DMCA - ANALYSIS - TITLE 1

SECURITY TESTING EXCEPTION

Jonathan Band’s DMCA Memo

TITLE I: WIPO TREATIES IMPLEMENTATION

Circumvention of Copyright Protection Systems - New Section 1201
Security Testing Exception. In addition to the encryption research exception, the DMCA provides another exception for information security activities. The security testing exception permits circumvention conducted in the course of security testing if it is otherwise legal under applicable law.¹² Security testing is defined as obtaining access, with proper authorization, to a computer, computer system, or computer network for the sole purpose of testing, investigating or correcting a potential or actual security flaw, or vulnerability or processing problem.¹³ In determining whether this exception is applicable, the DMCA requires the court to consider whether the information derived from the security testing was used solely to improve the security measures or whether it was used or maintained so as not to facilitate infringement.¹⁴ The DMCA also permits the development, production or distribution of technological means for the sole purpose of performing permitted acts of security testing.¹⁵

1. Reverse Engineering Exception
2. Exception for Law Enforcement and Intelligence Activities
3. Encryption Research Exception
4. Security Testing Exception
5. Exception Regarding Minors
6. Protection of Personally Identifying Information
7. Exemption for Nonprofit Libraries, Archives, and Educational Institutions
8. Certain Analog Devices and Certain Technological Measures