Part Of Apple's Abuse Of The DMCA Against Corellium Thrown Out... But Part Of It Lives On

Almost exactly a year ago, we wrote about a very troubling case in which Apple sued Corellium, arguing that it was copyright infringement for the company to create a virtualization tool to let users create and interact with virtual iOS devices. As we noted, virtualization is a useful tool for a wide variety of issues, including security researchers and app developers. A key part of Apple's lawsuit was that this virtualization violated Section 1201 of the DMCA. As we've explained for years, DMCA 1201 is the "anti-circumvention" part of the DMCA, and has been widely abused to try to stop perfectly legitimate activity that has nothing to do with copyright infringement. DMCA 1201 is a bad law and honestly we'd be better to just toss the whole thing in the garbage.

Apple's lawsuit against Corellium is a perfect example of why. One key thing that came out in the lawsuit is that Apple first tried to buy Corellium, and only filed the lawsuit after talks fell through, which certainly gives it the appearance of extra vindictiveness. Right before New Years a judge ruled on the summary judgment motions from both sides and tossed out some claims, but let others move forward. Unfortunately, reporters who apparently are unable to actually read through a full opinion, reported it (incorrectly) as Apple "losing" the case:

The reality is, unfortunately, not so clean. The court did toss out some copyright claims by ruling (correctly!) that Corellium's use is covered by fair use. But it also allowed the 1201 anti-circumvention claims to move forward -- and that's incredibly dangerous. Let's cover the dangerous parts first (which is the opposite of what the court did). The key issue is whether or not Corellium circumvents Apple's authentication server. Corellium argued both that it did not circumvent Apple's technological protection measures and that, even if it did, it was fair use. Unfortunately, the court (citing some other questionable decisions) says that there is no fair use defense to 1201 violations.

Here, if the Court were to adopt Corellium’s position that fair use is a defense to Apple’s DMCA claim, that would effectively render section 1201 meaningless. “A venerable canon makes clear that an interpreter must, if possible, give effect to every word and phrase in a statute.” Darrisaw v. Pennsylvania Higher Educ. Assistance Agency, 949 F.3d 1302, 1306 (11th Cir. 2020) (citation). “[Courts] cannot adopt an interpretation that would render a term meaningless . . . .” Id. (citation omitted, italics in original). Thus, the Court finds that the better reading is that adopted by the Corley court. Therefore, Corellium may make fair use of iOS, but it is not absolved of potential liability for allegedly employing circumvention tools to unlawfully access iOS or elements of iOS. As noted earlier, this result may seem to undercut section 107’s fair use. However, in passing the DMCA, Congress adopted a “balanced” approach to accommodate both piracy and fair use concerns. Corley, 273 F.3d at 444 n.13. “The balance embodied in a federal law is not something this court can disturb, absent a Constitutional violation not at issue here.” Realnetworks, Inc., 641 F. Supp. 2d at 943. The Court, therefore, rejects Corellium’s fair use defense in the context of the DMCA.

The main case the court is citing here, the infamous Corley case is the shitty gift that keeps on giving us shit for security researchers. That was the case in which Eric Corley, the publisher of 2600, was found to have violated the DMCA for daring to publish the code for DeCSS, a simple program that decrypted the lame DRM on DVDs, as well as linking to other sites that had posted the code. This was something of an early protest against DRM, in which tons of people posted the DeCSS code widely to highlight how it was a free speech issue. While the court did (helpfully!) recognize the computer code was protected by the 1st Amendment, it also said that it could separate out the expressive part of the code and the functional part -- and that the functional part could violate 1201. Even worse, it effectively said, as this new ruling says, that you can't use fair use to get out of a 1201 claim.

That's bad and should be another nail in the coffin for 1201 itself. When 1201 was passed as part of the DMCA, we were told, repeatedly, that it was necessary to protect copyright