Summary. Section 1201 of the Copyright Act makes it unlawful to break a digital lock on a copyrighted work, and unlawful to sell tools that do the breaking, even when the underlying use would be perfectly lawful. That decoupling of circumvention from infringement is what makes § 1201 both powerful and controversial, and it catches security researchers, repair shops, tinkerers, and competitors far more often than it catches pirates. This article explains the structure of the statute, the difference between access controls and copy controls and why it matters, the two trafficking bans, the seven permanent exemptions, and the triennial rulemaking through which the Librarian of Congress grants temporary exemptions for uses like jailbreaking phones, repairing tractors, and preserving video games. It works through the leading appellate decisions, including Corley, Chamberlain, Lexmark, and MDY v. Blizzard, and explains the circuit split over whether a § 1201 claim requires a nexus to infringement. It closes with compliance guidance for device makers, software vendors, researchers, and repair businesses, plus a worked example, an FAQ, and related reading.

Here is a fact that surprises almost everyone who learns it: you can violate the Copyright Act without infringing anyone's copyright.

Buy a legally purchased DVD. Own it outright. Want to copy a thirty-second clip into a film-studies lecture, a use that is comfortably fair? To get the clip you must defeat the disc's Content Scramble System. That act of defeat, standing alone, can violate 17 U.S.C. § 1201(a)(1), even though the use you make afterward infringes nothing. And the software you would need to do it is independently unlawful to distribute under § 1201(a)(2), so the person who wrote the tool has a problem too.

Section 1201 does not protect copyrights. It protects the locks on copyrights. Congress enacted it in 1998 to implement the WIPO Copyright Treaty and to give content industries confidence that digital distribution would not be immediately undone by circumvention. Twenty-eight years later, its most frequent targets are not commercial pirates but security researchers, independent repair shops, aftermarket parts makers, accessibility technologists, video game preservationists, and farmers who want to fix their own tractors.

This article explains how the statute actually works, who gets caught by it, and what lawful paths exist through it.

The short answer

  • Section 1201(a)(1) bans the act of circumventing a technological measure that controls access to a copyrighted work.
  • Section 1201(a)(2) bans trafficking in technology primarily designed to circumvent an access control.
  • Section 1201(b)(1) bans trafficking in technology primarily designed to circumvent a measure that protects a right of a copyright owner (a copy control).
  • There is no ban on the act of circumventing a copy control. That gap is deliberate; Congress wanted to preserve the ability of a lawful possessor to make a fair use once access is lawfully obtained. The tools to do it are still unlawful to distribute, which is a well-known asymmetry.
  • Fair use is not a defense to § 1201(a)(1). Section 1201(c)(1) preserves fair use as a defense to infringement, but courts have consistently held it does not excuse circumvention.
  • Seven permanent exemptions appear in § 1201(d) through (j), and temporary exemptions are granted every three years by the Librarian of Congress on the recommendation of the Register of Copyrights under § 1201(a)(1)(C).
  • Remedies are in § 1203 (civil, including statutory damages of $200 to $2,500 per act) and § 1204 (criminal, for willful violations for commercial advantage or private financial gain).

Part I: The architecture of § 1201

Two kinds of locks

The statute distinguishes between measures that control access to a work and measures that protect a right of the copyright owner (typically, the right to reproduce). The distinction sounds academic. It is not.

Access controls are things like the encryption on a Blu-ray disc, a login wall, a license key check, or the signature verification in a game console's boot chain. The statute defines circumvention of an access control as "to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner." § 1201(a)(3)(A). A measure controls access "if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work." § 1201(a)(3)(B).

Copy controls (more precisely, "measures that effectively protect a right of a copyright owner") are things like a watermark-triggered recording block or a DRM scheme that permits viewing but prevents duplication. § 1201(b)(2).

Now the asymmetry: the act of circumventing an access control is banned (§ 1201(a)(1)); the act of circumventing a copy control is not. Congress's reasoning appears in the legislative history: once a person has lawful access, the copyright law's own limitations, including fair use, should govern what they do next. But because trafficking in tools for either kind of measure is banned, the practical ability to exercise that preserved freedom is often illusory. Commentators have called this the "digital locksmith paradox," and it is the single most criticized feature of the statute.

The trafficking bans

Both § 1201(a)(2) and § 1201(b)(1) use the same three-part structure. Liability attaches to any technology, product, service, device, component, or part that:

  1. is primarily designed or produced for the purpose of circumventing; or
  2. has only limited commercially significant purpose or use other than to circumvent; or
  3. is marketed by that person or another acting in concert with that person's knowledge for use in circumventing.

Note that these are disjunctive. A tool with substantial legitimate uses can still create liability if it is marketed for circumvention. That is why the marketing copy in a product listing is often the most damaging document in a § 1201 case, and why "unlocking" and "bypass" language in a README can turn a research tool into an exhibit.

Note also what is missing: the Sony "substantial noninfringing use" safe harbor from contributory copyright infringement does not apply. Congress wrote a different standard, and courts have said so plainly.

Anti-trafficking is not secondary liability

A common analytical mistake is to treat § 1201(a)(2) as a species of contributory infringement requiring an underlying wrong. It is not. It is a freestanding prohibition. In Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001), the Second Circuit upheld an injunction barring a website from posting or linking to DeCSS, the DVD descrambling utility, and rejected First Amendment arguments. The court accepted that computer code is speech, applied intermediate scrutiny to the content-neutral functional regulation of it, and held the statute survived. Corley remains the leading appellate treatment of the constitutional question, and the D.C. Circuit's later decision in Green v. U.S. Department of Justice, 54 F.4th 738 (D.C. Cir. 2022), affirming denial of a preliminary injunction in a facial and as-applied challenge brought by security researchers, shows the argument is still being pressed and still not prevailing.

Part II: The infringement-nexus split

This is the doctrinal fault line that decides many cases, and every practitioner should know which side of it they are on.

Chamberlain: the Federal Circuit requires a nexus

In Chamberlain Group, Inc. v. Skylink Technologies, Inc., 381 F.3d 1178 (Fed. Cir. 2004), a garage door opener manufacturer sued a maker of universal remotes that defeated a rolling-code authentication routine. The Federal Circuit rejected the claim, holding that a § 1201(a)(2) plaintiff must show a "reasonable relationship between the circumvention at issue and a use relating to a property right for which the Copyright Act permits the copyright owner to withhold authorization." Otherwise, the court warned, § 1201 would give manufacturers a new species of monopoly over aftermarket products that copyright itself never granted, and consumers who bought a garage door opener would have no right to open their own garage.

The Sixth Circuit reached a compatible result in Lexmark International, Inc. v. Static Control Components, Inc., 387 F.3d 522 (6th Cir. 2004), where a printer maker used an authentication handshake to lock out third-party toner cartridges. The court held that the printer's Toner Loading Program was not "effectively controlling access" to a copyrighted work in the relevant sense, because purchasers could read the program directly from the printer memory; the lock controlled the printer's functionality, not access to the code as a work.

Both cases share a common intuition, and it is a good one: § 1201 was meant to protect works, not to convert every embedded microcontroller into an aftermarket exclusion device.

MDY v. Blizzard: the Ninth Circuit rejects the nexus for § 1201(a)

The Ninth Circuit disagreed. In MDY Industries, LLC v. Blizzard Entertainment, Inc., 629 F.3d 928 (9th Cir. 2010), the maker of "Glider," a bot that played World of Warcraft while the user slept, was sued for trafficking in a tool that circumvented Blizzard's Warden anti-cheat system. The Ninth Circuit held that § 1201(a) creates a new, independent right to control access, unmoored from infringement, based on the statute's text and structure, and it expressly declined to follow Chamberlain. It then held that Blizzard's Warden did not "effectively control access" to the game's literal code or individual non-literal elements (which resided on the user's hard drive) but did control access to the dynamic non-literal elements generated in real time from the server, so liability attached as to those.

MDY is also the leading case for a distinction that matters enormously in software licensing: the difference between a covenant and a condition. Breaching a covenant is a contract claim; exceeding a condition on the license's scope is copyright infringement. The court held that Blizzard's bot ban was a covenant, not a condition, so bot use was breach of contract rather than infringement. That analysis is essential reading for anyone drafting software license restrictions. See Drafting Software License Agreements.

Where the law stands

District courts remain split, and the practical guidance is jurisdictional:

  • In the Ninth Circuit, plaintiffs need not tie circumvention to infringement for § 1201(a) claims.
  • In the Federal Circuit (which will hear the case if patent claims are joined) and in courts persuaded by Chamberlain, the nexus requirement is a serious defense.
  • The Second Circuit's Corley did not squarely address the question, and the Sixth Circuit's Lexmark resolved the case on the "effectively controls access" element instead.

Defense counsel should always ask two questions before conceding a § 1201 claim: (1) does this measure actually control access to a work, or merely to a device's functionality; and (2) is there any relationship between the circumvention and an act the Copyright Act lets the owner prohibit?

Part III: The permanent exemptions

Congress wrote seven statutory exemptions into § 1201. They are narrow, technical, and frequently overestimated by clients. Each is summarized here with the practical caveat that matters.

§ 1201(d) — Nonprofit libraries, archives, and educational institutions. Permits circumvention solely to make a good-faith determination whether to acquire a copy of a work. This is a "shop before you buy" exemption, and nothing more. It does not permit circumvention for preservation or lending.

§ 1201(e) — Law enforcement, intelligence, and other government activities. Self-explanatory, and unavailable to contractors acting outside authorized activity.

§ 1201(f) — Reverse engineering for interoperability. The most important exemption for software developers. A person who has lawfully obtained the right to use a copy of a computer program may circumvent to identify and analyze elements necessary to achieve interoperability of an independently created computer program, to the extent those acts are not infringement. Subsections (2) and (3) further permit developing and, in limited circumstances, sharing the means of circumvention for that purpose.

Read the conditions carefully, because clients routinely fail one of them:

  • The information sought must not have been "previously readily available."
  • The purpose must be interoperability of an independently created program, not compatibility of hardware, not access to content, and not competitive replication.
  • The acts must not otherwise infringe.

This exemption is why Sega and Connectix-style reverse engineering survives, but it is narrower than the fair use doctrine those cases applied.

§ 1201(g) — Encryption research. Permits circumvention to identify and analyze flaws in encryption technologies, if the researcher lawfully obtained the work, the act is necessary to conduct the research, the researcher made a good-faith effort to obtain authorization, and the act does not otherwise infringe. The statute lists factors including whether the results were disseminated in a manner reasonably calculated to advance the state of knowledge and whether the researcher is trained or experienced in the field.

§ 1201(h) — Minors. Permits components in technology whose sole purpose is to prevent minors' access to material on the internet.

§ 1201(i) — Protection of personally identifying information. Permits circumvention where the measure collects or disseminates PII about the user's online activities without conspicuous notice and without a capability to prevent the collection.

§ 1201(j) — Security testing. Permits accessing a computer, computer system, or computer network solely for the purpose of good-faith testing, investigating, or correcting a security flaw or vulnerability, with the authorization of the owner or operator. The authorization requirement is the catch, and it is why coordinated disclosure programs, bug bounty terms, and safe-harbor language in vulnerability disclosure policies matter so much. Note that § 1201(j) does not immunize violations of other laws, including the Computer Fraud and Abuse Act.

And a savings clause that does less than it appears to. Section 1201(c)(1) provides that nothing in § 1201 "shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use." Courts have read this to preserve fair use as a defense to infringement claims, not to create a fair use defense to circumvention itself. Section 1201(c)(3) provides that nothing requires manufacturers to design products to respond to any particular technological measure, which is the "no mandate" clause.

Part IV: The triennial rulemaking

Congress anticipated that § 1201(a)(1) would sweep in legitimate uses it could not foresee, so it built in a safety valve. Under § 1201(a)(1)(C), every three years the Register of Copyrights conducts a public rulemaking and recommends to the Librarian of Congress classes of works for which users are "adversely affected" in their ability to make noninfringing uses. Granted exemptions are codified at 37 C.F.R. § 201.40 and last three years, at which point proponents must ask again (renewals of unopposed exemptions are now streamlined).

What the rulemaking can and cannot do

It can exempt the act of circumvention under § 1201(a)(1) for a defined class of works and uses.

It cannot exempt trafficking under § 1201(a)(2) or § 1201(b)(1). This is the structural flaw everyone complains about: the Librarian can tell you it is lawful to jailbreak your phone, but cannot make it lawful for anyone to give you the tool. Proponents have raised this in every cycle since 2000, and the Copyright Office has consistently said it lacks statutory authority to fix it. Legislation would be required.

The exemptions that matter in practice

Across recent cycles, the recurring categories include:

  • Motion picture excerpts for criticism, comment, documentary filmmaking, noncommercial videos, and educational uses (with detailed conditions about screen-capture versus decryption and about the necessity of high-quality source material).
  • Unlocking and jailbreaking of wireless devices, smartphones, tablets, smart TVs, routers, and voice assistants, to run lawfully acquired software or connect to a different network. The cellphone-unlocking saga is the best-known chapter of this story; see our history in Unlocking Cell Phones: The Law and the DMCA Exemption.
  • Repair and diagnosis of motorized land vehicles, medical devices, consumer devices, and, in more recent cycles, commercial and industrial equipment. This is where § 1201 collides directly with the right-to-repair movement; see The Right to Repair Movement.
  • Security research on lawfully acquired devices and software, in a controlled environment, where the research is conducted in good faith. This exemption is broader than § 1201(j) because it does not require the device owner's authorization, but it carries its own conditions.
  • Video game preservation by eligible libraries, archives, and museums, including limited server-dependent games. Proposals to allow off-premises remote access have repeatedly been rejected.
  • Text and data mining of lawfully acquired motion pictures and literary works by researchers affiliated with nonprofit institutions of higher education, subject to security and access conditions. This exemption has taken on obvious new significance in the machine learning era, and its boundaries (nonprofit, institutional, corpus security, no commercial use) are worth reading closely before relying on it.
  • Accessibility uses, including assistive technologies for people who are blind, visually impaired, or print disabled.

Two practical notes. First, the exemptions are narrower than their headlines. Each comes with conditions about who may act, on what devices, under what circumstances, and for what purpose. Read the codified text at 37 C.F.R. § 201.40, not the press summary. Second, exemptions expire. An exemption relied on in year one of a cycle may vanish in year four if nobody petitions for renewal, so any compliance program built on a temporary exemption needs a calendar entry.

How to participate

The rulemaking is genuinely open. Petitions, comments, hearings, and reply comments are public, and the Copyright Office's recommendations are detailed documents that read like judicial opinions. Trade associations, research groups, and individual companies all file. If your business model depends on an exemption, participating in the cycle is cheaper than litigating without one.

Part V: Remedies

Civil remedies under § 1203

Any person injured by a violation may sue in federal district court. Available relief includes:

  • Temporary and permanent injunctions, § 1203(b)(1).
  • Impoundment and, at final judgment, remedial modification or destruction of the offending device or product, § 1203(b)(2), (6).
  • Actual damages and the violator's profits, § 1203(c)(2).
  • Statutory damages, at the plaintiff's election: $200 to $2,500 per act of circumvention, device, product, component, offer, or performance of service for § 1201 violations, and $2,500 to $25,000 per violation for § 1202 violations. § 1203(c)(3).
  • Costs and attorney's fees, in the court's discretion, § 1203(b)(4), (5).
  • Treble damages for repeat violations within three years, § 1203(c)(4).
  • Reduction or remission for innocent violations, and mandatory remission for qualifying nonprofit libraries, archives, educational institutions, and public broadcasters, § 1203(c)(5).

Note two things about the statutory damages. First, they are per act or per device, which means volume drives exposure in a way that ordinary copyright statutory damages do not. Second, and importantly, § 412's registration timing bar does not apply. A plaintiff whose registration timing killed ordinary statutory damages may still have a § 1201 or § 1202 claim with statutory damages available, which is why sophisticated plaintiffs plead these counts.

Criminal liability under § 1204

Willful violation "for purposes of commercial advantage or private financial gain" is a crime: up to five years and $500,000 for a first offense, up to ten years and $1,000,000 for subsequent offenses. § 1204(a). Nonprofit libraries, archives, educational institutions, and public broadcasting entities are exempt from criminal liability. § 1204(b). The five-year statute of limitations runs from when the offense is committed. § 1204(c).

Section 1202: copyright management information

Section 1202 is § 1201's neglected sibling and is increasingly the more useful claim. It prohibits (a) knowingly providing false copyright management information with intent to induce or conceal infringement, and (b) intentionally removing or altering CMI, or distributing works knowing CMI has been removed, "knowing, or having reasonable grounds to know, that it will induce, enable, facilitate, or conceal an infringement."

What counts as CMI is broad: the title, the author, the copyright owner, terms and conditions for use, identifying numbers or symbols, and, per § 1202(c), other information the Register may prescribe. Courts have held that CMI is not limited to information embedded in a technological system; a photographer's credit printed in the gutter of a magazine page qualified in Murphy v. Millennium Radio Group LLC, 650 F.3d 295 (3d Cir. 2011).

The scienter requirement is doubled in § 1202(b): the defendant must both intend the removal and know or have reasonable grounds to know that removal will induce, enable, facilitate, or conceal infringement. Many claims fail here.

The "identicality" question has split district courts and is the live issue in AI training litigation: does § 1202(b) require that the defendant distributed an identical copy stripped of CMI, or does it reach outputs that are similar but not identical? Courts confronting claims about model outputs that reproduce code or text without attribution have taken both views, and the question is likely headed to the courts of appeals.

Part VI: Who actually gets sued, and what to do about it

Device makers and platform operators (the plaintiffs)

If you build a product with a technological protection measure, § 1201 can be a powerful enforcement tool, but only if the measure is designed to do what the statute contemplates.

Design the measure to control access to a work, not merely to a function. Lexmark is the cautionary tale. A handshake that gates the printer's willingness to operate is not obviously a measure controlling access to a copyrighted program that the purchaser can already read out of memory. A measure that encrypts the firmware image, requires a key to decrypt it, and thereby prevents access to the expressive content of the program is a much stronger predicate.

Document the copyrighted work being protected. In litigation, you will be asked to identify the work. "Our ecosystem" is not a work. The firmware, the game assets, the server-generated audiovisual display: those are works, and they should be registered.

Do not use § 1201 as an aftermarket exclusion device. Beyond the Chamberlain problem, courts are unsympathetic, and antitrust and right-to-repair exposure follows. Several states have enacted repair statutes, and the Federal Trade Commission has brought enforcement actions over warranty tie-in claims. See Antitrust for Technology Companies.

Security researchers

The most common question I get from researchers is whether they may test a device they bought. The layered answer:

  1. Check the current triennial exemption for good-faith security research. It is the broadest protection, and it does not require the vendor's permission, but it has conditions (lawfully acquired device, controlled environment, good faith, not violating other laws).
  2. Check § 1201(j), which requires authorization from the owner or operator of the system. On your own device you are the owner; on someone else's service you are not.
  3. Check § 1201(g) if the work is an encryption technology and the research is genuinely cryptographic.
  4. Remember the other statutes. The CFAA, state computer crime laws, contract terms, and export controls all operate independently. A § 1201 exemption is not a general research license.
  5. Follow coordinated disclosure and keep records. Good-faith conduct is an element, and contemporaneous notes about scope, intent, and notification attempts are the evidence of it.

For a vendor, the corollary is to publish a vulnerability disclosure policy with an explicit safe harbor. It costs nothing, improves your security posture, and removes the ambiguity researchers have to guess about.

Repair businesses and aftermarket manufacturers

Repair is the most active § 1201 battleground.

  • The triennial exemptions permit circumvention for diagnosis, maintenance, and repair of many device classes, but the details differ by class and cycle.
  • The exemptions do not authorize distributing tools, so a repair shop that develops a bypass may not sell it. This is the single largest practical barrier to independent repair.
  • State right-to-repair statutes create parts, tools, and documentation obligations, but they cannot override federal copyright law, and most contain express carve-outs acknowledging that.
  • Contract terms in the sale or the embedded software license may independently prohibit repair activity, and § 1201 is not the only exposure.

Software vendors and license drafters

MDY teaches that the covenant/condition line determines whether a license breach is a contract claim or an infringement claim. Draft accordingly: if you want a restriction to be a condition on the scope of the license, say so expressly, tie it to the grant clause, and avoid burying it in a general-obligations section. Then remember that a condition is not automatically a § 1201 predicate either. The measure must actually control access to a work.

Content and courseware companies

If your business depends on preventing extraction, understand that the triennial exemptions permit substantial educational and documentary extraction of motion picture content, subject to conditions. Building a business model that assumes zero lawful extraction will produce unpleasant surprises.

A worked example

Halcyon Robotics, Inc. (fictional) sells a $40,000 warehouse robot. Its firmware is encrypted; the robot verifies a signature before loading it, and diagnostic access requires a dealer key. Halcyon sells service contracts.

Ferro Repair LLC (fictional) is an independent shop. To diagnose a fault, Ferro extracts and decrypts the firmware image and writes a small utility that emulates the dealer key so it can read fault codes. Ferro then sells the utility to other shops for $500.

Run the analysis:

Is there a work? Yes. The firmware is a copyrighted computer program. Halcyon should have registered it. See Copyright Registration of Computer Programs.

Is there an access control? Very likely. The encryption plus signature check requires application of information with the authority of the copyright owner to gain access to the program. This is much closer to Corley than to Lexmark.

Did Ferro circumvent? Yes, twice: decrypting the firmware and emulating the key.

Does an exemption cover the act? Possibly. If the current triennial exemption for repair of commercial and industrial equipment covers this device class and Ferro's conduct meets the conditions (lawfully acquired device, purpose limited to diagnosis, maintenance, or repair, no distribution of decrypted material), Ferro's own acts may be exempt.

Does anything cover the tool? No. This is the fatal step. Selling the utility is trafficking under § 1201(a)(2), and no triennial exemption can reach trafficking. Ferro's business model, not Ferro's diagnostics, is the violation.

What about § 1201(f)? Only if Ferro's utility is an independently created program achieving interoperability with the robot's program, and the interoperability information was not previously readily available. A key-emulation shim built to unlock diagnostics is a hard fit, though counsel should develop the facts, because the boundary is genuinely contested.

What is Halcyon's exposure the other way? If Halcyon markets its lock as preventing all third-party service, it invites antitrust attention, state repair-law claims, and a hostile audience for its § 1201 case. And if the "protected work" turns out to be a trivial program that the purchaser can already read, Lexmark becomes Ferro's best case.

Better outcomes for both. Halcyon could license diagnostic access to certified independents on FRAND-like terms, capturing revenue without litigation. Ferro could stop selling the tool and instead provide diagnostic services, which keeps its conduct inside the exemption. Most § 1201 disputes have a version of this settlement available, and finding it early is worth far more than winning the nexus argument two years later.

Compliance checklist

If you deploy technological protection measures:

  • Identify and register the copyrighted works the measure protects.
  • Design the measure to control access to those works, not merely to gate device functionality.
  • Document the measure's design purpose contemporaneously.
  • Publish a vulnerability disclosure policy with a research safe harbor.
  • Review marketing language so the measure is not described purely as an aftermarket exclusion.
  • Track the triennial cycle and file comments if an exemption would affect your business.
  • Keep license terms clear about which restrictions are conditions on scope.

If you circumvent, or build tools that might:

  • Determine whether the measure controls access or protects a right, and confirm the act you plan is even prohibited.
  • Check the current codified exemptions at 37 C.F.R. § 201.40 and diary their expiration.
  • Determine whether § 1201(f), (g), or (j) applies, condition by condition.
  • Confirm you lawfully acquired the copy and have the right to use it.
  • Do not distribute the circumvention means; exemptions cover acts, not tools.
  • Scrub marketing and documentation of circumvention framing.
  • Separately analyze CFAA, state computer crime law, contract terms, and export controls.
  • Get a written analysis before shipping, and route it through counsel.

Frequently asked questions

Is it illegal to rip a DVD I own for personal use? The act of decrypting the disc's protection can violate § 1201(a)(1), and no general personal-use exemption exists. Some triennial exemptions cover narrow educational, documentary, and accessibility uses. This is the clearest example of § 1201 prohibiting conduct that infringes nothing.

Isn't fair use a defense? Not to circumvention. Section 1201(c)(1) preserves fair use as a defense to infringement, and courts have uniformly declined to read it as creating a fair use defense to § 1201(a)(1). The triennial rulemaking exists precisely because Congress recognized the gap. For the underlying doctrine, see Fair Use After Warhol.

Can I jailbreak my phone? Recent triennial cycles have granted exemptions for unlocking and jailbreaking various device classes, subject to conditions. Check the current codified text, because coverage varies by device type and cycle, and because an exemption for your phone does not automatically extend to your car, your console, or your smart speaker.

Can I sell a jailbreaking tool? No. The rulemaking cannot exempt trafficking, and § 1201(a)(2) reaches tools primarily designed to circumvent, tools with limited other commercial use, and tools marketed for circumvention.

Does § 1201 apply if the underlying work is in the public domain? The statute is keyed to "a work protected under this title." A measure controlling access to public domain material should not support a claim, but in practice protected and unprotected material are usually commingled inside a single encrypted container, and that commingling is where the litigation happens.

Our vendor's contract prohibits reverse engineering. Does § 1201(f) override it? No. Section 1201(f) is an exemption from § 1201 liability, not from contract liability. Some states, and some foreign jurisdictions, limit the enforceability of reverse-engineering prohibitions, and preemption arguments exist, but assume the contract binds you unless counsel concludes otherwise. See Open Source Software: Licenses, Compliance, and Risk for the related license-scope analysis.

We received a § 1201 demand letter. What is the first move? Preserve everything, including build artifacts, commit history, marketing drafts, and the acquisition record for the device or software. Then answer three questions: what work is protected, does the measure control access to it, and does an exemption cover our acts? Many demands collapse at the first question.

Does § 1201 apply outside the United States? Section 1201 is United States law, but most trading partners have parallel obligations under the WIPO treaties, with meaningful national differences. The European Union's Information Society Directive, for example, obliges member states to ensure beneficiaries of certain exceptions can actually benefit from them, which is closer to the fix American critics have asked for. Products shipped globally need country-by-country analysis.

Is text and data mining for AI training covered? A triennial exemption permits certain text and data mining of lawfully acquired motion pictures and literary works by researchers at nonprofit institutions of higher education, under conditions including corpus security and noncommercial purpose. That exemption does not cover commercial model training, and it does not answer the separate copyright question. See Fair Use After Warhol and Copyright Infringement Claims Against Generative AI.

Closing thought

Section 1201 is the part of copyright law that most clearly protects a business model rather than a work. That is not necessarily wrong; Congress made a policy choice in 1998 that digital distribution needed a legal backstop for technical measures. But the choice has costs, and the costs fall on people who are not pirates: the researcher who finds a flaw in a medical device, the archivist preserving a dead online game, the farmer with a diagnostic code and a locked ECU, the teacher who needs forty seconds of a film.

The triennial rulemaking is the pressure valve Congress built, and it works, slowly, for the act of circumvention. It does nothing for tools, which is why so many exemptions are theoretical for anyone without the ability to write their own software. Reform proposals have circulated for two decades, generally taking one of three forms: adding a fair-use-style defense to circumvention, extending the rulemaking to trafficking, or codifying the Chamberlain nexus requirement. None has passed.

Until something does, the practical advice for anyone touching a digital lock is the same: identify the work, identify the measure, find the exemption, do not distribute the tool, and write down the analysis before you act.

Related articles

This article is provided for general informational purposes and does not constitute legal advice. Triennial exemptions change every three years and are subject to detailed conditions; always consult the currently codified text at 37 C.F.R. § 201.40 and qualified counsel before relying on one.