SMITH, Circuit Judge.

Davidson Associates, Inc. d/b/a Blizzard Entertainment ("Blizzard") and Vivendi Universal Games, Inc. ("Vivendi"), owner of copyrights in computer game software and online gaming service software sued Ross Combs ("Combs"), Rob Crittenden ("Crittenden"), Jim Jung ("Jung"), and Internet Gateway, Inc. ("Internet Gateway") (collectively referred to as "Appellants"), for breach of contract, circumvention of copyright protection system, and trafficking in circumvention technology. Both parties moved for summary judgment. The district court granted summary judgment in favor of Blizzard and Vivendi, and determined that: (1) Blizzard's software end-user license and terms of usage agreements were enforceable contracts; (2) Appellants waived any "fair use" defense; (3) the agreements did not constitute misuse of copyright; and (4) Appellants violated the anti-circumvention and anti-trafficking provisions of the Digital Millennium Copyright Act ("DMCA"). We affirm.

I. Background A. Factual Background

Blizzard, a California corporation and subsidiary of Vivendi, creates and sells software games for personal computers. This appeal concerns the particular Blizzard games "StarCraft," "StarCraft: Brood War," "WarCraft II: Battle.net Edition," "Diablo," and "Diablo II: Lord of Destruction." Combs and Crittenden are computer programmers, Jung is a systems administrator, and Internet Gateway is an Internet service provider based in St. Peters, Missouri. Jung is also the president, co-owner, and day-to-day operator of Internet Gateway.

In January 1997, Blizzard officially launched "Battle.net," a 24-hour online-gaming service available exclusively to purchasers of its computer games. The Battle.net service has nearly 12 million active users who spend more that 2.1 million hours online per day. Blizzard holds valid copyright registrations covering Battle.net and each of its computer games at issue in this litigation. Battle.net is a free service that allows owners of Blizzard games to play each other on their personal computers via the Internet. Battle.net mode allows users to create and join multi-player games that can be accessed across the Internet, to chat with other potential players, to record wins and losses and save advancements in an individual password-protected game account, and to participate with others in tournament play featuring elimination rounds. Players can set up private "chat channels" and private games on Battle.net to allow players to determine with whom they wish to interact online. These Battle.net mode features are only accessible from within the games.

Like most computer software, Blizzard's games can be easily copied and distributed over the Internet. Blizzard has taken steps to avoid piracy by designing Battle.net to restrict access and use of the Battle.net mode feature of the game. Each time a user logs onto Battle.net, a Battle.net server examines the user's version of the game software. If a Blizzard game does not have the latest software upgrades and fixes, the Battle.net service updates the customer's game before allowing the game to play in Battle.net mode.

With the exception of "Diablo," each authorized version of a Blizzard game comes with a "CD Key." A CD Key is a unique sequence of alphanumeric characters printed on a sticker attached to the case in which the CD-ROM was packaged. To log on to Battle.net and access Battle.net mode, the game initiates an authentication sequence or "secret handshake" between the game and the Battle.net server. In order to play the Blizzard game contained on a CD-ROM, a user must first install the game onto a computer and agree to the terms of the End User License Agreement ("EULA") and Terms of Use ("TOU"), both of which prohibit reverse engineering. At the end of both the EULA and TOU, Blizzard includes a button with the text, "I Agree" in it, which the user must select in order to proceed with the installation. Users are also required to enter a name and the CD Key during installation of Battle.net and Blizzard games.

The outside packaging of all Blizzard games, except for Diablo, contains a statement that use of the game is subject to the EULA and that use of Battle.net is subject to the terms of the TOU. The terms of neither the EULA nor the TOU appear on the outside packaging. If the user does not agree to these terms, the game may be returned for a full refund of the purchase price within thirty (30) days of the original purchase. Combs, Crittenden, and Jung installed Blizzard games and agreed to the terms of the EULA. Crittenden and Jung logged onto Battle.net and agreed to the TOU.

The users of Battle.net have occasionally experienced difficulties with the service. To address their frustrations with Battle.net, a group of non-profit volunteer game hobbyists, programmers, and other individuals formed a group called the "bnetd project." The bnetd project developed a program called the "bnetd.org server" that emulates the Battle.net service and permits users to play online without use of Battle.net. The bnetd project is a volunteer effort and the project has always offered the bnetd program for free to anyone. Combs, Crittenden, and Jung were lead developers for the bnetd project.

The bnetd project was organized and managed over the Internet through a website, www.bnetd.org, that was made available to the public through equipment provided by Internet Gateway. The bnetd.org emulator provides a server that allows gamers unable or unwilling to connect to Battle.net to experience the multi-player features of Blizzard's games. The bnetd. org emulator also provides matchmaking services for users of Blizzard games who want to play those games in a multi-player environment without using Battle.net. Bnetd.org attempted to mirror all of the user-visible features of Battle.net, including online discussion forums and information about the bnetd project, as well as access to the program's computer code for others to copy and modify.

To serve as a functional alternative to Battle.net, bnetd.org had to be compatible with Blizzard's software. In particular, compatibility required that bnetd.org speak the same protocol language that the Battle.net speaks. By speaking the same protocol language, the bnetd programs would be interoperable with Blizzard games. Once game play starts, a user perceives no difference between Battle.net and the bnetd.org.

By necessity, Appellants used reverse engineering to learn Blizzard's protocol language and to ensure that bnetd.org worked with Blizzard games. Combs used reverse engineering to develop the bnetd. org server, including a program called "tcpdump" to log communications between Blizzard games and the Battle.net server. Crittenden used reverse engineering to develop the bnetd.org server, including using a program called "Nextray." Crittenden also used a program called "ripper" to take Blizzard client files that were compiled together in one file and break them into their component parts. Crittenden used the ripper program to determine how Blizzard games displayed ad banners so that bnetd.org could display ad banners to users in the format that Blizzard uses on the Battle.net service. Combs tried to disassemble a Blizzard game to figure out how to implement a feature that allowed bnetd.org to protect the password that a user enters when creating an account in Battle.net mode. Crittenden made an unauthorized copy of a Blizzard game in order to test the interoperability of the bnetd.org server with multiple games.

Blizzard designed its games to connect only to Battle.net servers. To enable a Blizzard game to connect to a bnetd.org server instead of a Battle.net server, bnetd had to modify the computer file that contained the Internet address of the Battle.net servers. As part of the bnetd project, Combs participated in the development of a utility program called "BNS" to allow Blizzard games to connect to bnetd. org servers more easily. Through the BNS program, the game sends the bnetd. org server information about its CD Key. An individual can thus play one of the Blizzard games at issue over the Internet via bnetd.org rather than Battle.net. According to Blizzard, the EULAs and TOUs prohibit this activity.

Bnetd.org has important operational differences from Battle.net. When bnetd.org receives the CD Key information, unlike Battle.net, it does not determine whether the CD Key is valid or currently in use by another player. The bnetd.org server computer code always sends the game an "okay" reply regardless of whether the CD Key is valid or currently in use by another player. The bnetd .org emulator always allows the Blizzard games to access Battle.net mode features even if the user does not have a valid or unique CD Key. Blizzard did not disclose the methods it used to generate CD Keys or to confirm the validity of CD Keys.

Combs, Crittenden, and Jung used Blizzard games to log into bnetd .org. Crittenden was aware that unauthorized versions of Blizzard games were played on bnetd. org. Jung knew that the bnetd.org emulator did not require that Blizzard games provide valid CD Keys. Combs suspected that the bnetd.org emulator would not know the difference between a real game and a pirated game. Combs and Crittenden either sent portions of the bnetd software to Jung to place on the www. bnetd.org website for download or put the software on the website themselves. Combs made the bnetd software available on his website located at www.cs.nmsu.edu/~rcombs/sc/. Also distributed was the BNS utility program which allowed Blizzard games to connect to bnetd.org. The source code was made available as an "open source" application, meaning that others were free to copy the source code and distribute it with or without modifications. Because the bnetd.org source code was freely available, others developed additional Battle.net emulators based on the bnetd.org source code. Binary versions of the bnetd.org were distributed which made it more convenient for users to set up and access the emulator program. Internet Gateway has donated space on its computers for use by the bnetd project. Internet Gateway also hosted a bnetd.org server that anyone on the Internet could access and use to play Blizzard games in Battle.net mode.

B. Procedural Background

Blizzard and Vivendi brought suit in the United States District Court for the Eastern District of Missouri. The second amended complaint alleged copyright infringement in violation of 17 U.S.C. § 501; circumvention of copyright protection systems and trafficking in circumvention technology in violation of 17 U.S.C. § 1201(a); federal trademark infringement in violation of 15 U.S.C. § 1114(1); federal false designation of origin in violation of 15 U.S.C. § 1125(c); common law trademark infringement and unfair competition claims; and breach of the EULA and TOU. Appellants counterclaimed, requesting declaratory relief as to non-infringement under 17 U.S.C. § 501, non-circumvention of copyright under 17 U.S.C. § 1201(a), the unconstitutionality of 17 U.S.C. § 1201(a), and unenforceability of Blizzard's EULA and TOU.

The district court entered a consent decree and permanent injunction which constituted the full and complete relief on the claims of copyright infringement, federal trademark infringement, federal false designation, and common-law trademark and infringement. The consent decree also provided complete relief on the counterclaim for declaratory judgment for non-infringement and unconstitutionality of 17 U.S.C. § 1201(a). The consent decree resolved all claims except for the claims of circumvention of copyright protection systems and trafficking in circumvention technology under 17 U.S.C. § 1201(a), breach of the EULA and TOU, and the counterclaims for declaratory relief for non-circumvention and unenforceability of the EULA and TOU.

Both sides motioned for summary judgment. The district court granted summary judgment in favor of Blizzard and Vivendi and determined that: (1) Blizzard's software end-user license and terms of usage agreements were enforceable contracts; (2) Appellants waived any "fair use" defense; (3) the agreements did not constitute misuse of copyright; and (4) Appellants violated the DMCA's anti-circumvention and anti-trafficking provisions of the DMCA. Appellants brought this appeal, disputing violations of the DMCA, and now argue that the state breach-of-contract claims were preempted by federal copyright law.

II. Discussion

We review the grant or denial of summary judgment de novo, applying the same standard as the district court and may affirm on grounds supported by the record. Bechtold v. City of Rosemount, 104 F.3d 1062, 1068 (8th Cir. 1997). Summary judgment is appropriate where the record shows that no genuine issue as to any material fact exists and that the moving party is entitled to judgment as a matter of law. Dorsey v. Pinnacle Automation Co., 278 F.3d 830, 834 (8th Cir. 2002). A plaintiff may not merely point to unsupported self-serving allegations, but must substantiate allegations with sufficient probative evidence that would permit a finding in the plaintiff's favor. Wilson v. Int'l Bus. Mach. Corp., 62 F.3d 237, 241 (8th Cir. 1995). "The mere existence of a scintilla of evidence in support of the plaintiff's position will be insufficient; there must be evidence on which the jury could reasonably find for the plaintiff." Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 252, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). "Only disputes over facts that might affect the outcome of the suit under the governing law will properly preclude the entry of summary judgment." Id. at 248, 106 S.Ct. 2505.

A. Preemption

The Copyright Act provides the exclusive source of protection for "all legal and equitable rights that are equivalent to any of the exclusive rights within the general scope of copyright as specified by . . . [§] 106" of the Copyright Act. See 17 U.S.C. § 301(a). The Copyright Act preempts state laws that attempt to protect rights exclusively protected by federal law. See Nat'l Car Rental Sys., Inc. v. Computer Assocs. Intern., Inc., 991 F.2d 426, 428 (8th Cir. 1993). Conversely, the Copyright Act does not preempt state law from enforcing non-equivalent legal or equitable rights. Id. A state cause of action is statutorily or expressly preempted if: (1) the work at issue is within the subject matter of copyright as defined in §§ 102 and 103 of the Copyright Act, and (2) the state-law-created right is equivalent to any of the exclusive rights within the general scope of copyright as specified in § 106. Id. at 428-29 (citing Harper Row Pub., Inc. v. Nation Enter., 723 F.2d 195, 200 (2d Cir. 1983)). Express preemption is no longer at issue in this case.

This case concerns conflict preemption. Conflict preemption applies when there is no express preemption but (1) it is impossible to comply with both the state and federal law or when (2) the state law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress. Pacific Gas Elec. Co. v. Energy Res. Conservation and Dev. Com'n, 461 U.S. 190, 204, 103 S.Ct. 1713, 75 L.Ed.2d 752 (1983); Jones v. Rath Packing Co., 430 U.S. 519, 525, 97 S.Ct. 1305, 51 L.Ed.2d 604 (1977). Appellants, relying upon Vault v. Quaid Software Ltd., 847 F.2d 255, 268-70 (5th Cir. 1988), argue that the federal Copyright Act preempts Blizzard's state law breach-of-contract claims. We disagree.

In Vault, plaintiffs challenged the Louisiana Software License Enforcement Act, which permitted a software producer to impose contractual terms upon software purchasers provided that the terms were set forth in a license agreement comporting with the statute. Id. at 268. "Enforceable terms [under the Louisiana statute] include the prohibition of: (1) any copying of the program for any purpose; and (2) modifying and/or adapting the program in any way, including adaptation by reverse engineering, decompilation or disassembly." Id. at 269 (citation omitted). The Louisiana statute defined reverse engineering, decompiling or disassembling as "any process by which computer software is converted from one form to another form which is more readily understandable to human beings, including without limitation any decoding or decrypting of any computer program which has been encoded or encrypted in any manner." Id. (citation omitted). The Fifth Circuit held that the Louisiana statute conflicted with the rights of computer program owners under the Copyright Act, specifically 17 U.S.C. § 117, which permits a computer program owner to make an adaptation of a program provided that the adaption is either created as an essential step in the utilization of the computer program in conjunction with a machine or is for archival purpose only. Id. at 270.

Unlike in Vault, the state law at issue here neither conflicts with the interoperability exception under 17 U.S.C. § 1201(f) nor restricts rights given under federal law. Appellants contractually accepted restrictions on their ability to reverse engineer by their agreement to the terms of the TOU and EULA. "[P]rivate parties are free to contractually forego the limited ability to reverse engineer a software product under the exemptions of the Copyright Act[,]" Bowers v. Baystate Techs, Inc., 320 F.3d 1317, 1325-26 (Fed. Cir. 2003), and "a state can permit parties to contract away a fair use defense or to agree not to engage in uses of copyrighted material that are permitted by the copyright law if the contract is freely negotiated." Id. at 1337 (Dyk, J., dissenting). See also Nat'l Car Rental Sys., Inc., 991 F.2d at 434 (holding that the Copyright Act does not preempt a breach of contract action based on prohibited use of software contained in a license agreement). While Bowers and Nat'l Car Rental were express preemption cases rather than conflict preemption, their reasoning applies here with equal force. By signing the TOUs and EULAs, Appellants expressly relinquished their rights to reverse engineer. Summary judgment on this issue was properly granted in favor of Blizzard and Vivendi.

B. DMCA Claims and Interoperability Exception

Congress enacted the DMCA in 1998 to implement the World Intellectual Property Organization Copyright Treaty ("WIPO Treaty"). WIPO requires contracting nations to "provide adequate legal protection and effective legal remedies against the circumvention of effective technological measures that are used by authors in connection with the exercise of their rights under this Treaty or the Berne Convention and that restrict acts, in respect of their works, which are not authorized by the authors concerned or permitted by law." WIPO Treaty, Apr. 12, 1997, art. 11, S. Treaty Doc. No. 105-17 (1997), available at 1997 WL 447232. The DMCA contains three provisions targeted at the circumvention of technological protections.

The first is § 1201(a)(1), the anti-circumvention provision. This provision prohibits a person from "circumvent[ing] a technological measure that effectively controls access to a work protected under [Title 17, governing copyright]." The Librarian of Congress is required to promulgate regulations every three years exempting from this subsection individuals who would otherwise be "adversely affected" in "their ability to make noninfringing uses." 17 U.S.C. § 1201(a)(1)(B)-(E). Section 1201(a)(1) differs from the second and third provisions in that it targets the use of a circumvention technology, not the trafficking in such a technology.

The second and third provisions are §§ 1201(a)(2) and 1201(b)(1), the "anti-trafficking provisions." These sections are similar, except that § 1201(a)(2) covers those who traffic in technology that can circumvent "a technological measure that effectively controls access to a work protected under" Title 17, whereas § 1201(b)(1) covers those who traffic in technology that can circumvent "protection afforded by a technological measure that effectively protects a right of a copyright owner under" Title 17. 17 U.S.C. §§ 1201(a)(2) (b)(1). (Emphases added.) In other words, although both sections prohibit trafficking in a circumvention technology, the focus of § 1201(a)(2) is circumvention of technologies designed to prevent access to a work, and the focus of § 1201(b)(1) is circumvention of technologies designed to permit access to a work but prevent copying of the work or some other act that infringes a copyright. See S.Rep. No. 105-190, at 11-12 (1998).

The district court determined that Appellants's reverse engineering violated § 1201(a)(1) as well as § 1201(a)(2). We agree.

1. Anti-Circumvention Violation

Section 1201(a)(1) provides that "[n]o person shall circumvent a technological measure that effectively controls access to a work protected under this title." The term "circumvent a technological measure" "means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner." 17 U.S.C. § 1201(3)(A). "Effectively controls access to a work" means that the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work. 17 U.S.C. § 1201(3)(B).

Blizzard games, through Battle.net, employed a technological measure, a software "secret handshake" (CD key), to control access to its copyrighted games. The bnetd.org emulator developed by Appellants allowed the Blizzard game to access Battle.net mode features without a valid or unique CD key. As a result, unauthorized copies of the Blizzard games were played on bnetd.org servers. After Appellants distributed the bnetd program, others developed additional Battle.net emulators based on the bnetd source code. Appellants's distribution of binary versions of the bnetd program facilitated set up and access to the emulator program.

Relying on Lexmark Int'l, Inc. v. Static Control Components, Inc., 387 F.3d 522 (6th Cir. 2004), Appellants argue that Battle.net mode is a strictly functional process that lacks creative expression, and thus DMCA protections do not apply. Lexmark Int'l, Inc., concerned two computer programs: the first was known as the "Toner Loading Program" and the second was known as the "Printer Engine Program." Id. at 528. DMCA anti-circumvention claims were brought after Lexmark's authentication sequence contained in its printer cartridges were allegedly circumvented. Id. at 528-29. The district court in that case held that Lexmark's authentication sequence effectively controlled access to the programs because it controlled the consumers' ability to make use of those programs. Id. at 546. The Sixth Circuit reversed, holding that it was not Lexmark's authentication sequence that controlled access to the programs, but the purchase of a Lexmark printer that allowed access to the program. Id. "No security device, in other words, protects access to the . . . program and no security device accordingly must be circumvented to obtain access to that program code." Id. at 547.

Here, Battle.net's control measure was not freely available. Appellants could not have obtained a copy of Battle.net or made use of the literal elements of Battle.net mode without acts of reverse engineering, which allowed for a circumvention of Battle.net and Battle.net mode. Unlike in Lexmark Int'l, Inc., Battle.net mode codes were not accessible by simply purchasing a Blizzard game or logging onto Battle.net., nor could data from the program be translated into readable source code after which copies were freely available without some type of circumvention. Appellants misread Lexmark Int'l, Inc. and we are unpersuaded that summary judgment on the anti-circumvention violations was improperly granted in favor of Blizzard and Vivendi.

2. Anti-trafficking Violations

Section 1201(a)(2) provides that:

No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that . . . is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title; . . . has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or . . . is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.

17 U.S.C. § 1201(a)(2). The bnetd.org emulator had limited commercial purpose because its sole purpose was to avoid the limitations of Battle.net. There is no genuine issue of material fact that Appellants designed and developed the bnetd.org server and emulator for the purpose of circumventing Blizzard's technological measures controlling access to Battle.net and the Blizzard games. Summary judgment was properly granted in favor of Blizzard and Vivendi on the anti-trafficking violations.

3. Interoperability Exception

The DMCA contains several exceptions, including one for individuals using circumvention technology "for the sole purpose" of trying to achieve "interoperability" of computer programs through reverse engineering. See 17 U.S.C. § 1201(f). Subsection (f)(4) defines interoperability as "the ability of computer programs to exchange information, and such programs mutually to use the information which has been exchanged." 17 U.S.C. § 1201(f)(4). Appellants argue that the interoperability exception applies to any alleged infringement of Blizzard games and Battle.net. To successfully prove the interoperability defense under § 1201(f), Appellants must show: (1) they lawfully obtained the right to use a copy of a computer program; (2) the information gathered as a result of the reverse engineering was not previously readily available to the person engaging in the circumvention; (3) the sole purpose of the reverse engineering was to identify and analyze those elements of the program that were necessary to achieve interoperability of an independently created computer program with other programs; and (4) the alleged circumvention did not constitute infringement. See 17 U.S.C. § 1201(f).

Appellants's circumvention in this case constitutes infringement. As detailed earlier, Blizzard's secret handshake between Blizzard games and Battle.net effectively controlled access to Battle.net mode within its games. The purpose of the bnetd.org project was to provide matchmaking services for users of Blizzard games who wanted to play in a multi-player environment without using Battle.net. The bnetd. org emulator enabled users of Blizzard games to access Battle.net mode features without a valid or unique CD key to enter Battle.net. The bnetd.org emulator did not determine whether the CD key was valid or currently in use by another player. As a result, unauthorized copies of the Blizzard games were freely played on bnetd. org servers. Appellants failed to establish a genuine issue of material fact as to the applicability of the interoperability exception. The district court properly granted summary judgment in favor of Blizzard and Vivendi on the interoperability exception.

Summary judgment in favor of Blizzard and Vivendi is affirmed.