Exact source is a bit convoluted, because most US law is convoluted, but is covered in multiple subsections of section 1201 of Public Law 105–304 (the technical name for DMCA). There are exceptions for things like making things interoperable and security research (kinda), but beyond that simply glancing at one of these locks can be a violation of DMCA. Sadly the document is excessivly long (60 pages plus references to other laws), and the available source PDF is so poorly formatted as to be nearly impossible to follow (nothing is aligned correctly, and subsections regularly form a very confusing pattern)