Seven lines of code can crack DVD encryption

From...

By Sam Costello

(IDG) -- The fight over DVD descrambling and the legal issues involved will seemingly not go away, as the battle gained a new combatant last week when a tool to help decrypt DVDs was released onto the Internet.

The program, called qrpff, can simultaneously decode and play DVDs. Qrpff is seven lines of Perl code that, when paired with an encryption key, removes CSS, the Contents Scramble System used to provide digital protection to DVDs and ensure that they are only viewed on approved devices. The code was released as the appeals phase of the DeCSS trial is beginning to gather steam. DeCSS is another program that removes CSS and allows for copying or viewing of DVDs.

The Motion Picture Association of America (MPAA), the industry trade group made up of the major movie studios and the instigating force behind both DVDs and CSS, filed suit against 2600: The Hacker Quarterly, a magazine dedicated to phone and computer hacking, over DeCSS and won a wide-ranging decision in August. But 2600, along with its legal backer, the Electronic Frontier Foundation, are appealing the verdict. The U.S. Department of Justice has since joined the fray, siding with the MPAA in a brief filed in late February.

IDG.net INFOCENTER PCWorld.com home Free daily newsletters PCWorld.com: Week in Reviews TechInformer Related IDG.net Stories Judges bars linking in DeCSS case DOJ slams publisher of DVD code FBI warns businesses about Internet extortion schemes Features Top 15 notebook PCs An inside tour of the Pentium 4 Surviving a disk crash: A checklist Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com SunWorld IDG.net search

The MPAA is "aware of [qrpff] and is taking a look at it," according to Rich Taylor, an MPAA spokesperson. Taylor declined to go into further detail.

Legal scholars and open-source software advocates have decried the rulings against DeCSS and the law that such rulings affirm--1998's Digital Millennium Copyright Act, or DMCA--as a threat to traditional consumer fair use rights. Fair use is a section of law that allows for quoting and noncommercial sharing of copyrighted materials. DVDs and CSS abridge these rights, they charge, because they require that legally purchased DVDs can only be viewed on certain approved players. DeCSS was created as DVD playback software for Linux, an open-source operating system that lacked such a player at the time. (At least one has since been created.)

Qrpff was created by Massachusetts Institute of Technology (MIT) computer science student Keith Winstein and MIT alumnus Marc Horowitz as a demonstration for a seminar Winstein taught at the college called "Decrypting DVD," which discussed the technical and legal issues surrounding the DeCSS decision and the DMCA, Winstein said in an e-mail interview.

Winstein says the program "helps demonstrate the preposterous incongruity" of barring the spread of such computer programs, as has been done with DeCSS. Computer programs, and their source code, ought to be protected as free speech, he argues. Qrpff is a good illustration of this issue because anyone "can write those seven lines of code on a piece of paper and hand them to you," which would, presumably, make them protected speech.

Furthering the free-speech argument, Winstein cited a recent comic strip that posed the question, "Why is it perfectly legal to post bomb-making instructions on the Internet, but it's not okay to post code that descrambles DVDs?"

Qrpff was created to make a legal point rather than a technical one, Winstein says.

"There's not a lot of technical need for a seven-line slow Perl CSS descrambler. The real 'need,' then, is probably in helping to make the argument that no constitutional law could restrict the production and distribution of this kind of expressive speech."

Of course, others, notably 2600's Eric Corley, have made the same argument and lost. Winstein isn't taking any chances.

"I think there's a reasonable case to be made that even if whatever is enjoined by that injunction in New York [the DeCSS injunction] is in fact illegal, I'm still in the clear. However, I'm not stupid. If they take action against me, I'll get a lawyer," he wrote.

Has the DVD-hacking case made a t-shirt illegal?
September 8, 2000
DeCSS: Round one to Hollywood, but the fight continues
August 23, 2000
Passionate reactions online to the DVD-copying decision
August 22, 2000
Focus on the DeCSS trial
July 27, 2000

Judges bars linking in DeCSS case
(IDG News Service - IDG.net)
DOJ slams publisher of DVD code
(IDG News Service - IDG.net)
FBI warns businesses about Internet extortion schemes
(The Industry Standard)
Top 5 encryption utilities
(PCWorld.com)
European cyber-crime proposal blasted
(IDG News Service - IDG.net)
Users to IBM: Beef up your wares
(Network World Fusion)
12 keys to keeping your company safe
(CIO)
Decoy nets gain backers in battle against hackers
(Network World Fusion)

Department of Justice

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.