S.C. § 1201(g).
1117 U.S.C. § 1201(j).
12Reimerdes, 111 F. Supp. 2d at 323.
13Id. at 332.

acknowledged that the extension of the prohibition to Internet hyperlinks could have
a possible chilling effect or be viewed as too broad and issued the following caveat:
Accordingly, there may be no injunction against, nor liability for, linking to
a site containing circumvention technology, the offering of which is unlawful under
the DMCA, absent clear and convincing evidence that those responsible for the
link (a) know at the relevant time that the offending material is on the linked-to
site, (b) know that it is circumvention technology that may not lawfully be offered,
and (c) create or maintain the link for the purpose of disseminating that14
Finding monetary damages to be inadequate, and proof of actual damages to be
difficult if not impossible, the court granted a permanent injunction against the posting
of DeCSS. It addressed the defendants’ argument that an injunction would be futile
because DeCSS is already all over the Internet. To deny relief would be to encourage
others to replicate unlawful conduct and to create a “futility defense.” But the court
was more troubled by the magnitude of destruction of intellectual property rights
posed by the Internet:
These defendants would harm plaintiffs every day on which they post DeCSS on
their heavily trafficked web site and link to other sites that post it because someone
who does not have DeCSS thereby might obtain it. ...[T]his decision will serve
notice on others that “the strong right arm of equity” may be brought to bear
against them absent a change in their conduct and thus contribute to a climate of
appropriate respect for intellectual property rights in an age in which the
excitement of ready access to untold quantities of information has blurred in some
minds the fact that taking what is not yours and not freely offered to you is15
The Decision of the United States Court of Appeal for the Second
Circuit.16 The Second Circuit’s analysis illustrates the tension between preserving
free speech rights while protecting property rights in the age of the Internet. The
court acknowledged that it was not within its purview to attempt to strike an optimal
balance between the interest in freedom of speech and press, on the one hand, and the
interest in protecting intellectual property from rampant piracy, on the other. This,
the court commented, is not a question appropriate for the courts, but only for
[T]he fundamental choice between impairing some communication and tolerating
decryption cannot by entirely avoided. In facing this choice, we are mindful that
it is not for us to resolve the issue of public policy implicated by the choice we17

have identified. Those issues are for Congress.
14Id .at 341. (Footnotes omitted.)
15Id. at 344. See also, Universal Studios v. Reimerdes, 111 F. Supp.2d 346 (S.D.N.Y.

2000)(Final injunction)

16Universal Studios v. Corley, 273 F.3d 429 (2d Cir. 2001).
17Id. at 458.

Rather, the court resolved the questions before it in a narrow fashion, considering
only whether the balance proffered by Congress meets standards of constitutional
sufficiency under the First Amendment:
Our task is to determine whether the legislative solution adopted by Congress, as
applied to the Appellants by the District Court’s injunction, is consistent with the18
limitations of the First Amendment, and we are satisfied that it is.
The Second Circuit concluded that the computer code at issue enjoyed First
Amendment protection, but applied a diminished standard of constitutional protection
– intermediate scrutiny – to the regulation. Under this standard, the injunction was
upheld, and the DMCA survived its first serious constitutional challenge.
The First Amendment Framework. The defendant’s central defense
involved the First Amendment, under which he argued that the application of the
DMCA to his publishing activities violated his freedom of speech.
A First Amendment defense to a law of general applicability proceeds through
three basic issues: (1) a court considers whether the challenged regulation burdens
“speech” protected by the First Amendment; it then asks (2) what level of First
Amendment protection and standard of review extends to that speech (i.e., rational
basis, intermediate scrutiny, or strict scrutiny); and, finally, (3) the court applies the
appropriate standard to determine whether the regulation withstands minimal
constitutional sufficiency.
Is computer code speech? The Court first held that all forms of computer code,
ranging from source code (read: the language in which computer programers speak)
to object code (read: binary code or machine code), are cognizable as “speech” for
purposes of the First Amendment and are, thereby, worthy of protection.19 In

18Id. (Two injunctions were issued. One was issued to prevent the posting of DeCSS, and the
other was issued to prescribe hyper-linking to DeCSS.)
19273 F.3d at 445- 449. “Source code” is the language in which computer programers speak,
while “object code” is the language in which computers speak.
Source code is the form a computer program takes when it is written by a programer in a
programing language, like perl or C. This language must be compiled into object code or
machine code or executed by an interpreter before a computer can understand and perform the
program’s instructions. Object code contains a sequence of instructions that the computer’s
processor can understand, but is difficult for a human to read or modify. (An instruction is an
order given to a computer processor by the computer program, ultimately manifesting as a
sequence of 1s and 0s.) In this regard, the distinction between source code and object code
may be a distinction without a difference, they are merely different forms of expressing the
same substantive concept.
The distinction is akin to expressing an instruction in English to a German speaker through
a translator: while the instruction initially manifests in a form incomprehensible to the intended
receiver (as English or source code), it is translated (by a translator/“compiler”) in a manner
comprehensible (in German/“object code”) to the receiver (the German-speaker/computer-

addition, the court questioned whether two forms of computer-related activity
constitute protected speech: hyperlinking and decryption programing.
The court issued a broad holding on the preliminary issue, finding that regulation
of computer code and its derivative manifestations or application (e.g., computer
programs and hyperlinks) triggers First Amendment protection. When scientists and
programers publish code, they may communicate ideas between other computer
scientists and programers – for instance, ideas about computational procedure. This
capacity, in the court’s view, creates a speech component of computer code.20
What is the scope of the First Amendment protection and to what does it apply?
The primary issue before the court involved the scope of the First Amendment’s
protection for computer code. While the court’s analysis on the first line of First
Amendment inquiry – whether protection attaches – is clear and broad, its analysis on
the second line – the scope of protection – is not.
The court began its analysis by restating the basic rule that “content-neutral
regulations incidentally burdening speech activity generally receive intermediate
scrutiny.”21 Two characterizations of fact serve as the basis for the court’s analysis.
First, computer code is, by its nature, expressive and functional (i.e., at the same time,
code expresses ideas, concepts, and values about computer programing to other
computer programers and instructs computers to perform a function).22 Second, it
found that when regulation is directed at the functional aspects of computer code (the

19 (...continued)
processor). Just as it is possible to communicate with a German speaker without knowing
German, it is possible to write a source program without knowing about the object code that
instructs the actual functions of the computer that carries out the program.
20See Corley, 273 F.3d at 454. Other courts, commenting on the First Amendment status of
source code, have issued narrow and divergent holdings, leaving open the issue of whether
object code is within the ambit of the First Amendment. See e.g. Junger v. Daley, 209 F. 3d
481, 485 (6th Cir 2000)(holding that “because computer source code is an expressive means
for the exchange of information and ideas about computer programing, . . . it is protected by
the First Amendment.”(emphasis added)) In dicta, another court found that computer
programs manifesting as object code (i.e. “compiled source code”) “would not convey ideas,”
suggesting a possible argument that a publication of object code would not receive First
Amendment protection. DVD Copy Control Association v. Bunner, 93 Cal. App. 4th 648,
661 (2001), citing Junger, 209 F.3d at 484-485. The Bunner court held that an injunction
brought under a state trade secrets law against the Internet publication of DeCSS source code
amounted to a regulation of “pure speech within the ambit of the First Amendment.” Id. at
666. See also, Bernstein v. United States Department of State, 945 F. Supp 1279, 1287
(N.D. Cal. 1996)(holding that “software relating to encryption is simply a topic of speech
employed by some scientists involved in applied research, [and is] speech afforded the full
protection of the First Amendment, not because it enables encryption, but because it is itself
21 Corley, 273 F.3d at 450. A regulation restricting speech is content neutral “if it is justified
without reference to the content of the regulated speech.” See id., citing Hill v. Colorado, 530
U.S. 703, 720 (2000).
22 Id. at 450

instructions to a computer), not the expressive aspect (the speech to other
programers), then it would be construed as content-neutral regulation of speech,
subject to intermediate scrutiny.23 These characterizations aided the court in
construing the DMCA as a content neutral regulation, causing the court to apply
intermediate scrutiny.
The Corley court held that when regulation burdens a computer code’s
functional aspects, and only incidentally burdens its expressive content, the regulation
will be subjected to intermediate scrutiny. This is a lower standard of scrutiny than
courts traditionally extend to speech protected under the First Amendment. As the
outcome of a First Amendment case turns on the applicable standard scrutiny, this
ruling constitutes the heart of the Corley decision. We, therefore, pause our case
analysis to consider the extension of this standard in future cases.
The line the court draws between the speech and non-speech, or the expressive
and functional aspects of computer code, may pose difficulties in future cases. While
some hypothetical cases pose situations where the court’s rationale and rules are fairly
easy to apply, the extension of the court’s rationale in other cases may prove harder
to apply. Thus, the court’s holding, while clear on the facts before it, may prove
vague in extension.
For instance, computer code posted on the Internet in the form of executable
binary or in programing language with a compilable source at hand appears to possess
higher degrees of functionality than constitutionally protected expression. This is so
because, in these cases, a user (or reader) can, with a few clicks of a mouse,
download and run the program, allowing the user to exploit the code’s functional
attributes (e.g. decrypting DVDs), rather than studying the code’s architectural,
syntactic, and semantic features (e.g., examining the expressive aspects of code).
However, it is not clear whether, for example, a decryption algorithm expressed in a
formal, code-like language that has no corresponding compiler (meaning that no
computer in the world could read and thus execute the language) has any functional
attributes whatsoever. Indeed, when a computer language exists as pure abstraction,
it is not clear whether or how the speech/non-speech division in Corley would apply.
Other questions respecting the extension of Corley’s speech/non-speech
distinction abound. For example, to what degree is code printed on a piece of paper
functional, to what degree is it expressive? Does a more abstract description of a
decryption algorithm presented during a lecture before a computer science class in a
language other than source or object code have equivalent functional attributes to
DeCSS? Would the use of decryption code in an academic setting rather than a

23Id. at 454. Cf. Bunner at 664 (finding that a preliminary injunction issued against a posting
of DeCSS source code amounted to a prior restraint on pure speech, which “are highly
disfavored and presumptively unconstitutional,” and holding that an economic interest in a
“trade secret is not an interest that is ‘more fundamental’ than the First Amendment right to
freedom of speech or even on an equal footing with the national security interests and other
vital governmental interests that have previously been found insufficient to justify a prior

commercial setting heighten the level of scrutiny that a court would apply? That is,
would the regulation cease to be content neutral once applied to an educational use
of code? These issues do not appear to be immediately answerable through the
court’s distinction between function and expression.
Though arguably vague in extension, the court’s rationale served its purposes in
a clear manner in the case before it. Indeed, the court explicitly narrowed its rationale
and reasoning to the facts before it, “favoring narrow holdings that would permit the
law to mature on a case by case basis.”24
Other courts addressing the First Amendment status of computer code have
found the functional characteristics of computer programs irrelevant on the first and
second lines of First Amendment inquiry. Rather, these courts found the distinction
relevant on the limited issue of measuring the government’s interest in regulation,
which speaks to the third and final line of inquiry – the application of the appropriate25
standard to the present case.
Constitutional Protection for Posting DeCSS. The free speech questions
posed by the district court’s injunction against Corley’s publishing activities followed
three lines of inquiry required by intermediate scrutiny: (1) whether the prohibition
on publishing DeCSS under the DMCA was content neutral, (2) whether the
application of the DMCA under these circumstances served a substantial
governmental interest unrelated to the suppression of ideas, and, (3) whether the
means chosen did not burden substantially more speech than was necessary to serve
that interest. The court evaluated each issue in turn.
Content Neutrality. Corley argued that the anti-trafficking provisions of the
DMCA are not content neutral because they “specifically targeted scientific
expression based on the particular topic addressed by that expression – namely,
techniques for circumventing CSS.”26 The court found this analysis unresponsive to
the speech/non-speech nature of computer code, focusing instead on the functional
character of computer code. The DMCA, and the posting for that matter, was not
“concerned with whatever capacity DeCSS might have for conveying information to
a human being,” but with DeCSS’s ability to “instruct a computer to decrypt CSS.”27

24 Id. at 444, citing Name.Space, Inc. v. Network Solutions, Inc., 202 F.3d 573, 584 n. 11 (2d
Cir. 2000).
25 See e.g. Junger, 209 F.3d at 484 - 485 (6th Cir. 2000)(holding that the “functional
characteristics” of computer code do not speak to the First Amendment status of computer
code, but only to “the governmental interest in regulating the exchange of this form of
speech.” The court rejected the premise that the functionality of computer code defeats First
Amendment protection: “the fact that a medium of expression has a functional capacity should
not preclude constitutional protection. Rather, the appropriate consideration of the medium's
functional capacity is in the analysis of permitted government regulation.”)
26 Supplemental Brief for Appellants at 1. See MPAA_DVD_
cases/ 20010530_ny_eff_supl_brief.html <visited January 3, 2002>.
27 Corley, 273 454.

That functional capacity “is not speech within the First Amendment.”28 Thus
regulation directed at inhibiting that function is not a content-based regulation of
A Substantial Governmental Interest Unrelated to the Suppression of Free
Expression. Quickly dispensing with this issue, the court found a substantial
governmental interest in providing owners of copyrighted materials with effective
rights and remedies to protect their proprietary material from unauthorized use.
Moreover, the court concluded, “the interest is unrelated to the suppression of free
expression,” since the injunction relates to the posting of DeCSS, regardless of
whether DeCSS contains expressive content that would qualify as speech.29
Narrow Tailoring. The court labored over the final issue, whether the incidental
regulation on speech burdens substantially more expression than is necessary to
further the government’s interest in preventing unauthorized access to copyrighted
material. The court noted that Congress could have attached civil and criminal
liability only to those who actually gained unauthorized access to the copyrighted
material, which would be a less restrictive alternative to further the DMCA’s
objectives. But Congress need not employ the least restrictive means of
accomplishing its objective. It need only avoid burdening more speech than necessary
to further legitimate interests. Congress must employ the least restrictive means only
when its regulations burden speech receiving the highest level protection – strict
scrutiny. Here, the question is whether the regulation “burdens substantially more
speech than is necessary” to obtain its interest. Given the nature of the Internet,
Corley’s posting made it possible for anyone in the world with a computer to be two
mouse-clicks away from accessing DeCSS, three from downloading it, and four from
copying DVDs on a home computer. The court was unpersuaded that the
government could prevent the world wide dissemination (and use) of DeCSS
technology and the rampant piracy of intellectual property in a less-speech-restrictive-
Constitutional Protection for Linking to DeCSS. Reviewing the injunction
preventing Corley from hyperlinking to other DeCSS sites on the Internet, the court
determined that the prohibition was content neutral and applied intermediate scrutiny.
Hyperlinks, like computer code, have speech and non-speech components. A
hyperlink conveys information – the Internet address of the linked web-page – and
performs a function. By clicking on the link it directs a web-browser to look up that
address and display its contents instantaneously. The instantaneous nature of the
linking technology persuaded the lower court to issue the injunction. The injunction
was focused on inhibiting the functional character of linking technology, since it
applied for reasons independent of whether the link contained information
comprehensible to a human being.
Without discussion, the court of appeals asserted that the government’s interests
were substantial. Presumably, the nature of the Internet as a media capable of

28 Id.
29 Id.

instantaneous communication and dissemination of information warrants a heightened
government interest in thwarting the ease in which circumvention devices may be
obtained and distributed on the web. Whether this interest is unrelated to the
suppression of free expression was not clearly addressed by the court.
Narrow Tailoring. In crafting standards for issuance of the injunction, the lower
court adapted the standards of a landmark First Amendment case, New York Times30
v. Sullivan. Avoiding strict liability for linking was necessary, both the district and
the court of appeals held, to avoid two impairments of free expression: Inhibiting
website operators from displaying links for fear that it might contain DeCSS, and
prohibiting linking to a website which would curtail access to information other than
DeCSS. Hence, an injunction pursuant to the DMCA against the posting of a
hyperlink will withstand constitutional scrutiny if the plaintiff shows by clear and
convincing evidence that those responsible for the link:
(1) know at the relevant time that the offending material is on the linked-to site,
(2) know that it is circumvention technology that may not lawfully be offered,
(3) create or maintain the link for the purpose of disseminating that technology.31
Corley argued that the only constitutionally viable standard would be one that
would likewise enable a plaintiff to enjoin a newspaper from printing the address of
a website publishing DeCSS. This, the court found, ignores the reality of the digital
world, where “materials are available for instantaneous worldwide distribution before
any preventive measures can be effectively taken.”32 Thus, the relevant constitutional
standard for print media is not necessarily appropriate for electronic media.
While the injunction runs the risk of inhibiting website operators from posting
links to sites for fear that a site might contain DeCSS and while it also curtails access
to other non-offending information on a linked-to site, the court upheld the injunction.
“The fundamental choice between impairing some communication and tolerating
decryption cannot be entirely avoided,” the court concluded.33
Conclusion. Lawyers representing Corley have asked that the full Second
Circuit Court of Appeals reconsider the three-judge panel decision. In the petition for
a rehearing, Corley argues, among other things, that the appellate panel misapplied
the intermediate scrutiny standard to the facts of the case, and that the decision

30376 U.S. 254, 283 (1964)(involving the regulation of political speech to which the court
applied strict scrutiny).
31Corley, 273 F.3d at 455-456.
32Id. at 457.
33 Id.

unconstitutionally forecloses access to a medium of free expression.34 A decision on
a rehearing is not expected until Spring.
In a relatively short time since enactment, the anticircumvention provisions of
the Digital Millennium Copyright Act have engendered broad public interest and some
controversy. To date, Universal Studios v. Corley represents the DMCA’s survival
under its first serious constitutional challenge. Others are sure to follow.
As events unfold and as the courts entertain more anticircumvention litigation,
this report will be updated.

34 See, MPAA v. Corley, et al., Petition for Rehearing, 3-10 (filed January 14 2002) at
cases/20020114_ny_eff_pr.html <visited January 16, 2002].