The current legal DVD battle between the movie industry and the free/open software communities over DVD is a microcosm of an ongoing intellectual property war. This war pits intellectual property owners against such diverse groups as programmers opposing restrictions on reverse engineering and the publication of computer code and librarians opposing new restrictions on copyright rights of first sale and fair use.
Jon Johansen may be the youngest victim of this war. Because of software posted on the 16-year-old’s Web site, his home in Norway was raided in January by police who seized two computers and a cell phone. Both Jon and his father were indicted; criminal charges could result in two- to three-year prison sentences.
The software published by Johansen, called DeCSS, decrypts Content Scrambling System (CSS), the encryption software for DVD movie discs. Although much of the news coverage claimed that Johansen had broken CSS in a few hours, it appears that CSS was broken by others, most of whom posted their results anonymously. One of the reasons that the myth of Johansen’s breaking CSS took hold is that CSS is amazingly weak. CSS uses only a 40-bit key, a length known to be breakable in a few minutes by exhaustive search. It also employs a proprietary algorithm, rather than one extensively tested in the public domain. The copy protection system relies heavily on obfuscation which, together with the carelessness of one licensee, appears to have created additional opportunities to break the system.
Concerns about the vulnerability of their protection scheme was a motivating factor for extensive lobbying by Hollywood and the DVD manufacturers on behalf of the anti-infringement component of the Digital Millenium Copyright Act (DMCA), passed in 1998. Quoting from Emedia Professional in 1997, "The film industry has submitted ‘Anti-Circumvention’ legislation to Congress in order to criminalize products or actions that would bypass the copy protection system" [1]. An earlier article in the Electronic Engineering Times stated "Also unresolved … on the policy side [is] the language of a draft for anti-circumvention legislation. That proposed law must be agreed upon by movie studios, computer and consumer companies"[2].
Authentication, which verifies that a player or operating system has been licensed, is used to protect the proprietary algorithm and to discourage the manufacture of non-compliant DVD players. The DVD Copy Control Association (DVD CCA) was created in December 1999 to issue licenses. To obtain a license, a fee is paid and an agreement is signed pledging not to produce non-compliant machines or to reveal the copy protection scheme. The Linux community was divided. One group, LSDVD, has been working on a licensed DVD player; another, LiViD, was working on creating a free open-source version of DVD for Linux. Because there is no one who can speak for the entire community, a clash with the open/free software community was preordained, if not actually intended.
Johansen is not the only person facing legal proceedings. As of this writing there are three lawsuits—in California, New York, and Connecticut. Preliminary injunctions have been issued in California and New York, where plaintiffs also attempted to obtain preliminary injunctions against Web sites that link to others containing the DeCSS code. The California judge refused to grant Web site injunctions; there is still the possibility of the granting of such injunctions in New York.
The New York and Connecticut cases, brought by the eight largest movie studios, is based on the DMCA’s prohibition on the circumvention of "copyright management information." (For a discussion of the possible negative impact on computer security R&D of the DMCA, see "Outlawing Technology," Communications, Oct. 1998, p. 17). The California case, brought by the DVD CCA, is based on misappropriation of trade secrets. While the defendants never signed a nondisclosure agreement, DVD shrink-wrap licenses forbid reverse engineering. (See "Melissa’s Message," Communications, June 1999, p. 25; it discusses UCITA, an on-going attempt to legalize some of the most egregious aspects of shrink-wrap licenses). If you wish to obtain a copy of the DeCSS source code, the DVD CCA thoughtfully provided it in the California case (cryptome.org/dvd-hoy-reply.htm#Exhibit B). Or you can wear it on a T-shirt (to order, go to copyleft.net/cgi-bin/copyleft/t039.pl?1&back).
Many of those involved with breaking CSS say they did so to make it possible to play legally purchased DVDs on Linux and other free/open-source-based operating systems. Although the DMCA outlaws almost all reverse engineering of copy protection systems, reverse engineering for compatibility is specifically not prohibited by the DMCA; so the compatibility issue could become an important point in the New York case.
None of the defendants is accused of making illegal copies of DVDs—only of providing software that makes it possible to play a DVD disc on any computer with a DVD drive. Nor is DeCSS a prerequisite for making illegal copies. The main function for CSS appears to be to protect a monopoly on licensing the player market and to inhibit the widespread production of illegal DVDs and non-compliant machines.
What would have happened had the DVD CCA licensed all Linux and other free/open-source operating systems, or eliminated the licensing requirement altogether? Surely the risk of illegal copying of DVDs would not be any greater than it is now, with DeCSS widely available. Given the weaknesses of the DVD copy protection system, it seems likely that others would have broken CSS. Would their case have been significantly impaired because they couldn’t argue that the reverse engineering was legal under the DMCA for reasons of compatibility? Or would the courts eventually have determined, as in the Bernstein case, that code is a form of speech and thereby protected in the U.S. under the First Amendment?
The consortium that imposed the DMCA on the country confronted a difficult problem. Was the DVD group’s goal of preventing wholesale illegal copying a reasonable goal? Could a robust solution for protecting DVD’s have been developed, or would any attempt, even one using strong encryption, have been doomed to failure? Did the DVD group make a fundamental mistake by failing to modify its business model to be more compatible with the new distribution environment?
ACM also has dealt with problems related to the ease of copying digitized material. The success of its digital library, even though copyright policy allows unlimited noncommercial copying, demonstrates that it’s possible to remain financially solvent without resorting to draconian measures such as those contained in the DMCA. Is there a way that the ACM model or something similar could be applied to the movie industry? Or are the financial demands of a for-profit business simply too great to be compared to those of a not-for-profit?
Perhaps 20 years from now people will look back in amazement at our lack of understanding and insight. But this thought is of little comfort either to those who are being threatened with large fines and prison sentences or to intellectual property owners who fear wholesale illegal copying.
We knew bad legislation posed risks to free speech and standard procedures such as reverse engineering. Unfortunately, we now have moved from the theoretical to a concrete demonstration. Unless the most insidious portions of the DMCA are repealed or declared unconstitutional and UCITA is stopped, there will be damage to legitimate and accepted practices for the advancement of computing, to say nothing of significant restrictions on even more basic rights.
We need to declare a truce in the intellectual property war and start a discussion about how intellectual property owners can receive fair compensation without resorting to restrictions on technology and speech.
Join the Discussion (0)
Become a Member or Sign In to Post a Comment