James Grimmelmann has an interesting piece on LawMeme concerning a strange side issue involving unauthorized access to one party's copyrighted works through Archive.org by a third party (From the Strange File: Archive.org Hacking in Civil Lawsuit?). There are many issues involved in the case, so read the whole thing, but one issue stuck out for me:
HAS is raising a striking issue here: third party standing to sue over violation of various computer security statutes. Take for example the DMCA claim. It presumably runs something like this. Access to our copyrighted works (the web pages) is effectively controlled by the technological measures in place at Archive.org. You circumvented those measures. We were injured as a result (I can see copyright infringement, plus possibly some of the other claims from the underlying lawsuit). Therefore, under sections 1201(a) and 1203(a) of the DMCA, you're liable to us. Ka-pow. [links in original]
To my eyes, however, this is not a striking claim with regard to the DMCA because I see it as the basis for the most famous DMCA case of all, the MPAA
anti-DeCSS cases: EFF Archives: MPAA DVD Cases
One issue I always thought wasn't properly raised in the MPAA cases was who really had the right to bring the lawsuit. The movie studios brought the lawsuit because it was their copyrighted works that were being "protected" by CSS copy protection. However, the movie studios have no rights in the CSS system. It is fully controlled by the DVDCCA. Even if the movie studios changed their mind and thought it would be okay to distribute DeCSS, they had no authority to do so. Only the DVDCCA can determine what is authorized with regard to CSS.
The MPAA's argument (if they had been forced to make one) would have had to go something like this: access to the MPAA's copyrighted works (the movies) is effectively controlled by the technological measures owned and controlled by the DVDCCA. DeCSS circumvented those measures, but it is the MPAA that is injured as a result. Thus, the MPAA gets to sue.
I argued at the time that this was incorrect, that the DVDCCA should be the only plaintiff in the suit or, at a minimum, the DVDCCA was a necessary party. Obviously, my arguments never got anywhere.
This issue may seem new because all the other DMCA cases I am aware of have been brought by the companies that actually control the DRM technology used, such as Real v. Streambox, Chamberlain v. Skylink, and Lexmark, to name but a few.
I still think it is important point, however, and it will be interesting to see what a court makes of it. The consequences can be tremendous. As a DRM creator who licenses use of the DRM system, does the DMCA mean that you lose all control over what you permit with regard to your DRM system to those you've licensed it to?