Anticircumvention Risk Checklist: Technological Measures, Exceptions, Exemption Fit, Trafficking, and Documentation

By Casey Scott McKay · 2025-05-21

This checklist assesses and reduces Section 1201 exposure for either side, in the order the questions should be asked rather than the order the statute is written. It classifies the measure, tests whether a protected work actually sits behind it - the strongest and most under-argued defence - separates conduct from trafficking, and identifies the circuit, because the nexus split resolves most device cases before any exception is reached. It screens the seven permanent exceptions and explains why each requires something the client usually lacks, then reads the current triennial classes properly including the cycle check. It covers manufacturer-side design decisions and the authorized access path, the file a repairer or researcher must build in advance, Section 1202 screening with its double scienter requirement, and the parallel contract and computer-access claims that frequently outlast the anticircumvention count.

IP and Technology > Copyright | Checklist | Published 21 May 2025 - Updated 30 May 2026 | Casey Scott McKay - marksy.us

Summary. This checklist assesses and reduces Section 1201 exposure for either side, in the order the questions should be asked rather than the order the statute is written. It classifies the measure, tests whether a protected work actually sits behind it — the strongest and most under-argued defence — separates conduct from trafficking, and identifies the circuit, because the nexus split resolves most device cases before any exception is reached. It screens the seven permanent exceptions and explains why each requires something the client usually lacks, then reads the current triennial classes properly including the cycle check. It covers manufacturer-side design decisions and the authorized access path, the file a repairer or researcher must build in advance, Section 1202 screening with its double scienter requirement, and the parallel contract and computer-access claims that frequently outlast the anticircumvention count.

Keywords: measure classification · protected work test · effectively controls access · conduct versus trafficking · circuit and nexus · statutory exception screening · reverse engineering scope · encryption research factors · security testing authorization · triennial cycle check · class language reading · exemption fit · repair program · authorized access path · lawful acquisition record · purpose statement · dissemination decisions · section 1202 screening · parallel claims · annual review

How to use this checklist

| Phase | What it covers | |---|---| | 1 | Classify the measure | | 2 | The protected work test | | 3 | Effectively controls access | | 4 | Conduct versus trafficking | | 5 | Circuit and the nexus split | | 6 | Authorization | | 7 | Reverse engineering scope | | 8 | Encryption research | | 9 | Security testing | | 10 | The other permanent exceptions | | 11 | Triennial cycle check | | 12 | Reading the class language | | 13 | The trafficking gap | | 14 | Manufacturer design decisions | | 15 | The authorized access path | | 16 | Repairer and researcher file | | 17 | Dissemination decisions | | 18 | Section 1202 screening | | 19 | Parallel claims | | 20 | Litigation posture | | 21 | Triennial participation | | 22 | Annual review |

Boxes marked [Gate] must clear before circumventing anything, or before an access control ships.

The matter. An independent repair shop bypassed diagnostic authentication on agricultural equipment. The shop's conduct was exempt under the current class; the tool vendor's trafficking was not, and no exemption reaches trafficking.

Phase 1. Classify the measure

[ ] [Gate] Access control or copy control?
- Access control: in the ordinary course of its operation requires the application of information, or a process or treatment, with the copyright owner's authority to gain access — 17 U.S.C. § 1201(a).
- Copy control: protects a right of the copyright owner — 17 U.S.C. § 1201(b).
[ ] Understand why it decides everything. Only access controls carry a conduct prohibition. There is no prohibition on the act of circumventing a copy control — only on supplying the means.
[ ] Identify the type: content encryption, component authentication, signed firmware, licence key or activation check, diagnostic credential, region or account lock.
[ ] Rule out non-measures: a contractual prohibition with no technical enforcement; a password the owner supplied; a warning screen or licence text.
[ ] Record the classification in one sentence before proceeding.

Phase 2. The protected work test

[ ] [Gate] Identify the work behind the measure, and confirm it is fixed and original.
[ ] Ask whether the measure gates access to that work, or to something adjacent — a hardware function, a data table, an unprotectable compilation.
[ ] Recognize this as the strongest and most under-argued defence.
- Reference. Lexmark International v. Static Control, where an authentication routine did not effectively control access to a program that was readable regardless.
[ ] For a plaintiff: establish the work early, register it, and be able to state precisely what the measure controls access to.
[ ] For a defendant: engage an engineer at the outset. This is a technical question with legal consequences, and it is where the case is frequently won.

Phase 3. Effectively controls access

[ ] Apply the statutory test, not a strength assessment. "Effectively" sets a low bar and weak measures qualify.
[ ] Ask whether the measure gates anything in ordinary operation, or is bypassed by normal use of the product.
[ ] Consider obfuscation separately. Whether mere obfuscation qualifies is contested and turns on whether ordinary operation requires applying information or a process with the owner's authority.
[ ] Note the consequence of the low bar. A trivial authentication routine generates the same cause of action as strong encryption, which is what makes the statute available as a business tool in accessory and repair markets.

Phase 4. Conduct versus trafficking

[ ] [Gate] State which prohibition applies, per act, per party.
[ ] Circumvention of an access control — 17 U.S.C. § 1201(a)(1). The only prohibition triennial exemptions reach.
[ ] Trafficking in access circumvention — 17 U.S.C. § 1201(a)(2).
[ ] Trafficking in copy-control circumvention — 17 U.S.C. § 1201(b).
[ ] Apply the trafficking test: primarily designed for circumvention; only limited commercially significant purpose other than circumvention; or marketed for that use. Any one suffices.
[ ] Remember information can be a means. The provisions reach technology, products, services, devices, and components — the argument in Universal City Studios v. Corley.

Phase 5. Circuit and the nexus split

[ ] [Gate] Determine the forum before assessing the merits.
[ ] Chamberlain Group v. Skylink Technologies requires a reasonable relationship between circumvention and infringement of a right protected by the Act.
[ ] MDY Industries v. Blizzard Entertainment rejects that for § 1201(a), treating it as a distinct anti-circumvention right — while accepting § 1201(b) has an infringement connection in its text.
[ ] For a plaintiff choosing forum, do this analysis before filing.
[ ] For a defendant in the Ninth Circuit, do not lead with "nobody infringed anything"; redirect effort to Phases 2 and 12.

Phase 6. Authorization

[ ] [Gate] Ask whether the owner authorized the access. Circumvention requires acting without the authority of the copyright owner, so authorization defeats the definition entirely.
[ ] Look for it in the licence, the terms, a service agreement, or correspondence.
[ ] Ask for it before litigating. A credential, a published research policy, or a service arrangement is frequently available and always cheaper than the analysis that follows.
[ ] Record any refusal, which is relevant under § 1201(g) and useful generally.

Phase 7. Reverse engineering scope

[ ] Confirm all four elements of 17 U.S.C. § 1201(f): lawful right to use the program; sole purpose of identifying and analyzing elements necessary for interoperability of an independently created program with other programs; elements not previously readily available; and non-infringing underlying acts.
[ ] [Gate] Confirm the purpose is program-to-program interoperability.
- Trap. Not hardware compatibility generally. Not content access. Not repair, except where repair genuinely requires an interoperable program.
[ ] Search for available documentation or a licensable interface, and record the search — availability defeats the exception.
[ ] Use a clean-room structure to keep the underlying acts non-infringing: one team analyzing and producing a specification, a separate team implementing from it.
[ ] Log every step — who, when, what was accessed, what was produced. The log is the exception's evidence and cannot be reconstructed.
[ ] Note the contract layer. § 1201(f) is no defence to breach of an accepted prohibition on reverse engineering — Bowers v. Baystate Technologies.

Phase 8. Encryption research

[ ] Work the 17 U.S.C. § 1201(g) factors: lawful acquisition; necessity; good-faith effort to obtain authorization; and whether dissemination advances knowledge or facilitates infringement.
[ ] Recognize the practical problem. The factors cannot be assessed in advance, which makes the exception unusable as a planning tool even where it may ultimately be satisfied.
[ ] Send an authorization request in writing regardless, expecting refusal. The request is weighed; its absence is the first thing asked about.
[ ] Document necessity — why the research could not be conducted without circumvention.
[ ] Prefer the current triennial class where one covers the activity, since it is a defined condition set rather than a balancing exercise.

Phase 9. Security testing

[ ] [Gate] Confirm the authorization required by 17 U.S.C. § 1201(j) — of the owner or operator of the computer, system, or network.
- Trap. Independent researchers examining a shipped product do not have it, which is why the exception rarely helps.
[ ] Check for a published security research policy, which converts the exception from unusable to available.
[ ] Work in an isolated environment that cannot harm anyone.
[ ] Record the purpose contemporaneously, before the work begins.
[ ] For a vendor: publish a policy. It grants authorization on stated terms, removes the reputational problem, and costs a page.

Phase 10. The other permanent exceptions

[ ] Libraries, archives, educational institutions — 17 U.S.C. § 1201(d). Access solely for a good-faith acquisition decision. Not a research exception.
[ ] Law enforcement and intelligence — 17 U.S.C. § 1201(e).
[ ] Preventing minors accessing the internet — 17 U.S.C. § 1201(h).
[ ] Personally identifying information — 17 U.S.C. § 1201(i). Requires that the measure collect or disseminate personal information without notice and that circumvention have no other effect.
[ ] Note the pattern. Every exception requires something the client usually lacks: authorization, a narrow purpose, or a balancing exercise conducted in advance.

Phase 11. Triennial cycle check

[ ] [Gate] Confirm the current cycle. An exemption from a superseded cycle is worthless.
[ ] Confirm the class was renewed, and whether it was narrowed on renewal.
[ ] Diary the next cycle, including the petition window.
[ ] Understand the authority. 17 U.S.C. § 1201(a)(1)(C) confines the rulemaking to the conduct prohibition.
[ ] Tell the client the exemption expires, so reliance is planned rather than assumed.

Phase 12. Reading the class language

[ ] [Gate] Read the class in full, not a summary.
[ ] Check four things: the category of work; the device or context; the permitted purpose; and conditions on who may rely on it.
[ ] Confirm the client falls inside the class, not merely that the purpose is sympathetic.
[ ] Quote the class verbatim in the file, with the cycle identified.
[ ] Where the client falls just outside, consider participating in the next cycle — Phase 21.

Phase 13. The trafficking gap

[ ] [Gate] Confirm that no exemption reaches § 1201(a)(2) or § 1201(b).
[ ] Say the asymmetry to the client plainly. They may be permitted to circumvent and prohibited from obtaining the tool that makes it possible.
[ ] Assess the tool supplier's position separately, since it is a different party with a different prohibition and no exemption.
[ ] Consider whether the client's own request for a tool creates exposure for the supplier.
[ ] Note that state right-to-repair statutes do not authorize trafficking, whatever they require of manufacturers.

Phase 14. Manufacturer design decisions

[ ] [Gate] Decide deliberately whether to include an access control, understanding it creates a cause of action requiring no showing of infringement in the Ninth Circuit.
[ ] Answer in writing: does a protected work sit behind the measure; is it an access control or a copy control; is there an authorized access path; and what happens at end of life.
[ ] Model the end-of-life problem. An activation server switched off converts remaining devices into ones that cannot lawfully be made to work — the most sympathetic exemption fact pattern there is.
[ ] Map the state right-to-repair obligations applicable to the product category.
[ ] Keep the design file: purpose of the measure, what it gates, and the authorized path.
[ ] Coordinate with the terms of use, since a contractual prohibition survives preemption under ProCD v. Zeidenberg and is frequently the more reliable claim.

Phase 15. The authorized access path

[ ] Build one. It removes the reputational problem, frequently satisfies the state obligation, and costs less than litigating.
[ ] Define who qualifies — independent repairers, security researchers, accessibility organizations, institutional preservers.
[ ] Publish the terms and the price, since availability at an unreasonable price is treated as unavailability in exemption proceedings.
[ ] Make the request process work — a named contact, a stated turnaround, and an actual grant rate.
[ ] Record grants and refusals, because both are evidence in the next cycle.
[ ] Review annually, alongside the state obligations.

Phase 16. Repairer and researcher file

[ ] [Gate] Lawful acquisition record. Purchase, licence, or receipt — required by § 1201(f) and relevant to most exemptions.
[ ] [Gate] Purpose stated contemporaneously, before the work begins.
- Trap. A purpose articulated afterwards reads as constructed.
[ ] The exemption analysis, with class language quoted and cycle identified.
[ ] The conduct/trafficking line — what the client did, and whether anything was supplied to anyone.
[ ] Authorization sought, in writing, even if refused.
[ ] The technical record of what the measure was and how it was bypassed.
[ ] Terms accepted, since a contractual prohibition creates a claim no exemption answers.

Phase 17. Dissemination decisions

[ ] Distinguish findings from tools. Publishing a description of a vulnerability is different from publishing a working bypass, and § 1201(a)(2) reaches technology and services.
[ ] Weigh the § 1201(g) factor on whether dissemination advances knowledge or facilitates infringement.
[ ] Follow a coordinated disclosure practice — vendor notification, a reasonable period, and a record of both.
[ ] Record the reasoning behind what was published and what was withheld.
[ ] Check the exemption conditions, since research classes typically condition on information being used primarily to promote security.

Phase 18. Section 1202 screening

[ ] Understand the prohibitions. Providing or distributing false copyright management information with intent to facilitate infringement; and intentionally removing or altering CMI, or distributing works knowing CMI was removed, knowing or having reasonable grounds to know it will facilitate infringement — 17 U.S.C. § 1202.
[ ] [Gate] Test the double scienter.
- Reference. Stevens v. Corelogic requires a pattern or identifiable connection, not merely that metadata was stripped in ordinary processing.
[ ] Note CMI is broader than metadata — Murphy v. Millennium Radio Group held a printed credit qualified.
[ ] For a plaintiff: plead it only where the double scienter is provable, since a failing count weakens the complaint.
[ ] For a defendant: audit the processing pipeline and document that stripping is automatic and purpose-neutral.
[ ] Note the remedies at 17 U.S.C. § 1203 and 17 U.S.C. § 1204.

Phase 19. Parallel claims

[ ] Contract, which survives preemption under ProCD v. Zeidenberg and is frequently the stronger count.
[ ] Computer access under 18 U.S.C. § 1030, reaching unauthorized access with different elements.
[ ] Trade secret under 18 U.S.C. § 1836 where the gated material is confidential rather than published.
[ ] Copyright itself, where the circumvention was in aid of copying.
[ ] Patent, where the access control mechanism is claimed.
[ ] [Gate] Do not confuse 17 U.S.C. § 512 with 17 U.S.C. § 1201. They sit in the same statute and do opposite things.
[ ] Tell the client that defeating the anticircumvention claim frequently does not end the case.

Phase 20. Litigation posture

[ ] For the plaintiff: identify the work and the measure with specificity; plead conduct and trafficking separately; choose forum with the nexus split in mind; consider whether the contract count is stronger.
[ ] For the defendant, in order: no protected work behind the measure; measure does not effectively control access; nexus where the circuit permits; exemption; permanent exceptions; authorization.
[ ] Prepare for preliminary relief, which is common and tests the exemption analysis on an incomplete record.
[ ] Engage with the damages theory early. Statutory damages under 17 U.S.C. § 1203 accrue per act of circumvention, making the number of acts contested and consequential.
[ ] Budget for the engineer, since the technical work is more determinative than the legal analysis.
[ ] Correct the fair use misunderstanding immediately. 17 U.S.C. § 107 is a defence to infringement and not to circumvention.

Phase 21. Triennial participation

[ ] Understand the burden — that users of a particular class are, or are likely to be, adversely affected in their ability to make non-infringing uses.
[ ] Assemble concrete evidence: repairs that could not be completed, research abandoned, works that could not be preserved, and declarations from affected users.
[ ] Show no reasonable authorized alternative exists, including on price.
[ ] Draft the class narrowly enough to be granted — defined category, defined purpose, defined persons.
[ ] Support renewal of any class the client relies on, which is now considerably easier than establishing a new one.
[ ] Coordinate with others, since coalition petitions with varied evidence do better.
[ ] Budget most of a year for petitions, comments, opposition, replies, and hearings.

Phase 22. Annual review

[ ] Check the exemption cycle — renewed, narrowed, or lapsed, and whether the client still falls inside.
[ ] Re-read the class language, since renewals are not always identical.
[ ] Re-run Phase 2 for any product that has changed. A firmware update can change what the measure gates.
[ ] Review terms accepted, since updated vendor terms may add a circumvention prohibition.
[ ] Confirm the documentation practice is running — acquisition records, purpose statements, authorization requests, technical records.
[ ] For a manufacturer: confirm the authorized access path functions, the design file is current, and state right-to-repair obligations are met.
[ ] Diary the next cycle's petition window.

Outcome. The measure was classified as an access control gating engine control software. The defence's strongest point was whether the measure gated the software or merely a diagnostic function, which required an engineer and was never fully litigated. Filed in a Ninth Circuit district, so the nexus argument was unavailable under MDY. The reverse engineering exception was argued and was weak, because the purpose was repair rather than program-to-program interoperability. The current triennial class covering diagnosis, maintenance, and repair of lawfully acquired equipment fitted the shop's conduct on a full reading of the class language. The tool vendor had no exemption, because none reaches trafficking — the repair was lawful and the means of accomplishing it was not. What resolved the matter was the manufacturer's exposure under a state right-to-repair statute requiring diagnostic tools on fair terms, and the case settled with an authorized tool published at a fixed price.

Phase 23. The six-question triage

Run these in order and stop as soon as one resolves the matter. Most do not reach the exemptions.

[ ] 1. Is there a technological measure, and what does it control? Access or a right of the copyright owner. Only the former carries a conduct prohibition.
[ ] 2. Is there a work protected under the Act behind it? A measure guarding data, a hardware function, or an unprotectable compilation may fall outside 17 U.S.C. § 1201 entirely.
[ ] 3. Is the conduct circumvention or trafficking? Only circumvention is reachable by an exemption.
[ ] 4. Which circuit? The nexus split between Chamberlain Group v. Skylink Technologies and MDY Industries v. Blizzard Entertainment produces opposite results on identical facts.
[ ] 5. Does a permanent exception apply? Run each; expect none to fit.
[ ] 6. Does a current triennial exemption apply? Cycle, class language, and whether the client falls inside.
[ ] [Gate] Record which question resolved the matter, because that determines what evidence has to be preserved and what the file needs to contain.

Phase 24. Device-category boxes

Run the base checklist, then the boxes for the category, since available relief is category-specific.

Vehicles.

[ ] Diagnostic port authentication and signed firmware are the usual measures.
[ ] Repair exemptions have been granted across cycles and remain conditional.
[ ] State right-to-repair statutes are most developed here.
[ ] Telematics data raises a separate privacy layer.

Medical devices.

[ ] Regulatory overlay — modification may affect clearance, and an exemption from 17 U.S.C. § 1201 says nothing about device regulation.
[ ] Exemption classes carry patient-safety conditions; read them closely.

Consumer electronics and appliances.

[ ] Firmware signing and activation servers.
[ ] Model the end-of-life problem: a discontinued activation service converts working devices into ones that cannot lawfully be made to work.

Video games and software preservation.

[ ] Server-dependent titles that cannot function after shutdown.
[ ] Institutional eligibility conditions are the usual constraint on preservation classes.

Agricultural and industrial equipment.

[ ] The repair pattern in its purest form, and where federal and state law are most obviously in tension.

Accessibility.

[ ] Among the least contested and most consistently renewed classes.
[ ] Frequently overlooked, because the client does not frame the problem as a copyright question.

Printers, cartridges, and consumables.

[ ] The Lexmark International v. Static Control territory, where the protected-work defence is strongest.

Streaming and content platforms.

[ ] The original context; Universal City Studios v. Corley still governs the trafficking analysis.

Phase 25. Evidence request, written in advance

Assemble before acting, or issue on receipt of a claim.

[ ] Technical description of the measure — what it is, what it gates, and how it operates in ordinary use.
[ ] The work behind the measure, identified, with its registration if any.
[ ] Source or object code sufficient to establish what the measure protects.
[ ] Lawful acquisition records for any device or copy involved.
[ ] Contemporaneous purpose statements.
[ ] Authorization requests and responses, including refusals.
[ ] The exemption analysis, with class language and cycle.
[ ] The technical record of the bypass — what was done, by whom, when.
[ ] Supply records, establishing whether anything was provided to anyone else.
[ ] Terms accepted, with version and date, for the parallel contract analysis.
[ ] Reverse engineering logs and clean-room records, where 17 U.S.C. § 1201(f) is relied on.
[ ] Publication and disclosure records, for the 17 U.S.C. § 1201(g) dissemination factor.
[ ] For a manufacturer: the design file, the authorized access path terms, and the grant and refusal log.

Why this belongs here. Most of these are technical rather than legal records, they cannot be reconstructed after the fact, and the party who has them controls the narrative on the questions that actually decide these cases.

Phase 26. The ninety-day programme

For a client whose business depends on this analysis — a repair operation, a research group, an accessory maker, or a manufacturer deploying access controls.

[ ] Days 1-10. Inventory the products and activities in scope. For each, classify the measure and identify what sits behind it, with engineering input.
[ ] Days 5-20. Run the six-question triage per activity and record which question resolves it.
[ ] Days 15-30. Read the current triennial classes in full against the inventory, and record fit or non-fit per activity with the class quoted.
[ ] Days 25-40. Establish the documentation practice — acquisition records, contemporaneous purpose statements, authorization requests, and technical records — and start it running before any further activity.
[ ] Days 35-50. Send authorization requests where any are plausibly available. A published research policy, a service agreement, or a credential removes the analysis entirely for that activity.
[ ] Days 45-60. Map the parallel exposure: terms accepted, computer access exposure under 18 U.S.C. § 1030, and any 17 U.S.C. § 1202 issue.
[ ] Days 55-75. For a manufacturer: design review of each access control, the authorized access path, and state right-to-repair obligations for each product category.
[ ] Days 70-85. Identify activities that fall just outside a class, and decide whether to participate in the next cycle.
[ ] Days 85-90. Write the standing memorandum, name an owner, and diary the next cycle's petition window.

What is deliberately deferred. Litigation-grade technical analysis of every measure. Prioritize by commercial significance, and accept that activities the client does not actually conduct do not need an opinion.

Phase 27. The standing memorandum

Two pages, refreshed annually, and it is the artifact a successor practitioner will need most.

[ ] Per product or activity: the measure; what it gates; the classification; the circuit; the applicable exemption class and cycle; and the documentation held.
[ ] The parallel claims position — terms accepted, and any computer-access or trade secret exposure.
[ ] Authorization status — sought, granted, refused, with dates.
[ ] For a manufacturer: the design rationale, the authorized path terms, and the state obligations by category.
[ ] The open questions, named, with what evidence would resolve each.
[ ] The next cycle date and whether the client intends to participate.
[ ] [Gate] Refresh it annually, and after any firmware change, terms update, or product launch.
[ ] Why it earns its keep. It makes the next question answerable in an hour rather than a week, and it is the record that the analysis was done at the time rather than reconstructed afterwards.

Phase 28. Advising before the client acts

Most of this practice is advisory, and the conversation has a standard shape.

[ ] Ask what they want to do, in plain terms, before any legal framing. Repair a device, test a product's security, make an accessory work, preserve software, extract data they own.
[ ] Ask whether a lock is involved at all. A surprising number of matters resolve here, because the client assumed a technical obstacle was a legal one or the reverse.
[ ] [Gate] Ask whether there is an authorized path. Buying the tool, requesting a credential, or signing a service agreement is frequently available and always cheaper. Clients skip this because they assume refusal.
[ ] Run the six-question triage.
[ ] Give the answer in three parts: what they may do; what they may not do; and what documentation to create before doing anything.
[ ] State the trafficking line explicitly, because a client who may lawfully circumvent will ask a vendor for a tool and may create liability for that vendor.
[ ] State the contract layer explicitly, because a prohibition in accepted terms creates a claim no exemption answers.
[ ] [Gate] Correct the fair use misunderstanding at the first meeting. A client who believes 17 U.S.C. § 107 covers circumvention will act on that belief, and will act before calling again.

Phase 29. Four sentences worth saying

[ ] To any client contemplating circumvention. "Fair use is a defence to copying. It is not a defence to getting past the lock. Those are separate wrongs, and the second one does not care whether what you did afterwards was lawful."
[ ] To a client relying on an exemption. "The exemption covers what you do. It does not cover anyone who supplies you the tool, and it expires. Both are things to plan around rather than discover."
[ ] To a manufacturer designing a product. "Putting an access control in this device creates a legal right you may never use, a reputational exposure you probably will encounter, and a state-law obligation to provide the access it prevents. Decide whether you want all three."
[ ] To a researcher. "Ask for authorization in writing even though they will refuse. The request is weighed in your favour, the refusal costs nothing, and its absence is the first thing you will be asked about."
[ ] Why these four. Each corrects a belief the client already holds and would otherwise act on. In this practice the doctrine is comparatively stable and the client's assumptions are not.

Phase 30. Quarterly and annual metrics

For a client operating a programme that depends on this analysis.

[ ] Activities in the inventory with a completed six-question triage, as a proportion. Target: all of them.
[ ] Activities relying on a triennial exemption, with the cycle expiry date for each. This is the number that should be visible to the business, because reliance without a renewal plan is a cliff.
[ ] Authorization requests sent and outcomes. A rising grant rate frequently means the authorized path is working and the analysis is becoming unnecessary.
[ ] Documentation completeness — acquisition records, purpose statements, and technical records, sampled across recent activities.
[ ] For a manufacturer: authorized access requests received, granted, refused, and median turnaround. Availability at an unreasonable price or with an unreasonable delay is treated as unavailability in exemption proceedings, so the turnaround is evidence.
[ ] Products whose firmware changed in the period, and whether Phase 2 was re-run for each.
[ ] Terms updates received from vendors, and whether any added a circumvention prohibition.
[ ] And one annual question for the standing memorandum: which activities would become unlawful if the relied-upon exemption were not renewed, and what the contingency is. Answering it once a year is what turns a cliff into a plan.

Phase 31. Where this fits in the wider practice

[ ] Alongside copyright itself, where the circumvention was in aid of copying and the infringement claim is the stronger one.
[ ] Alongside contract, which is frequently the more reliable claim and which survives preemption under ProCD v. Zeidenberg. See the Copyright Preemption Checklist.
[ ] Alongside computer access law, where a single bypass engages 18 U.S.C. § 1030 with different elements.
[ ] Alongside trade secret, where the gated material is confidential rather than published.
[ ] Alongside state right-to-repair obligations, which increasingly require manufacturers to supply the very access their measures prevent, without authorizing circumvention or trafficking.
[ ] [Gate] And distinctly from 17 U.S.C. § 512. The two halves of the same statute do opposite things — one shields intermediaries from liability for hosted content, the other creates liability for circumvention — and practitioners conflate them regularly. See the DMCA Takedown Notice Checklist.

Key Authorities at a Glance

| Authority | Proposition | |---|---| | 17 U.S.C. § 1201(a)(1) | Circumventing an access control | | 17 U.S.C. § 1201(a)(2) | Trafficking in access circumvention | | 17 U.S.C. § 1201(b) | Trafficking in copy-control circumvention | | 17 U.S.C. § 1201(a)(1)(C) | Triennial rulemaking | | 17 U.S.C. § 1201(d) | Library and educational exception | | 17 U.S.C. § 1201(e) | Law enforcement | | 17 U.S.C. § 1201(f) | Reverse engineering | | 17 U.S.C. § 1201(g) | Encryption research | | 17 U.S.C. § 1201(h) | Minors and the internet | | 17 U.S.C. § 1201(i) | Personally identifying information | | 17 U.S.C. § 1201(j) | Security testing | | 17 U.S.C. § 1202 | Copyright management information | | 17 U.S.C. § 1203 | Civil remedies | | 17 U.S.C. § 1204 | Criminal penalties | | 17 U.S.C. § 107 | Fair use, not a circumvention defence | | 17 U.S.C. § 117 | Computer program copies | | 17 U.S.C. § 512 | The safe harbor, frequently conflated | | Universal City Studios v. Corley | Trafficking; information as a means | | Chamberlain Group v. Skylink Technologies | Nexus required | | Lexmark International v. Static Control | Effectively controls access, narrowed | | MDY Industries v. Blizzard Entertainment | No nexus under § 1201(a) | | Storage Technology v. Custom Hardware Engineering | Maintenance and § 117 | | Murphy v. Millennium Radio Group | CMI beyond metadata | | Stevens v. Corelogic | Double scienter | | Green v. Department of Justice | Constitutional challenge | | ProCD v. Zeidenberg | Contract survives preemption | | Bowers v. Baystate Technologies | Contractual reverse engineering ban | | 18 U.S.C. § 1030 | Parallel access statute | | 18 U.S.C. § 1836 | Trade secret alternative |

The five things people get wrong

Believing fair use excuses circumvention. 17 U.S.C. § 107 is a defence to infringement. Circumvention is a separate wrong, and the lawfulness of what follows does not make bypassing the lock lawful. Clients act on this misunderstanding, which is why correcting it belongs in the first meeting.

Starting at the exemptions. They are the hardest question and the least likely to help. Most matters resolve on whether a protected work sits behind the measure, whether the measure is an access control or a copy control, or which circuit the case is in.

Assuming an exemption covers the tool. Triennial exemptions reach only the conduct prohibition at 17 U.S.C. § 1201(a)(1). A client may lawfully circumvent while the vendor who supplied the means is liable under § 1201(a)(2) — the repair is lawful and the means is not.

Treating Section 1201(f) as a general reverse engineering right. It requires program-to-program interoperability, elements not previously readily available, and non-infringing underlying acts. Hardware compatibility, content access, and most repair fall outside it, and over-arguing it costs credibility the exemption analysis will need.

Reading a class summary instead of the class language. Exemptions are drafted narrowly because the Copyright Office grants what the evidentiary record supports, and the conditions on category, purpose, and eligible persons are the exemption. A client whose purpose is sympathetic but who falls outside the class has no defence at all.