[free-sklyarov] Straining digital copyright law, junior paper exposes protection flaws in CDs

[Richard M. Smith]

http://www.dailyprincetonian.com/archives/2002/11/21/news/6433.shtml

Straining digital copyright law, junior paper exposes protection flaws
in CDs

By JOSHUA TAUBERER
Princetonian Senior Writer

  
Photo by Gabriel Fossati 
    As senior computer science major Alex Halderman '03 was presenting
his junior paper to a room of scientists Monday, he was thinking about
his future career. Being sued by the music industry was further from his
mind.

    Halderman said he could possibly be sued for violating the Digital
Millennium Copyright Act by presenting his spring JP at the ACM
Conference on Computer & Communication Security in Washington.

    Halderman's paper explains how some companies have protected CDs
from being copied by computers.

    Concern over a DMCA lawsuit until now has been reserved for just
some of the University's faculty, notably computer science professor
Edward Felten.

    But what separates Halderman even from the professors - in the
unlikely event that he is sued - is that the University might provide
him with legal defense, Halderman said.

    "I've been given assurances that the University would help me if I
were sued for breaking the DMCA," he said. This would be an
unprecedented and controversial move for the University if it were to
happen.

    The DMCA prohibits circumvention of copy-protection technologies,
such as encryption and digital watermarking. The copy-protection system
that Halderman examined is an exploit of existing flaws in computer
software.

    Because those technologies constitute a major focus area in computer
science, some say the DMCA prohibits legitimate academic research.

    "That makes the DMCA problematic for universities and other
institutions," Wilson School professor Christopher Eisgruber said in an
email.

    The DMCA is the same law that put peer-to-peer file sharing programs
- such as Napster, Gnutell and Kazaa - on the judicial radar.

    Also as a result of the DMCA, the University's radio station WPRB
will face higher royalties for webcasting.

    Halderman - a 'Prince' associate photo editor - said he would have
written his JP differently if there were no DMCA.

    In the past, to show the weaknesses in a security system, one would
write a program to break it. "That would be a proof," he said.

    But since the DMCA was passed in 1998, creating such a proof can be
illegal.

    Instead, Halderman said he was careful to explain why the CDs'
copy-protection system is inherently weak, without providing a recipe
for circumventing it.

    In 2001 Felten received a letter from the music industry allegedly
threatening a DMCA lawsuit in response to research he and others had
done.

    The threatening letter never became a lawsuit. But following
Felten's troubles, the University faculty voted to establish a committee
on threats to academic freedom by legal intimidation, chair of the
committee and physics professor Edward Groth said in an email.

    Groth said the committee will be finalizing a report to the dean of
the faculty's office next month.

    The University has provided indemnification - legal defense - for
students and faculty in the past, when they were performing a certain
function for the University, such as serving on the Honor Committee,
General Counsel Peter McDonough said.

    Indemnification was originally designed only to protect the highest
officers of the University from suits related to their roles, he said.

    Protecting researchers for the sake of research is more than just
rare, he added. "It is unheard of."

    McDonough's office recommends cases of indemnification to the
president, who holds the authority of granting indemnification.

    "Once you get indemnification and once the University controls your
defense, all of the sudden the decisions . . . are not necessarily the
individuals," he said.

    McDonough added that he would not want to see his office become the
de facto clearinghouse for research papers.

    If his office were to deny a researcher recommendation for
indemnification, McDonough said, then some might see the office as
censoring the student or faculty member.

    Groth said, "Technology has completely changed the landscape."

    The DMCA was created to prevent technology from making copyrights
moot. But the law itself is unusual.

    Halderman's JP adviser, Professor Andrew Appel '81, said the DMCA
gives "a hook on which to hang a reasonably credible threat" - even if
that threat would be unlikely to hold up in court.

    "One has to explicitly be prepared to deal with the possibility of
these threats of lawsuits," he said.

    Without a team of defense lawyers at a researcher's disposal, facing
a threat may not be feasible. Some researchers might be forced to choose
a less risky path by not doing the research at all.

    Halderman called that the "chilling effect" of the DMCA. Though
Halderman said it is unlikely that he would be sued, he said he plans to
continue his research, which could cause more conflict with the act.