 Because this is not going to be enough to teach you anything. So when I was reviewing the materials coming in today, I saw some of the speakers and lecturers and some of the topics. Man, some of the names were, you know, the Crimson Fugue was speaking on something and the Digital Rubicon and all these great names. And I see my name in his Dario Diaz, you know, speaking on the DMCA, very exciting. So I made a decision that I changed the name of my lecture and my lecture is not going to be, so you got your lame ass indicted by a federal grand jury and now the feds have a bunch of guys in riot gear storming your house to forfeit all your stuff and put you in a federal penitentiary with a cellmate named Bumba who wants to make you his biatch. And from this point on, I want to be known as the law slut, okay? It makes me feel much better if I have a title to be called by. The Digital Millennium Copyright Act was enacted by Congress in, well, over a long period of time, but actually signed in law in 1998. It's comprised of five separate titles. The general idea is to implement some World Intellectual Property Organization treaties, and those are two treaties, the Copyright Treaty and the Performance of the Phonograms Treaty. It's codified at 17 United States Code Section 1201A1203, you know, look it up, you'll see what it is. It was signed in law in 1998 by President Clinton, a technical failure here. The Digital Millennium Copyright Act is spread into five titles. The first title implements those treaties that we talked about just now, the World Intellectual Treaties. The second title is an online copyright limitation liability act. What that does is it lets online service providers have certain content on their website and not be liable for it. The third title is the Computer Maintenance Competition Assurance Act, and what that allows certain companies or corporations to do is start a computer, and if it's password protected with software or some type of operating system or somehow it doesn't allow you to get into it to fix it, it allows you to bypass that protection to fix it. The fourth title just involves miscellaneous provisions, and the fifth title is a standard United States Congress law-growing adding its Vessel Hope Design Protection Act. You can see the serious thought that went into this copyright act that they have to protect boat hulls as a result of passing, you know, protecting DVDs and CD-ROMs and so forth. The first section I'm going to cover is 17 United States Code 1201A1, and it reads, no person shall circumvent a technological measure that effectively controls access to a work protected, and I put my copyright law because there's a whole bunch of stuff after that that I really don't want to get into. The first thing I want to tell you about this general little rule up there is that it seems to require that in order to receive protection of the Digital Millennium Copyright Act, you must implement some type of effective control to keep people from circumventing it or copying it. What does that mean? Well, I got some case law and we'll talk about it later on, but something you're going to hear from me today if you ask questions at the end of the conference is, I don't know. And with somebody with an ego like mine to say, I don't know, it's really hard and hurts, but I don't know and there's not much law on it right now. So the first thing is you have to have effective control. The second thing is it divides technological measures into two parts. It prevents unauthorized access to the work, which means, you know, bypassing some type of encryption or key up front or some type of lock to get into the work, and the second thing it prevents is copying the work once you get to it. So it sounds like, in essence, you have two separate things. You have works that have some type of system to bypass to get to and works that don't. Well, you know you can't copy the ones that don't because copyright law protects it. In this statute, Congress did not anticipate something like the DVD that has access and copyright protection. And if you read the little, read on your own and you'll get an idea for the difficulty everyone's going to have interpreting this law. That's the copyright office summary of this law. As to the act of circumvention itself, the provision prohibits circumventing unauthorized access but not unauthorized copying. Since copying of work may be fair use, section 1201 does not prohibit the act of circumventing a technological measure that prevents copying. By contrast, since the fair use doctrine is not a defense to the act gaining authorized access to work, the act of circumventing a technological measure in order to gain access is prohibited. Now, I put together a large binder presenting this presentation at DEF CON. I've read that statement no less than 80 times. My field is trial work and I practice law. I cannot make sense of that. If you can make sense of it, please come up to me after the lecture and let me know. That wouldn't look like an idiot the next time I talk about this. It absolutely flies right in the face of what every software manufacturer is going to do in this world. And that's put a simple access code in front of their copyrighted work and prevent everyone from circumventing it so they can get access to the copyright work regardless of what your intention is to do with the copyrighted work. The next section I'm going to talk about, and these are the only two I'm really going to deal with today, is 1201A2. No person shall manufacture import off to the public provider otherwise traffic in any technology, product service device component or part thereof, that. And then it gives you a list of items, sort of like a checklist. It's primarily designed to circumvent a technological measure, has only limited commercially significant purpose other than to circumvent a technological measure or, and I put or in red and underlined it because or and in the law have special meanings. It's inclusive or exclusive and what you'll see as or means any one of these things, any one of these three things violates the DMCA. You don't need all three, you need only one of these three things. And the third thing is, is marketed for use in circumventing a technological measure. And at the bottom there, I've got the definition of what they mean to circumvent a technological measure. Descramble, decrypting, avoiding bypassing almost anything, impair any technological measure without the authority of the copyright owner. So basically any one of those three things, bypassing only limited commercial significance, any one of the three is the violation of the DMCA. We'll see you later on in some case law what happens. Throughout the lecture I'd like to have a few questions I'm going to pose to you and I definitely want to have some discussions back and forth. If you can hold that to the end, man, I really appreciate it. First question is, does the statutes that we just saw prevent providing any information or instructions on how to circumvent a technological measure? Yesterday I was sitting in a lecture and I saw in front of me a guy wearing a shirt and it had the code to CSSDscramble.C. He's wearing that on the back of his shirt. It's C code. Somebody probably has it in here right now. Does that violate the DMCA? There's a First Amendment case that we read about in Constitutional Law and Law School where a guy wore a shirt to the draft board and the back of his shirt, he didn't say a word but the back of his shirt said, and trying to have a modicum of dignity in here, his shirt said, fuck the draft. Well, he got a lot of trouble for that and it started a whole area of law about expressive conduct versus not expressive. In other words, is what that guy yesterday with a CSSDscramble.C shirt on, is he in violation of the statute? Is providing instruction, violation, is that a technological measure? Are you circumventing something merely by giving somebody a set of instructions or printing it on the back of your shirt or sending them an email? And there's the example I'm using. Harry Hack writes a program and he just publishes a code. He writes it in C, doesn't give anybody the compiler, doesn't give the executable. Publishes that code on his website. Somebody copies it, compiles it, and uses it. Is Harry Hack in trouble? Well, we'll see you later on. He may not be because of some corrections that were made in the law over a period of time. But you begin to see the problem with the Fritzman of First Amendment in certain areas of the law when the DMCA comes into effect. I don't know the answer to this question. I really don't know. Is that against the rules? Is instruction enough? Over time, I guess we'll find out. This law is only three years old. The DMCA also sets out various exemptions, things you can do that will not get you in trouble and will not run afoul of the DMCA. The first thing is the law enforcement exemption. What that does is any lawfully authorized investigative protective information security intelligence activity is exempt from the entire DMCA. Does that mean that a county sheriff, investigating something, whatever that may be, is he an investigative authority? It doesn't really say. It's the federal law. Does it apply to county sheriffs or Tampa Police Department or from Tampa? So who does that really apply to? The second thing is the nonprofit library. It's a very narrow exception. What it allows the nonprofit library to do is make copies of circumvent technology for fair use to provide little clips of access to various other people. And I talk about does not exclude you from A2 or B1. B1 is very similar to A2. You get the statute, look at it. I don't have the time to go into all of them here, but it doesn't give an exemption to the library for circumventing the technological measure under the provisions of A2, which I showed a little bit earlier. The third thing is reverse engineering. This is where everybody in this room would think they would fall under. Everybody is very happy that they added the reverse engineering. We're going to make it OK to circumvent technology or make copies for you to make your program interoperable with other programs. In other words, we want to be able to make a DVD disc for Linux. We'll see you later on as it played an important role. So let's circumvent the technology to make it interoperable with other technologies. So we thought that that was a good thing, the reverse engineering. The next exemption is encryption research. It's not a violation to circumvent a technological measure for good faith. In good faith, I got it read and underlined again, because that's an interesting concept, because what's good faith to me may not be good faith to you. It may not be good faith to you. So they try the best they can to codify what that means. The encryption researcher has to lawfully obtain a copy of the copyrighted work. He's got to act. The act has to be necessary to conduct the research that he's trying to do. This is the killer. The guy performing the encryption research has to make a good faith effort to obtain permission from the copyright owner to do this work. There's something happening very recently. I'll talk about it at the end where you'll see that that's a real problem. So keep that in the back of your mind, making a good faith effort to obtain permission to circumvent the encryption. And this is something neat that I don't understand as well. Item number four, such act of the encryption researcher does not constitute infringement. I have no idea what that means. How can you be circumventing technological measures and technological access without infringing on the copyright owners? Copyright, they give you the exemption and then they just take it away from you at the very end by saying you can't infringe on this, though. Don't do that. Here are the good faith factors. Was the information disseminated? In other words, did I give it to a whole bunch of people on the website, just publish it for the world to see? Was the person in a legitimate course, I put court, bad habit, course of study, trained, experienced in encryption research, think about a court making the decision for anybody in this room as to whether it's good faith as to what you've done or not. There are people in this room that know more about what this is trying to protect than any college professor. So how can a court make a decision that this gentleman, for example, is not a legitimate course of study when he's trying to learn something, or he's not experienced in encryption research when he may know more about it than a college professor? The researcher has to provide the findings to the copyright owner as a result of his work, and he's not exempt under B1. Again, B1 is very simpler to A2, 1201, B1. There's no exemption for that. So even though you do all the good faith stuff, all these things that they want you to do, you contact the guy, you want to get the information, you do all those things, you're still not exempt on another provision of the DMCA under B1. So it's given and then taken away by another method. The fifth exemption is protection of minors. You can circumvent if somehow you're protecting minors. You know, different cookies, somebody's opened a web browser before and it opens up 40 windows. Some of those windows don't have particularly tasteful things contained in them. You can somehow circumvent a program that may be doing that if you have a minor using the computer. It's a very narrow exception. And once again, it adds at the very end of it the technology product or service must not violate the provisions of this title. That's very nice to give you these things and then at the very end, they say don't violate the provisions of the title. Personal privacy. If the software is giving out your personal information for whatever reason it is, the software is sending personal data, whatever record you have and you don't know about and you can't get to it, you can circumvent it to turn off that switch that'll send your personal information. And the last one is security testing. It permits the circumvention of access control measures for the purpose of testing the security computer network. You need the authorization of the person you're getting into. So in other words, it would be a consultant going into a company website or a company network and getting together with the owner and saying I'm gonna prove your security by hacking your network. And that gives you protection. And once again, you have an exemption on that. Was the info used solely to provide security? Well, what does solely mean? Does it mean that once I'm done with that, I cannot take what I learned to a similar corporate website with the exact same information and use that that I got from this guy with this guy? Does it mean that once I'm done here I have to wipe my memory solely for that information? And whether the info derived from the testing was used so as to not facilitate infringement. Once you learn it, did you give it to somebody else that they could do it to somebody? That they could do it to a corporate network? Was it your purpose in doing this work, whatever you're doing with somebody's network to not facilitate infringement, to bypass other networks? And that's the factor. Here are the remedies. Let's say someone in this room violates one of the provisions. What does the other party, the copyright owner, what right does that individual have against you? I mean, slap on the wrist, poke in the eye, whatever he wants to do, what do they do? Well, section 1203 sets out the civil remedies. Civil remedies generally involve money and injunctions, things like that, doesn't put you in jail. It allows temporary and permanent injunctions and this next line is very interesting. But a no event imposed a prior restraint on free speech or the press protected by the First Amendment. So you can get an injunction, you can get a permanent injunction, but that injunction is not supposed to violate free speech. Think about that when you're posting something or you're publishing a newsletter or the guys on 2600 are posting some code. Is that free speech? Is that something that you're conveying a message, you're expressing something to somebody else? It's not supposed to limit that, it's not supposed to fringe on that and as we'll see it, there's a little problem with it later on. The court can order the impounding of any device or product involved in the violation. So they basically come in and take all your computer stuff. They come in and take all your hardware, all your software, they can take everything from you that you're using to violate the DMCA. They can award money damages, actual damages loss of profits as the company can prove actual damages that you lost profits or they can actually put a number on it. The court can give the copyright owner that number. You know, John Smith prevented me from selling 4,000 rights of my copyright and I sell them at $10 each. So I'm entitled to $400,000. There are statutory damages. You have to make an election during the litigation. The copyright owner has to make an election. The damages are not less than 200 or not more than 2,500. The copyright owner can recover the cost to defending the action. The prevailing party gets attorney's fees and costs. The court can order the modification of the equipment or the destruction of the equipment. If the court is convinced that your computer that you use to violate the DMCA somehow needs to be destroyed, the court can take your stuff and destroy it. And finally, if you do it more than one time, the court can award trouble damages, which is three times the damages. So if they prove 2,000, they get 6,200,000, they get 600,000 and so on. Here's the interesting part of the DMCA. Let me go over, this screen doesn't fit. These are criminal penalties of the DMCA, which, I mean, you can imagine where the problem's already in construing the statute if you were to follow these. You have to violate the provisions of the DMCA willfully and, once again, I put it in red, for purposes of commercial advantage or private financial gain. So if you violate it willfully, which I think everybody has to be conscious when they're sitting at a computer keyboard and tapping out code, so every act that does it is willful, so I think everyone's gonna fall into the first one. And for purposes of commercial financial advantage or private financial gain, does that mean you're helping a friend? Does it mean that you're helping another company and they gain from your act, even though you didn't know about it? I don't know. The first offense, once you get caught in the Fed Stormier room and wanna put you above, the first offense is up to $500,000 fine in five years in prison, or both, or both. It's not one or the other. The court can give you both of them. Every subsequent offense after that is a fine up to $1 million, 10 years in prison, or both. So, once again, do it again, you get caught, you're in bad shape. And the statute puts a five-year statute of limitations, which means that from the time of the act, the government has five years to indict you, take you before the grand jury, and say you're now going to face criminal prosecution for your act. So, if any of you have done anything five years ago, you're good. For those of you that haven't done things five years ago, and I saw a lot of phases out there, you're not so good. Let me talk for a minute about some of the case law. I spent, this case is probably the longest case that I broke down for you. It's Universal City Studios' Remordies, I think is where you pronounce it. This is a famous DCSS case. CSS has a technology, or DVDs have a technology on it, content scrambled system. And what it does is it is a code on a DVD, and everybody probably knows this, and you're gonna make fun of me. And I was a tech guy for seven years, so I know all the codes, but I'm gonna speak to newbies. It's got a code on it that needs a DVD player to encrypt that code so you can play it on the screen. You can't copy it, you can't duplicate it in a machine, you can't really do anything with it, other than play it in a DVD player. So it has protections for access to the information, and then it has protections to prevent you from copying the information. So it has two purposes, and remember earlier, I talked about Congress not anticipating that. They didn't expect that. They did both things. The young 15-year-old kid in Norway wrote a piece of code with a couple other guys he met on IRC that basically took the information on the DVD, stripped it, and allowed people to copy DVDs to make perfect digital copies. And then there was a technology that came along called DivX that allowed you to compress it and put it on a CD, and this really bothered the movie studios, because all their information now could be made perfect digital copies, and anybody could transport it. Just over the internet, send it over modem, however you wanted to do it. Well, 2600, this little website and magazine, some of you may have heard of it, maybe. These guys posted the CSS, or the DCSS code on their website, and it cheesed off the studios. You know, these people now can make these perfect digital copies of it. So they sued under the Digital Millennium Copyright Act 2600. A few other people, too, but 2600 were the bad guys. They sued them and told them, take all your stuff off the site. Take all the DCSS off the site. I am gonna get to that. They posted it, they posted it on the site at first. The preliminary injunction came out. DCS, the guys of 2600 said, hey, there's a chance we're gonna lose this. So as an act of civil disobedience, and we all know that the 2600 guys are, they don't like that. They don't like the civil disobedience stuff. These guys posted 50 mirrors. They went to a whole bunch of sites that allowed you to get DCSS, but didn't actually have it on their site. So it became a big issue later on as to whether that is a violation. Can you post to other sites? Can you provide information that tells people go get it from wwwx.com? Or where can you get it from? It posted a big thing. Well, the court wrote a long opinion, and they came up with these, read the opinion. Find it somewhere and read the opinion. You won't understand 90% of the First Amendment stuff, but it's very interesting to see the court's sidestep, certain rights and certain things that we take and we think are right in the court's sidesteps. What I've done here is I've used some of the exemptions and just a few of them that the guys from 2600 argued. The first thing they argued was reverse engineering. Remember the exemption for reverse engineering I had up earlier? The argument was this is necessary for us to make Linux DVD player. There's not one out there. I mean, we're gonna make interoperable. We gotta make this work with Linux. You know, there's a lot of people that have Linux. No one here, but there's an operating system called Linux and we need to make our DVDs work with Linux and nobody has that yet. So we need access to them to make them interoperable. Well, the court heard the argument and this is what they held. The argument fails because the source can only be made available in others, to others by the person who acquired the information. It means that only I, if I write that code, can give it to you. I cannot give it to you and then you give it to that third party. So that's the way they sidestep that, that the statue reads that only the person writing it. The right to make the information available extends only to the dissemination solely for the purpose. Remember the solely language I used? So basically you have to follow the encryption research, give all the information to the copyright owner and you know, it's gotta be solely for the purpose. It can't be for anything else. So in other words, we want this for a Linux DVD player but we can't bypass the code and we can't copy it to make a DVD player. It's gotta be solely for the purpose of a DVD player and this code lets other people who don't have Linux DVD players rip DVDs and have perfect copies of movies. So it fails reverse engineering for that purpose because somebody else other than Linux users can have it. Not for public dissemination. A, you're not supposed to give it to anybody else. And finally, the most interesting argument I think that the court wrote in their opinion is that DCSS was written on a Windows platform and therefore the writers should have known that Windows users were gonna use this software. Now, I don't know of any platform that is that is owned or operated by one person. In other words, nobody has a laptop that has the Dario operating system on it and I gotta write it for that so I can do it. These people wrote it in Windows and the court said, well because you wrote it in Windows other people could use it and therefore it's not solely for the purpose. The logic, figure it out. The second argument the guy has from 2600 made is that there's a fair use. Copyright law is, it's an entire chapter in United States code. You basically have the right to make copies of things for fair use. In other words, I can copy something for this presentation in a small portion to present it to you. A college professor can copy two comparative works to show you a director from Citizen Kane and how he did something as compared to a director from Hackers, that movie Hackers. How did they do that? There's a fair use object. The court acknowledges and in their opinion they write, oh, this is gonna really be a problem for fair use. We now, Houston, we have a problem on this one. The way they get around it is they say Congress created the exemptions that they thought was fair and they put fair in quotations. Nevermind the fair use doctrine. Nevermind the exemptions that I went through earlier are what Congress thought fair when they wrote the statute. The fact that Congress elected the leave technologically unsophisticated persons who wish to make fair use of encrypted copyrighted works without the technical means of doing so is a matter for Congress. That's a quote from the opinion. Then finally, 2600 argued the First Amendment. Now, the First Amendment for the court in this case is a big, hairy, smelly 800-pound gorilla. If you read the opinion, you'll burn it and throw it away because you won't understand it, number one, and it compares content versus expressive versus all kinds of stuff, and it's a real mess for them. The court, the first thing the court did in this opinion is acknowledge that code is protected free speech. Code is written, it's free speech. We understand that it can be free speech. We understand that a code is entitled for First Amendment protection. Page down here real quick so you can read this all at one time and do it together. Just as a computer code cannot be excluded from the area of First Amendment concern because it is abstract in many cases, arcane. I had to look arcane up in the dictionary because my vocabulary is not that big, but arcane means understood by only a few, okay? So it's abstract, first of all, I'm sure everybody in this room thinks that computer code is abstract, and I'm sure that everybody in this room thinks that computer code is arcane, but that's the way the court views it. It's abstract in arcane. That long history of First Amendment jurisprudence makes equally clear that the fact words, symbols, and even actions can be ideas. Remember the fuck, the draft shirt or things like that. And evoke emotions does not inevitably place them beyond the power of government. What the court basically did there, there's a famous case about written in First Amendment law. And you're protected by First Amendment speech, but in a room like this, I'm not protected if I yell fire, fire, and everybody storms through the door and people get trampled, that's a not protected free speech, because there's not a fire, I'm not trying to save anybody, I'm just creating a problem. That's what the court's done with that statement. That court said in this opinion that the CSS code, or the DCSS code rather, is equivalent of yelling fire in a crowded room like this and it's not protected. That's the way that they put it into context that lawyers may understand instead of programmers. A computer program does more than convey a message. It does more than express the programmers' concepts. DCSS has a distinctly functional non-speech aspect in addition to reflecting the thoughts of the programmers. The DMCA, as applied to the posting of computer code, is valid exercise of Congress's authority. Relief granted. Relief granted basically means they gave them an injunction, they could have gotten money damages, they could have gotten other damages allowed by the DMCA, they could have taken their equipment, they could have burned it, they could have done all the things that we talked about. But that last line about code not being expressive, its instructions as a function is very troubling and if you get a moment, and more than a moment, but if you read the opinion, you'll see the trouble the court has in dealing with that issue, that First Amendment issue, as to whether code is protected first, get in two cassette decks and make a copy of it. And it creates a real problem for real networks and the argument as well. But effective control doesn't necessarily mean I can't get to it. Effective control just means there's some protection afforded to it. That's the way the courts have interpreted that. And there's actually a definition of effective control in the statute itself, but like everything else is subject to interpretation. The argument, this is what Streambox was arguing. This is what Streambox was telling the judge, look, the protection is not effective because the user could videotape the screen with a digital video camera and could listen to what's coming through the speakers and then they could circulate perfect digital copies of that off the screen. The court found the argument was not valid because the result would not be a perfect digital copy. That's true, but a camcorder that makes digital copies would be perfect digital copies of that result, which would basically get you exactly what you needed anyway. The court held that even if it were so, even if that were true, that you could copy it from your camcorder, it doesn't make a difference because the VCR circumvents access to let you see it in the first place. Remember the big or I put on that thing, one, two or three? Just because the VCR circumvented the access to that stream, that's enough under the DMCA. We don't even worry about whether you could copy it or not. What we're worried about is did you circumvent the access? Yes, you violated the provisions of the DMCA and that was enough. So we're not even gonna get to you copying it off the screen or copying it with your pocket recorder, whatever it is. And I got a little note here because one of the things that real networks tried to argue is that their data, their file, their stream was in a proprietary format and no one else had access to it. Therefore, you don't need access, but just the fact that it's proprietary means it's protected, nobody else can get it. That is a horrifying argument. If you think about it for just a minute, the fact that this law has resulted in a copyright owner saying, all I'm gonna do is put it in a proprietary format, I'm not gonna protect it. That in itself makes it protected is the repercussions of that in not only in law, but in the computer areas is very, very scary. The third case I wanna talk about real quick is microsystem software versus Scandinavia online. This case involved a little program called Cyber Patrol. What it is, a web blocking program. You added to your computer and there's certain websites you can't go to if that program is installed. What the folks at microsystems did is they encrypted the web access, what sites were being blocked. In other words, if I were a small company called Microsoft and I made one of these, and in that code I encrypted the fact that I didn't want people to go to Linux or I didn't want people to go to anything with 2,600 in it or I didn't want people to visit any site, how would I know? It's encrypted, I don't have access to it. How would I know that that software is now blocking my access to certain 2,600 sites or certain Linux sites or certain competitor sites? Well, that was the issue of that case. The court doesn't even address it. It doesn't even talk about whether you can decrypt something like that. The court, very interestingly, wants to avoid any discussion of the violation by saying, sorry guys, you didn't have standing. Standing is a thing in the law that I cannot sue for her. I can't go and say I wanna sue on behalf of her. She has to sue on her own. Well, what happened is Scandinavian Online basically left their cause of action and some people that wanted the decrypted information they were providing followed up on the appeal. They said, wait a minute, wait, we want the right to be able to do that and they were doing a good thing for us so that we could see who was being blocked and not. The court said, hey, y'all are good guys, that's a great argument. We're not gonna wrestle that animal. You don't have standing, thanks, bye. That's the way they got rid of it. They got rid of it on legal grounds, not on grounds of the DMCA. One of the reasons I brought these three cases out is they're pretty much the leading cases in the area. But more importantly, so you get an idea of how courts are having a problem wrestling with this issue of what constitutes access, what constitutes fair use. They will sidestep any way they can to avoid it. They'll avoid it with standing. They'll avoid it with saying the First Amendment, well, we got a problem with it, but fair use is what Congress says it is. Now what we say it is, they're constantly sidesteping because the language of the DMCA is a little bit tough to deal with. Yes, what's that? The reason I use this case is because this case addresses many of that, the launch.com case, but it's very similar to this case. But the actual written opinion on that one is not near as nice to read as the real network's case. This one's a little bit better to read. Yes, yes, no, actually no it doesn't. The real network's case deals, what was that? Oh, I thought somebody said something. The, oh yeah, I'm sorry. Does the real network case talk about the Sony versus Universal case? It does. You're talking about the VCR and time shifting, right. They talk about that and it got a little bit deep. I'm already at 40 minutes, I knew this was gonna happen. But basically what they argued was you could time shift it. In other words, I could record, you know, a phrasier at eight o'clock and watch it at 11 o'clock. That case with VCR said it's okay to time shift real networks, they address it, but it doesn't play a part in it because why would you need a time shift on a computer if you always have it there? It's not the equivalent of losing the show once it already passed. So they talk about it, but that dealt with VCRs and they didn't really do a whole lot with it. Now, there was a thing called the SDMI Challenge. The SDMI Challenge is a new technology with a variance watermark to prevent people from copying CD-ROMs, copying music. It was a challenge that these, this SDMI put out and they basically threw down a gauntlet to a bunch of people and said, break our technology. This is great technology, this variance watermark is so good, you know, it's the best thing coming along. Well, they put it out there, they let people download content with the watermark in it, they let people have access to it and they let people get into it to try to break the watermark. Well, not surprising, somebody did it. Many people did it. One of the people that did it was a gentleman named Edward Felton. Edward Felton is a college professor in computer science at Princeton University. You know, he's sort of a reputable guy, I guess, you know, he's got a little bit of credentials behind him. He refused, he wrote an article, a paper on it, he submitted the paper to peer review and he was gonna present the paper at the Information Hiding Workshop in DC this year. He got a very interesting letter from the folks at RIA, the recording industry and SDMI. He got a very interesting letter when he submitted his paper publishing and I got a copy of it and I just highlighted some areas and I want you to take a look at how far we've come in three years where a challenge is thrown down, the challenge is answered and then you get an interesting letter like this. This is the whole letter, I just, I highlighted some stuff in red and I brought up my screen at the bottom and all kinds of stuff is falling apart on me. This is the letter he got and some of this you can't see, so I'll read it. He got a letter from the vice president, who's a lawyer, of the Recording Institute and the letter said, as you are aware, at least one of the technologies that was subject to the public challenge, notice the public challenge. I mean, they basically threw down a gauntlet and this guy met the challenge. The variance watermark is already in commercial use and the disclosure of any information that might assist others to remove this watermark would seriously jeopardize the technology and the content it presents. In addition, any disclosure of information gained from participating in the public challenge would be outside the scope of the activities permitted by the agreement and could subject you to research team to actions under the DMCA. Unfortunately, the disclosure that you are contemplating could result in significant broader consequences and could directly lead to the ego distribution of copyrighted material. Such disclosure is not authorized by the agreement, would constitute a violation of the agreement and would subject your research team to the enforcement actions under the DMCA and possibly other federal laws. Business has already made the decision that they can use the Digital Millennium Copyright Act to stop the publication of a paper presented by a Princeton college professor. He pulled the paper on his own. He pulled the paper. Talk about the freezing and chilling of free speech. Is it a prior restraint? Yes. Did Congress address a prior restraint on free speech in the DMCA? Yes. Did they care? Was it enough to scare Felton? He pulled his paper. Here is a college professor that was chilled by words in the statute, now used by the people who enacted the statute to stop him from providing all of us with a technical paper that may lead us to better security, that may lead us to something that is not anticipated right now, he pulled it. They have filed an action. They filed a, Dr. Felton filed a declaratory action to say, can I publish it or not? But who knows if that's gonna be out eight years from now or eight months from now, rather a year from now, there's no way to tell. Yes. Remember the world, the WIPO treaties? You take it whether you like it or not. Look, those questions, all right, those are too hard, all right? There's too much there on that one, okay? Yes. The question is, is it an alternate action that he wanted to establish a test case? Yeah. But do you think he dedicated a research team at Princeton just to make law? Do you think Dr. Felton gives a rosy rat's ass about me and the law or he was doing a project? Somebody threw down a challenge in front of a man who said, I'll meet your challenge and as a result of meeting it, I'm gonna let all my peers. I subjected this paper to peer review and everybody said, damn, man, you're a pretty bright guy, but you can't release that information. So do I think he did it for the purpose of doing this? No, not by any stretch of the imagination. Do I think that he's in his own party caught up in a cyclone of law that he may not understand? That's exactly what I think happened. Yes. Right, actually he entered what's called a click through agreement. In order to get the test software, you had to go to the website, identify yourself, read an agreement, click through it, and then the software came over to your computer. So he read a click through agreement. That may be an issue that the court may use to circumvent the DMCA again. You know, they may go on principles of contract law, basically, but it's gonna be very interesting to find out. There was an agreement, he did click through to get the software, which gives the court another issue to hang on to in order to maybe get away from the DMCA. Yes. The question goes to, can I talk a little bit about patent law versus copyright law versus a company putting something out there in just a proprietary format? And the answer to that question is no, I can't, because I really don't know anything about patent law. So I do trial work, I don't do much patent law stuff. Let me get to the questions real quick and then I'll answer the questions afterwards. Here's some examples that I just, I thought up in my reading and preparation. You know, here's Nimboy. This guy buys a piece of software that's protected by what everyone here probably knows is a dongle. You buy a piece of software, you can open up certain aspects of the software and it malfunctions. And Nimboy cannot get to the portion of the software that he purchased because it's obsolete or malfunctions or the date stamp ran or for whatever reason. He tries to contact the company, he tries to find out, he thinks they went out of business. Can Nimboy circumvent the access to get to the portion of the program that he paid for? I see yes faces, I see no shaking back there, I see all kinds of stuff. Yes, who was it that said that back there? The Library of Congress, okay, you're a frightening guy because you know too much. There was a provision in the DMCA that allowed the Librarian of Congress to make exceptions as time went on because Congress anticipated the fact that we're gonna have problems like this. Out of all the things you could possibly come up with, the Librarian of Congress came up with two where you can access or circumvent. This is one of them. If you have a piece of software that you paid for and you paid for the copyright to use an access and it malfunctions because something goes wrong, you can circumvent the access in order to get to the portions that you wanted or you paid the right to copyright for. Now, in order to the guy that knows too much back there, let's say that the entire CD-ROM that you buy with 10 software suites on it has to be circumvented in order to get the piece that you bought. Do you violate the DMCA there? I don't know. I really don't know because most of the time software dongles has five or six volumes, five or six different programs on it. Well, I don't know. I don't know what the answer to that is, but if it's only one, you do have the right to circumvent it. The question is, there's a question here as to whether you could sell that solution or share that solution. Exactly. Here's my best piece of, I represent certain people that don't do very nice things in our society, that do distasteful things in our society. And the best piece of advice I can give anybody, if you're facing any problem or you're doing something, is the smell test. If it doesn't smell right, probably you're right. All right? If you get an idea that what you're doing may not quite pass that smell test, don't do it. Now, that being said, that being said. All right, here's the problem that I'm really concerned about. And maybe there's some ingenious person here that'll take this sick mind of mine and implement this. But a software company, a software company makes a piece of software. And it's a database for business. And they market it and people buy it and they love it and they're using it and they're putting all their data in there, a contact manager, whatever it may be. Then that company, without knowing the user, puts a little piece of code in there that changes the access method a couple years down the road. They rewrite the access method. Two years down the road, somebody says I want access to my data, they turn their computer on, it gives them a message saying access denied. They call the company, the company says, oh yeah, you need version 2.0. Because now you don't have access to your data. Can that user circumvent the protection to that data file to get their own data? I hear yeses, why? Where's the yes, who's the yes? Put your hand up, yes. Okay, guy in the blue back there, why? Isn't the format proprietary like real networks? That data is in the format of the database structure that they use to write the program. Is that enough? The data itself is yours in many things. Isn't basically the data contained on a DVD ROM yours? Why? Because it belongs to the copyright owner? See, you'll have 10 answers and 10 responses for each answer. Right, but remember from before, access is enough. Remember where the court said, even if you copied it with a digital camcorder, the act of accessing violates. Have you violated if you do that? If you do this to the company's software to get your own data, have you violated? Because you've access to, you've circumvented a technological measure giving you access. And the thing is, what's that? I don't know, I mean there's a lot of answers out here. People have a lot of ideas, but there's no opinion on it yet. There's no opinion. Is the company required up front to tell you they're gonna be changing it? Okay, why? For as long as it's 30 days, bring that. See, y'all are gonna have a lot of stuff to talk about out here. See, it wasn't so boring after all, was it? Let me finish up with something real quick and then I wanna take questions. And I knew I'd run long and I apologize to the next speaker, but fuck him. Actually, the next speaker is a guy named Steven Thew and I recommend everybody to stay here. He is sort of a hero of mine. He's a safe web guy. The guy is A-OK, you know, stick around for it. He's very good. I represented a, when I was putting together my presentation, I was looking for stuff to add to try to make this non-boring, to try to give you something. And I ran across a cartoon. I represented a kid, received some national exposure who was, and it's a tragic case and I don't mean to make fun of it, but in my business, you gotta kinda laugh at some of the things that happened. The kid was throwing rocks off an overpass and the rock fell through a windshield and killed a teacher from Alabama. It was really bad. There were teenagers. It was a bad case. But I was looking through, trying to put something and I saw a cartoon that to me, I can laugh at it even though it was very tragic and you might be able to laugh at it. Maybe not and maybe everybody think I'm a sick SOB, but this is sort of hackers throwing rocks off the information highway. And what they do to the information highway. I sort of see it a little bit different. I read a little line preparing and it says that computer hackers are to free speech today what pornographers were to free speech 20 years ago. And we see it in the opinions of the court. We see that these people who the court is having dealing with on the First Amendment are the same people they had dealing with the Hustler Magazine case. And the same people that just do certain things to learn, to share information, to have fun. And when you have a law like the DMCA, read it, understand it because the kind of thing that can really get you in trouble. And with that, I'm going to end and I'll take questions and I think I should probably end and maybe take questions outside because I don't want to piss off the next guy. So thank you.