Anti-circumvention : What protects the content protectors?

March 1, 2005

In the information society, digital content is king. Whether ring tones, video clips, music files or the copy for this article (and others more worthy), the speed and simplicity of sending and accessing digitised information is one of the defining aspects of modern life.

The rapid development of digital technology has changed the business environment for industries reliant upon copyright protection, including new possibilities to exploit the value of copyright works. Digital technology has enabled new ways of distribution of copyright works and new ways of charging for them. Apple’s on-line iTunes Music Store sold 800,000 songs in its first week, and even now continues to sell hundreds of thousands weekly. In fact, the potential online music market is so valuable that traditional music retailers are being joined by most unconventional entrants into the online market. Newspapers, drinks companies, software companies and (it seems) any other high profile business with a strong youth brand have joined the rush to offer music content from their Web sites.

But the development of technology has not only enhanced potential markets for copyright industries, but also caused serious new threats. The ability to make perfect copies of digital works and the ease of distribution at low cost have caused vast losses. Whilst Napster have now “gone legal” and pay for content, there are plenty of other peer-to-peer networks who do not pay for delivering or sharing content.

These problems appear greater for the music industry than the film industry. The latter has collaborated with distributors and electronics manufacturers to develop the Content Scramble System (CSS), which is software loaded onto DVDs which prevents unlawful copying and permits authorised playback. The DVD players themselves contain circuitry which recognises CSS and follows its instruction. The investment in such systems and the collaboration required to establish them is huge – the standards set for DVD players on behalf of the consumer electronics industry are extensive, and the fall in price of DVD players over the last few years is breathtaking: from well over £100 a few years ago to £25 now. It is no surprise that the UK‘s biggest electrical retailer Dixons announced in November that it was discontinuing all sales of VHS video players. DVD player sales have increased sevenfold over the past five years, and by November outnumbered video player sales by 40 to 1.

But existing DVD machines are not limited to playback – even now, DVD recorders are available for about £150. It is clear that technology protection measures (TPMs), such as CSS for DVD, are increasingly important to copyright industries. The demand for greater legal protection for TPMs has been high for many years, and recent legislation seeks to address this.

At the international level, the World Intellectual Property Organization’s (WIPO) Copyright Treaty and the Performances and Phonograms Treaty (WIPO Treaties) require contracting states to provide for an adequate legal protection of TPMs. In Europe, the WIPO Treaties have been implemented by EC Directive 2001/29/EC (the Information Society Directive), which covers TPMs and other significant areas, and required Member States to implement the terms of the Directive by the end of 2002. Many still have not done so – Belgium and Sweden, as recently as November, fell foul of an ECJ ruling criticising them for default. But in the UK, the provisions of the Information Society Directive have been implemented (only a little late) into the Copyright, Designs and Patents Act 1998 by UK regulations which came into force on 1 October 2003.

1. The UK’s anti-circumvention law before October 2003

It is worth recalling that, even before the implementation of the Information Society Directive, UK law (unlike the laws of most other countries) already prohibited (in old s296 of the CDPA) the dealing in devices specifically designed or adapted to circumvent copy protection, and was applicable to all categories of copyright works in digital form. The old law gave protection to the copyright owner, and any person issuing legitimate copies of the work to the public, against any person who, knowing or having reason to believe that it would be used to make infringing copies, either (a) made available any device specifically designed to circumvent the form of copy-protection employed, or (b) published information intended to assist persons to circumvent that form of copy-protection.

The effect of this law was considered earlier this year by the English Court in a case brought by game consoles manufacturers Sony in Kabushiki Kaisha Sony Computer Entertainment v Ball. Sony’s games, recorded on CD or DVD discs, contain computer programs (protected by copyright as literary works) and other creative works (such as drawings protected as artistic works). The copyright subsisting in the games is either owned or controlled by Sony. The games are also protected by a copy protection system consisting of two different parts: one is embedded in the console and the other in the discs. When an original game disc is inserted into a console, the console recognises the embedded copy protection code from the disc and allows the game to be played. Although the games as such can be copied to other discs, the part of the copy protection code embedded in the disc is not capable of being copied, so copied discs will be useless. This prevents both the sale of pirate copies and the sale in one geographical region of a game designed to be played in another region.

The defendants were involved in dealing in devices which enable the circumvention of Sony’s copy protection system. The devices, when attached to Sony’s game console, tricks the console to believe that any inserted disc contains the required embedded copy control code, and thus allows the playing of pirate copies and games from different regions.

As the defendants’ acts spanned the period when the old and new laws were in force, the Court had to decide whether those acts were in violation of both. In relation to the old law, the Court held that each time a game is inserted into the console, a copy of it is made in the console’s Random Access Memory and the RAM chip therefore constitutes an article representing the infringing copy, which was made using the device.

Under English law, in general an infringing copy must at some stage be either made in or imported into the UK. If circumvention devices were exported to other countries and used outside the UK, their use would not result in the making of infringing copies in the UK. The Court in Sony accepted this and held that the old law does not prohibit export of circumvention devices to other countries. Whether all such devices are exported outside the UK is a matter of fact, of course.

2. The “new” anti-circumvention law

The law changed on 1 October 2003, and made it more complex. The amended CDPA sets out two distinct regimes of protection against circumvention of copy protection devices. The amended section 296 applies only to circumvention of technical devices applied to computer programs, whereas the new sections 296ZA-296ZF apply to circumvention of, and dealing in, devices designed to circumvent “effective technological measures” employed to protect all other copyright works. The reason for adopting two clearly different regimes is that the Information Society Directive was not intended to affect the existing community provisions relating to the legal protection of computer programs (the Computer Program Directive). Therefore the amended (and more elaborate) ss296ZA-296ZF reflect the Information Society Directive, whilst the amended s296 reflects the Computer Program Directive.

2.1 Protection of computer programs

It is prohibited (under the new s 296 of the CDPA) for a person to (i) deal with products for which the sole intended purpose is to facilitate the unauthorised removal or circumvention of a technical device applied to a computer program; and (ii) publish information intended to enable or assist persons in removing or circumventing such technical device, where that person knows or has reason to believe that it will be used to make infringing copies.

The technical device here means any device that is intended to prevent or restrict copyright infringement – these can include simple encryption, password protection, copy protection devices, use control systems and access control systems.

The copyright owner may enforce these provisions, as can a wide group of others. These include those issuing to the public copies of the program containing the technical device; those communicating such program to the public; the copyright owner’s exclusive licensee; and the owner or exclusive licensee of any intellectual property right in the technical device applied to the computer program.

However, like the old law, the new law does not outlaw the actual acts of circumvention of copy protection devices, merely the dealing in circumvention devices. Circumvention itself is permissible, unless it is itself an infringement of copyright, and further liability is incurred only if the work is then copied without consent.

These provisions are strongly in favour of rights holders. They further enable the rights holders to seize relevant products from temporary sales outlets (eg market stalls) or apply to the court for an order for delivery up of the relevant products.

In the Sony case (Kabushiki Kaisha Sony Computer Entertainment Inc v Ball [2004] EWHC 1738 Ch), the court had the opportunity to consider the new law. It held that all the points made about infringing copies and activities directed outside the UK under the old law applied similarly to the new law insofar as it relates to circumvention devices applied to computer programs (new s 296) and actual circumvention in relation to other works (s 296ZA – see below). A defendant may therefore be liable under these sections only in respect of circumvention devices supplied for use in the UK or actual use in the UK. However, dealing in the UK with circumvention devices for possible use outside the UK in relation to other works (not computer programs) may still be an infringement of other sections of the new law (s 296ZD – see below).

Further, in relation to the prohibition on publishing, it is clear that if someone publishes on its Web site information which enables the circumvention of a copy protection system, that information would be published simultaneously to both British and foreign users of the device, and so be actionable in the UK. That follows from the standard English principles of availability of information in the UK of Web-based material, but any such action would relate to the publication in the UK only.

2.2 Protection of other works – music, films, etc

Preventing circumvention

The provisions relating to the protection of other digital content (ss 296ZA-ZF) are more complex than for computer programs, and reflect the close attention which content received in the Information Society Directive. They apply if effective technological measures have been applied to a copyright work (other than a computer program) or a work protected by right in performance, publication right or database right, and a person does something that circumvents such technological measures. It is prohibited (under s 296ZA) for a person to circumvent the technological measure if he knows or has reason to believe that what he does will result in that circumvention.

Technological measure is defined as any technology, device or component which is designed, in the normal course of its operation, to protect a work protected by copyright (or any other above-mentioned right). And the technological measure is effective if the use of the work is controlled through an access control or protection process (eg encryption or scrambling), or a copy control mechanism which achieves the intended protection.

It is interesting to note that these provisions (relating to content, amongst other things, but not computer programs) apply only if the technological measure is effective – ie achieves some form of protection of the copyright work. Incompetently designed or applied technological measures will not have the benefit of this protection – they can be circumvented with impunity; that seems sensible because by definition they would not need to be circumvented in the first place. This may be contrasted with the position relating to computer programs above: for those, technical devices which are incompetently designed but were intended to prevent copying cannot be circumvented, even though they may be useless.

As with computer programs, a wide group of others may enforce these provisions as well as the copyright owner. This group largely corresponds to the group listed for computer programs above, being those issuing to the public copies of the work containing the technical measures; those communicating such work to the public; and the copyright owner’s exclusive licensee.

But there is an express exception to these provisions which permits circumvention for research purposes carried out in the field of cryptography, deemed necessary to protect the cryptographic industry. This exception applies, however, only if circumvention or the later publication of the results of such research does not prejudicially affect the rights of the copyright owner. Clearly, this exception was introduced in order to protect those legitimately involved in studying cryptography. However, in the author’s view, the limitation is likely to chill down research (both commercial and academic) in the field of cryptography as it seems likely that any publication or use of cryptographic analysis results may be prejudicial to the copyright owner.

In Sony, the Court held that, to the extent that the defendant installed devices to game consoles and such consoles were then used, there is no defence to the allegation that Sony’s technological measures had been circumvented. For this provision to bite, it is irrelevant whether any copyright has actually been infringed. However, as before, any possible circumvention outside the UK would not constitute a breach of this provision.

Dealing in circumvention devices

Further provisions of the new law (s 296ZD) are concerned with dealing in devices enabling or facilitating the circumvention. It is prohibited to deal in any product or provide services which (1) are promoted for the purpose of the circumvention of effective technological measures, (2) have only a limited commercially significant purpose or use other than circumvention, or (3) are primarily designed to enable the circumvention.

Again, the copyright owner and a wide group of others may enforce these provisions, the wider group corresponding exactly with the group listed for computer programs above. Also, as for the computer program provisions above, these provisions further enable the rights holders to seize relevant products from temporary sales outlets or apply to the court for an order for delivery up of the relevant products.

The wrong which this provision addresses is summarised above as “dealing” in these devices. More specifically, the section prohibits the manufacture, importation, distribution, selling or letting for hire (or offering or advertising to do so), and the possession for commercial purposes of devices. As with the other sections, the actual circumvention must occur in the UK. However, crucially, possession in the UK for commercial purposes of a stock of devices marketed for use in the UK and elsewhere has been held (in Sony) to constitute marketing in the UK: just because some devices happen to be exported subsequently does not change the fact that they were marketed and held in stock in the UK. Such devices therefore infringe.

Criminal offences

Clearly, these provisions are designed to grant wider powers to the rights holders. This is amplified further in the establishment of criminal offences for those dealing in any product designed to enable the circumvention of effective technological measures, or offering such a circumvention service. These new offences carry similar potential prison terms as the existing offences of copyright infringement itself (up to 2 years), and reflect the Government’s position that the offences of both copyright infringement and copy protection circumvention should be treated consistently.

2.3 Rights management information

Electronics rights management (ERM) information is also protected under the new law. If ERM information is altered or removed by anyone knowing or with reason to believe that this would enable or conceal copyright infringement, that person may be sued by the copyright owner, its exclusive licensee or anyone legitimately issuing copies or communicating the work to the public. Similar liability will attach to anyone knowingly dealing with a copyright work from which ERM information has been altered or removed who knows or has reason to believe that this would enable or conceal copyright infringement.

2.4 Copy protection and fair dealing

Copyright is not an exclusive right. Since it was first introduced into English law, legislators have tried to strike a careful balance between the rights of copyright owners to prevent copying of their works and the reality that members of the public should be able to use some works for some purposes. This is done by providing certain limitations to copyright owners’ exclusive rights. The CDPA limits copyright owners’ rights, for instance by allowing fair dealing for the purposes of private study, research for a non-commercial purpose and for the purposes of criticism and review where (if possible) there is sufficient acknowledgement.

Of course, technical devices and technological measures such as encryption, password protection, copy protection devices and use and access control systems are capable of restricting not only illegal uses of copyright works but also permitted uses (eg fair dealing). But without further legislation, the anti-circumvention measures described above would catch those trying to circumvent protection devices even for permitted uses. Therefore, the Information Society Directive requires Member States to take appropriate measures to ensure that copyright owners enable the beneficiaries of certain copyright exceptions to benefit from those exceptions.

The UK legislation implements this requirement in a rather unusual way. It provides a remedy for a person who is prevented by a technological measure from carrying out a permitted act with respect to a copyright work (other than computer program). Such a person may send a notice of complaint to the Secretary of State, who may then give directions to the owner or exclusive licensee of the work to allow the permitted act to be carried out. But the Secretary of State is under no obligation to take any action whatsoever, and there is no right of appeal of his decision (or indecision). And an application for judicial review of the decision may be problematic, as one would need to show that the decision would not have been reached by any reasonable Secretary of State.

As the right to complain to the Secretary of State is the sole remedy available to permitted users in these circumstances, it is questionable whether this qualifies as an “appropriate measure” required by the Information Society Directive. It is anticipated that the remedy will be time-consuming and frustrating, if used at all.


The new law grants wider protection to rights holders than was the case before October 2003. Due to the legislative history, rather elaborate differences in wording and definitions exist between the regimes for (1) computer program protection, (2) other copyright work protection, and (3) electronic rights management. However, there is no doubt that the interests of copyright owners are being protected by the law, and upheld by the court.

For both computer programs or other works it is interesting to note that, where the dealing in products is actionable, no actual copyright infringement, or even actual circumvention of technical measures is required for the provisions to apply. The provisions are violated simply by dealing (ie importing, selling, advertising etc.) in an anti-circumvention device, whether or not there is any actual infringement. Therefore, the protection given to copyright owners and others by these provisions goes beyond traditional copyright protection as such, and represents an additional layer of protection. It represents a powerful weapon for rights holders.

However, the distinction between the provisions for computer programs and other works is artificial, arising as it does from the implementation of two different European directives. There seems to be no policy reason why actual circumvention of computer program protection devices is lawful but actual circumvention of protection devices for other works is unlawful. Similarly, it is a legislative oddity why the marketing in the UK of devices which may ultimately circumvent “other work” copy protection outside the UK is lawful, whereas the marketing in the UK of devices for circumventing computer program copy protection outside the UK is permissible.

On the latter point, however, the English Court has shown itself willing to come to the aid of rights holders. The Court has been quick to stress that a person can be sued in the UK not only for breaching the provisions of the CDPA, but also for breaching corresponding laws of other member states of the EU in accordance with the provisions of the Brussels Convention. As increasing numbers of European countries implement the Information Society Directive, rights holders would be well advised to consider bringing an action in the UK in respect of anti-circumvention activity across Europe.

William Cook is a Solicitor in the Intellectual Property Department of Simmons & Simmons.

Copyright Simmons & Simmons