LWN.net Logo

Student faces suit over key to CD locks (News.com)

News.com reports that SunnComm is planning to sue John Halderman for the crime of showing how to evade SunnComm's new CD "copy protection" scheme. As predicted, the shift key is now a DMCA violation. "On Thursday, SunnComm CEO Peter Jacobs said the company plans legal action and is considering both criminal and civil suits. He said it may charge the student with maligning the company's reputation and, possibly, with violating copyright law that bans the distribution of tools for breaking through digital piracy safeguards."
(Log in to post comments)

Student faces suit over key to CD locks (News.com)

Posted Oct 9, 2003 22:22 UTC (Thu) by dvrabel (subscriber, #9500) [Link]

"Future versions of the SunnComm software would include ways that the copy-protecting files would change their name on different computers, making them harder to find, Jacobs said."

Eh? And this is going to work how? I don't see much of a reputation to malign if this is the sort of stuff they think of.

David Vrabel

Student faces suit over key to CD locks (News.com)

Posted Oct 9, 2003 22:49 UTC (Thu) by pto (guest, #5753) [Link]

Naturally, the "Delete" key will also become a DMCA violation.

Student faces suit over key to CD locks (News.com)

Posted Oct 10, 2003 13:35 UTC (Fri) by erat (guest, #21) [Link]

That would be a hoot. Imagine a world where you can't log into Windows or reboot a
Windows machine (CTRL-ALT-DEL).

Student faces suit over key to CD locks (News.com)

Posted Oct 9, 2003 23:13 UTC (Thu) by dve (guest, #15903) [Link]

"He said it may charge the student with ... violating copyright law that bans the distribution of tools for breaking through digital piracy safeguards."

Of course he's not distributing any tool here. Microsoft is distributing the tool. He's just telling people how to use it. Something Microsoft and other vendors have already done.

Student faces suit over key to CD locks (News.com)

Posted Oct 10, 2003 8:48 UTC (Fri) by beejaybee (guest, #1581) [Link]

Given that Microsoft tell people how to circumvent software that executes automatically when a CD is inserted - in fact they provide a circumvention tool (TweakUI) which makes alters the Registry so that you don't even have to hold down the shift key - the culprit here is obviously Bill Gates.

The obvious defence is that the "circumvention mechanism" was published years before the "security tool" was released.

C'moff it, these snake oil vendors deserve every bit of the "reputation" which this case deserves to get them.

This is in the same class as patenting water or copyrighting the letter "a". Use of the DMCA in these circumstances only brings further discredit on the US legal system.

Idiots!

Posted Oct 10, 2003 0:09 UTC (Fri) by jre (subscriber, #2807) [Link]

So, SunComm figures their reputation will be best protected by suing a Princeton student for writing an academic article revealing how stunningly, mind-bogglingly feeble their "copy-protection" scheme is.

Mind you, this is a guy so scrupulous that he wouldn't even click to accept the EULA because it contained a boiler-plate prohibition against "reverse-engineer[ing]." On the law-abiding scale, John Halderman scores a 10 out of 10! How long do you figure it took those less exacting in their principles to spread the same information on the net, with or without John Halderman? Can we even measure a time interval that small?

So SunComm's various functional groups all think it is a lovely idea to sue a poor student (PR: "Brilliant, chief!) and probably lose (Legal: "You go!") to protect a secret lost 10 seconds after the first CD shrink-wrap was broken (Marketing: "Hey, they were laughing at us anyway.")?

Evidently, SunComm's technical and strategic staff went to the same school as the crafty cryptologists at SCO who thought transliterating into "Symbol" font is an unbreakable cipher.

And it wasn't Princeton.

Idiots!

Posted Oct 10, 2003 11:24 UTC (Fri) by rknop (guest, #66) [Link]

On the law-abiding scale, John Halderman scores a 10 out of 10!

He should, but he doesn't. The laws in this country are that stupid, yes.

-Rob

A closer look at Sunncomm's lawsuit threat

Posted Oct 10, 2003 0:38 UTC (Fri) by skybunny (guest, #4478) [Link]

Sunncomm Technologies (STEH) was in trouble long before a Princeton student explained how to circumvent their anti-piracy technology.

From the article: The damage to SunnComm's reputation, while not necessarily permanent, was quickly seen in a drop in its market value, totaling close to $10 million over several days, Jacobs said.

Okay...the article has actually helped us figure out how big Suncomm really is. Sunncomm is a penny stock; the stock appears to have gone from about 17 cents a share before Halderman's revelation, to 11 two days later. This probably gives them a market cap of about $30 million (if trading at $.17). SCOX, for comparision, would have that market cap if it was trading at about $2. Small company.

**

Some research on their recent press releases reveals why this was damaging to them. Why did their stock price fall?

August 27: SunnComm's MediaMax CD-3 Technology passes international test with 'flying colors'; a test center in Belgium says, "'The SunnComm MediaMax CD3 Technology was a very compelling test for us. It achieved a very high level of playability combined with an incredible level of security for the music.' ... The testing results were able to verify playability on consumer electronic devices, stability of the product on computers and robustness of the security features to protect content against unauthorized copying when used with CD ripper programs."

September 16: SunnComm's MediaMax CD Copy Management Technology Chosen For BMG's First Commercial Release in the U.S.. We already know about this one; this is what Halderman used to figure out his circumvention. The technology begins to gain visibility.

September 25: Independent Record Label, Razor & Tie, Selects SunnComm's MediaMax CD-3 Copy Management Technology for Commercial Release in the U.S. Market.

September 26: SunnComm Technologies Lands Additional Revenue Deals with More Independent Record Labels Who Will Utilize MediaMax CD-3 Copy Management Technology

**

Why is all this important? Sunncomm's stock price soars to as high as 25 cents in late August, and maintains itself above 15 cents right up to October 7, the day of Halderman's revelation. Then it plummets to 10.

Sunncomm's fall in stock price is not the fault of John Halderman. The reason the stock price fell is that Sunncomm's security software obviously isn't living up to expectations. If software can be as easily avoided as Halderman shows, obviously something was wrong with the tests performed in late August that show that the security software meets the 'highest standards', causing a stock peak. There's a fairly direct relationship here between the inherent security of MediaMax CD-3 and the stock price of STEH.

Halderman may be sued by Sunncomm, but there should be no question of why Sunncomm finds themselves on the defensive. They set expecations with their investors that have not been met, because the simplest of workarounds to it has surfaced. Microsoft tells us how to do this, too: Turn Off Autoplay for Program CDs. Someone may well perform this task because they find the auto-playing of, say, the 'Adaptec EZ CD Creator 5' disc to be an irritant. It's in Microsoft's 'Tips Archive'.

Now, the $64,000 question: has Microsoft inadvertently violated the DMCA by providing this tip to its users? It is functionally identical to that which Halderman proposed. Here, it's probably safe to argue that Microsoft could not have known this tip would be problematic - so now we are forced to consider DMCA violations in context. If someone follows Microsoft's directions in the tips archive, that person won't even know they've circumvented the MediaMax technology. The more people that follow this tip for a completely irrelevant reason, the weaker MediaMax technology is, because its 'installed base' is lower.

One can argue that Halderman's solution is not circumvention at all; it is simply the act of not installing software. A [shift] override is a standard Windows feature to prevent CDs from running Autoplay when a disc is inserted. A user does not have to install the MediaMax software as a prerequisite to play a MediaMax secured disc, and Halderman's solution proves it.

The trouble with a compact disc is that it must be able to play in a device created in 1985 while not being allowed to be ripped by one made in 2003. This is a difficult proposition -- and Sunncomm is being dealt the brunt of the fact.

A closer look at Sunncomm's lawsuit threat

Posted Oct 10, 2003 1:48 UTC (Fri) by dve (guest, #15903) [Link]

Circumvent: To bypass, avoid or go around, especially by ingenuity or strategem.

"has Microsoft inadvertently violated the DMCA by providing this tip to its users?"
Based on prior DMCA rulings, probably yes. If the software is not installed, then it's function is circumvented, and that's a no-no insofar as DMCA rulings to-date would seem to indicate.

IANAL, however reading the DMCA front-to-back suggests that no security device (however ludicrous) is exempt from protection from circumvention. I suppose you could put a sticker on a CD or DVD, and require the user to phone your Helldesk (toll-free or premium rate) and provide their shoe-size before placing it in any reader/player AND charge people with DMCA violation if they failed to call or provided a misleading shoe-size.

None of that holds up under the UCC, of course. (All this week, the UCC and the DMCA slug it out, in the consumer rights battle of the century: "What constitutes a sale?" all this week on pay-per-view)

From the letter of the law, I would think that a judge would have to rule for Sunncomm on DMCA grounds. He could conceivably deny them damages on the basis of being idiots. If this is academic research we get into first-amendment territory, where there's a couple prior rulings that might let Halderman off the hook. I feel a wise judge would probably bump this one to the Supreme Court for reasons of job safety. No district judge would want to call this case either way, IMO (caveat: IANAL, nor a judge).

wise judges?!?

Posted Oct 10, 2003 9:41 UTC (Fri) by ronaldcole (guest, #1462) [Link]

Truly an oxymoron if there ever was one. Job safety? Judges are seemingly required to make mistakes... that's the whole "raison d'etre" for appellate courts. And to ensure that appellate courts will always have plenty of cases to examine, there's a little carrot they dangle called "qualified immunity": as long a judge pretents to be doing "his job", he's doesn't have to answer for his "mistakes".

A judge can't bump it to the SCOTUS, must make ruling

Posted Oct 10, 2003 9:46 UTC (Fri) by Duncan (guest, #6647) [Link]

> I feel a wise judge would probably bump this one to the Supreme Court
> for reasons of job safety. No district judge would want to call this case
> either way, IMO (caveat: IANAL, nor a judge).

Well, they might /want/ to, but ..

At least as I understand it (IANAL/J either), the gateway to the court system is thru
the trial court, which MUST decide one way or another. They can then stay the
ruling for a period of time, giving the losing side (well, in criminal cases, if the
prosecutor loses, that case is over, tho in priority cases another level may try the
person on different charges, federal on federal crimes if the state failed to convict on
the basis of state law/crimes, or vis versa, so only a trial court guilty verdict can be
appealed, tho from there the appeals either way can be appealed) time to appeal. In
some exceptional cases, appeals courts can pass on it and send it in an expidited
process to the SCOTUS, but often as not the SCOTUS rejects it and sends it back
thru the appeals process. The reason being SCOTUS likes all the appeals history
and trial and appeals arguments organized neatly before them, giving them a chance
if possible to rule on some technicality and send it back down to the bench or
appeals level for resolution based on that. In fact, the court system at every level
looks to rule on technicalities, rather than ruling on the big issues, as they are
otherwise accused of being "activist judges that make law rather than deciding
current law."

Thus, at the low end, the trial court, at least, the judge has NO CHOICE but to rule
one way or the other, tho they WILL usually try to rule on a technicality rather than
the big picture, if at all possible.

Duncan

snakeoil

Posted Oct 10, 2003 8:17 UTC (Fri) by hingo (subscriber, #14792) [Link]

The reason the stock price fell is that Sunncomm's security software obviously isn't living up to expectations. If software can be as easily avoided as Halderman shows, obviously something was wrong with the tests performed in late August that show that the security software meets the 'highest standards',


All these 'copy-protection schemes' that we have seen lately, remind me of stories from Lucky Luke and other westerns, where someone gets tarred and feathered for selling snakeoil. That is, some bogus liquid that is marketed as a cure for everything from baldness to clavus.

I think it would benefit us to more openly label these technologies as snakeoil. (I think Bruce Schneier uses the term for bogus cryptography products.)

Not that I care if record labels are getting screwed buying hoaxes like these, but the problem is that then we get our legislators that believe they need to come up with some new legislation (DMCA, EUCD) to prevent this 'copy-protection' from getting 'cracked'.

The message that needs to get through therefore is: There is nothing here that deserves to be called 'copy-protection', it's just snakeoil. No need for legislative intervention. Nothing to see here, move along...

henrik

PS. How do you spell DMCA without pressing the shift key?

snakeoil

Posted Oct 10, 2003 12:12 UTC (Fri) by KaiRo (subscriber, #1987) [Link]

Well, what they call "copy-protection" is actually just meant to protect their money but not the rights of consumers.
We have a saying here that states "Der Kunde ist König" ("The consumer is the king"), and it's actually the most important rule for every salesman here. As long as the consumer get satisfied and is happy with you, he'll come around buying your products the next time as well.
Those "protections" are doing it the other way round though. They're telling the consumer "Yes, you bought this music/video, but you are not allowed to use it the way you want, not even for yourself only, you only are allowed to use it the way WE want". And recent laws are even supporting that style of doing things. I don't wonder if people stop buying CDs or DVDs because they're feeling pissed off. The markets should be orientated at the things the consumer needs and wants, and not at the needs and wants of the industry.

Hell, if I'm buying music of my favourite group, I want to play it the way I want. And I simply want to play it from a Ogg Vorbis file with XMMS. It's OK if I'm not allowed to share that file or resell it. But it's not OK if I can't even create this file and play it for myself. I don't want to change CDs for every other song I want to listen to. I just want to run them from my favourite playlist, in my favourite player. As long as they don't allow me to do that, I won't buy any music of them and I'll try to get it somehow without the need to buy something I can't really use the way I want.
If they're able to provide the music to me in a way I can use, I'm very willing to buy it though.

The real problem of the music and video industry is that they're taking away the consumer's freedom. If they were acting as our friends, we'd also act like friends and buy more CDS and DVDs. I'm quite sure of that.

snakeoil

Posted Oct 10, 2003 14:09 UTC (Fri) by mattdm (subscriber, #18) [Link]

"The customer is king." Yeah, we have that too. And sure, all the sales-people *tell* you that that's the number 1 rule. And maybe it is for some low-level people, but for the higher-ups, it's just a cynical ploy.

Student faces suit over key to CD locks (News.com)

Posted Oct 10, 2003 4:04 UTC (Fri) by ccchips (guest, #3222) [Link]

This lawsuit was for the kind of people who write articles on sites like news.com. They love to blab about how great it is that the government is violating our right to ownership in favor of their (bosses') rights to protect their "property."

Student faces suit over key to CD locks (News.com)

Posted Oct 10, 2003 4:12 UTC (Fri) by ccchips (guest, #3222) [Link]

I went over and read the article. The one thing that strikes me as interesting is that they posted a link to Halderman's paper. I hope it stays there. Remember all the bruhaha about people linking to DeCSS?

Yer honor, I put the CD in Linux drive

Posted Oct 10, 2003 6:27 UTC (Fri) by RobDavies (guest, #9930) [Link]

Oh dear, that super protection software system didn't work, I must be a
DMCA pirate to!

This could bring down the DMCA

Posted Oct 10, 2003 7:36 UTC (Fri) by rakoch (guest, #4666) [Link]

This could become the case the DMCA falls over - provided Halderman is
willing to walk all the way down into the people mill called legal system.
Which is only his decision. Noone can demand from him not to bail out,
just like Skylarov did. But unlike Skylarov he's a US citizen. Skylarov
was probably not very interested in suffering to change stupid US laws,
Halderman might...

-Rudiger

This could bring down the DMCA

Posted Oct 10, 2003 8:47 UTC (Fri) by bastiaan (guest, #5170) [Link]

IIRC, Sklyarov did not bail out, the US prosecutor did: the charges were dropped in 'exchange for' his testimony in the case against his employer Elcomsoft. A testimony he would have given anyway and did not help the prosecutor one bit....

Bastiaan

Linux a circumvention device?

Posted Oct 10, 2003 7:38 UTC (Fri) by jbh (subscriber, #494) [Link]

This "copy protection" doesn't work on gnu/linux (or *bsd, mac, or actually any other os than windows) either.

That would make linux a circumvention device, wouldn't it? Linux distributors beware...

Linux a circumvention device?

Posted Oct 10, 2003 11:28 UTC (Fri) by rknop (guest, #66) [Link]

That would make linux a circumvention device, wouldn't it? Linux distributors beware...

It sounds like a joke, but it's only a matter of time. Some already make the argument that it's insane to have an open-source operating system because anybody can see the source code and hack it. Right now, it's security FUD, and the community by and large have recognized that it's FUD. However, when it comes to copyright circumvention devices, and DRM that needs to be built into the kernel, then, yes, just the ability to modify the source code becomes a circumvention device.

It is not much of a stretch to see free and open source software outlawed in this country. I hope we don't go that far, but we're rocketing very rapidly in that direction right now. Unless we have *radical* campaign finance reform, or figure out how to elect somebody instead of the same old republicans and deomcrats, we're going to get there.

-Rob

Linux a circumvention device?

Posted Oct 10, 2003 13:59 UTC (Fri) by ccchips (guest, #3222) [Link]

'scuse me....what, exactly, do you mean by "elect?" I know what "I" mean when I say that word, but obvously the Supreme Court doesn't have the same view on the matter. A Republican-controlled Supreme Court, a Republican-controlled Congress, and a president who was appointed by that Supreme Court?

So, again, what does "elect" mean in the United States? Some kind of choice? What choice?

The wise thing for the courts to do would be to rule large parts of the DMCA unconstitutional. But in the United States, profit is far more important than wisdom. Government is a "business," remember?

Linux a circumvention device?

Posted Oct 10, 2003 15:32 UTC (Fri) by dooglio (guest, #2604) [Link]

The wise thing for the courts to do would be to rule large parts of the DMCA unconstitutional. But in the United States, profit is far more important than wisdom. Government is a "business," remember?

Right, but as consituents, we-the-people can still write letters to our congress-people. The more emails, faxes and snail mails we send to congress, the more likely legislation will get drafted to fix this bum law.

So, write to your congress-person and senator about this crap! We need a grass roots movement and spread the word.

Linux a circumvention device?

Posted Oct 10, 2003 15:35 UTC (Fri) by dooglio (guest, #2604) [Link]

It is not much of a stretch to see free and open source software outlawed in this country.

I swear to God that I will move out of the country if that happens. Of course, where would I go? Doesn't Canada have it's own version of DMCA as does Europe?

Student faces suit over key to CD locks (News.com)

Posted Oct 10, 2003 8:50 UTC (Fri) by bastiaan (guest, #5170) [Link]

'SunnComm'? Surely it must be 'SunnCOmm Group' ...

This is different than SCO

Posted Oct 10, 2003 9:50 UTC (Fri) by frazier (subscriber, #3060) [Link]

These guys aren't SCO at all.

SCO claims to own the work of others. SunnComm claims to have created a decent form of security. These are two distictly different forms of suck.

SCO claims ownership of the city park. SunnComm is selling combination locks that pull open regardless of what combination is used.

Student faces suit over key to CD locks (News.com)

Posted Oct 10, 2003 13:21 UTC (Fri) by trutkin (guest, #3919) [Link]

arstechnica.com has an intelligent discussion of why their lawsuit is likely to fail.

Blame shifting?

Posted Oct 10, 2003 14:07 UTC (Fri) by walterbyrd (guest, #11620) [Link]

Uh-oh, somebody found out our product sucks. We better file a lawsuit to make it appear that he is to blame instead of us. At least draw attention away from the fact that our product is so easily cracked.

Student faces suit over key to CD locks (News.com)

Posted Oct 10, 2003 15:11 UTC (Fri) by davidl (guest, #12156) [Link]

In a word. "Ludicrous."

Copyright © 2003, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds