Interoperability is widely touted for its ability to spur incremental innovation, increase competition and consumer choice, and decrease barriers to accessibility. In light of these attributes, intellectual property law generally permits follow-on innovators to create products that interoperate with existing systems, even without permission. The anticircumvention provisions of the Digital Millennium Copyright Act (DMCA) represent a troubling departure from this policy, resulting in patent-like rights to exclude technologies that interoperate with protected platforms. Although the DMCA contains internal safeguards to preserve interoperability, judicial misinterpretation and a narrow textual focus on software-to-software interoperability render those safeguards largely ineffective.

Subjecting restrictions on interoperability to antitrust scrutiny, and the resulting mandatory disclosure of technical information, is one approach to holding anticircumvention law in check. But a number of considerations suggest antitrust is a poor tool for lessening the DMCA's impact on interoperability. Whether characterized as tying, denial of essential facilities, or refusal to deal, the use of anticircumvention law to impede interoperability is unlikely to consistently trigger antitrust enforcement. In part, the limits on the ability of antitrust to address the impact of the DMCA stem from its deference to the legislative process. Antitrust rarely interferes with the exercise of legitimately acquired IP rights.

Rather than relying on antitrust to limit the DMCA's restriction of interoperability, this Article proposes a solution that addresses that restriction at its source. Expanding the DMCA's existing interoperability exemption would create an environment more hospitable to interoperable technologies. But in order to preserve the protections the DMCA offers copyright holders, this expanded exemption must disaggregate restrictions on the use of interoperable software and devices from the restrictions on access and copying that Congress intended to enable. The former can be ignored only to the extent the latter are respected.

Late in 2005, Sony BMG released millions of Compact Discs containing digital rights management technologies that threatened the security of its customers' computers and the integrity of the information infrastructure more broadly. This Article aims to identify the market, technological, and legal factors that appear to have led a presumably rational actor toward a strategy that in retrospect appears obviously and fundamentally misguided.

The Article first addresses the market-based rationales that likely influenced Sony BMG's deployment of these DRM systems and reveals that even the most charitable interpretation of Sony BMG's internal strategizing demonstrates a failure to adequately value security and privacy. After taking stock of the then-existing technological environment that both encouraged and enabled the distribution of these protection measures, the Article examines law, the third vector of influence on Sony BMG's decision to release flawed protection measures into the wild, and argues that existing doctrine in the fields of contract, intellectual property, and consumer protection law fails to adequately counter the technological and market forces that allowed a self-interested actor to inflict these harms on the public.

The Article concludes with two recommendations aimed at reducing the likelihood of companies deploying protection measures with known security vulnerabilities in the consumer marketplace. First, Congress should alter the Digital Millennium Copyright Act (DMCA) by creating permanent exemptions from its anti-circumvention and antitrafficking provisions that enable security research and the dissemination of tools to remove harmful protection measures. Second, the Federal Trade Commission should leverage insights from the field of human computer interaction security (HCI-Sec) to develop a stronger framework for user control over the security and privacy aspects of computers.