Earlier this year, Jon Johansen from Norway wrote and posted a program that breaks the encryption scheme on DVDs---Digital Versatile Disks. Because his program de-encrypts the DVD's Content Scrambling System (CSS), he named the software DeCSS. But fame often has its price, which in this case, came as a knock on the door by Norway's federal police. According to Johansen, the police raided his home, seized his computer and cellphone and indicted both Johansen and his father, who owns the domain (mmadb.no) where the younger Johansen's homepage is based. Johansen said he was taken in for six to seven hours of questioning.

The police raid is the most dramatic in a series of legal meneuvers surrounding the protection of digitally encoded audio and video. Hollywood and the recording industry are discovering what the software industry has known for years: digital data is easy to steal. In video and film, a print of a print of a print will suffer obvious degradation. Make a tape recording of a record album, and the copy will contain noise not found on the original. That's not so in a digital recording. A CD copy of the Beatle's A Day in the Life has a definitive data structure---as precise as a spreadsheet or the the object code for Windows 2000. Consummers benefit from this precision in the form of crisper images, scratch-less audio, and no degradation from frequent playing. CDs and DVDs don't have to be rewound and have no moving parts. The industry also also benefits: the cost of producing a CD or DVD is much less than a tape or VCR cassette. It's already clear that tape rental companies will be stacking their shelves with DVDs, consigning tapes to collectors. Industry forecasters see the revolution happening in the U.S. in five to seven years, though if the CD's success over vinal is any indicator, DVDs may take over even sooner. In Japan where DVD sales have been slower, the new DVD-capable Sony Playstation 2 is expected to help propell the format.

But the entertainment industry for also pays the price for digital encoding because piracy has never been easier. You can burn your own illegal CDs for the cost of a CD-R player, whose price sometimes dips below $100 in the U.S. DVD writers are more expensive, but the cost is falling. And the Internet itself has become the perfect distribution medium for digital entertainment. Upper middle class American kids are starting to grow up with broadband connections in their homes---and are routinely downloading entire movies, some of them shot with a digital camera in a movie theater---right off the net.

Naturally, the entertainment industry is not happy about all of this. They argue that creative artists in both the visual and audio mediums should be paid for their talents, time and risks. A filmmaker may love what he does, but he still wants to be compensated, and the same is true with the most obscure garage band, whose members dream of quitting their day jobs for a lucrative career. Even Shakespeare and Michaelangelo expected a profit from their work.

In the United States, the Congress has attempted to grapple with this brave new era by introducing a broad piece of legislation called the Digital Millennium Copyright Act., (DMCA), which President Clinton signed into law in late 1998. While the law does not extend outside the United States, it has been used by both film and recording industry interests to try and thwart the rampant illegal copying of their material.

In Johansen's case, the 16 years old says he wasn't thinking about piracy when he wrote DeCSS. Rather, he claims he simply wanted to view DVDs on a Linux machine. That's not ordinarily possible because commercial DVD deencryptors are only available via Windows and the MacOS. But the entertainment industry doesn't see it that way. And so, the real action surroundinig DeCSS is taking place not in Norway, but in the the United States, where the lawsuits have been filed under the DMCA against website operators who posted DeCSS. Last December, for example, the DVD Copy Control Association, which represents both film and consumer electronics industries, sued 72 programmers and websites in an effort to stop them distributing DeCSS programs.

In January, eight Hollywood studios followed with their own lawsuit in New York's Federal Court with essentially the same complaint. Jack Valenti, president of the Motion Picture Association of America, said in a statement that the posting of DeCSS is "no different from making and then distributing unauthorized keys to a department store." Plaintiffs are primarily films studios or their subsidiaries such as Walt Disney Company's Disney Enterprises Inc. and Sony Corporation's TriStar Pictures.

So far, the courts have been receptive. The New York judge, Lewis Kaplan, issued a preliminary injunction prohibiting any Internet website from "manufacturing, importing or offering to the public, or otherwise trafficking in DeCSS." In a later memorandum, he rejected the Linux argument, doubting that DeCSS was developed for the sole purpose of achieving interoperability between Linux and DVDs. The judge noted the merits of CSS---that it has been licensed to hundreds of DVD player manufacturers and DVD content distributors around the world, and, since 1996, has helped spur the growth of DVDs for copyrighted movies. More than 4,000 motion pictures have been released in that format in the United States alone, the judge said, with new titles coming at the rate of more than 40 each month. The judge also noted that more than five million DVD players have been sold, with DVD disk sales now exceeding a million units per week.

Kaplan said that, with pending court action in place, "members of the hacker community....stepped up efforts to distribute DeCSS to the widest possible audience in the apparent attempt to preclude effective judicial relief. One individual even announced a contest with prizes (copies of DVDs) for the greatest number of copies of DeCSS distributed, for the most elegant distribution method, and for the 'lowest tech' method." The judge concluded that there is no reasonable difference between offering a technology that circumvents copyright protection and actual copyright infringement itself. Plaintiffs, he said, potentially face the same immediate and irreparable injury from the posting of DeCSS as if they were infringed directly. And then there's the matter of encryption research, which the DMCA specifically permits. But good faith encryption research, he said, requires that the copyright holders be authorized and that the de-encryption be academically important. Research in this case means advancing the state of knowledge of encryption technology. Some observers have speculated that the industry in fact made CSS a particularly easy encryption algorithm to crack specifically so that the hacker could not claim research as an out.

Not surprisingly, the judge's preliminary ruling was met with disappointment. "The motion picture industry is using its substantial resources to intimidate the technical community into surrendering rights of free expression and fair use of information," said Tara Lemmey, executive director of the Electronic Frontier Foundation (EFF), which has become the most visible organization defending the propigation of DeCSS. "These actions are a wake-up call for the technical community. The process of reverse-engineering and public posting and commenting of code that the MPAA (Motion Picture Association of America) is attempting to suppress is fundamental to the development of commercial and open source software."

EFF co-founder John Gilmore called the decision a major wake-up call for the Linux community. "If Judge Kaplan's reading of the DMCA holds, then it will become illegal to build open source products that can interoperate and/or compete with proprietary ones for displaying copyrighted content. EFF staff attorney Robin Gross said that the ruling if upheld would also impact on fair use, the provision of the Copyright Act that gives people to make personal copies for their own use without the authors' permission.

Tara Lemmey also brought up the issue of free speech, a right protected under the U.S. Constitution. She said that the lawsuits are not really about privacy or hacking, but about "censorship of speech critical to science, education and innovation." The Global Internet Liberty Campaign (GILC), a coalition of some fifty international civil liberties and human rights groups, said that "intellectual property owners should not be allowed to expand their property rights at the expense of free speech, legal reverse-engineering of software programs for interoperability reasons, and discussions of technical and scientific issues of the Internet."

But Kaplan has so far rejected the free speech issue, writing that the U.S. Supreme court "has made it unmistakably clear that the First Amendment does not shield copyright infringement."

Napster: A giant pirate bizaar?

One lawsuit is against Napster, which was invented by Shawn Fanning and provides a single interface for locating and downloading MP3 formatted music. ("Napster" was Fanning's school nickname, inspired by his curly, "nappy" hair). "Imagine....an application that takes the hassle out of searching for MP3s," says the brief description on the Napster website. "No more broken links, no more slow downloads, and no more busy, disorganized FTP sites. With Napster you can locate and download your favorite music in MP3 format from one convenient, easy-to-use interface." The application also provides online chat between users, tracks MP3 libraries for later browsing, and will even play MP3 files, just in case you don't have an external player.

The idea behind Napster is that you don't need a central server to store MP3 files. Rather, a community of users can themselves become a widely distributed MP3 music server. With Napster, you designate one folder on your computer as a network-readable location for MP3 files. When you log on with Napster, you make those MP3 files available online to anyone logged on at the same time. Type in "Sisters of Mercy" and if someone online has them, you can download them.

After you disconnect from Napster, pointers to those files remain in Napster's central database---but the files themselves are shown as unavailable. The Napster chat facility makes sense because the users you contact probably have similar musical tastes, and this user-to-user connection means that communitites of like-minded individuals will quickly form. But there is nothing in Napster or the MP3 format to distinguish between a freely downloadable MP3 file and one that has been pirated from a copyrighted source.

Like Jon Johansen, Fanning is a teenager, aged 19, and like Bill Gates, a college drop-out. He started Napster Inc. last year, leaving Boston's Northeastern University as a freshman where he was majoring in computer science. Napster was the first Windows program he ever wrote. Since then, investors have put money down on his software invention and are unlikely to be dissuaded from a mere lawsuit. Fanning has said that he didn't envision Napster as a catalyst for exchanging pirated music. Instead he simply saw it as an extention of the MP3 format, a way for unknown musicians to get a following that bypasses the traditional distribution method of record stores and radio stations. Napster also argues that it is protected by the Digital Millennium Copyright Act, which shields ISPs from being legally responsible for the content they carry.

The RIAA counters that Napster functions as a "giant online pirate's bazaar" and is seeking up to $100,000 for each copy protected song that allegedly exchanged using Napster software. The organization says that, in practice, Napster "maintains a continuously updated database of links to millions of pirated recordings along with software that allows fast, efficient identification, copying and distribution" of those recordings. "Because Napster creates its links from the personal collections of Napster users, without Napster, these infringements would not be taking place at all."

"It is the single most insidious website I have ever seen. It's like a burglar's tool," said Ron Stone of the recording artist agency of Gold Mountain Management, in a written statement on RIAA's website. Another recording artist manager, Simon Renshaw, said that while he and his clients are "huge fans of the Internet and its possibilities," that tolerance doesn't extend to piracy. "If the Internet thieves are not stopped or better regulated, it not only robs current artists, but might have even more serious repercussions for the next batch of artists."

Writing on Salon.com, columnist Scott Rosenberg argued that the recording industry is overreacting and that the most enthusiastic users of Napster are also the music industry's best customers. He says that "if Napster users are flaunting the copyright law, then the law, and not the music aficionados, are the problem. If these activities are illegal, violations are so widespread that enforcement becomes almost impossible as with....the copyright laws surrounding home audio and video taping, or the copying and emailing of the full text of theoretically copyright-protected Web articles...."

Rosenberg and others suggest that the RIAA is going to have a particularly difficult time successfully suing Napster because the company simply acts as a clearinghouse, not as a policeman. Unlike MP3.com, Napster doesn't actually store the music itself, only the link to it.

The Napster story has gotten more intricate because several universities have blocked the service---not because of piracy, but because of demands on bandwidth. Moreover, David Weekly [see Pacific Connection number 55 interview ] has published Napster's underlying protocols---which he reversed engineered. A more exensive effort is underway through the OpenNap project. Both efforts mean that if Napster is shut down, a comparable service could rise in its place.

My.MP3.com

The recording industry is also going after MP3.com, a site best known for its amassing of music recordings in the MP3 format that musicians and sometimes, record labels, have made available to the world via the web---inevitably for promotional purposes. That business model has kept MP3 from crossing swords with the RIAA. But a new service, called My.MP3.com, put MP3.com squarely in the RIAA's gunsight.

My.MP3.com acts as a kind of storage locker for a listener's personal CD collection. You put a music CD into your player, and connect with the My.MP3.com site. The site validates that the recording is legitimate and adds the cuts on the CD to your own personal record library. The key is that the process does not require you to actually upload the music, only for the site to confirm that you have the CD in your possession. Once the songs are indexed, the site merely gives you permission to play back those songs from a large MP3-compiled library that it stores on its own server. And that library is growing quickly. Last February it included some 80,000 CDs, up from 45,000 the month before. The operation, which MP3.com called DaBOMB FACTORY "rips" the contents of about 1,500 disks each day---translating each song into the MP3 format.

MP3.com says that the service is simply for personal use, enabling you to amass a kind of jukebox of your favorite songs that can then be played back in any order. Naturally, the RIAA doesn't see it that way and indeed there are a few problems with the argument. For one thing, you can borrow a friend's CD and make the songs on it your own. Nor is there anything to stop people from trading passwords so that one person's massive collection can be shared instantaneously among friends.

The RIAA argues that MP3.com doesn't own rights to almost any of the albums it has uploaded and has no right to copy them into its library without getting authority from the people who own the copyright holders. In a statement, the RIAA argued that the service goes well beyond the personal use permitted by the United States Supreme Court---which permits, for example, individuals to tape television shows for viewing at a different time. "According to MP3.com's theory, this entitles MP3.com to copy every television show that has ever been broadcast into a massive digital archive, and create a business allowing consumers access to any show, at any time, on demand, all in the name of 'consumer rights.' While such a business might be appealing from the consumer perspective and this business model might ultimately emerge on the Internet, would it be fair for MP3.com to do this without seeking authorization from the broadcasters and production companies that have invested billions of dollars producing or acquiring the rights to all that programming? We don't think so---and the law would not permit MP3.com to do it."

Unstoppable?

MP3.com appears to have fewer defenders than DeCSS and Napster, perhaps because the business model is more blatent, or perhaps because MP3.com is now looked at as part of the establishment compared with the other two technologies, which were, after all, invented by teenagers.

As for the entertainment industry, it sees trouble ahead and wants to squash it quickly. These lawsuits were filed quickly, broadly, for literally billions of dollars---not because anyone thinks there's billions of dollars to be had, but because the recording and film companies want to send as strong a message as possible. But legal action may not be enough---as the software industry has already learned. Indeed, the current situation that the software industry finds itself in may represent the future for the entertainment industry. Mass piraters are sued, but piracy continues, in the form of bootleged copies and companies that buy one copy of a package then illegally propigate it on many seats. These actions have certainly put a dent in software company profits, but hardly drove anyone out of business. For many people, the moral code is to steal first, and if you like it, buy it: effectively transforming all software into shareware. That's a deal that many software vendors can live with, though few will admit it publically.

The entertainment industry makes a different product, one that doesn't require support, bug patches, or incremental upgrades. If you overlook the newer CD issue, The Beatles' Sargeant Pepper is still version 1.0. But whether most music customers will pirate most of their software remains to be seen. If the entertainment industry wants to appeal to its customers' higher moral grounds, it has plenty of work to do.

"Whatever the moral objections, I don't care," says Trevor Mery, an Northern California IT professional and enthusiastic Napster user. "The record companies have made millions a minute, and now they're finally facing something they can't control. The Internet is a completely, uncontrollable vehicle for the free-flow of information---it can't be stopped. And I love that."