| DMCA Censorship |
| Home | About | Publications | Practical Cryptography |
Related information:
Frequently asked questions about DMCA and my HDCP paper
Why don't you publish your paper anonymously?
There are several reasons. First of all, that is not necessarily a safe option. In a lawsuit, my opponents would only have to convince a jury of twelve average Americans that the likelihood of the evidence shows that the published paper came from me.
More importantly: At this point in time I no longer care about HDCP. It is broken. Everybody knows it is broken. Somebody will soon duplicate my results and publish them anyway.
Most importantly: it misses the point. This is not about HDCP, it is about the DMCA and my right to speak and be heard. At this moment I have to think about every word I write down or speak on the phone. That is no fun. As I write this I'm packing to fly to the US tomorrow. I don't know what awaits me when I get there. That is no fun either. I want to be able to exercise my free speech rights without fear.
Did you really break HDCP?
If I say that I have broken HDCP then I honestly believe that I have done so. I am not just some crackpot. I have more than ten years experience in cryptography, and I have published many scientific articles.
Of course, there is always a possibility that I made a mistake in my work, but at the moment I cannot send it to other cryptographers to have them check my results. If it turns out that I made a mistake, then I'll be slightly embarrassed, but not a whole lot. We all make mistakes, especially in a field as difficult as cryptography. But all of this is beside the point. I have a right to publish my article, even if it is wrong.
How does Intel fit in to all of this?
Intel developed the HDCP system and published it on the web. They have been very polite and I have no complaints about them. They told a reporter that they do not object to me publishing my paper, although they have not informed me directly of this position. The problem is that the lawsuit threat comes from other parties too. Any company that feels harmed by my publication could sue me. As we all know, the RIAA is more than happy to threaten with lawsuits over academic publications. And then there is the DoJ, that could prosecute me. There is nothing Intel can do to stop any of them.
Doesn't the DMCA have exemptions for research and such?
Yes, the DMCA has an exemption for encryption research and one for security testing. Neither of them apply to my work. The formulation of the exemptions is far narrower then the formulation of the sections they exempt.
The encryption research exemption allows me to decrypt an HDCP-protected work under certain restricted circumstances, but only if I acquired the copy I am decrypting legally. My paper doesn't decrypt HDCP-protected works, and I don't have a HDCP-protected work here. Therefore my paper is not covered by this exemption. Check out DMCA section 1201.g and 1201.g.2.A in particular. A similar argument applies to the security testing exemption in 1201.j.
Isn't breaking HDCP against Dutch or European law?
No, it is not. I didn't break into any computer. I just wrote a paper that demonstrates some weaknesses of HDCP.
I work to make systems more secure. The only way to learn how to secure systems is to try to attack them. Therefore, part of my job is to attack cryptographic security systems. Doing so is not against Dutch law, and in general it isn't against US law either. The DMCA outlaws it if and only if the security system is used to protect the profits of certain large corporations. Amazingly enough, corporate profits get better protection than nuclear weapons information under current US law.
If you travel to the US you must accept US laws
And I do, for the time that I spend in the US. The DMCA is telling me what I cannot do at home in Amsterdam. I do not accept that US laws apply to me here at home in Amsterdam. I seem to remember that one of the reasons for the US revolution was the laws and taxes that were being imposed from the other side of the ocean without any representation. I'm not allowed to vote in US elections. Why should US laws apply to me here at home?
I have travelled to more than 18 foreign countries so far, and I expect to keep travelling to those and many more. Each country has its own laws, and while you are there you have to respect those laws. The extraterritorial effect of the DMCA introduces an entirely new situation. Now you have to obey all the laws of all the countries you travel to simultaneously.
Suppose you decide to take a cruise after your retirement. The ship calls at many ports in different countries. Do you really want every country you visit to have the right to arrest you for something you did back at home? Are you a member of a political party? Have you ever criticised another country? Do you have a home page on the web? Are you absolutely sure that all those things are legal in every country you are going to visit? Can you even read their laws?
Extraterritorial application of national laws create an environment in which you effectively have to give up the right to travel, as you cannot possibly keep track of what laws would otherwise apply to you. This is unacceptable, and we have to fight it.
Are you anti-American, or what?
Not at all. I like America, I like Americans, I even imported my wonderful girlfriend from the US because I couldn't find anybody even remotely as lovely as her over here. I really enjoy travelling to the US. I have many friends in the US. It is a great country, and it has done much good for the world. But that doesn't mean that everything they do there is good.
I'm fighting for a fundamental human right here. The DMCA limits free speech. It does that for Americans as well as for those abroad. I have always thought it very American to fight for your rights, especially those in the Bill of Rights.
| Home | About | Publications | Practical Cryptography |
Copyright © 2001-2003 by MacFergus BV, last update 2003-04-04.