Copyright Act 1968

An owner or exclusive licensee of the copyright in a work or other subject‑matter may bring an action against a person if:

the person does any of the following acts with a device:

manufactures it with the intention of providing it to another person;

imports it into Australia with the intention of providing it to another person;

distributes it to another person;

offers it to the public;

provides it to another person;

communicates it to another person; and

the person knows, or ought reasonably to know, that the device is a circumvention device for a technological protection measure; and

the work or other subject‑matter is protected by the technological protection measure.

Subsection (1) does not apply to the person if:

the device is a circumvention device for the technological protection measure only because it was promoted, advertised or marketed as having the purpose of circumventing the technological protection measure; and

both of the following apply:

the person did not do such promoting, advertising or marketing;

the person did not direct or request (expressly or impliedly) another person to do such promoting, advertising or marketing.

Subsection (1) does not apply to the person if:

the circumvention device will be used to circumvent the technological protection measure to enable the doing of an act; and

the act:

relates to a copy of a computer program (the original program) that is not an infringing copy and that was lawfully obtained; and

will not infringe the copyright in the original program; and

relates to elements of the original program that will not be readily available to the person doing the act when the circumvention occurs; and

will be done for the sole purpose of achieving interoperability of an independently created computer program with the original program or any other program.

Subsection (1) does not apply to the person if:

the technological protection measure is an access control technological protection measure; and

the circumvention device will be used to circumvent the access control technological protection measure to enable a person (the researcher) to do an act; and

the act:

relates to a copy of a work or other subject‑matter that is not an infringing copy and that was lawfully obtained; and

will not infringe the copyright in the work or other subject‑matter; and

will be done for the sole purpose of identifying and analysing flaws and vulnerabilities of encryption technology; and

the researcher is:

engaged in a course of study at an educational institution in the field of encryption technology; or

employed, trained or experienced in the field of encryption technology; and

the researcher:

has obtained permission from the owner or exclusive licensee of the copyright to do the act; or

has made, or will make, a good faith effort to obtain such permission.

Subsection (1) does not apply to the person if:

the technological protection measure is an access control technological protection measure; and

the circumvention device will be used to circumvent the access control technological protection measure to enable the doing of an act; and

the act:

relates to a copy of a computer program that is not an infringing copy; and

will not infringe the copyright in the computer program; and

will be done for the sole purpose of testing, investigating or correcting the security of a computer, computer system or computer network; and

will be done with the permission of the owner of the computer, computer system or computer network.

Subsection (1) does not apply in relation to anything lawfully done for the purposes of:

law enforcement; or

national security; or

performing a statutory function, power or duty;

The defendant bears the burden of establishing the matters referred to in subsections (2) to (6).