What Election Security Researchers Need to Know about DMCA Section 1201

Tori Noble, a staff attorney at the Electronic Frontier Foundation, opens by describing Section 1201 of the DMCA as a 1990s anti-piracy law that became a major legal obstacle for security research, including work on election systems. She separates its two prongs, the anti-circumvention rule and the anti-trafficking rule, and explains what counts as a technical protection measure. She notes that courts have said little on the boundaries, and that treating something as outside the law is risky without counsel.

She then walks through the two statutory exemptions, security testing and encryption research, and explains why both are narrow. The main relief comes from a temporary administrative exemption that security researchers, including Voting Village leaders, won from the Library of Congress. It covers good-faith research on lawfully acquired devices without device-owner permission, but it does not cover trafficking, does not shield against CFAA or copyright claims, must be renewed every three years, and requires that access be solely for research. The lawfully acquired requirement is the main ambiguity, since voting machine companies have argued that resale restrictions in their contracts defeat it.

In the audience questions she addressed fair use, possible constitutional challenges, pre-enforcement suits, and whether donated machines count as lawfully acquired. Her practical advice is to seek written permission from device owners where possible and to follow responsible research practices. She stressed that the talk is general information, not legal advice.