Code, Keys, and the First Amendment: Universal City Studios v. Corley

When the hacker publication 2600: The Hacker Quarterly posted a small program called DeCSS that stripped the encryption from DVDs, eight major movie studios sued — and the case became the first major appellate test of the Digital Millennium Copyright Act’s anti-circumvention rules. In Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001), decided November 28, 2001, the Second Circuit, in an opinion by Judge Jon O. Newman, upheld an injunction against the publisher and rejected a sweeping First Amendment challenge. The court accepted that computer code is a form of speech, yet held that the government may still regulate code because of what it does, not what it says. Corley set the terms for how courts reconcile the DMCA with free expression.

At a glance

• Case: Universal City Studios, Inc. v. Eric Corley, a/k/a “Emmanuel Goldstein,” and 2600 Enterprises, Inc., 273 F.3d 429 (2d Cir. Nov. 28, 2001).
• Court: U.S. Court of Appeals for the Second Circuit; opinion by Judge Jon O. Newman.
• Posture: Appeal from the Southern District of New York (Judge Lewis A. Kaplan), which had permanently enjoined the defendants in the related Reimerdes litigation from posting or linking to DeCSS.
• Holding: The DMCA’s anti-trafficking provision, Section 1201(a)(2), as applied to DeCSS, does not violate the First Amendment; computer code is speech, but a content-neutral regulation of its functional capacity survives intermediate scrutiny, and the statute does not unconstitutionally impair fair use.
• Significance: The first appellate decision upholding the DMCA’s anti-circumvention regime against a major constitutional challenge, establishing the functional-versus-expressive framework for code.

DeCSS and the Content Scramble System

DVDs were protected by the Content Scramble System (CSS), an encryption scheme that prevented copying and limited playback to licensed devices. In 1999, DeCSS appeared — a program that decrypted CSS, allowing DVD content to be copied and played outside the licensed ecosystem. Eric Corley, who published 2600 under the pen name Emmanuel Goldstein, posted the DeCSS code on the magazine’s website and, after being enjoined from hosting it, linked to other sites that offered it while urging readers to download and propagate it.

The studios sued under Section 1201(a)(2) of the DMCA, which prohibits “trafficking” in technology primarily designed to circumvent a technological measure that controls access to a copyrighted work. Judge Kaplan, in the district court (the case captioned Reimerdes below), found that DeCSS plainly fit the statute and entered a permanent injunction. Corley appealed, mounting a constitutional defense centered on the First Amendment.

Code as speech — but regulated for its function

The Second Circuit’s most enduring contribution is its treatment of computer code as expression. Judge Newman agreed that code conveys information to those who can read it and therefore has an expressive component protected by the First Amendment. But code is also functional: DeCSS does not merely describe how to decrypt CSS; it performs the decryption. That dual nature, the court held, is decisive.

Because the DMCA targets DeCSS for what it does — its capacity to circumvent — rather than for any idea it expresses, the court treated the anti-trafficking ban as a content-neutral regulation. Content-neutral restrictions that incidentally burden speech are judged under intermediate scrutiny: they survive if they serve a substantial governmental interest unrelated to suppressing expression and burden no more speech than necessary. The interest in preventing unauthorized access to copyrighted works, the court found, was substantial, and the prohibition was appropriately tailored to the program’s functional capacity. The injunction therefore stood.

Linking, fair use, and the limits of the holding

The court also addressed two harder edges. First, it held that Corley’s linking to other sites hosting DeCSS could itself constitute trafficking. Recognizing the free-speech sensitivity of hyperlinks, the court adopted a demanding standard: linking is enjoinable only where the defendant knows the linked material is circumvention technology, knows it is unlawful to offer, and links for the purpose of disseminating it. Corley met that standard because he had touted the links and encouraged readers to spread DeCSS.

Second, the court rejected the argument that the DMCA unconstitutionally destroys fair use. It reasoned that the First Amendment does not guarantee access to copyrighted works in the most technologically convenient form; users retained other means to comment on or excerpt films, even if circumventing CSS was off-limits. Fair use, the court suggested, is a defense to infringement, not an affirmative right to break access controls. That reasoning has been criticized for narrowing fair use in the digital environment, but it remains the controlling framework in the Second Circuit and has been widely cited.

Open questions

• How far does the linking standard reach? Corley enjoined links made to disseminate circumvention code, but the boundaries for ordinary linking and search remain contested.
• Does the DMCA leave fair use adequate breathing room? The court said yes, but critics argue access controls can foreclose legitimate uses the copyright bargain was meant to permit.
• When does code’s functional character override its expressive value? The framework is clear in principle but fact-sensitive, and newer tools blur the line between describing and performing.

Implications

• For technologists and publishers: Publishing functional circumvention code can be enjoined even though code is speech. The expressive label does not immunize a tool that performs circumvention.
• For rights holders: The DMCA’s anti-trafficking provision is a powerful, constitutionally durable remedy against the distribution of circumvention tools.
• For website operators: Knowingly linking to circumvention technology, with intent to spread it, can create liability; neutral, informational linking stands on different footing.
• For fair-use advocates: Corley treats fair use as a defense, not a right of access, limiting its force against technological protection measures — a tension that persists in DMCA litigation.
• For litigators: Frame anti-trafficking claims around the tool’s function and the defendant’s purpose; frame defenses, if any, around expressive content and tailoring under intermediate scrutiny.

Frequently asked questions

What did Universal City Studios v. Corley hold? The Second Circuit upheld an injunction barring Eric Corley from posting and linking to DeCSS, a program that decrypts DVD protection. It held the DMCA’s anti-trafficking provision, Section 1201(a)(2), constitutional and ruled that the ban did not violate the First Amendment or fair use.

If computer code is speech, how could the court ban it? The court agreed code has an expressive component, but found the DMCA regulated DeCSS because of its function, not its message. As a content-neutral regulation of the code’s functional capacity to decrypt, the ban survived intermediate First Amendment scrutiny.

Why was linking to DeCSS treated as trafficking? Corley not only posted DeCSS but also linked to other sites offering it and urged readers to download and spread it. The court held that knowingly linking to circumvention code, with the purpose of disseminating it, amounted to trafficking under the statute.

Authorities and sources

• Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001): opinion (Justia); opinion (CourtListener).
• District court decision: Universal City Studios, Inc. v. Reimerdes, 111 F. Supp. 2d 294 (S.D.N.Y. 2000): case summary (Quimbee).
• DMCA anti-circumvention statute, 17 U.S.C. § 1201 (Cornell LII): https://www.law.cornell.edu/uscode/text/17/1201
• Teaching copy of the opinion (Harvard): https://cyber.harvard.edu/people/tfisher/IP/2001%20Corley%20Abridged.pdf