Anticircumvention takedowns: The AACS story

In mid-April, a number of bloggers got word from Google of copyright complaints against recent posts. Each of the posts in question included a 128-bit number, written in hexadecimal. A poster to the Doom9 forum had earlier identified the number as a processing key in the AACS restriction scheme for high-definition DVDs. The cease-and-desist orders came from lawyers representing the Advanced Access Content System Licensing Administrator (AACS-LA), and intoned in heavy legalese: “It is our understanding that you are providing to the public the above-identified tools and services at the above referenced URL, and are thereby providing and offering to the public a technology, product, service, device, component, or part thereof that is primarily designed, produced, or marketed for the purpose of circumventing the technological protection measures afforded by AACS.”

In response to the AACS-LA letter, Google asked its bloggers to remove the posts. Author and U.S.C. Fulbright Chair Cory Doctorow felt compelled to censor the class blog for his U.S.C. course, where the key had cropped up in a discussion of the digital rights management technology. But as he did so, he chronicled the incident on BoingBoing.

Lawyer letters can be fans to an Internet blaze, and as the letters rolled in, interest in the 128-bit integer soared. Digg users Dugg it; Wikipedians added encyclopedia entries; others registered it in the domain name system, screened it on t-shirts and set it to music. Digg initially removed posts in response to complaints from AACS-LA, but within a day, Digg founders embraced the community frustration: “You’d rather see Digg go down fighting than bow down to a bigger company. We hear you, and effective immediately we won’t delete stories or comments containing the code and will deal with whatever the consequences might be.”

So, was Digg taking a risk? Were Wikipedia editors being rightly cautious in removing entries or deeming the number unnecessary to the encyclopedia's coverage? What should you do if, as a Web host or a blogger with comment space, you get a similar complaint?

First, it's worth looking quickly at what this complaint was not. It was not a complaint of copyright infringement. Although sufficiently large numbers (think of a computer program binary) can be protected by copyright, AACS-LA was not claiming such protection for 09-F9. That means this wasn't a standard DMCA section 512 notice of claimed copyright infringement. For those, you probably already have a DMCA policy of “expeditious” takedown, to earn the safe harbor protection from risks of indirect liability. (If you don't, see Chilling Effects for more information on DMCA 512.) Copyright claimants like section 512, because it means new complaints get quick takedown action, while service providers like its relative clarity.

In the case of 09-F9, however, AACS-LA took care not to use the inapplicable section 512 takedown. Instead, they asserted that the number was a component of a circumvention device, prohibited by a different part of the DMCA: section 1201's anticircumvention.