DMCA fun from StorageTek [LWN.net]

July 14, 2004

This article was contributed by Joe 'Zonker' Brockmeier.

The latest effort to use the Digital Millennium Copyright Act (DMCA) as an obstacle to competition is courtesy of StorageTek. StorageTek, a company that sells a number of storage devices and data management software, is suing Custom Hardware Engineering & Consulting (CHE Consulting) for circumventing its GetKey algorithm to gain access to StorageTek tape library maintenance codes. So far, so good for StorageTek, which has received an injunction (PDF of the decision and the injunction) against CHE Consulting, essentially preventing the company from doing any maintenance on StorageTek tape libraries that requires access to the libraries' event messages. For the moment, an appeals court has put a stay on the injunction, but that stay could be withdrawn at any time.

Reading through the decision issued by U.S. District Judge Rya Zobel, it seems clear that Zobel has been firmly convinced of StorageTek's case. From page 10 of the decision:

The balance of harm to plaintiff from the denial of the injunction against that to defendant from the grant thereof tilts heavily to plantiff, given its financial losses and damage to customer relations from defendants' deliberate and calculated misconduct and theft.

It seems that StorageTek has managed to convince Zobel that CHE Consulting has violated the DMCA by going around the GetKey algorithm and that CHE has misappropriated StorageTek's trade secrets by gaining access to event messages on StorageTek equipment.

CHE Consulting argued that Section 117 of the Copyright Act was designed to allow third-parties to perform maintenance or repair, but that did not convince Zobel.

Defendants copy the Code by turning on the machine; however, they do so not just for repair, but also for the express purpose of circumventing plaintiff's security measures, modifying the Maintenance Level, and intercepting plaintiff's Event Messages.

What Zobel overlooks, of course, is that the only purpose to intercept the event messages is to allow CHE Consulting to perform maintenance on the equipment in question -- exactly what Section 117 of the Copyright Act was intended to allow. There is no benefit to CHE aside from being able to perform maintenance.

In order to get additional background and both sides of the story, we spoke to StorageTek spokesperson Joe Fuentes and CHE Consulting's president, David York. According to York, this case has actually been going on for some time. He noted that CHE Consulting had purchased software to access the error codes from 1997 through the first quarter of 2001, when StorageTek sent a letter to CHE Consulting alleging that the company was infringing on StorageTek's intellectual property rights. York said that CHE Consulting provided documentation that they were buying the software and then they didn't hear from StorageTek again until October of 2002 when the suit was filed. He also noted that StorageTek stopped selling the maintenance code to CHE Consulting in 2001.

When we spoke to Fuentes about the case, he was largely unable to answer most of our questions, as he said that he was not technical enough to respond to questions about the nature of the diagnostic tools and what would be required for a third-party maintenance provider to work on a StorageTek tape library without access to the maintenance code. Fuentes was also unable to provide access to a StorageTek spokesperson or employee who was knowledgeable enough about the case or the equipment to provide answers to our questions.

Fuentes did provide a statement about the case:

We believe that CHE was using our intellectual property without permission. Our job is to defend that intellectual property. I can't get any more specific than that... I think what the court is saying kind of confirms the value of our exclusive maintenance microcode. It's a competitive business, and we use our developed codes to provide superior services to enterprises.

We also asked Fuentes how StorageTek's customers would benefit from this action. According to Fuentes, "we value our relationships with our customers and want to make sure they get the best possible service. I have to stop there." While talking about StorageTek's services group, Fuentes also noted that the company serviced equipment produced by EMC, HP and other providers. Fuentes could not answer whether or not StorageTek used event messages generated by other manufacturers' equipment when providing service.

Fuentes also said that StorageTek's position was that third-parties could provide service for the equipment if they "invest and develop their own diagnostic tools to work on our equipment."

We asked York if it were possible for a third-party vendor to develop their own diagnostic tools. According to York, CHE Consulting has done so:

We've been providing this [service for StorageTek equipment] for seven years, all we're accessing is their data. We're not accessing anything that could be deemed to be actual diagnostics, we have developed our own exercise routines [for the equipment] on our own... we're talking about error data, data from the physical device. The error data is what they're claiming to own a copyright on.

We then asked York if it were possible for a third-party vendor to develop tools, as Fuentes suggested, that would allow them to generate their own codes. "Is it technically possible? We could debate that for a long time." When asked if it were reasonable to suggest that a vendor should develop that functionality on their own, he was more firm. "No, it is not."

We are still in litigation and we are feeling this decision. CHE has worked hard, its team members have worked hard. We believe we have a right to compete, we believe we have a right to exist, and we don't believe we have infringed upon anybody's rights here. We believe we're just some hard-working people. Based upon the fact that we're using the software with the customer's permission as it was designed is mind-boggling to me.

Zobel decided that "defendants' conduct has caused it [StorageTek] irreparable harm." However, Zobel doesn't seem inclined to consider the effects of the ruling on CHE Consulting. If StorageTek is successful in preventing CHE Consulting from maintaining their equipment, it is likely to be fairly catastrophic for CHE. York estimated that about half of their business consists of maintaining equipment that is now essentially off-limits to their company, unless they are successful in fighting the case. York says that CHE Consulting has filed a request for an appeal and stay of the order as of Monday, July 12.

We also asked York whether he was concerned about other vendors using the DMCA to prevent third parties from servicing their equipment:

I'm certainly concerned, but I can't say what another company might do. We service IBM equipment, even though we're partnered with them. For us to be able to provide service, IBM sells diagnostic code, manuals, parts... having said that, IBM, it appears, welcomes competition. If there is competition, IBM makes the most of it by saying, "Okay, we can sell some things, we win, independent organization wins, and most of all the customer wins."

Meanwhile, StorageTek's customers lose, and so does CHE. There would be little incentive for CHE to access event codes if some of StorageTek's customers had not decided that they wanted to have their equipment serviced by another organization.

StorageTek is not the first company to attempt to use the DMCA to lock competitors out of their business, nor are they likely to be the last. Until such a time as the DMCA is reformed, we will continue to see this sort of case. As this case illustrates, it's simply not enough to count on the courts to prevent abuse of the DMCA, nor is it enough to depend on the goodwill of corporations to protect the rights of their customers or act in their best interests.

(Log in to post comments)

Reverse engineering?

Posted Jul 17, 2004 10:55 UTC (Sat) by Duncan (guest, #6647) [Link]

> So if the DMCA holds here then does
> reverse engineering come illegal in the US?

IANAL and all that, but no, as I understand from what I've read, it can't
"become" illegal, because the terms of the DMCA specifically and directly
define it AS illegal already, within the scope of subverting "encryption"
with the purpose of "access protection". That isn't disputed, it's in the
law (altho the rightness of the law is certainly disputed).

The court cases have turned on the definition of "encryption" and "access
protection". Unfortunately, the terms have been interpreted rather
broadly, such that virtually anything not in plainest possible format is
encryption, and anything not specifically licenced by the rights holder is
violation of the "access protection". Thus, for example, a mechanism
documented to have originally been included for data compression purposes
could conceivably be validly claimed to be "encrytion for the purpose of
access protection" as well.

Unfortunately, that's where we're at, and why the DMCA is so despised by
technical people everywhere.

I intend to follow up with a more political analysis of the situation IMO,
so fair warning to those that don't like such things, to skip it.

Duncan

Political analysis: Effects of the current political environment on MS, in context

Posted Jul 17, 2004 11:37 UTC (Sat) by Duncan (guest, #6647) [Link]

An upline post asked about the DMCA and reverse engineering, and what
effect that might have on MS and SAMBA, etc. I said AFAIK the DMCA
specifically prohibited reverse engineering where it could be construed as
interfering with access protection, and that unfortunately the courts have
been construing that quite broadly, but left the political analysis and
effect on MS/SAMBA for this post.

While many have predicted MS attacking open source legally, it hasn't yet
happened, except by proxy in cases such as SCOG and various funded think
tank propaganda pieces. One may fairly ask what's holding them back.

The answer, it would seem, would be the sensitivity of the monopoly
situation. Altho they did seem to have gotten lucky with the election
process and won the last round by default, the situation remains delicate
enough that it would seem they are hesitant to bring a lot of action
directly, as it could easily reignite the monopoly wars, which I'd guess
they'd just as soon avoid, at present.

I haven't seen it mentioned directly, probably because that direct a
discussion of politics is generally avoided, but it is my belief and I
believe that of others as well, that should Bush win reelection, that
might change. Such an event could be viewed as affirmation of the Justice
Department's handling of the situation under his leadership, and therefore
be seen as a green light for MS to do whatever they want. Assuming this
view is correct as I believe, one could further predict that if Bush wins
in November, we can expect a number of MS legal announcements in December
or certainly by March, as MS begins "enforcing its intellectual property
rights", free of the worry that such will trigger yet another round of
anti-monopoly action, at least at the federal level.

If Kerry wins, I'd predict a period of feeling out his policies, with the
round of actions likely beginning second half of next year, if they are
comfortable with the anti-monopoly atmosphere.

As for the DMCA, keep in mind it was passed in 1998, about half way thru
the second term of the Clinton Administration. By then, of course,
Congress was safely Republican, but it's important to remember that just
because the white house changes parties, doesn't mean policies will change
for the better re the DMCA. There's talk of modifying it, and while talk
originally centered on a DMCA-II strengthening it, if that can even be
imagined, it would seem the political winds have changed and there's now
some pressure to weaken its most draconian provisions, altho there's as
yet no realistic proposals to outright repeal it. Unfortunately, I don't
know what the position of the political primaries is at this point, nor
what either Bush or Kerry support.

As for my personal position on those two, while I frankly don't trust
Kerry one bit as he comes across to me as the consumate polititian, /far/
to "inside the beltway" and slimy for my tastes, I simply cannot imagine
the policies of a Kerry administration could be worse than that of the
current Bush administration. If they are, I'm afraid we may ultimately be
in for a John Titor like scenario (look it up if necessary). The scary
thing about Titor is that regardless of whether one believes his
definitely "out there" story, his predictions remain all to close to the
possibility of reality for comfort. Never-the-less, despite my grave
reservations about Kerry, the fact is I simply cannot vote to affirm the
current policies, and continue them four more years, Kerry reservations or
not.

Duncan

DMCA fun from StorageTek

Posted Jul 16, 2004 0:33 UTC (Fri) by jamesh (guest, #1159) [Link]

StorageTek might claim that they hold copyright on the format strings used to generate the log messages, so the event log as a whole is a derivative work of their software.

A bit tenuous, but it seems like they pulled it off.

DMCA fun from StorageTek

Posted Jul 16, 2004 23:05 UTC (Fri) by giraffedata (subscriber, #1954) [Link]

Maybe the terms of the sale of the machine say the customer assigns copyright in all the error data the machine produces to StorageTek. Seems like a clever way to structure a deal.

DMCA fun from StorageTek

Posted Dec 20, 2004 0:48 UTC (Mon) by Matlock (guest, #26779) [Link]

David York, et al have other problems, including a federal investigation against CHE through the U.S. Department of Labor for improper job classification. Several field engineers are supposed to be non-exempt and paid overtime. CHE has classified them as exempt and does not pay any overtime as required by federal law. I suspect a class-action suit is in the making.

Btw... I have reviewed the situation of the STK case and the injuction stay has been lifted. The ELEMS at all STK equip'd sites had to be removed and the injunction is currently in effect. The ELEM code seems to be in violation of the law as stipulated in the original STK complaint. CHE does not have the direct ability to monitor the tape libraries unless they ask the customers for host-system reports, which is what they have asked their field engineers to do... it's a mess!