Code, Keys, and the First Amendment: Universal City Studios v. Corley

When the hacker publication 2600: The Hacker Quarterly posted a small program called DeCSS that stripped the encryption from DVDs, eight major movie studios sued. The case became the first major appellate test of the Digital Millennium Copyright Act’s anti-circumvention rules. In Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001), decided November 28, 2001, the Second Circuit, in an opinion by Judge Jon O. Newman, upheld an injunction against the publisher and rejected a sweeping First Amendment challenge. The court accepted that computer code is a form of speech, yet held that the government may still regulate code because of what it does, not what it says. Corley set the terms for how courts reconcile the DMCA with free expression.

At a glance

• Case: Universal City Studios, Inc. v. Eric Corley, a/k/a “Emmanuel Goldstein,” and 2600 Enterprises, Inc., 273 F.3d 429 (2d Cir. Nov. 28, 2001).
• Court: U.S. Court of Appeals for the Second Circuit; opinion by Judge Jon O. Newman.
• Posture: Appeal from the Southern District of New York (Judge Lewis A. Kaplan), which after a trial on the merits had permanently enjoined the defendants from posting DeCSS or knowingly linking to sites containing it. The case was captioned Reimerdes below.
• Holding: The DMCA’s anti-trafficking provision, Section 1201(a)(2), as applied to DeCSS, does not violate the First Amendment; computer code is speech, but a content-neutral regulation of its functional capacity survives intermediate scrutiny, and the statute does not unconstitutionally impair fair use.
• Significance: The first appellate decision upholding the DMCA’s anti-circumvention regime against a major constitutional challenge, establishing the functional-versus-expressive framework for code.

DeCSS and the Content Scramble System

DVDs were protected by the Content Scramble System (CSS), an encryption scheme that prevented copying and limited playback to licensed devices. In 1999, DeCSS appeared: a program that decrypted CSS, allowing DVD content to be copied and played outside the licensed ecosystem. Eric Corley, who published 2600 under the pen name Emmanuel Goldstein, posted the DeCSS code on the magazine’s website in November 1999, in an article that also included links to other sites where the program could be found. After a January 2000 preliminary injunction barred him from posting the code, he complied but kept posting links to other sites carrying it, an action the defendants termed “electronic civil disobedience,” and urged other web sites to post DeCSS.

The studios sued under Section 1201(a)(2) of the DMCA, which prohibits “trafficking” in technology primarily designed to circumvent a technological measure that controls access to a copyrighted work. Judge Kaplan, in the district court (the case captioned Reimerdes below), found that DeCSS plainly fit the statute and entered a permanent injunction. Corley appealed, mounting a constitutional defense centered on the First Amendment.

Code as speech, but regulated for its function

The Second Circuit’s most enduring contribution is its treatment of computer code as expression. Judge Newman agreed that code conveys information to those who can read it and therefore has an expressive component protected by the First Amendment. But code is also functional: DeCSS does not merely describe how to decrypt CSS; it performs the decryption. That dual nature, the court held, is decisive.

Because the DMCA targets DeCSS for what it does (its capacity to circumvent) rather than for any idea it expresses, the court treated the anti-trafficking ban as a content-neutral regulation. Content-neutral restrictions that incidentally burden speech are judged under intermediate scrutiny: they survive if they serve a substantial governmental interest unrelated to suppressing expression and do not burden substantially more speech than is necessary to further that interest. The court stressed that a content-neutral regulation need not use the least restrictive means available. The interest in preventing unauthorized access to copyrighted works, the court found, was substantial, and the prohibition was appropriately tailored to the program’s functional capacity. The injunction therefore stood.

Linking, fair use, and the limits of the holding

The court also addressed two harder edges. First, it upheld the injunction’s linking prohibition. Recognizing the free-speech sensitivity of hyperlinks, Judge Kaplan had fashioned a demanding test below, adapted from New York Times Co. v. Sullivan: he required clear and convincing evidence that those responsible for a link know the offending material is on the linked-to site, know it is circumvention technology that may not lawfully be offered, and create or maintain the link for the purpose of disseminating that technology. He found the evidence satisfied that test. The Second Circuit affirmed, but it expressly declined to decide whether a test that rigorous is constitutionally required, resting instead on the circumstances “amply shown by the record.”

Second, the court rejected as extravagant the argument that the DMCA unconstitutionally eliminates fair use. Notably, it declined to decide whether fair use has constitutional protection at all, holding that question far beyond the scope of the lawsuit because the defendants never claimed to be making fair use of any copyrighted work. It reasoned that fair use has never been held to guarantee access to a work so that it can be copied by the user’s preferred technique or in the format of the original; users retained other means to comment on or excerpt films, even if circumventing CSS was off-limits. Fair use, the court suggested, is a defense to infringement, not an affirmative right to break access controls. That reasoning has been criticized for narrowing fair use in the digital environment, but it remains the controlling framework in the Second Circuit and has been widely cited.

Open questions

• How far does the linking standard reach? Corley upheld an injunction against links made to disseminate circumvention code, but the Second Circuit left open how rigorous a test the First Amendment demands, and the boundaries for ordinary linking and search remain contested.
• Does the DMCA leave fair use adequate breathing room? The court said yes, but critics argue access controls can foreclose legitimate uses the copyright bargain was meant to permit.
• When does code’s functional character override its expressive value? The framework is clear in principle but fact-sensitive, and newer tools blur the line between describing and performing.

Implications

• For technologists and publishers: Publishing functional circumvention code can be enjoined even though code is speech. The expressive label does not immunize a tool that performs circumvention.
• For rights holders: The DMCA’s anti-trafficking provision is a powerful, constitutionally durable remedy against the distribution of circumvention tools.
• For website operators: Knowingly linking to circumvention technology, with intent to spread it, can create liability; neutral, informational linking stands on different footing.
• For fair-use advocates: Corley treats fair use as a defense, not a right of access, limiting its force against technological protection measures. That tension persists in DMCA litigation.
• For litigators: Frame anti-trafficking claims around the tool’s function and the defendant’s purpose; frame defenses, if any, around expressive content and tailoring under intermediate scrutiny.

Frequently asked questions

What did Universal City Studios v. Corley hold? The Second Circuit upheld an injunction barring Eric Corley from posting and linking to DeCSS, a program that decrypts DVD protection. It held the DMCA’s anti-trafficking provision, Section 1201(a)(2), constitutional and ruled that the ban did not violate the First Amendment or fair use.

If computer code is speech, how could the court ban it? The court agreed code has an expressive component, but found the DMCA regulated DeCSS because of its function, not its message. As a content-neutral regulation of the code’s functional capacity to decrypt, the ban survived intermediate First Amendment scrutiny.

Why was linking to DeCSS treated as trafficking? Corley not only posted DeCSS but also linked to other sites offering it and urged other web sites to post it. The district court applied a demanding test, requiring clear and convincing evidence that the linker knew the material was circumvention technology that could not lawfully be offered and linked for the purpose of disseminating it, and found it satisfied. The Second Circuit affirmed the linking ban, while declining to decide whether a test that rigorous is constitutionally required.

Authorities and sources

• Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. Nov. 28, 2001): opinion text (Digital Law Online).
• District court decision: Universal City Studios, Inc. v. Reimerdes, 111 F. Supp. 2d 294 (S.D.N.Y. 2000): case summary (Quimbee).
• DMCA anti-circumvention statute, 17 U.S.C. § 1201 (Cornell LII): https://www.law.cornell.edu/uscode/text/17/1201
• Teaching copy of the opinion (Harvard): https://cyber.harvard.edu/people/tfisher/IP/2001%20Corley%20Abridged.pdf