Brooklyn Law Review

I. Introduction

When copyrighted works are published in digital form, publishers may seek to prevent copyright infringements by embedding technological protections into the published content. Publishers have a statutory incentive to deploy such technological protection measures (commonly referred to as “digital rights management” or “DRM” systems), for if they do, they may avail themselves of the protections of the Digital Millennium Copyright Act of 1998 (“DMCA”). The DMCA forbids circumventing, or trafficking in devices that circumvent, technological measures that protect copyrighted works. This statutory prohibition on circumventing technological protection measures supplies

rights holders with an additional cause of action that they may elect to pursue instead of, or in addition to, the ordinary remedies for copyright infringement.

In a number of recent cases, however, courts have permitted defendants to circumvent DRM measures or to traffic in circumvention devices, finding no violation of the DMCA. The courts in these cases offered a number of reasons for rejecting the plaintiffs’ claims, including (1) that the technological subject matter of the parties’ dispute was not within the scope of the DMCA; (2) that plaintiffs were attempting to apply the DMCA in circumstances not contemplated by Congress at the time it passed the statute; (3) that the plaintiffs were abusing the DMCA as a means of gaining improper advantage over a competitor in the marketplace; and (4) that the plaintiffs should be required to demonstrate an underlying act of copyright infringement by the defendant as a necessary element of any DMCA claim. The first two of these arguments rest on inferences and suppositions about legislative intent in the face of minimally illuminating statutory text. The latter two are essentially policy arguments that, whatever their persuasive appeal, are even less readily grounded in the language of the DMCA as passed.

These recent decisions gain persuasive force, however, if contextualized within the long history of judge-made exceptions to the general provisions of federal copyright law. The common-law doctrine of fair use, for example, began—and, even after receiving express statutory recognition in the Copyright Act of 1976, continues to evolve—as a judge-made exception to the statutory exclusive rights of copyright holders. So viewed, recent decisions may be creating what amounts to a judge-made exception to the liability rules of the DMCA—what is in substance, even if it has not been so labeled by the courts, an emerging doctrine of “fair circumvention.”

My aims herein are both descriptive and normative. As to the former, I believe that the reference to an emerging judge-made common law of fair circumvention more accurately describes what the courts are doing in fact when confronted with cases that test the limits of the statutory ban on circumventing or trafficking in circumvention devices. To decide DMCA disputes, the courts are borrowing—sometimes expressly, sometimes not—from copyright law principles, including fair use. As to the latter, I conclude that further development of legal doctrine in this area ought to rest on the forthright acknowledgment and evolution of an express judge-made “fair circumvention” exception to the DMCA through the ordinary means of case-by-case adjudication. As I will discuss below, acknowledging the link between the existing fair use doctrine and the emerging “fair circumvention” doctrine would offer a far more robust analytical toolset than exists under the courts’ current approach, which involves divining (or, more accurately, imputing) legislative intent in the face of statutory silence. Indeed, several of the factors the courts have seized upon as most salient, such as the nature of the underlying expressive work and the threat of economic harm to the plaintiff, are as clearly encompassed within the historical contours of copyright’s fair use doctrine as they are detached from the actual statutory text of the DMCA.

An analytical caveat is in order, however: it is not my contention that the courts have imported copyright’s fair use exception wholesale into the DMCA. Although the statute states Congress’s intention to preserve fair use, the anti-circumvention provisions of the DMCA make no express exceptions for fair uses, and some courts have rejected the notion that a party accused of a DMCA violation may interpose a fair use defense. Although some language in more recent court decisions is more hospitable to the possibility that a fair use defense may exist in the DMCA context, no court has yet gone so far as to hold that circumventing a technological protection measure is permissible under the DMCA in order to make a fair use of the underlying copyrighted work. My contention, rather, is that courts are borrowing (and should borrow) factors and criteria that have developed under fair use en route to creating what I have labeled a separate doctrine of “fair circumvention” under the DMCA. Continued borrowing of the same sort may, in time, blur or even eliminate the distinction that presently exists between the scope of copyright’s fair use exception and the narrower, but growing, DMCA exception for fair circumvention. The fact that the borrowing is as yet incomplete, however, should not obscure the substantial amount that has already occurred or preclude further expansions of the fair circumvention doctrine in the future as an ordinary adjunct of the courts’ common-law powers to interpret and apply federal copyright law.

Part II of this Article briefly surveys the enactment and text of the DMCA before turning to a detailed consideration of several cases that have given the statute either a conspicuously broad, or a conspicuously narrow, reading. My review suggests that courts on both sides of the divide over the proper reading of the DMCA are issuing opinions that are difficult to square with the statutory text they purport to construe. Because the text alone appears inadequate to explain the actual results in DMCA cases, the inquiry expands in Part III of this Article to consider whether other principles can be invoked to support the courts’ decisionmaking. My principal conclusions here are that (1) courts may, and properly should, draw upon the broader corpus of federal copyright law to illuminate the meaning of the DMCA; (2) partly for historical reasons and partly because of the particular terms of the copyright statutes, federal copyright law leaves a comparatively broad domain available for judicial policymaking; and (3) the development of copyright’s fair use doctrine provides a useful model for the courts to follow in crafting exceptions to liability under the DMCA. This analysis also suggests that one of the criticisms leveled against some of the courts in DMCA cases—to wit, that the courts are substituting their own policy preferences for Congress’s—is ill-founded in view of the courts’ prominent historical role in the development of copyright law. Part IV seeks to guide further judicial development of the emerging fair circumvention doctrine by analogizing, first, to principles of fair use, and second, to policy distinctions that have been made in the DMCA cases to date. The goal here is to suggest that the courts should make explicit a debate that is currently occurring sotto voce under the surface of their DMCA opinions. To foster development of a coherent body of doctrine under the DMCA, the courts should engage in a forthright balancing of the interests at stake in DMCA cases. The courts should not discount copyright holders’ interests in protecting their works, nor knowledgeable consumers’ interests in making ordinary uses of lawfully acquired electronics products, but should simply make explicit the factors they employ in declaring one or the other set of interests to predominate in a given case.

II. Judicial Constructions of the DMCA

Because the courts in DMCA cases have declared repeatedly that their decisions rest solely on a consideration of the statute’s literal text, it is pertinent to begin by reviewing the circumstances that led Congress to enact the statute and the language it selected to effectuate its intent. The sections that follow will summarize the background and text of the statute’s anti-circumvention provisions before turning to a critical review of some of the key cases that have arisen under the DMCA to date.

A. Statutory Background

In 1996, at the urging of the Clinton Administration, the World Intellectual Property Organization (“WIPO”) promulgated two new treaties dealing, among other issues, with what was perceived as a growing threat of copyright infringement in the digital arena. The treaties proposed to authorize content owners to deploy technological measures that could effectively prevent such infringements from occurring by limiting users’ practical ability to access or copy the protected works, except upon terms specified by the content owners. It was broadly understood, however, that such access and copying controls could never be designed to be perfectly effective in all circumstances—sufficiently sophisticated users could circumvent the protections and access or copy the work. To forestall this outcome, the 1996 WIPO treaties required signatory nations to adopt new legislation punishing circumvention of access and copy control technologies.

First, Article 11 of the WIPO Copyright Treaty required as follows:

Contracting Parties shall provide adequate legal protection and effective legal remedies against the circumvention of effective technological measures that are used by authors in connection with the exercise of their rights under this Treaty or the Berne Convention and that restrict acts, in respect of their works, which are not authorized by the authors concerned or permitted by law.

The contemporaneous WIPO Performances and Phonograms Treaty imposed a similar obligation, directing in Article 18 as follows:

Contracting Parties shall provide adequate legal protection and effective legal remedies against the circumvention of effective technological measures that are used by performers or producers of phonograms in connection with the exercise of their rights under this Treaty and that restrict acts, in respect of their performances or phonograms, which are not authorized by the performers or the producers of phonograms concerned or permitted by law.

Title I of the DMCA, captioned the “WIPO Copyright and Performances and Phonograms Treaties Implementation Act of 1998,” was enacted to implement both of these treaty requirements.

The relevant provisions of the DMCA define three distinct offenses, one of which forbids circumvention of a technological measure while the other two forbid trafficking in circumvention devices. The statute’s anti-circumvention provision provides that: “No person shall circumvent a technological measure that effectively controls access to a work protected under this title.” The statute’s two anti-trafficking provisions are each directed against different types of prohibited devices. The DMCA first forbids the making of or trafficking in devices that circumvent the same sort of access controls that are the subject of the anti-circumvention clause:

No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that—

(A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;

(B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or

(C) is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.

The other provision forbids making or trafficking in devices that circumvent copy control technologies:

No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that—

(A) is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof;

(B) has only limited commercially significant purpose or use other than to circumvent protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof; or

(C) is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof.

As drafted, there is a certain lack of parallelism in the statute: the provision forbidding trafficking in copy control circumvention devices is not matched, as the access control trafficking provision is, by a separate clause outlawing the use of such a device, although this is perhaps explainable by the fact that circumventing a copy control measure may be separately punishable as copyright infringement.

The DMCA provided definitions of two of the key phrases employed in the statute’s liability provisions. First, Congress defined what it meant by “circumvention”:

[T]o “circumvent a technological measure” means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner . . . .

Congress next provided an explanation of the requirement that an access control measure “effectively control access” to a copyrighted work:

[A] technological measure “effectively controls access to a work” if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.

As will be seen below, these definitional provisions have caused their own share of difficulty for courts called upon to construe the DMCA.

Congress contemplated three broad types of exemptions from the DMCA’s liability provisions. First, the statute includes a number of provisions excusing certain types of users from the statute’s liability provisions, including nonprofit libraries, archives, and educational institutions; law enforcement and intelligence agents; competing developers of interoperable computer software; and encryption and security researchers. Second, Congress provided a mechanism by which certain types of works would be exempted from the DMCA’s liability provisions by means of a triennial administrative rulemaking conducted by the Library of Congress upon the recommendation of the Register of Copyrights. Finally, Congress sought to guide judicial constructions of the statute’s liability provisions by listing a number of countervailing policies and rights with which it disclaimed any intention to interfere, including fair use and freedom of expression. Congress similarly stated that it did not intend the DMCA to alter the traditional judge-made contours of secondary liability or to force technology manufacturers to include any particular form of technological protection measure in their products.

B. The DMCA in the Courts

The cases that have delineated the boundaries of the anticircumvention cause of action may be divided, without undue oversimplification, into two categories. On one side fall the cases that have construed the DMCA broadly, enlarging its remedial reach by construing uncertainties in the statutory text against accused violators. On the other side are the cases that have given the statute a narrow reading, enunciating principles that support limits on the scope of DMCA liability. Both sets of cases, however, give the statute a reading that is at once rigidly formalistic and highly selective—that is, the courts simultaneously insist that their interpretations are commanded by the statutory text while disregarding or construing away other provisions that actually appear in the DMCA.

1. The DeCSS Case

One of the earliest judicial applications of the DMCA, and still the high-water mark of the expansive view of the statute, was the socalled “DeCSS” litigation. DeCSS was a computer program written to enable users to decode the audiovisual content of DVD-Video discs (more colloquially, “DVDs”) which had been scrambled using a rudimentary form of digital encryption known as the “Content Scramble System,” or “CSS.” DeCSS made it possible for users to decrypt (and thereafter to view or copy in unencrypted form) the content of a CSS-encrypted DVD even if the user had not paid a licensing fee to the DVD Copy Control Association (“DVDCCA”), an industry group, for an authorized decryption key.

Set-top DVD players produced by consumer electronics manufacturers included lawful, DVDCCA-licensed decryption keys. Jon Johansen, a Norwegian teenager, acting in concert with unidentified others, obtained such a licensed DVD player and “reverse engineered” it to discover the algorithm employed by the CSS encryption system. The practical necessity of designing DVD players to be able to play back encrypted DVD discs effectively ensured that such reverse engineering would be successful—that is, that it would be possible from studying the input (an encrypted DVD) and the output (the decrypted video content) to draw correct inferences about the decryption algorithm that was being employed. The result of Johansen’s work was the DeCSS program, which was posted on Johansen’s web site and quickly spread to hundreds of other sites worldwide.

Journalist Eric Corley copied the DeCSS program to his web server and made it available for readers to download. This prompted a DMCA lawsuit against Corley and his publishing company. Corley removed DeCSS from his web site following the district court’s grant of a preliminary injunction to the movie studio plaintiffs, but maintained hyperlinks from his site to other sites that “purport[ed] to offer [the software] for download.” The district court found that both Corley’s original posting of the DeCSS program and his posting of hyperlinks to other web sites where the program had been made available violated (a)(2)’s prohibition on trafficking in access control circumvention technologies.

The court reasoned that CSS was a “technological measure that effectively controls access to” a copyrighted work—to wit, the movie contained on a DVD disc. It rejected the defendants’ arguments that CSS could not be said to “effectively control access to” the copyrighted content of a DVD because it was a minimal form of encryption. The court reasoned that because CSS, “‘in the ordinary course of its operation, requires the application of information or a process or a treatment, with the authority of the copyright owner, to gain access to a work,’” it satisfied the statutory definition of “effectively control access.” The protections of the DMCA, in other words, did not turn upon whether the measure was actually “effective”—that is, whether it functioned in such a way as to frustrate unauthorized attempts to access the work. Rather, the court reasoned, the dispositive question was whether the copyright owners had granted express permission for the creation of the circumvention tool at issue: DeCSS circumvented what was “effectively” an access control mechanism because the copyright holder had provided an avenue for authorized decryption of the protected content (to wit, purchase of a license from the DVDCCA) with which the designers of DeCSS had failed to comply. Because there was no “authority of the copyright owner” for the creation of such a tool, the court reasoned, the dissemination of DeCSS by the defendants necessarily violated the DMCA.

The court rejected the defendants’ argument that circumvention of a technological measure for the purpose of making a fair use of the underlying copyrighted work would be permissible under the DMCA. The court’s reasoning began with the truism that copyright infringement and violations of the anti-circumvention provisions of the DMCA are distinct offenses. A defense to the former, accordingly, was not automatically a defense to the latter. The statutory text, however, was silent on the question whether fair use could be raised as a defense to a claim under the DMCA. The court construed this silence as an implicit legislative rejection of the fair use defense, reasoning that “[i]f Congress had meant the fair use defense to apply to such [DMCA] actions, it would have said so.” Rather than “saying so,” however, Congress gave indications that the court found adequate to conclude that fair use of the underlying copyrighted work could not immunize a party from liability for circumventing an access control mechanism. The court pointed, first, to the fact that authorization by the copyright holder was a complete defense to a DMCA violation; second, to the fact that Congress delayed the statute’s effective date; and third, to the enumeration of some exceptions to liability in the DMCA itself. The court found the DMCA “crystal clear” in providing no fair use defense to a trafficking claim and refused any suggestion that it should construe the statute in favor of such an exception. “In such circumstances,” the court concluded, “courts may not undo what Congress so plainly has done by construing the words of the statute to accomplish a result that Congress rejected.”

The persuasive force of Reimerdes is occasionally impaired by the heated—at times, borderline intemperate—rhetoric of the court’s opinion. For example, the court seemed to insinuate that the DeCSS technology was guilty by association with various sordid topics also covered in the defendants’ magazine. The court apparently found it damning that the defendants had previously published “a guide to the federal criminal justice system for readers charged with computer hacking.” Elsewhere, the court likened the defendants to political assassins and the DeCSS code to a virus. It painted the authors of DeCSS, who plausibly claimed to be motivated by the desire to play their lawfully purchased DVD discs on computers running the Linux operating system, essentially as anarchists, describing them as “adherents of a movement that believes that information should be available without charge to anyone clever enough to break into the computer systems or data storage media in which it is located.” The effect is to make it difficult to tell whether, and to what extent, the court’s sweeping reading of the DMCA’s liability provisions, and its denial that copyright’s fair use doctrine was relevant to the reach of the DMCA, truly rest upon a careful construction of the statute rather than on the judge’s manifest visceral dislike of the defendants.

That the court’s hostile rhetoric provides the key to understanding its analysis is further evidenced by the fact that, considered on its own terms, Reimerdes articulates a facially dubious construction of the statutory text. (c)(1) of the DMCA, for example, states Congress’s intention not to constrict the scope of the fair use doctrine. According to the Reimerdes court, this provision signified only that fair use remained a defense to a claim for copyright infringement but did not provide a defense to a claim arising under the DMCA. As so construed, however, (c)(1) is mere surplusage, adding nothing to the statutory fair use defense to copyright infringement already provided in of the Copyright Act. Settled principles of interpretation counsel against a construction that renders statutory language superfluous.

Still more troubling is the tension between the court’s interpretation of the text of the DMCA and the provisions of the copyright treaties that the DMCA was enacted to implement. As the Reimerdes court noted, Congress passed the DMCA to implement the United States’ obligations under the WIPO Copyright Treaty. Article 11 of that Treaty requires signatory nations to prohibit circumvention of technological measures “that restrict acts . . . which are not authorized by the authors concerned or permitted by law.” Fair use of copyrighted works, however, is expressly “permitted by law” in the United States. To the extent that the DMCA is interpreted to implement the treaty obligations that prompted its enactment, accordingly, the statute cannot plausibly be read to forbid circumvention for fair use. Although the Reimerdes court recognized that its interpretation of the DMCA “le[ft] technologically unsophisticated persons who wish to make fair use of encrypted copyrighted works without the technical means of doing so,” it declared that this problem was “a matter for Congress.” A court less animated by hostility to the defendants in the case at bar might more readily have perceived such an absurd consequence as evidence of error in its interpretation of the statute.

2. The Durable Goods Cases

In a trio of more recent cases—Chamberlain Group, Inc. v. Skylink Technologies, Inc., Lexmark International, Inc. v. Static Control Components, Inc., and Storage Technology Corporation v. Custom Hardware Engineering & Consulting, Inc.—two federal courts of appeals refused to apply the DMCA to prevent circumvention of access control mechanisms embedded in durable goods.

a. Chamberlain v. Skylink

In Chamberlain v. Skylink, the plaintiff, Chamberlain, manufactured garage door openers that incorporated what the court presumed to be copyrighted computer software code. Chamberlain’s software was designed to recognize a certain set of transmitted numerical codes as valid commands to open the owner’s garage door. Chamberlain included in its software a separate routine that would “reset” the listing of accepted codes, enabling a user to open their garage door even if the first transmitted code was not recognized as valid. Skylink, a competitor, produced and sold a “universal transmitter” that was capable of operating with garage door openers sold by many other companies, including Chamberlain’s. Skylink’s transmitter was designed to transmit a burst of three code sequences in rapid succession that would either be recognized as a correct code, or else trigger the “reset” routine in Chamberlain’s software—resulting, in either case, in the opening of the owner’s garage door.

Chamberlain sued, alleging that the code sequences were technological measures that protected access to the copyrighted software embedded in its garage door openers. The district court granted summary judgment to Skylink on Chamberlain’s DMCA claim, and the court of appeals affirmed.

The court in Chamberlain, like the court in Reimerdes, characterized the dispositive issue as whether the defendant had authority to access plaintiff’s copyrighted work in the manner in which it did. The two courts’ conceptions of what “authorization” entailed, however, could scarcely be more dissimilar. Whereas Reimerdes had looked only at whether the copyright owner had granted express permission for the defendant’s access, the Chamberlain court viewed the lack of Chamberlain’s permission as essentially irrelevant to the question before it, because the copyright statute itself supplied the necessary “authorization” for Skylink’s access. So long as Skylink’s product was designed to enable uses that the copyright statute permitted, in other words, trafficking in such a device did not constitute a DMCA violation notwithstanding Chamberlain’s denial of permission. The court rejected Chamberlain’s argument (which the Reimerdes court surely would have accepted) that “all such uses of products containing copyrighted software to which a technological measure controlled access are now per se illegal under the DMCA unless the manufacturer provided consumers with explicit authorization.”

Although the court declared that its “inquiry ends with [the] clear language” of the DMCA, it went on to consider the issue in light of the statute’s background, structure, and purpose. It found that the “[s]tatutory structure and legislative history both make it clear that applies only to circumventions reasonably related to protected rights.” Quoting from the legislative history, the court emphasized Congress’s intention “‘to specify, with as much clarity as possible, how the right against anticircumvention would be qualified to maintain balance between the interests of content creators and information users.’” That balance would be upset, the court reasoned, if the statute were read as Chamberlain wished. The crux of the matter, in the court’s view, was Chamberlain’s insistence “that no necessary connection exists between access and copyrights”—that is, that anti-circumvention liability under the DMCA was unrelated to the question whether the defendant had infringed, or contributed to the infringement, of plaintiff’s copyrights. Noting that the DMCA was enacted in part to deter copyright infringement, the court reasoned that it would be illogical to construe the statute so as to make irrelevant the question whether the plaintiff actually faced potential infringement. The court concluded that “Congress could not have intended such a broad reading of the DMCA.”

As a policy matter, this interpretation of the DMCA may have much to commend it. It harmonizes the DMCA with the remainder of the Copyright Act in a fashion that self-consciously seeks to preserve the Copyright Act’s balancing of the interests of content creators on the one hand and consumers and users of copyrighted works on the other. Furthermore, it neatly sidesteps the often-debated question whether the DMCA is inherently inimical to fair use.

The court’s interpretation, however, makes a sufficiently poor fit with the text of the DMCA as enacted to raise challenging questions concerning the decision’s persuasive force in future cases. Nothing in the text of , for example, expressly conditions a defendant’s anti-circumvention or trafficking liability upon a prior showing of copyright infringement. Articulating the contrary view, the Copyright Office has suggested that, while circumvention of a copy control mechanism for a noninfringing purpose would survive scrutiny under the DMCA, circumvention of an access control mechanism for the same purpose would be illegal. The Chamberlain court’s apparent assumption that the defendant must have either infringed, or at least helped contribute to the infringement of, plaintiff’s copyrights also coexists uneasily alongside Congress’s express disavowal in the DMCA of any intention to alter the existing contours of secondary liability for copyright infringement. In short, by purporting to rest its decision upon the “clear language” of the DMCA, the Chamberlain court may have limited the persuasive reach of its own decision, for the actual language of the DMCA may as readily support a conclusion opposite the one the Chamberlain court reached.

This is particularly true with respect to the court’s treatment of the pivotal issue of authorization. The DMCA, as the court correctly observed, “defines circumvention as an activity undertaken ‘without the authority of the copyright owner.’” The court concluded, however, that the copyright owner’s denial of authorization was not dispositive, based on the court’s conclusion that other provisions of the Copyright Act provide an alternative source of “authority.” This latter interpretation, to be sure, finds support in sources outside the statutory text. A court more inclined to focus on the text of the statute itself, however, might as readily conclude that the phrase “authority of the copyright owner” necessarily implies that such authority is for the “copyright owner” to grant or withhold at its election.

b. Lexmark International v. Static Control Components

The court in Lexmark International, Inc. v. Static Control Components, Inc. avoided the Chamberlain court’s entanglement in the thicket of “authorization,” relying instead on the dubious notion that the purchase of a product containing unencrypted software code necessarily conferred on consumers the right to extract and copy that code.

Lexmark involved a DMCA claim brought by a manufacturer of computer printers against a supplier of aftermarket refilled toner cartridge components. Lexmark, the printer manufacturer, sought to avail itself of the protections of the DMCA by embedding a piece of copyrighted software, the “Printer Engine Program,” in its printers, and another software program, the “Toner Loading Program,” in its toner cartridges. One purpose of these programs was to limit consumers’ freedom to install non-Lexmark toner cartridges by disabling their printers if they did so. Upon powering up, each Lexmark printer performed a two-step authentication sequence. It first queried a separate microchip inside the inserted toner cartridge, which contained an eight-byte key combination. Applying a publicly available encryption algorithm known as “Secure Hash Algorithm-1” or “SHA-1,” the printer calculated an authentication code based on the toner cartridge’s eight-byte key. Authentication succeeded if the result the printer calculated matched a parallel calculation undertaken by the chip on the toner cartridge itself. During the second stage of the authentication sequence, the Printer Engine Program downloaded a copy of another very short program (the Toner Loading Program) from a chip on the toner cartridge and computed a checksum of the downloaded bytes. This stage of the authentication procedure succeeded if the checksum the Printer Engine Program calculated matched a value encoded elsewhere on the toner cartridge chip. The printer shut itself down unless both steps of the authentication procedure succeeded. The authentication procedure sought to ensure that consumers used only toner cartridges (whether new or refilled) supplied by Lexmark.