In the sixth triennial proceeding to determine Digital Millennium Copyright Act (“DMCA”) exemptions, the Copyright Office adopted an exemption concerning the electronic control unit (“ECU”) software found in automobiles and agricultural vehicles. The new exemption permits owners to circumvent the technological control measures (TMPs) found in ECU software for the purpose of diagnosing, repairing, and modifying their vehicles. In light of important public health, safety, and environmental concerns raised by opponents, the exemption has been substantially narrowed and implementation delayed for 12 months.
The Adopted Exemption
After weighing the arguments of the opponents and proponents of the vehicle software exemption, the Copyright Office adopted the following DMCA exemption:
Computer programs that are contained in and control the functioning of a motorized land vehicle such as a personal automobile, commercial motor vehicle or mechanized agricultural vehicle, except for computer programs primarily designed for the control of telematics or entertainment systems for such vehicle, when circumvention is a necessary step undertaken by the authorized owner of the vehicle to allow the diagnosis, repair or lawful modification of a vehicle function; and where such circumvention does not constitute a violation of applicable law, including without limitation regulations promulgated by the Department of Transportation or the Environmental Protection Agency; and provided, however, that such circumvention is initiated no earlier than 12 months after the effective date of this regulation. (emphasis added to show exclusions.)
Cannot circumvent telematics or entertainment systems
The exemption excludes the circumvention of computer programs that operate vehicle entertainment and telematics systems (e.g. systems related to navigation, communications, safety, and security). This exclusion may be of particular importance because hackers have been able to exploit some telematics systems. See, e.g. “Hackers Remotely Kill a Jeep on the Highway.” (On January 28, 2016, Norton Rose Fulbright is sponsoring an Insurance Academy event entitled “Caution ahead – Internet of Things and cyber insurance – A talk with Chris Valasek, the “Jeep Hacker.” We invite you join.) Most automobile companies opposed the vehicle software exemption, arguing that it could further open the door for hackers to exploit vehicles. By excluding telematics systems, would-be hackers will continue to face potential claims for copyright infringement. Additionally, by excluding the circumvention of entertainment systems, unauthorized use of creative or proprietary copyrighted content remains prohibited.
Must be an authorized owner
The vehicle software exemption also excludes circumvention by third parties, even on behalf of the vehicle owner. Only vehicle owners may engage in the diagnosis, repair or modification of their vehicles. The Copyright Office determined that allowing third parties to engage in circumvention is in tension with anti-trafficking provisions of section 1201(a)(2) and (b) of the copyright law. Also, when it passed the Unlocking Act, which allows the unlocking of cellphones and other devices by third parties at the direction of device owners, Congress indicated that extending an exemption to cover third party actors requires a legislative amendment. This exclusion of third parties would therefore prohibit a potential hacker from circumventing copyright law as well.
Circumvention cannot violate other applicable laws
The exemption requires that any diagnosis, repair, or modification of a vehicle must not violate other laws or regulations including those promulgated by the Department of Transportation (DOT) and the Environmental Protection Agency (EPA). This exclusion relates to safety and environmental concerns raised by those agencies. For example, the EPA focused on the potential for persons to alter emission controls arguing that vehicle modifications performed to increase engine power or to boost fuel economy could lead to violations of the Clean Air Act.
Rule operative in 12 months
Due to the concerns raised by DOT and EPA, the vehicle software exemption does not become operative until twelve months from the effective date. This delay is designed to allow affected agencies to prepare for the exemption. During this period, other legislation may be enacted addressing vehicle safety and privacy. For instance, in light of the publicized vulnerabilities of vehicles, there has been federal legislation proposed to outlaw vehicle hacking. In addition, hearings have taken place to address cybersecurity concerns relating to internet-connected vehicles.
This article was prepared by Erik Janitens under the supervision of Sue Ross and Saul Perloff.
Digital Millennium Copyright Act; Greenberg, A., “Hackers Remotely Kill a Jeep On The Highway – With Me In It,” Wired Online (July 21, 2015); Adel, R. “Automakers urge Congress to limit regulation on ‘Internet of Cars’”, SC Magazine (online Nov. 19, 2015)