Silenced professor sues over encryption research

From...

By Scarlet Pruitt

(IDG) -- The Princeton professor whose digital-music-cracking research was squashed by the Secure Digital Music Initiative (SDMI) organization last April filed suit against the SDMI and a group that represents major record labels in a New Jersey federal court, asking to publish his research without fear of prosecution.

Professor Edward Felten and his research team, represented by the Electronic Frontier Foundation (EFF), lodged the suit against the SDMI, the Recording Industry Association of America Inc. (RIAA), watermark technology company Verance Corp., which made one of the watermarks Felten's team cracked, and the U.S. Department of Justice after Felten and his team said they were threatened with legal action if they presented their findings from a SDMI hacking challenge.

In a statement posted on its Web site, the RIAA said that "Professor Felten's decision to sue the RIAA and SDMI Foundation is inexplicable. We have unequivocally and repeatedly stated that we have no intention of bringing a lawsuit against Professor Felten or his colleagues."

The statement continues to say that Felten and the EFF are using the suit as a publicity measure and that the RIAA has "no issue with the publication of the paper."

IDG.net INFOCENTER IDG.net's main page Free daily newsletters Instant help from the Dummies Network Computerworld Communities Related IDG.net Stories Under RIAA pressure, academic does not present paper DeCSS hacker's appeal hinges on what's fair SDMI timeline: The course of events from 1998-2001 Features How to make your PC a fortress Napster alternatives The best low-cost PCs Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider IDG.net search

No one at the SDMI was available for comment Wednesday afternoon.

Felten and his team were one of two groups that claimed to have successfully broken through the digital watermark technology SDMI put forth during a much-publicized hacking challenge. Felten was scheduled to present the team's watermark-busting findings and techniques at the Hiding Workshop conference, held April 25-27 in Pittsburgh, but chose not to after he received a letter from the SDMI threatening a lawsuit [See "Under RIAA pressure, academic does not present paper" April 26 ].

SDMI, which is both the name of the organization and the technology it is attempting to implement to make digital music secure, claimed that by presenting the findings, Felten and his team would be violating the 1998 Digital Millennium Copyright Act (DMCA), which makes it illegal to provide technology that bypasses industry controls limiting how consumers can use music they have purchased.

Felten and the EFF claim that the DMCA stymies academic research and freedom that should be protected under First Amendment rights.

The EFF said Wednesday that it is challenging the constitutionality of the DMCA's anti-distribution provisions and is asking the federal court to give Felten and his team the right to present their digital music access research at an USENIX Security Conference in Washington, D.C. this August, without fearing reprisal from the record industry. The USENIX association, representing roughly 10,000 computer research scientists, is also a co-plantiff in the case.

"We want them to pledge not to take action against the paper and all future papers as well," EFF Legal Director Cindy Cohn said in a conference call Wednesday. "It's not appropriate for scientists to have to ask the industry for permission to present research."

When asked about the RIAA's claim that it has no issue with the publishing of the paper, Cohn said that given the association's response to Felten's initial attempt to publicize his findings, she did not believe that they wouldn't try to intervene.

"They have made clear that the only way they would agree to it being presented is if it was substantially dumbed down," said Cohn.

Although the record industry supposedly wants to keep its technology secrets out of the hands of the general public, Felten contends that the paper is not a blueprint for cracking SDMI's technologies.

"The paper would be unintelligible to a lay person," Felten said.

Furthermore, Felten claims that the SDMI and RIAA's alleged efforts to keep his research from being published is a case of shooting the messenger.

"We are not going to change the weaknesses in the technology by publishing the paper," Felten said. "The technology is weak. It would be widely defeated, quickly."

Felten added that the research is not only meant to benefit the scientific community, but also the record companies.

"If they are buying into this technology, they have a right to know if it actually works," said Felten.

The SDMI hacking challenge was originally meant to identify holes in their digital watermark technologies -- audio marks in music files -- which were intended to protect copyright materials.

"The record companies want to distribute their music in digital straightjackets but want to make it illegal to talk about whether their straight jackets work or not ," said Cohn.

The true arrow of the plaintiffs' case is not aimed at the defendants, however, but at the highly-charged subject of the DMCA. The DMCA makes it a crime to provide information that can sidestep copyright protection devices, which Felten and his team could be seen as doing by publishing their research.

The DMCA is also the focal point of another one of EFF's high-publicity cases involving a magazine's publishing of a DVD (digital versatile disk) descrambling source code called DeCSS (De Contents Scramble System) [See "DeCSS hacker's appeal hinges on what's fair" May 1].

The EFF made it clear Wednesday that even if they win the fight with the record industry to get Felten's paper published, they will continue to press against the DMCA.

The DMCA is why USENIX joined the case, saying that the association feared that it could be held criminally liable for material presented at its conferences under the Act's provisions.

The plaintiffs are hoping to get a decision on the case before the August USENIX conference, and say that if the decision is delayed, it is unlikely the research would be presented without a guarantee that the scientists would be protected from litigation.

It remains to be seen how the case will proceed given the RIAA's claim that the defendants have no intention of suing the professor or his colleagues.