Anticircumvention and Repair Toolkit: Section 1201, Exemptions, and Right to Repair

By Casey Scott McKay · 2024-02-09

Section 1201 prohibits circumventing technological measures independently of whether any copyright is infringed, which makes it the provision that reaches repair, interoperability, research, and resale in ways ordinary copyright does not. This toolkit works the two prohibitions - circumventing access controls and trafficking in circumvention tools - and the split between the Federal Circuit's infringement-nexus approach in Chamberlain and the Ninth Circuit's rejection of it in MDY. It sets out the permanent statutory exemptions for reverse engineering, encryption research, and security testing, and the triennial rulemaking exemptions covering repair and other uses. It then works the state right-to-repair statutes and the warranty tie-in rules that operate alongside, and closes with the copyright management information provisions.

IP and Technology > Copyright | Toolkit | Published 9 February 2024 - Updated 9 June 2026 | Casey Scott McKay - marksy.us

Summary. Section 1201 prohibits circumventing technological measures independently of whether any copyright is infringed, which makes it the provision that reaches repair, interoperability, research, and resale in ways ordinary copyright does not. This toolkit works the two prohibitions — circumventing access controls and trafficking in circumvention tools — and the split between the Federal Circuit's infringement-nexus approach in Chamberlain and the Ninth Circuit's rejection of it in MDY. It sets out the permanent statutory exemptions for reverse engineering, encryption research, and security testing, and the triennial rulemaking exemptions covering repair and other uses. It then works the state right-to-repair statutes and the warranty tie-in rules that operate alongside, and closes with the copyright management information provisions.

Keywords: section 1201 · technological protection measures · access controls · copy controls · trafficking prohibition · Chamberlain nexus · MDY v Blizzard · permanent statutory exemptions · reverse engineering exemption · encryption research · security testing · triennial rulemaking · repair exemptions · right to repair statutes · Magnuson-Moss tie-in · copyright management information · section 1202 · remedies · interoperability

Start Here

An independent repair shop wants to fix a piece of agricultural equipment. The fault is a sensor calibration, and correcting it requires access to diagnostic software the manufacturer protects with an authentication check.

No copyright is being infringed. Nothing is copied, distributed, performed, or displayed. The repair is entirely lawful in every ordinary sense.

And yet bypassing that authentication check may violate 17 U.S.C. § 1201, because the provision prohibits circumventing a measure that controls access to a work, independently of whether anything is done with the work afterwards.

That decoupling — a copyright provision that operates without any copyright infringement — is what makes this area distinctive, and it is why it reaches repair, security research, interoperability, and resale.

This toolkit answers three questions.

What is prohibited? Two distinct prohibitions with different scopes and different exemptions.
What is permitted? Permanent statutory exemptions and time-limited rulemaking exemptions, both narrower than they appear.
What operates alongside? State repair statutes, warranty rules, and exhaustion — none of which are copyright and all of which bear on the same conduct.

If you read only one thing, read The DMCA's Other Half. It works the two prohibitions and the exemption structure in the order the questions arise.

The Two Prohibitions

Prohibition one: circumventing access controls. 17 U.S.C. § 1201(a)(1) provides that no person shall circumvent a technological measure that effectively controls access to a work protected under the title.

To circumvent means to descramble, decrypt, or otherwise avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner.

Effectively controls access means that the measure, in the ordinary course of its operation, requires the application of information or a process or treatment, with the authority of the copyright owner, to gain access. The bar is low — a measure need not be strong to be effective.

Prohibition two: trafficking. 17 U.S.C. § 1201(a)(2) prohibits manufacturing, importing, offering to the public, providing, or otherwise trafficking in technology primarily designed to circumvent an access control, having only limited commercially significant purpose other than circumvention, or marketed for that use.

And a parallel trafficking prohibition for copy controls. 17 U.S.C. § 1201(b) prohibits trafficking in tools that circumvent measures protecting a right of a copyright owner — but there is no prohibition on the act of circumventing a copy control, only on trafficking in the tools.

Which produces the asymmetry that matters. Circumventing an access control is itself unlawful. Circumventing a copy control is not, though obtaining the means to do so may be.

The consequence for exemptions. Every rulemaking exemption permits the act of circumvention. None permits trafficking in the tools required to accomplish it — which is why exemptions are frequently useless in practice to anyone who cannot write their own tool.

Remedies. 17 U.S.C. § 1203 provides civil remedies including actual damages or statutory damages per violation, injunctions, and costs. 17 U.S.C. § 1204 provides criminal penalties for wilful violations for commercial advantage or private financial gain.

The Circuit Split

Chamberlain Group v. Skylink Technologies. The Federal Circuit held that a 17 U.S.C. § 1201(a) claim requires a nexus between the circumvention and infringement of rights protected by the Copyright Act — that the provision prohibits access that facilitates infringement, not access as such.

The facts. A garage door opener manufacturer asserted the provision against a maker of universal remotes. The court reasoned that a homeowner has an implied right to access their own garage door opener's software, so there was no unauthorised access and no protected interest at stake.

MDY Industries v. Blizzard Entertainment. The Ninth Circuit expressly declined to follow it, holding that 17 U.S.C. § 1201(a) creates a new anti-circumvention right distinct from copyright infringement, and that no infringement nexus is required for access control claims.

The Ninth Circuit did require a nexus for copy controls under 17 U.S.C. § 1201(b), which by its terms protects a right of a copyright owner — so the split concerns access controls specifically.

Universal City Studios v. Corley upheld the trafficking prohibitions against First Amendment challenge, treating code as speech with a functional component subject to content-neutral regulation.

Lexmark International v. Static Control Components found no violation where the protected code was not itself the subject of meaningful access control and where the authentication sequence did not control access to a protectable work in the relevant sense — reasoning frequently invoked in aftermarket disputes.

Practical consequence. The availability of the infringement-nexus argument depends on the forum, and it is the first question in any defence. Where the nexus approach applies, a defendant with no infringing purpose has a substantial argument; where it does not, the exemptions carry the entire defence.

Which makes forum selection consequential in a way it usually is not for copyright claims.

The Permanent Exemptions

Seven statutory exemptions, each narrower than its label suggests.

Reverse engineering. 17 U.S.C. § 1201(f) permits a person who has lawfully obtained the right to use a copy of a computer program to circumvent for the sole purpose of identifying and analysing elements necessary to achieve interoperability of an independently created program, to the extent the acts do not constitute infringement.

Its conditions. Lawful acquisition. Sole purpose of interoperability. Elements not previously readily available. And the information obtained may be made available to others only for the purpose of enabling interoperability, and only if that does not constitute infringement.

It permits limited tool development and sharing for that purpose, which makes it the only exemption with a meaningful trafficking dimension.

Encryption research. 17 U.S.C. § 1201(g) permits circumvention to identify flaws in encryption technologies, subject to conditions including lawful acquisition, necessity, a good faith effort to obtain authorisation, and consideration of whether the results are disseminated in a manner reasonably calculated to advance knowledge rather than to facilitate infringement.

Security testing. 17 U.S.C. § 1201(j) permits accessing a computer or network solely for good faith testing of security, with authorisation of the owner or operator, and subject to whether the information is used to promote security rather than to facilitate infringement.

Which requires authorisation, and is therefore unavailable for unsolicited research on systems the researcher does not control.

Law enforcement and intelligence activities. 17 U.S.C. § 1201(e).

Non-profit libraries, archives, and educational institutions may circumvent solely to make a good faith determination whether to acquire a copy, under narrow conditions.

Protection of minors and personally identifying information exemptions, both narrow and rarely relied on.

The common defect. Every one requires lawful acquisition, imposes a sole-purpose limitation, and carries dissemination constraints. A researcher or repairer whose conduct falls outside any element loses the exemption entirely.

The Triennial Rulemaking

The mechanism. 17 U.S.C. § 1201(a)(1)(C) directs a rulemaking every three years to determine whether users of particular classes of works are, or are likely to be, adversely affected in their ability to make non-infringing uses. Exemptions granted apply for the following three-year period.

Which means exemptions expire. An exemption relied on in year three of a cycle must be renewed, and a use lawful last year may not be lawful this year.

Renewal is streamlined for previously granted exemptions where no material change has occurred, but it is not automatic and it requires a petition.

Classes that have been granted over successive cycles include, in varying formulations: repair, diagnosis, and maintenance of motorised land vehicles, medical devices, and consumer devices; assistive technologies for print-disabled readers; educational and documentary uses of short excerpts; preservation of software and video games by libraries and archives; security research; and unlocking and jailbreaking of certain devices.

Each is drafted narrowly. The class definition, the qualifying conditions, and the permitted purposes are specific, and conduct outside the definition falls outside the exemption entirely.

The trafficking gap. Rulemaking exemptions permit circumvention. They do not permit trafficking in tools, and 17 U.S.C. § 1201(a)(2) is unchanged by them.

Which is the central practical criticism. An exemption permitting a repairer to circumvent is of limited value if nobody may lawfully provide the tool that accomplishes it. Some exemptions have been paired with narrow provisions addressing this and most have not.

Advocating for an exemption. The process accepts petitions and comments, and the evidentiary burden falls on the proponent to show adverse effects on non-infringing uses. Industry participation matters and the record is what decides.

Practical approach. Before relying on an exemption, read its current text — not a summary — confirm it is in force for the current cycle, and map the intended conduct against every element of the class definition and its conditions.

And diary the cycle end. A repair or research programme built on an exemption has an expiry date, and renewal advocacy should begin well before it.

Right to Repair

The parallel development that operates entirely outside copyright.

The mechanism. State statutes requiring original equipment manufacturers to make available, on fair and reasonable terms, the parts, tools, and documentation necessary for diagnosis, maintenance, and repair — to owners and to independent repair providers.

Coverage varies substantially. Some statutes cover digital electronic equipment broadly; others are limited to specific categories such as agricultural equipment, wheelchairs, or consumer electronics. Exclusions for medical devices, vehicles, and certain safety-critical categories are common.

What must be provided. Parts at the price and on the terms offered to authorised providers. Diagnostic and repair tools, including software tools. Documentation, schematics, and firmware updates.

Which addresses the practical problem that 17 U.S.C. § 1201 exemptions do not: obtaining the means to perform the repair lawfully.

Enforcement is generally by state attorneys general under unfair and deceptive practices authority, with penalties, and in some statutes a private right of action.

Warranty tie-ins. 15 U.S.C. § 2302 prohibits conditioning a written warranty on the use of a branded article or service unless provided without charge or authorised by waiver. A manufacturer voiding a warranty because an independent repairer was used is asserting a position the provision does not support.

Warranty void stickers asserting that removal voids the warranty have been the subject of enforcement under 15 U.S.C. § 45 as deceptive practices.

Vehicle-specific frameworks exist by statute and by industry agreement in several jurisdictions, with their own access requirements.

For manufacturers. The compliant posture is an authorised access programme — parts, tools, and documentation available on published terms — which satisfies the statutes, removes the exemption argument's force, and preserves control over how access is granted.

For repairers. Document the acquisition of parts and tools through lawful channels, rely on statutory access where available, and treat circumvention as the last resort it is.

Copyright Management Information

The companion provision, less litigated and increasingly relevant.

The prohibition. 17 U.S.C. § 1202 prohibits knowingly providing false copyright management information with intent to induce, enable, facilitate, or conceal infringement, and prohibits intentionally removing or altering such information, or distributing works knowing that it has been removed or altered, with the same intent or knowledge.

What copyright management information is. The title, the author, the copyright owner, terms and conditions of use, identifying numbers or symbols, and information conveyed in connection with copies of a work.

Which includes metadata. Embedded rights information in image files, watermarks, and attribution data all qualify.

The intent element does the work. Removal must be intentional and coupled with knowledge or intent regarding infringement — which is what prevents every metadata-stripping content management system from being a violation.

Where claims arise. Photographs distributed with attribution metadata stripped. Content scraped and republished without rights information. And, increasingly, machine-processed content where metadata is lost in the pipeline.

Remedies. 17 U.S.C. § 1203 provides civil remedies including statutory damages per violation, which for a large volume of works produces substantial aggregate exposure.

Practical guidance for content handlers. Preserve embedded rights metadata through processing pipelines. Where a technical constraint requires removal, document the reason and consider whether attribution can be conveyed another way.

For rights holders. Embed the information, because the provision protects it only where it exists, and it supplies a claim independent of infringement.

For anyone building automated content processing, including model training pipelines, metadata handling is a design decision with legal consequences, and stripping by default is the pattern that generates claims.

Defending a Claim

Step one — identify the measure precisely. What technological measure is asserted, and does it control access to a work protected under the title, or does it protect a right of the owner? The two prohibitions differ and the exemptions differ with them.

Step two — check whether it effectively controls access. The bar is low, but a measure that is not applied in the ordinary course, or that does not require information or a process to gain access, may not qualify. Lexmark International v. Static Control Components reasoning is the starting point.

Step three — ask what work is being accessed, and whether it is protectable. Functional code with no protectable expression is a weaker predicate than a creative work.

Step four — run the nexus argument where the forum permits it, under Chamberlain Group v. Skylink Technologies — and be prepared for the MDY Industries v. Blizzard Entertainment response.

Step five — map the conduct against every exemption. Permanent exemptions first, then the current rulemaking classes, element by element.

Step six — check authorisation. Circumvention is defined as acting without the authority of the copyright owner, so an express or implied authorisation defeats the claim. Terms of service, authorised repairer programmes, and published research policies all bear on it.

Step seven — separate the acts. Circumventing an access control is one claim; trafficking is another; and a defendant who circumvented under an exemption but distributed a tool has two different positions.

Step eight — check the remedies exposure. 17 U.S.C. § 1203 statutory damages are per violation, and the definition of a violation in a high-volume context is contested and consequential.

Step nine — assess the underlying copyright claim. Frequently a 17 U.S.C. § 1201 claim accompanies an infringement claim, and the two have entirely different elements and defences. 17 U.S.C. § 107 fair use is a defence to infringement and is not, by itself, a defence to circumvention.

Which is the point most often missed. A lawful fair use does not authorise the circumvention that enabled it, absent an exemption. That gap is the provision's most criticised feature and it is the law.

Programmes on Each Side

For a security research organisation. A written policy on target selection and authorisation. Lawful acquisition documented for every device or copy examined. An assessment against 17 U.S.C. § 1201(g) and 17 U.S.C. § 1201(j) before work begins, recorded. A good faith effort to obtain authorisation, documented including refusals. A disclosure policy calibrated to advance security rather than to facilitate infringement. And no distribution of tools, because no exemption permits it.

For a repair business. Statutory access first — parts, tools, and documentation obtained under right-to-repair statutes or authorised programmes. Circumvention only where a current rulemaking exemption covers the specific conduct, with the exemption text on file and the cycle end diarised. Records of lawful acquisition for every device serviced. And no tool distribution.

For an interoperability project. 17 U.S.C. § 1201(f) is the only exemption with a meaningful sharing dimension, and its conditions are strict. A clean-room process, documented lawful acquisition, a written statement of the interoperability purpose, a scope limited to elements necessary for interoperability, and controlled dissemination. See Running a Reverse Engineering or Interoperability Program.

For a manufacturer. An authorised access programme — published terms for parts, tools, and documentation — which satisfies the state statutes, undercuts exemption advocacy, and preserves control. A security research policy granting authorisation on defined terms, which converts adversarial research into coordinated disclosure. Warranty terms that do not assert tie-ins contrary to 15 U.S.C. § 2302. And an honest internal assessment of whether the access control serves a copyright interest or an aftermarket one, because that assessment is what a court will make.

For a content platform. Metadata preservation through processing pipelines, to avoid 17 U.S.C. § 1202 exposure, and a documented reason where removal is technically necessary.

For anyone building automated pipelines over third-party content. Rights metadata handling as a design requirement, and an assessment of what the pipeline circumvents, if anything, before it runs.

Common Mistakes

Assuming fair use answers a circumvention claim. 17 U.S.C. § 107 is a defence to infringement. It is not, by itself, a defence to circumvention.

Relying on an exemption without reading its current text. Class definitions are narrow, conditions are specific, and cycles expire.

Missing the cycle end. A programme built on a rulemaking exemption has a three-year clock.

Confusing the two prohibitions. Circumventing a copy control is not itself prohibited; trafficking in the tool is. Circumventing an access control is prohibited outright.

Assuming an exemption permits tools. Only 17 U.S.C. § 1201(f) has a meaningful sharing dimension, and it is confined to interoperability.

Relying on the nexus argument in the wrong forum. Chamberlain Group v. Skylink Technologies and MDY Industries v. Blizzard Entertainment point in opposite directions.

Security testing without authorisation, which 17 U.S.C. § 1201(j) requires.

Reverse engineering beyond interoperability, which takes the conduct outside 17 U.S.C. § 1201(f) entirely.

No record of lawful acquisition, which every permanent exemption requires as a threshold.

Warranty void assertions contrary to 15 U.S.C. § 2302, which draw enforcement independently of any copyright question.

Stripping rights metadata by default in content pipelines, creating 17 U.S.C. § 1202 exposure at scale.

Treating an access control as a business control. Where the measure protects an aftermarket rather than a copyright interest, the claim is weaker and the reputational cost of asserting it is real.

Worked Example: The Diagnostic Tool

A manufacturer of commercial refrigeration equipment protects its diagnostic software with a device-bound authentication check. An independent service company wants to service the equipment its customers own.

The manufacturer's position. The check controls access to the diagnostic software, which is a work protected under the title, and bypassing it violates 17 U.S.C. § 1201(a)(1).

The service company's first argument. Nexus, under Chamberlain Group v. Skylink Technologies — no infringement is facilitated, and the equipment owner has an implied right to access software in a machine it owns. Available in some forums and not others.

Second argument. Whether the check effectively controls access to a protectable work, or merely authenticates a device, on the Lexmark International v. Static Control Components reasoning. This turns on what the software does and how much protectable expression it contains.

Third argument. A current rulemaking exemption covering repair, diagnosis, and maintenance of consumer or commercial devices — if the equipment falls within the class as defined, and if the conduct meets every condition. The text is read, not the summary.

Fourth argument. State right-to-repair statutes requiring the manufacturer to make diagnostic tools available on fair and reasonable terms. Where the equipment is within a covered category, this is the argument that actually resolves the problem, because it produces access rather than a defence.

Fifth point. Warranty assertions. If the manufacturer voids warranties for independent service, 15 U.S.C. § 2302 is engaged separately.

The manufacturer's better course. An authorised service programme with published terms for the diagnostic tool. It complies with the state statutes, weakens the case for a broader exemption in the next rulemaking cycle, generates revenue, and preserves quality control — which is what the access control was for.

How this usually resolves. Not in court. The state statutes and the reputational dynamics push manufacturers toward access programmes, and the service company's leverage is regulatory rather than judicial.

The lesson for both sides. 17 U.S.C. § 1201 frames the dispute and rarely resolves it. The resolution comes from the access programme, the statutes requiring one, and the commercial relationship.

Diligence Questions

What technological measures does the product implement, and what do they control access to?

Is the protected material a work with protectable expression, or functional code with little?

Does the measure serve a copyright interest or an aftermarket interest? The answer shapes both the claim's strength and its reputational cost.

Is there an authorised access programme for repairers, researchers, and interoperability partners?

Do the warranty terms assert tie-ins contrary to 15 U.S.C. § 2302?

Which state right-to-repair statutes cover the product category, and does the company comply?

Has the company asserted 17 U.S.C. § 1201 against repairers, researchers, or competitors, and with what outcome?

For a research or repair business: what exemption is each activity relying on, is its current text on file, and when does the cycle end?

Is lawful acquisition documented for every device or copy examined?

Are tools distributed to anyone? No exemption permits it outside the interoperability provision's narrow terms.

Does any content pipeline strip rights metadata, creating 17 U.S.C. § 1202 exposure?

Is there a coordinated disclosure policy granting authorisation for security research, which converts a 17 U.S.C. § 1201(j) question into a permission?

Questions Clients Ask

Is it illegal to fix my own device? Repairing is not a copyright question. Bypassing a technological measure to do it may engage 17 U.S.C. § 1201(a)(1), and a current rulemaking exemption may permit the specific conduct.

We own the machine. Doesn't that mean we can access its software? Chamberlain Group v. Skylink Technologies reasons along those lines; MDY Industries v. Blizzard Entertainment does not. The answer depends on the forum.

Our use is fair use. That is a defence to infringement under 17 U.S.C. § 107. It is not, on its own, a defence to circumvention, which is the criticism most often made of the provision.

There is an exemption for what we do. Read its current text and check it is in force for this cycle. Then check every condition, because the class definitions are narrow.

Can we buy the tool? 17 U.S.C. § 1201(a)(2) prohibits trafficking, and exemptions permit circumvention rather than tools. The interoperability provision at 17 U.S.C. § 1201(f) is the narrow exception.

We are doing security research. 17 U.S.C. § 1201(j) requires authorisation from the owner or operator. Without it, the exemption is unavailable and a coordinated disclosure programme is the practical answer.

We are building a compatible product. 17 U.S.C. § 1201(f) is available for the sole purpose of interoperability of an independently created program, with lawful acquisition and controlled dissemination.

They said our warranty is void because we used an independent repairer. 15 U.S.C. § 2302 prohibits conditioning a written warranty on branded service absent authorisation or free provision.

Can we require our customers to use our service? As a commercial matter within limits; as a warranty condition, generally not; and after Impression Products v. Lexmark International, not through patent enforcement against a purchaser.

Someone stripped the credit from our photographs. 17 U.S.C. § 1202 may apply if removal was intentional and coupled with the required knowledge or intent, and remedies under 17 U.S.C. § 1203 are per violation.

What is the safest posture as a manufacturer? An authorised access programme with published terms. It complies with the state statutes, reduces the case for broader exemptions, and produces a better commercial outcome than litigation against repairers.

The One-Page Position

Circumvention position — [company or programme], [date]. Role: [rights holder / researcher / repairer / interoperability developer]. Technological measures implemented: [list], each protecting [work], serving [copyright / aftermarket] interest. Authorised access programme: [in place since date / none]; terms published at [location]; parts, tools, and documentation available [yes/no]. State right-to-repair statutes applicable: [list]; compliance assessed [date]. Warranty terms reviewed against 15 U.S.C. § 2302 on [date]; [N] tie-in assertions removed. Security research policy: [in place / none]; authorisation granted on [terms]; coordinated disclosure since [date]. For research or repair activities: exemptions relied on [list with current text on file]; cycle ends [date]; renewal advocacy [planned / not]; lawful acquisition documented for [N] of [N] projects; tools distributed to third parties [none]. Interoperability projects: [N], each with a clean-room record and a documented 17 U.S.C. § 1201(f) assessment. Metadata handling: rights information preserved through [N] of [N] pipelines; 17 U.S.C. § 1202 exposure assessed [date]. Claims asserted or received: [N], outcomes [summary]. Recommended actions: [publish the access terms / diary the exemption cycle end / obtain research authorisation / fix the metadata pipeline / remove the warranty tie-in language].

Sector Notes

Agricultural and construction equipment. The sector that drove right-to-repair legislation, where equipment lifespans are long, dealer networks are concentrated, and downtime has immediate economic consequences for the owner.

Consumer electronics. Repair exemptions, parts availability statutes, and warranty tie-in enforcement, with the reputational dimension unusually prominent.

Medical devices. Repair access intersects with regulatory requirements on servicing, and safety arguments carry more weight here than elsewhere — which is why medical device exclusions appear in several state statutes.

Automotive. A developed access framework by statute and industry agreement, telematics access as the current contested area, and design patents on replacement parts running alongside. See Design Patent Toolkit.

Video games and entertainment software. Preservation exemptions for libraries and archives, server shutdown problems for online-dependent titles, and the anti-cheat measures that produced MDY Industries v. Blizzard Entertainment.

Printers and consumables. The classic aftermarket fact pattern, where Lexmark International v. Static Control Components and Impression Products v. Lexmark International both arose and where the copyright and patent theories have both narrowed.

Security research. Coordinated disclosure programmes have become the norm precisely because 17 U.S.C. § 1201(j) requires authorisation, and a published policy converts a legal problem into a process.

Accessibility technology. Exemptions for print-disabled access have been among the most consistently renewed, and the underlying need is uncontested.

Content and media pipelines. 17 U.S.C. § 1202 exposure at scale, which is a design question rather than a litigation one.

Working With Other Advisers

Product engineering, who implement the technological measures and who can say what they actually protect. That answer determines the strength of any claim and the honesty of any defence.

Service and aftermarket leadership, who own the authorised access programme that resolves most of these disputes commercially.

Security leadership, for the coordinated disclosure policy that converts research from an adversarial posture into a managed one.

Regulatory and government affairs, for the triennial rulemaking, where participation shapes the exemption text that a business will rely on or live with for three years.

Consumer protection counsel, for the warranty tie-in analysis under 15 U.S.C. § 2302 and the state statutes, which are enforced independently of copyright.

Patent counsel, because aftermarket disputes typically involve design patents, repair-reconstruction questions, and exhaustion under Impression Products v. Lexmark International alongside the copyright theory.

Communications, because asserting circumvention claims against repairers and researchers carries a reputational cost that frequently exceeds the legal benefit, and that assessment belongs in the decision.

Outside counsel with rulemaking experience, for exemption petitions and comments, where the evidentiary record is what decides the outcome.

A Closing Note

The provision's defining feature is that it operates without copyright infringement, and everything difficult about it follows from that.

A repairer infringes nothing and may still violate it. A researcher improving security infringes nothing and may still violate it. A user making a lawful fair use infringes nothing, and the fair use does not authorise the circumvention that enabled it. The exemptions that address these situations permit the act and not the tools, which for most people is the same as permitting nothing.

Which is why the practical resolution of these disputes has moved elsewhere. State right-to-repair statutes produce access rather than defences. Coordinated disclosure programmes produce authorisation rather than exemption arguments. Authorised service programmes produce revenue and quality control rather than litigation against customers.

For a rights holder, the useful question is not whether a claim exists but whether asserting it is the best available outcome — and increasingly it is not. For a repairer or researcher, the useful question is not which exemption applies but whether authorisation can be obtained, because an authorisation removes the question entirely.

What This Costs

For a rights holder. Implementing technological measures is a product cost the company has usually already incurred. The legal work is an honest assessment of what each measure protects, a warranty terms review, and an access programme — days of counsel time and a commercial decision.

The access programme itself. Real investment in parts distribution, tool licensing, and documentation, offset by revenue and by the compliance obligations it satisfies.

For a researcher. The exemption assessment per project, the authorisation effort, and the disclosure policy. Hours, and the discipline is the deliverable.

For a repairer. Statutory access where available, exemption text on file, lawful acquisition records, and a diary entry for the cycle end. Small.

For an interoperability project. The clean-room process is the cost, and it is engineering time rather than legal spend — but the documentation has to be contemporaneous.

Rulemaking participation. Meaningful expense for the evidentiary record, shared across an industry in practice, and it determines what is permitted for three years.

Against that: statutory damages per violation under 17 U.S.C. § 1203, criminal exposure under 17 U.S.C. § 1204 for wilful commercial violations, and — for a rights holder asserting claims against repairers or researchers — a reputational cost that has, in several well-known instances, exceeded any judgment obtainable.

The economics here favour access programmes over enforcement more clearly than in almost any other area of intellectual property practice, and that is the advice worth giving plainly.

Cadence

At every product design decision involving a technological measure. Record what it protects and why, because that record is the answer to the aftermarket-versus-copyright question when it is asked.

At every rulemaking cycle. Review the exemptions relied on, petition for renewal where needed, and participate where an adverse exemption is proposed. Diary the cycle end three years ahead.

Annually. Warranty terms reviewed against 15 U.S.C. § 2302. State right-to-repair coverage reassessed as statutes are enacted. Access programme terms reviewed. Security research policy refreshed.

Per research or repair project. Exemption assessment before work begins, lawful acquisition documented, scope limitation observed, and dissemination decision recorded.

Per interoperability project. Clean-room documentation maintained contemporaneously, not reconstructed.

On any enforcement decision. A written assessment of the claim's strength, the forum's position on the nexus question, and the reputational cost — before the letter goes out.

On any pipeline change touching third-party content, a metadata handling review under 17 U.S.C. § 1202.

Run on that cadence, the area becomes manageable — which is not the same as saying the law is coherent, and a practitioner who tells a client it is will not be believed for long.

A Suggested Reading Path

For the doctrine:

For the surrounding copyright framework:

For the aftermarket and exhaustion dimension:

Primary Authorities

| Authority | Proposition | |---|---| | 17 U.S.C. § 1201 | Circumvention; trafficking; exemptions | | 17 U.S.C. § 1202 | Copyright management information | | 17 U.S.C. § 1203 | Civil remedies | | 17 U.S.C. § 1204 | Criminal offences | | 17 U.S.C. § 117 | Copies by the owner of a program copy | | 17 U.S.C. § 107 | Fair use | | 17 U.S.C. § 102 | Subject matter; idea exclusion | | 17 U.S.C. § 109 | First sale | | 17 U.S.C. § 512 | Safe harbours | | Chamberlain Group v. Skylink Technologies | Infringement nexus required | | MDY Industries v. Blizzard Entertainment | No nexus for access controls | | Universal City Studios v. Corley | Trafficking prohibitions upheld | | Lexmark International v. Static Control Components | Authentication sequences and access | | Impression Products v. Lexmark International | Exhaustion on authorised sale | | Google v. Oracle America | Fair use in software interfaces | | Sony Computer Entertainment v. Connectix | Intermediate copying for interoperability | | 15 U.S.C. § 2302 | Warranty tie-in prohibition | | 15 U.S.C. § 45 | Unfair or deceptive practices | | 35 U.S.C. § 271 | Repair and reconstruction context | | State right to repair statutes | Parts, tools, and documentation obligations |

Forms and Templates

Circumvention work produces one artefact that determines the outcome, and it is the contemporaneous project record: what was accessed, how it was lawfully acquired, what the purpose was, what was necessary to achieve it, what was learned, and what was disseminated to whom. Every permanent exemption in 17 U.S.C. § 1201 turns on those facts, and each requires them to be true at the time rather than asserted afterwards. The Portfolio Inventory Template adapts to the register a research or repair organisation should keep: one row per project, with the target, the acquisition basis, the exemption relied on, the scope limitation observed, the dissemination decision, and the reviewer. The License Agreement Template matters from the other direction — where a manufacturer authorises access, an express authorisation removes the question entirely, and a well-drafted authorised-repairer or research programme is cheaper than litigating exemptions. The Cease and Desist Template is the instrument on the enforcement side, and its value depends on identifying the specific measure and the specific circumvention rather than asserting general unauthorised access.

Related Toolkits and Checklists

The Copyright Fundamentals Toolkit covers the underlying framework that this provision sits beside without depending on. The Interoperability and Reverse Engineering Checklist runs the clean-room and documentation steps that the reverse engineering exemption requires. The Exhaustion and Gray Market Toolkit covers the aftermarket rights that repair disputes engage alongside this provision, particularly after Impression Products v. Lexmark International. And the Software, Data, and Open Source Toolkit covers the licensing layer that governs what a lawful acquirer may do with code before any circumvention question arises.