United States: Software Copying for Maintenance or Repair Purposes can be Protected by Copyright Act "Safe Harbor"

In a case of first impression, the Federal Circuit Court of Appeals recently held that the "safe harbor" provision of Section 117(c) of the Copyright Act applies to conduct that constitutes "maintenance or repair" of a machine, even if the repair activity results in some copying of source code. See Storage Technology Corporation v. Custom Hardware Engineering & Consulting, No. 04-1462 (Fed. Cir. 2005). The court reasoned that section 117(c) was enacted to protect the "class of companies that fix and maintain computer systems, as opposed to those that would make other commercial use of copyrighted material." Further, a claim under the Digital Millenium Copyright Act ("DMCA"), 17 U.S.C. § 1201(a)(1), fails unless the conduct in question constitutes actual infringement or facilitates such infringement. Thus, the court made clear that the protection of section 7(c) can apply even in circumstances where the repair or maintenance company circumvents software protection protocols.

The reasoning in Storage Technology should be welcomed news to service providers that maintain or repair machines and systems that are operated, in whole or in part, by computer programs. On the other hand, copyright owners may view the Storage Technology case as further eroding copyright protections. The case may be a reflection of a growing public policy that favors businesses which provide maintenance and repair services on computer-operated machines. The Federal Circuit’s holding in Storage Technology has repercussions for both software providers, and providers of maintenance or repair services.

Recommendations for Software Providers

• Take active contractual measures to protect intellectual property by putting in place valid non-disclosure, confidentiality, and non-compete agreements with respect to employees and third-party contractors.

• Encrypt automatically-loaded software programs and error messages used to trouble-shoot the system, and be sure not to make any information public if you wish to protect it as a trade secret.

• Differentiate programs that are loaded at "start-up" from those that run after the initial system activation.

Recommendations for Repair and Maintenance Providers

• Execute or load into memory only those programs that are necessary for the start-up of the system.

• Do not access or use copies of third-party programs for purposes other than to start up the machine pursuant to maintenance or repair.

• Upon completion of diagnostics, delete the "copy" of the program that is made during start-up.

• Keep in mind that providers of "repair" services have greater restrictions on their activities than providers of "maintenance" services.

Case Background

StorageTek manufactures automated tape-cartridge libraries that store massive amounts of computer data. During system start-up, the StorageTek system automatically loads copyrighted, executable source code into the system’s random access memory ("RAM"). The code consisted of "functional" code and "maintenance" code, although the maintenance code was found to be so entangled with the functional code that the court could not distinguish between the two programs for purposes of the its analysis.

CHE is an independent operator that provides maintenance and repair services on the tape-cartridge libraries manufactured by StorageTek. CHE trouble-shoots system problems by intercepting error messages generated by StorageTek’s maintenance code. CHE developed a system to circumvent or "crack" StorageTek’s password-protection scheme, called GetKey. CHE used StorageTek’s source code and system-generated error messages strictly for purposes of maintenance or repair; no source code was ever copied by CHE for any purpose other than to start up the system and to diagnose problems.

StorageTek alleged that CHE (a) committed copyright infringement; (b) violated the DMCA’s anticircumvention provision; and (c) misappropriated StorageTek’s trade secrets. The district court issued a preliminary injunction against CHE, finding that StorageTek was likely to succeed on its claims. CHE appealed to the Federal Circuit, which vacated the grant of preliminary injunction and remanded for further proceedings.

No Copyright Infringement if "Safe Harbor" Applies

On appeal, CHE argued that its conduct fell within the safe harbor provision of the Copyright Act, section 117(c), because (a) the copy of the computer program was made solely as part the machine start-up process, i.e., the program was "necessary for the machine to be activated"; (b) the program was not be used in any other manner; and (c) the program was destroyed or deleted immediately after the maintenance or repair was completed.

The Federal Circuit agreed with CHE. The court examined the language of the Copyright Act and reasoned that "maintenance" is distinct from "repair." CHE’s activity fell into the category of "maintenance" because CHE’s trouble-shooting system remained in place on the end-user’s system in order to detect future malfunctions. "Maintenance" was given a broader temporal connotation, which included "the servicing of the machine in order to make it work in accordance with its original specifications.…" CHE’s actions fell under section 117(c) because, at the conclusion of each maintenance activity, CHE reboots and destroys the copy of the copyrighted program, as required by the statute. Thus, the court concluded that CHE was likely to prevail in its argument under the safe harbor provision of section 117(c).

No DMCA Violation if No Infringement or Facilitation Found

Section 1201(a) of the DMCA provides a private cause of action related to the use of technology to circumvent services or techniques (e.g., password protection) used to protect against copyright infringement. In other words, the DMCA provides a cause of action against hackers who circumvent technology used to protect code. The court reasoned, however, that section 1201(a) does not create a new property right. Thus, in order to prevail on a claim under section 1201(a), the copyright owner must prove that the circumvention activity either "infringes or facilitates infringing a right protected by the Copyright Act."

The court found no violation of section 1201(a) because CHE’s actions neither constituted nor facilitated copyright infringement. As discussed above, the court had previously determined that StorageTek was unlikely to prevail on its infringement claim.

Implications of the Storage Technologies Decision

Overall, the holding in Storage Technologies should be reassuring to maintenance providers who service computer-operated machines; the holding makes clear that such providers cannot be held liable for copyright infringement if they comply with the safe harbor provisions of Section 117(c). Most notably, such providers must only use "affiliated" programs, or allow such programs to be copied as are necessary for the start-up of the system, and must, upon completion of diagnostics, delete the "copy" of the program that is made during start-up. At the same time, the DMCA was interpreted narrowly, such that service providers cannot be held liable under the DMCA if their activity—in circumventing computer-protection devices—is not directly related to actual infringement.

On the other hand, manufacturers and/or creators of software might have a different, less favorable view of the Storage Technologies holding because it appears to further erode copyright protections. One could imagine a scenario where a former employee opens an independent repair business using general information known about vulnerabilities or deficiencies in the system developed by his/her former employer. Storage Technologies stands for the proposition that, in certain situations, the independent repair businesses are free to operate and copy the underlying computer program if done in conformity with the safe harbor provision of the Copyright Act and the DMCA.

In sum, Storage Technologies provides lessons for both manufacturers of computer-operated machines and those that seek to provide repair or maintain such systems. The court read the safe harbor provision of the Copyright Act broadly, which means that manufacturers or owners of software may need to consider other means to protect their intellectual property. Similarly, the DMCA "anticircumvention" provision was interpreted narrowly to apply only in those circumstances where a circumvention facilitates, or results in, actual infringement. Manufacturers can limit the effect of this ruling by actively protecting intellectual property with contractual provisions, using encryption for messages communicated between system components, and by segregating true "startup" programs from other maintenance programs. Providers of maintenance or repair services should be sure their actions fall within the safe harbor provision of section 117(c) by executing only those programs that are necessary for the start-up of the system pursuant to maintenance or repair, and should delete all copies of programs from memory. Finally, providers of "repair" services should keep in mind the greater temporal restrictions compared to providers of "maintenance" services.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.