Password Circumvention for Repair Did Not Lead to Copyright Infringement

In Storage Technology Corp. v. Custom Hardware Engineering & Consulting, Inc., et al. (Fed. Cir. August 24, 2005) the court identified repair conduct invloving password circumvention conduct that appears to fall within the safe harbor of 17 U.S.C. § 117(c) and is therefore outside the scope of the Digital Millenium Copyright Act. The court also recognized that a license agreement with customers allowed the customers’ agent to copy software into RAM during the activation of the customers’ licensed product.

Section 117(c) of the copyright Act is entitled "Limitations on exclusive rights: Computer programs" and provides that

it is not an infringement for the owner or lessee of a machine to make or authorize the making of a copy of a computer program if such copy is made solely by virtue of activation of a machine that lawfully contains an authorized copy of the computer program, for purpose only of maintenance or repair of that machine, if --
(1) such new copy is used in no other manner and is destroyed immediately after the maintenance or repair is completed; and
(2) with respect to any computer program or part thereof that is not necessary for the machine to be activated, such program or part thereof is not accessed or used other than to make such new copy by virtue of the activation of the machine.

In this case, StorageTek sold its tape libraries to customers, but merely licensed the software that ran the library systems. The licensed software specifically excluded the maintenance code which was stored in RAM and protected by a password provided only to authorized service providers. As an unauthorized service provider, CHE had to had to override the "GetKey" password protection scheme in order to read the system fault codes

StorageTek alleged that CHE committed copyright infringement when it rebooted and reconfigured its customers’ units in order to obtain the fault codes. CHE did not deny that the copyrighted maintenance code is copied into RAM when the company reboots its customers’ systems. Instead, CHE’s position was that its actions are protected by section 117(c) because the owners of the tape libraries authorized CHE to turn on the Control Units and Management Units in order to maintain and repair the tape libraries, and the duplication of the software into RAM is necessary for the machine to function. CHE also argued that its activities fall directly within Congress’s purpose in enacting section 117(c), which was to "ensure that independent service organizations do not inadvertently become liable for copyright infringement merely because they have turned on a machine in order to service its hardware components."

According to Cory Hojka at the Patently-O Blog,

In a case of first impression, the Federal Circuit addressed the extent of
this protection offered by 17 U.S.C. § 117(c). The Court of Appeals, relying on
definitions in 17 U.S.C. § 117(d), held that § 117(c) protects maintenance and
repair as two different activities. “Repair,” according to the Federal Circuit,
is restoring a broken machine to its original specifications. “Maintenance,” on
the other hand, has “a much broader temporal connotation” that “encompass[es]
monitoring systems for problems [and] not simply fixing a single, isolated
malfunction.” Thus, the Federal Circuit found erroneous the district court’s
conclusion that only repair activities are protected under Sec. 117(c).

Cathy Kirkman at the Silicon Valley Media Law Blog also offered this analysis with regard to the scope of the software licenses:

StorageTek argued that its license did not extend rights to third parties,
because it stated that the licensee may not "permit another person to use" the
code. However the Court looked to other clauses of the agreement to
conclude:

"The clear implication of those sections is that the license is
tied to the piece of equipment on which the software resides. Thus, the
authorized use is tied to a particular machine, rather than a particular
person."

The clauses in question stated that the software may be transferred
only with the equipment, and the license is solely for use in enabling the
equipment on which the code was provided.

The court also went on to conclude that, to the extent that CHE’s activities do not constitute copyright infringement or facilitate copyright infringement, StorageTek is foreclosed from maintaining an action under the Digital Millenium Copyright Act:

The problem in this case is that the copying of the software into RAM when the
Control or Management Units are rebooted takes place regardless of whether the
LEM or ELEM is used. Hence, there is no nexus between any possible infringement
and the use of the circumvention devices. Rather, CHE’s circumvention of GetKey
only allows CHE to use portions of the copyrighted software that StorageTek
wishes to restrict technologically. The activation of the maintenance code may
violate StorageTek’s contractual rights vis-à-vis its customers, but those
rights are not the rights protected by copyright law. There is simply not a
sufficient nexus between the rights protected by copyright law and the
circumvention of the GetKey system. . . . In this case, the threat from CHE’s circumvention of GetKey is distinct from the dangers that StorageTek’s copyright protects against.

In his disenting opinion, Judge Rader noted that, while he agreed that "maintenance" includes checking the proper functioning of components, he did not agree that CHE’s use of Storage Tek’s maintenance code falls within the protection of § 117(c):

Section 117(c)(1) specifies that any copy of the maintenance software must
be destroyed "after the maintenance or repair is completed." CHE, however, does
not meet this condition. CHE runs the maintenance software continually to
monitor operation. Only when a problem arises during monitoring, does CHE
actually work on the silo. Thus, CHE uses the copy of the maintenance code in
RAM beyond actual servicing or repairing. This continual use falls outside the
scope of § 117(c). . . .

CHE [also] does not boot the machine in order to service or repair it;
it boots to manipulate the maintenance level of the maintenance code so that it
may read fault codes. As noted above, this is not "maintenance" or "repair"
under § 117(c). CHE also does not "immediately destroy" the copy when the
service or repair is completed. CHE uses the maintenance code even while the
machine is functioning properly and is in full use by the client. How can CHE’s
continual use of Storage Tek’s software during a three-year (or more) contract
not be "using the material for a prohibited purpose"? Again, the "immediately
destroy" requirement of § 117(c) protects use only during the limited time the
repairman is actually working on the computer.