Earlier quoted context omitted.
DVD supports both encrypted and unencrypted video, so Bob is only breaking the law if he's releasing a decryption tool. The entire DeCSS case hinged on video decryption specifically, everything else was already implemented by other parties. Now, if Bob decides to encrypt those DVDs, then you have an interesting legal area where half the law applies and the other half doesn't. DMCA 1201 only applies to things that pro…
> But if you distribute a DVD decryption tool, then you're harming the protection of copyrighted DVDs, so you can't distribute a decryption tool even though some jackass might try to functionally recopyright public domain material with DVD CSS. I don't think you're appreciating how crazy that is. Suppose some implements a DRM system that works like this. They have a server that speaks ordinary HTTPS and has a standar…
The second half of the law is the anti-trafficking provision. This is a lot stricter because it has no fair use exception. However, the actual requirement for violating this law is that the tool has to either...
- Be only capable of violating the DRM scheme
- Have limited commercial purpose other than violating the DRM scheme
- Be advertised as being capable of violating the DRM scheme
Just selling a pentalobe screwdriver is not enough to trip the anti-trafficking part of DMCA 1201. Either your DRM system has to have special screws that only that particular device uses[0], or you have to specifically sell it as a way to steal music. Pentalobe screwdrivers have all sorts of significant commercial uses other than just breaking this hypothetical DRM scheme.
For the same reason, you misusing Bitlocker does not make Microsoft liable for violating DMCA 1201, because Bitlocker has a very wide commercial purpose outside of circumvention. However, if someone says "hey the key is all zeroes", they are liable for trafficking in circumvention tools. Generally speaking, DRM needs to be narrowly tailored to avoid overlap with commonly-available and thus legal circumvention tools. If you abuse existing functionality to make DRM in a way that is trivially circumvented then you gain very little from anti-circumvention. For the same reason, those little right-click blockers people used to put on their website don't mean that Chrome DevTools is illegal[1].
Your ransomware-by-FairPlay example is actually legally interesting. I could see it going all the way to SCOTUS. If I were a cybercriminal, I would absolutely do this just to see people hold off on releasing unlock tools. That being said, I don't think a judge would actually find a security vendor liable here. There's a very basic principle in law that illegal activity is afforded no protection by the law[2]. So I can't sue a drug dealer because he spiked my heroin with fentanyl, or sue a game developer for using my unauthorized fanart of their characters without permission[3]. The criminals who released the ransomware cannot sue the security vendor, the DRM system vendor would have to be baited into doing so. Furthermore, "decrypting shit that was encrypted without my knowledge or permission" would be a perfectly valid commercial purpose. So as long as the security vendor does not say "this tool decrypts DRM" it's probably fine for them to release this.
[0] For various economic reasons in screw manufacturing, this is highly unlikely to ever exist.
[1] I'm pretty sure just mentioning this is committing one of my three felonies for the day.
[2] This does not mean that criminals have no protection under the law at all, of course. Someone who burgles your house and gets injured can still sue for damages, because it's illegal to set up traps to kill people.
[3] Under US law, if an artistic work is a derivative of another artistic work, the derivative is afforded copyright protection if and only if it is licensed. If it is unlicensed you own nothing.