Product1 publisher3 min readPublished
Rossmann's nonprofit pays bounties for breaking the locks DMCA 1201 protects
Louis Rossmann's Own Your Shit tour spent the summer pointing crowds at Section 1201 of the DMCA, the 1998 provision that makes bypassing a manufacturer's lock illegal. His nonprofit Fulu pays for doing it anyway.
The Product Desk · Product desk
What happened
- Louis Rossmann's Own Your Shit tour reached its penultimate stop in San Jose, where about 80 people packed a brewery's narrow side porch, with the last event set for Silver Springs, Maryland, on October 1.
- The tour's single call to action is killing Section 1201 of the Digital Millennium Copyright Act, the 1998 provision that prohibits bypassing digital locks a manufacturer builds into a product.
- Rossmann and fellow advocate Kevin O'Reilly founded the nonprofit Fulu to pay bounties to people who disable digital locks on devices, even when doing so brings legal consequences.
- Before Rossmann spoke, panels featured an Electronic Frontier Foundation advocate, students from San Jose State University's Fixit workshop, and a leader of the Fisker Owners Association.
- New European Union regulations this year require companies to help extend the life of consumer products by making them more repairable and their batteries easier to replace.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- exposure Hardware teams whose service revenue rests on a pairing or activation check now face a funded buyer for defeating it, and the fund pays whether or not the person who did the work gets sued.
- constraint Repairability compliance and lock policy come apart under this framing: a company can publish manuals and sell spare parts and still refuse an installed part in firmware, so a repairability score tells a buyer little about what they can fix.
- decision Anyone who added a post-purchase subscription to already-shipped hardware has to decide, lock by lock, which ones they would defend by naming a threat and which ones exist to bill the owner a second time.
- precedent A bounty fund for circumvention gives other advocacy groups a way to act against a statute without waiting for a legislature to amend it.
A BMW owner sat down in a car they had already paid for and got an ad for the new Spider-Man movie on the dashboard screen [14]. Rossmann read that out at the San Jose event next to Amazon removing books from people's Kindles [12] and Roost discontinuing its stand-alone Wi-Fi leak detectors, to the dismay of the people who owned them [13]. Adding a paid subscription to a product after the customer has bought it is, in his words, a form of "ransomware" [15].
Section 1201 was ostensibly written to protect device security. In practice it lets a manufacturer lock hardware and then charge the owner for access to it [6]. Rohit Chopra, the former director of the Consumer Financial Protection Bureau who now heads the California Business and Consumer Services Agency that Governor Gavin Newsom created in July [11], was in the crowd. He raised his hand when Rossmann asked who enjoys getting threats of lawsuits [10].
The Federal Trade Commission's ruling against John Deere, which came alongside a $99 million lawsuit, requires the company to make its products more fixable [18]. That is a repairability obligation, not a rule about locks. A firm can meet it, publish the manuals, sell the parts, and still ship a firmware check that refuses a genuine part until its own server approves the swap, and Section 1201 is what puts the law behind that check [5].
The bounty fund is aimed at the check rather than the statute, and it is paid even when the person collecting it faces legal consequences [7]. Rossmann told the San Jose crowd, "I enjoy when people try to sue me," and added, "When they send me threats, I literally frame them" [8].
Wired's account of the tour mentions no bill and no named sponsor for changing 1201 [22]. After the last event, the campaign still has the fund.
Katharine Trendacosta, a director of policy and advocacy at the Electronic Frontier Foundation, spoke at the event about companies turning nearly everything into a subscription. "They get the subscription and our data," Trendacosta said. "It's a win-win for them and a lose-lose for us" [16]. Devices cost more, and people want to hang onto the ones they have for longer [23].
For a team that ships locks, try the sentence you would post in a support thread when an owner asks why the part they bought will not work. If that sentence names someone who gets hurt when the lock comes off, it survives an audience like the one on that brewery porch. If it names your service margin, the lock is a billing rule with a security label on it, and Fulu will now pay someone to take it off [7].
What to watch
- Whether the October 1 Silver Springs event produces a named sponsor or bill text for changing Section 1201.
- Whether Fulu publishes which devices its bounties unlocked, and whether any recipient is sued for collecting one.
- Whether Chopra's new California Business and Consumer Services Agency treats device locks as a consumer-services matter.