We're Not Your Enemies; We're Your Customers
July 24th, 2001 by Mike Orr in
Contents:
"We're not your enemies; we're your customers." This was said about Adobe during the protest in front of their Seattle office yesterday, but it could apply to any company that prosecutes its users under the Digital Millenium Copyright Act (DMCA). One must consider both those cases that have happened (2600/DeCSS) and those that have not: what if a future version of MS Word used an encrypted format to make it illegal for WordPerfect, AbiWord, catdoc and the rest to work with .DOC files? Yesterday, though, it was Adobe who was in hot water because of a Russian programmer named Dmitry Sklyarov. This article looks at one of the protests staged Monday to free Sklyarov, discusses why the DMCA is bad for programmers in particular and offers some suggestions for future action. Oh, and there are also some pictures of the protest.
Adobe's beef with Sklyarov was that his company, Elcomsoft, sold a program that converted Adobe's encrypted eBook format to ordinary PDF. This program is legal in its home country (Russia) and practically every country in the world, and would have been legal in the United States until the Digital Millenium Copyright Act of 1998. So when Sklyarov came to the US to give a talk at DEF CON about the weaknesses of Adobe's eBook encryption (another topic Adobe didn't want publicized), Adobe had the FBI arrest him, because even talking about weaknesses in a company's encryption format is illegal under the DMCA, if the format is used for copyright protection.
Later, we'll get into some legitimate uses for third-party decryption (including exercising your Fair Use rights and verifying that the product is indeed secure), but for now let's look at how the computing community responded to this event.
The Electronic Frontier Foundation, a lobbying organization that has long supported individual freedom in the digital age and staunchly opposes the DMCA, launched a grassroots campaign to free Dmitry, expose what Adobe is doing and repeal the DMCA. Meanwhile, the free-sklyarov mailing list was created and was logging over three hundred messages a day, as people worked over the weekend to organize protests in 10-12 cities including San Jose, Seattle and Moscow. The speed at which this was accomplished is noteworthy. The arrest was seven days ago, local coalitions and the international group were stitched together four days ago, and many of the protests took place yesterday.
The Seattle group coalesced around the seattle-sklyarov list, gaining members by word of mouth. There are some fifty people on the list. We had a strategy session Saturday evening at Beth's Cafe in north Seattle. Five people attended, and the biggest topic was whether to picket Adobe. The EFF had called off the protests because it was in the middle of negotiations with Adobe (at Adobe's headquarters in San Jose, California) and wanted to give the company a chance. Most groups decided to picket Adobe anyway. A few (e.g., Portland, Oregon) decided to delay their protests to see how the negotiations would go. The Seattle group was pretty evenly divided. In the end, we decided to split into two groups: the "protesters", who would picket Adobe, and the "EFF contingent", who would hold a rally (euphamistically called a "picnic") at nearby Gasworks Park and await word by cell phone from the EFF on how the negotiations were going. Some were critical of the EFF's decision to halt the protests but wanted to honor their request. We figured that Adobe, knowing that the picketers had reinforcements nearby (whom the Adobe executives could just barely see out of the corner of their window), would feel pressured to act responsibly in the negotiations, in order to prevent the reinforcements from joining the picketers.
It should be noted that there was no pressure to protest or not to protest. Everybody was asked whether they wanted to picket at this time, and everybody's preference was honored. There was full respect and cooperation between the two groups, which was the reason for their success.
Monday morning, both groups assembled at 11 a.m. in Gasworks Park. There were 30-40 people. The first order of business was a poster-making party. Two local TV stations interviewed the organizer, Neale Pickett, and shot footage, but it didn't make yesterday's news. (However, the Seattle Post-Intelligencer ran an article today.)
Then the picketers went off to the Adobe building and the "EFF contingent" stayed in the park for a "picnic". (But we hadn't had the foresight to bring food.) A phone call came in from the San Jose group that they had 85 protesters, but no word came from the EFF. Finally, somebody told us that the media would not cover the event unless we got more picketers, so the rest of us decided to join them. We marched the thirteen blocks to the People's Republic of Fremont (which is a wacky neighborhood in of itself) and joined the picketers, who were walking back and forth in front of an outdoor cafe on the first floor of the Adobe building. (We were hoping some Adobe executives would see us as they took their lunch break.)
Our signs read, "FREE DMITRY", "CODING IS NOT A CRIME" and other slogans. Some carried US flags to show that our beef was not with our country but with certain laws. One guy had a poster with a hammer and sickle symbol to demonstrate the irony that arresting somebody to prevent competition is something we'd expect to see in the Stalinist Soviet Union, not in the land of the free; instead, we have a Russian programmer in jail because of an intrusive, speech-restricting US law and a US company.
Of course, you cannot have a protest in Seattle without awakening people's memories (and fears) of WTO, so we maintained the utmost of decorum. We remained polite to Adobe employees and stepped aside for them to pass. We stayed off the street and even obeyed the stop lights. The cops hid themselves discreetly behind a parking lot across the street; then, deciding we were not a menace to society, they sped off.
A few pedestrians stopped to ask us what this was about. One asked us, "Is this about the DVDs?" We replied, "No, this is a different case, but it's the same law", and gave him the background.
A few protesters drifted away one by one, then at 1 p.m. we folded up shop and walked back to the park. We returned to our homes and workplaces and discovered the good news: Adobe had agreed to withdraw their complaint against Sklyarov and would recommend his release. The EFF had convinced Adobe that holding this man was not necessary.
Of course, that's not the end. Sklyarov's fate is in the hands of the US Justice Department, which still considers him a criminal. Many people are still mad at Adobe for sic'ing the FBI on Sklyarov in the first place, for agreeing to his release only to avoid bad PR, for remaining unrepentant about encryption, reverse engineering and the DMCA in general, and for miscellaneous other sins. Some people are mad at the EFF for accommodating Adobe, but the overriding concern is the DMCA and the fact that it is still a law and enforceable.
Much has been written about the DMCA's ability to prevent users from exercising their Fair Use rights with regard to products they have purchased. US copyright law has long recognized the rights of individuals to read a book whenever and wherever they want, to lend it to others, to quote portions in a review or satire, to photocopy portions for personal study or to discuss a point with somebody, to sell it at a used bookstore, and to read it anonymously (without telling the publisher who is reading which portions when). Likewise, we have the right to record an audio CD onto tape (format conversion), to play it in any CD player we wish and to play it anonymously. The 2600/DeCSS suit is about format conversion and "any player". Linux users wrote a driver to play their DVDs on Linux (the company didn't provide such drivers) and were promptly threatened under the DMCA (infraction: circumventing encryption that is intended to provide copyright protection). A web site was also sued under the DMCA for linking to information about DeCSS (infraction: talking about circumventing encryption that is intended to provide copyright protection). Note that neither charge alleges actual copyright infringement but only that the technology is capable of it. It is also capable of enabling one to exercise one's Fair Use rights and, in Sklyarov's case, to convert an eBook to a format blind readers could read.
I would like to focus on another aspect of the DMCA that has not been written about as much: its effect on programmers. Alan Cox, a prominent British programmer and the #2 man on the Linux kernel development team, resigned his position at the Usenix conference, writing, "With the arrest of Dimitry Sklyarov it has become apparent that it is not safe for non-US software engineers to visit the United States.... Until the DMCA mess is resolved I would urge all non-US citizens to boycott conferences in the USA and all US conference bodies to hold their conferences elsewhere."
I asked a security/cryptography programmer in the Seattle group how the DMCA is affecting him and programmers he knows. He said that 75% of the speakers at DEF CON could have been nabbed for the same reason Sklyarov was, and that the DMCA criminalizes normal and necessary practices in software engineering, especially those in security-sensitive industries. Here is an outline of the problem in his own words:
In a capitalist nation such as the United States, many of the companies directly influence the rejection or passing of new laws that effect said companies. The DMCA is a perfect example of this. Here is the effect of the DMCA on companies' products.
FACT: The DMCA directly impairs any third-party entity from validating that the methods and implementation, for a given piece of software, are valid, if, and when, those methods and implementations are secured by any method of encryption or comparable security. It is illegal to reverse engineer these processes to determine provable validity of the software and its methods.
FACT: Therefore, it is illegal to verify that any secured software algorithm contains both the features that were promised to the user, or that the software does not put the user at risk when using the software.
FACT: The only entity that can promise these properties are included in the software is the software company itself. A software company can, and usually does, choose to sell a software product that has not been fully tested beyond the extent that it will be used by the average customer, since the company has a financial interest in the sales of the software product. It can be assumed that no product in existence, when developed under a financial budget, will be completely error and/or bug free, since it would be financially burdensome to prove that there were no errors whatsoever in the software product.
FACT: Henceforth, under DMCA, it is illegal for anyone to verify through reverse engineering that a company's software product is performing the functions that it should be performing. Software companies will leverage this law to the maximum potential. Today in the software security field, a bug in a software program can turn into lost revenue and, in many cases, bad publicity. This law makes the third-party finders of these bugs punishable in a US Federal Court.
Why Would a Company Favor DMCA?
FACT: Protect your software algorithms and methods with security, and no hacker or engineer will be allowed to reverse engineer your program legally.
Will this stop the people who crack software and reverse engineer security algorithms?
FACT: No. The majority of people who crack software and reverse engineer algorithms do it for the sake of learning, or are doing third party validation of network security. People who crack software will continue, as their real identities are not publicly known, and they therefore have no more chance of getting caught than they do now. Network security engineers will relocate and continue to find flaws in the security algorithms because it is the "right" thing to do. The majority of network engineers are looking out for the rights of the American people at all times. This is the main focus behind network security: the security and right to privacy for any user of a computer on a network.
Why do You Want DMCA Revoked if You are an Engineer?
FACT: Software companies can lie and cheat about their software products. What they do or do not do will be illegal to find out, for every person or entity in the United States.
Would you trust that every software product from every software company in the United States not only does everything the marketing people say the product does, but also has no flaws in its security algorithms?
FACT: Trusting every company also suggests that you have to trust every person that has ever touched the software product from that company. It also means you trust that no person touching the software product has made a mistake.
Are you willing to put the security of yourself, your friends, your family and your personal information in the hands of a software company that says, "Our product is secure and is impenetrable from hackers", knowing that the DMCA protects that company from ever being proven that the product, in fact, is not secure at all?
No. I generally have faith that companies and people alike do things in good faith. However, due to the number of security flaws found in software over the last many years, is there any question why this law is only going to allow software companies to have more freedom to get away with shoddy coding practices?
One last item. Criminal hackers that indeed use security flaws for personal gain are not scared of the DMCA. These engineers are already doing illegal acts. If you have stolen five million dollars from a bank, the last thing you are worried about is a speeding ticket from the local police. In short, no criminal will care about the DMCA laws, as those laws are below the laws they either have already broken or intend on breaking. The DMCA protects only the interests of companies that cannot develop solidly coded, secure software products. Companies that embrace the DMCA are merely embracing the power that allows them to sell their software regardless of its quality or security.
These opinions do not necessarily reflect the opinions or views of my employers or friends.
I am a software and network engineer who recently retired from Laplink, Inc. My name is Drew "Ender" Miller, and I have been active in network security for over five years. I have spoken twice at the DEF CON network security convention in Las Vegas, NV. Currently, I contract to companies for security software development and validation of software network security algorithms.
Jessica Litman wrote in Digital Copyright that when Congress debates copyright law, the publishers and media companies make sure their interests are represented (by virtue of their campaign contributions, cynics would say). But the public and libraries are rarely consulted, as if their rights didn't exist. This is in spite of the fact that the Constitution, the courts and traditional copyright law have long recognized the public's right to a short copyright term (so that items will fall into public domain sooner), to Fair Use, and to the sharing of knowledge and ideas.
For many people, the Sklyarov case was their first opportunity to voice their interests in the copyright debate. Hopefully, they will continue to demand their place at the table until their concerns are satisfied. But picketing is not the only form of action. For instance, you can:
write a letter to your Congressmen.
meet with your Congressmen and ask them where they stand on the issue (so you can decide whether to vote for them next time).
boycott DVDs (yes, I know that will hurt).
tell your friends, family and co-workers about the dangers of the DMCA and how it will soon deprive them of rights they have long considered unshakeable.
tell your friends in Canada, Europe and other countries about what's happening in the US, and how they must not allow the DMCA to spread to their country.
if you're a programmer or working on a software project (whether commercial or free), consider whether it might infringe on the DMCA and, if so, consider moving the project and yourself outside the US. Be sure to tell the media and your Congresspeople loudly that you are leaving because of the DMCA, and outline the economic, cultural and prestige losses the United States will suffer.
It's hard to explain the problems with the DMCA to somebody outside the Slashdot world. But to succeed in repealing it or having it declared unconstitutional, we must show John Non-Tekkie and Jane Not A Computer User how the DMCA affects them, that in the future utopia when all books are digital, their Fair Use rights may exist but they'll have no way to legally exercise them, that they may be prohibited from even discussing the issue, and that they may have to buy shoddy or insecure products because competing better products have been declared illegal. That should get them hopping mad too, and then they'll be writing to their Congressmen demanding to know why their rights aren't being protected.
Who would publish or invent anything if the payment could be circumvented? Nobody except Plato, Homer, Galileo, Da Vinci, Gutenberg, etc.
Don't let Sklyarov ROT-13 in prison.
The New York Times published an excellent and balanced article about the Sklyarov case and the DMCA. This was before the protests, but it provides good background and explains (some of) what the anti-DMCA community is worried about.
More photos and information about the Seattle demonstration, the seattle-sklyarov mailing list, More photos and more photos. (Note: some of the photo pages are mirrors of each other.)
The free-sklyarov international mailing list and the free-sklyarov-announce list. (The second is moderated and contains only announcements, not discussion.)
The Joint statement from the EFF and Adobe recommending Sklyarov's release, in which Adobe promises to withdraw its complaint against him.
The Electronic Frontier Foundation (EFF) home page.
Bryan Pfaffenberger as usual wrote a well-researched Linux Journal web article on the topic.
Wired has published several articles on the Sklyarov case. Search for "sklyarov" or "dmca".
Special Magazine Offer -- 2 Free Trial Issues!
Receive 2 free trial issues of Linux Journal as well as instant online access to current and past issues. There's NO RISK and NO OBLIGATION to buy. CLICK HERE for offer
Linux Journal: delivering readers the advice and inspiration they need to get the most out of their Linux systems since 1994.
Sorry, offer available in the US only. International orders, click here.
Subscribe now!
The Latest
Featured Videos
Linux Journal Live - Oct 9, 2008
October 9th, 2008 by Shawn Powers
The October 9, 2008 edition of Linux Journal Live! Associate Editor, Shawn Powers, and Kyle Rankin, "Hack and /" columnist and author of Knoppix Hacks, Linux Multimedia Hacks, Knoppix Pocket Reference and others, discuss Linux distributions.
Linux Journal Live - Oct 2, 2008
October 3rd, 2008 by Shawn Powers
The October 2, 2008 edition of Linux Journal Live! Associate Editor, Shawn Powers, and Steven Evatt, Online Development manager for The Houston Chronicle discuss surviving disaster with Linux.
Recently Popular
From the Magazine
November 2008, #175
There aren't many numbers that put the US national debt to shame, but here's one: 1,100,000,000,000,000. What's that? That's how many floating-point operations per second the Roadrunner supercomputer at Las Alamos can perform. That's about 100 FLOPS per dollar of US debt (unfortunately, the debt is winning the second derivative race). Read the article about Roadrunner in this month's High Performance Computing issue of LJ.
Along with that, find out how to program the Cell processor and how to use CUDA with your NVIDIA GPU. Also in this issue: Mr HandS (aka Kyle Rankin) gives us a few tips on using Compiz, Chef Marcel shows you how to get blogging off your plate quicker, Mick Bauer talks about Samba security, Dan Sawyer interviews Cory Doctrow and Doc talks about how information technology can affect democracy and fix the national debt (just kidding about that last part). That and more for your reading pleasure in this month's Linux Journal.
Delicious
Digg
Reddit
Newsvine
Technorati








Post new comment