October 15, 2003

How the Digital Millennium Copyright Act affects you

"Coding is not a crime." -- Anonymous

You might be unfamiliar with the Digital Millennium Copyright Act. By the end of this essay you will be familiar with this act and learn how, through this law, the University of Chicago Press--and particularly the Astronomy Group-- might get sued.

The Digital Millennium Copyright Act (DMCA) is a 1998 law which extended copyright in the U.S. Code into the sphere of digital technologies. Extending copyright to protect intellectual property is one thing, but the DMCA has gotten heat for granting copyright holders too much power. (It's unclear to me whether or not this excess of power was intentionally granted by the DMCA's crafters or an unforeseen consequence; it could be both.) One particularly controversial passage is in Section 1202, an anti-trafficking provision, which forbids anyone from gaining unpermitted electronic access to a copyrighted work.

On the surface, it doesn't seem that controversial: copyright holders should have the right to protect their intellectual propery. But the problem is that the DMCA has given copyright holders the right to sue against both past criminal acts and against anyone with information which could be used to crack the encyption code protecting digitally copyrighted works.

Let me repeat that: If you learn or discover information which might be used to access copyrighted digital material, you are open to being sued under the DMCA, even if you didn't use--and have no intent to use--your discovery in criminal endeavors.

And you thought pre-crime was just something in the movies.

Two highly-publicized cases have highlighted the insanity behind this provision. Dmitry Sklyarov, a PhD student at Moscow University, gave a speech in Las Vegas in 2001 about security weaknesses in Adobbe e-Book. Sklyarov conducted his research in Russia (where it's legal there), and he didn't infringe against any copyrighted material, and he didn't help anyone infringe against any copyrighted material, and he didn't cite any sensitive details in his speech on the weakness itself. And yet, because of his speech, Sklyarov was arrested in Las Vegas and jailed in the USA for three weeks; he was released but both he and his company ElcomSoft were indicted on five counts of circumvention offenses. ElcomSoft (a Russian company!) has been hemorrhaging money in the last two years in DMCA-related legal fees.

Another example is Jon Johanssen, a Norwegian who--in 1999, at age 15--used a program for deciphering the Content Scrambling System (CSS) used to protect material on film DVDs. Johanssen faced a criminal charge brought by Norwegian police at the request of the Motion Picture Association of America; the specific charge was breaking into property which wasn't his (which was peculiar since Johanssen owned the DVD whose code he deciphered).

The effect of the DMCA on scientific research is chilling. Computer scientists or any scientists who use computers have held back publishing their research, or avoided coming to the conferences held in the United States, or even abandoned entire lines of research. Science Magazine weighed in on the matter:

Computer security and encryption researchers are far from the only scientists who have reason to fear the DMCA. Any data in digital form can be protected by encryption and other technical measures, and those who distribute digital data in this manner can use the DMCA to restrict what scientists or other researchers can do with the data.

The University of Chicago Press, the ASP [the Astronomical Society of the Pacific], or the AAS [the American Astronomical Society], could find itself on the wrong side of a lawsuit by publishing computer code. Suppose PASP publishes some computer code purely intended for research purposes (which has been already done--see www.journals.uchicago.edu/PASP/journal/issues/v115n805/203034/203034.html). Suppose further that Henry the Hacker reads this code and somehow incorporates it in a brand-new CSS descrambler which is then used to crack the protective encryption on a DVD of, say, The Lord of the Rings. Then AOL Time Warner (which owns New Line Cinema which made The Lord of the Rings) could sue Henry (duh!), but they could also sue the ASP and/or the University of Chicago Press. The possibility of this actually happening is probably slight, but it's not zero.

However, there is good news: a backlash against the DMCA is afoot. In January 2003, a Norwegian court acquitted Jon Johanssen on the grounds that he owned the DVD he cracked and therefore was free to toy with the code. As a sign of increasing digital civil disobedience, Carnegie-Mellon computer science professor David Touretzky assembled a gallery of CSS descramblers (see it at http://www-2.cs.cmu.edu/~dst/DeCSS/Gallery/), which flirt with (or cross?) the line between aiding criminals and freedom of speech. And perhaps best of all, legislation is being considered to remedy some of the odious parts of the DMCA: the Digital Media Consumers' Rights Act, which would affirm the legitimate uses of computer coding and research, is being introduced in Congress. (You can find out more and get involved at http://action.eff.org/action/index.asp?step=2&item;=2421)."