"Members who participate in the Media Extensions Working Group will have to make a legally binding promise not to use anti-circumvention laws to aggress against security researchers or implementers."
Note that this promise only refers to 17 USC 1203, which deals with civil offenses, i.e. a lawsuit.
Circumventing access controls is also a criminal offense under 17 USC 1204 (if done "willfully and for purposes of commercial advantage or private financial gain") and it's not possible for a company to waive the government's ability to prosecute that crime.
Does anyone else think that the purported victim of a crime should always have the right to waive it? If the victim is society, then no, but if something's a crime because it harms an identifiable party and that party doesn't want them to be prosecuted, is there any good reason for the law to prosecute them anyway?
I don't. Whether it's relevant to computers or patent law I don't know, but there are certain areas where it's seen as important that the victim is denied the right to absolve the perpetrator. For example, this comes up a lot in domestic abuse cases.
(not to say that these kind of domestic abuse policies don't have their own controversy... but nonetheless the situation isn't a cut-and-dry obviously-this-is-better type of thing)
In general, one concern is that criminal suspects might threaten victims with violence to get them to withdraw their support for a prosecution. The legal system also uses this concern to justify legally-compelled testimony.
It's hard for me to put myself in the shoes of someone who thinks this law is a good idea in the first place -- I've been protesting against the idea of legal restrictions on DRM circumvention since 1999 and I think §1201 was and is a huge mistake.
I guess you could imagine having a set of criminal offenses where coercion of victims appears especially unlikely, but I'm not sure of how to identify or define those.
This opens the victim up to intimidation by the perpetrator. Which might also be illegal (for example threatening to hire someone to assault your family members if you don't let the person go), but then that can be waived as well. It allows large criminal organizations to rule through fear.
But in some situations it does seem to be what one would want (for example the under age people arrested for sexting pictures of themselves). However, if we could rely on common sense in these situations, the people would never be arrested in the first place.
My main issue is that it leaves open an opportunity to intimidate the victim into waiving the prosecution. Sometimes it is helpful to look at extremes to highlight the point: if a young child was abused by a patent, then was influenced by the parent who didn't abuse them this would be unjust.
In a more everyday case, if a woman is beaten by her partner and it is witnessed, I feel that person should be prosecuted regardless of the feelings of the victim - domestic violence, in my view, is often perpetuated because a spouse or partner will not speak up - normally because they are psychologically dependent on their abuser.
These are obviously crimes of violence. If a crime is committed against a corporation, on the other hand then I think that they should be allowed to waive the prosecution.
You can require the victim to be of age. I don't have a good idea on how to deal with the second example, but perhaps you could issue restraining orders if a judge thinks it's warranted, regardless of waivers, and if that's violated the person goes to jail for the original crime, regardless of waivers? Then judges could still protect people.
Note that this promise only refers to 17 USC 1203, which deals with civil offenses, i.e. a lawsuit.
Circumventing access controls is also a criminal offense under 17 USC 1204 (if done "willfully and for purposes of commercial advantage or private financial gain") and it's not possible for a company to waive the government's ability to prosecute that crime.