A "Key" to Civil Disobedience

Location: Home :: Comments :: C 09 I f9 V 11 I 02 L 9d D 74 I e3 S 5b O d8 B 41 E 56 D c5 I 63 E 56 N 88 C c0 E

On the Path to Reenabling Fair Use, or How a Random Number Became Illegal to Write.

An event happened which brought intellectual property laws to the fore and will change the shape of our nation's laws. I'm no more than a single participant in that event, one among a few million, but I'm a participant nonetheless. This is not something I do lightly. I have spent a great deal of time considering this, and I've decided to participate in an act of civil disobedience.

The key is 09F911029D74-E35B-D841-56C5-635688C0.

Or, in a form slightly more appreciable by human beings, 13,256,278,887,989,457,651,018,865,901,401,704,640. That's 13 undecillion in short scale or 13 sextillion in long scale.

The number is not de-jure illegal to write (yet), but the Hollywood Cartel would sure love it to be. I'll explain what it means.

It's no secret that I'm not a fan of the DMCA; it's a law I thought was a Very Bad Idea™ since before Clinton's '98 Congress passed it. Among its provisions is a clause which makes explicitly illegal the defeat or bypass of any hardware- or software-based copy prevention mechanism for any purpose whatsoever, including what's otherwise fair or free use. The most common name for this class of copy protection mechanisms is DRM, an acronym which is supposed to mean "Digital Rights Management," but which consumers are slowly realizing actually means "Digital Restrictions Management." So although we have the right to use others' copyrighted work for certain purposes and the right to use public domain work for any purpose, thanks to the DMCA we don't have the right to access that work if it has DRM, even though we own the media on which it's stored, and even if the DRM-protected work is in the public domain. Under a strict and literal interpretation of the DMCA, we don't have the right to exercise our rights with DRM-protected works.

DRM manages rights in the same way the prison system manages freedom.

When the DVD standard was created, once upon a time, a DRM licensing authority for the DVD's DRM system was created as well. The system is called "Content Scramble System" (CSS), and the authority is called the DVD Copy Control Association (DVD-CCA). CSS was cracked in 1999 by DVD-Jon and two anonymous others as a program whose code would become known as DeCSS. The purpose was to bring DVD playback capabilities to PCs with DVD-ROM drives and without Microsoft Windows, operating systems such as the varieties of Unix and Linux. When the code was leaked, the Motion Picture Association of America (MPAA) was of course outraged and took measures to remove the code from as many Web sites as it could, and yet pleas for DVD playback on any OS but Microsoft Windows and Apple Mac OS continued to be ignored. The act of civil disobedience then was to publish the code, which was only a few lines long, in a variety of ways: T-shirts, wallpapers, song recordings, and as a prime number which decompressed into the code, among a few others.

The DeCSS code is still technically illegal, but it's the long and hard way to crack CSS anyway. The code revealed that CSS keys are vulnerable to brute force cracking in under a day, and much faster methods have been developed anyway. The CSS system is so broken now that an increasing number of DVD titles are being pressed and sold by copyright owners with no DRM at all.

Now, Unix and Linux users are able to watch their legally purchased DVDs in the legally purchased DVD players built in to their computers. The legality of doing so is still uncertain to this day, but the widespread protests and civil disobedience sparked by the MPAA's actions against DeCSS made it possible. Without the DeCSS incident, DVD playback in Unix and Linux, legal or not, would still be impossible.

The reason for this historical interlude? Well, on May First, it happened again. This time, it was with the HD DVD format.

The players this time are the Advanced Access Content System (AACS) DRM format, and the AACS Licensing Administrator (AACS-LA) association. HD DVD players had been on the market for less than 14 months when the AACS key hit the fan. The key had actually been published several months ago; indeed, tools to make backup copies of HD DVD and Blu-Ray disks have been available since late last year. AACS as a DRM system is so much weaker than CSS, despite using stronger, 128-bit AES keys and a system of key revocation, that even the IEEE recognized the weakness of AACS more than a year before it was deployed.

Yes, this is the same AACS at the center of the longest suicide note in history.

As a consequence of the key's leak in February, The AACS-LA revoked the key in April. What this means for the consumer is that HD DVDs mastered after April 23rd can't be played in HD DVD players without a software update. It's just one more annoying thing consumers have to do after buying a PC with WinDVD or PowerDVD preinstalled should they get a version whose key has been revoked. And that's assuming consumers don't simply conclude that the disks, rather than the players, are broken.

AACS depends on a system of key revocation, seemingly conceding to the fact that the system will be cracked. As keys are revealed, the disks and players are upgraded with information to invalidate those keys. Player manufacturers previously assigned those compromised keys must push updates within 90 days of the AACS-LA's decision, or else their customers will find themselves unable to play new disks. WinDVD and PowerDVD users are finding that out the hard way. The problem is that, if the system is fundamentally weak, the key revocation cycle becomes accelerated and never-ending as more keys are discovered, revealed, and published. AACS ensures that the revoked keys become virtually worthless.

But as much as it leaves law-abiding consumers in the lurch, it hasn't thwarted the true pirates at all. AACS has proven to be so weak that the latest AACS revision was defeated a week before its release on new HD DVD disks. Ironically, the revision was supposed to protect the HD releases of The Matrix, a trilogy about using massively distributed computer systems to break the bonds of control those same systems have over the human mind.

On May First, the AACS key at the top of this article was embedded in a story linked from a user-submitted story on Digg.com. (I'm a user, and you can see the stories I've dugg there.) Digg.com received a demand letter from the MPAA to take down the story, and in addition to complying with the letter, Digg.com banned the user who posted the link. [Google received a similar demand letter on April 17th.] Out of fear of a lawsuit, the Digg.com administrators started deleting stories and banning users wholesale for posting variations on the link and story in question. But the pace of stories submitted and dugg outpaced the deletion, and by the end of the day the entire homepage was literally filled with stories exposing the key.

When Digg.com founder Kevin Rose got online and realized the futility of fighting the revolt on his hands, he officially relented. His users' reaction to the story is here: "Digg This: 09-f9-11-02-9d-74-e3-5b-d8-41-56-c5-63-56-88-c0" posted by kevinrose. As the founder of an entirely user-driven site, he had no real choice. If he gave up and sided with his users, as he did, then he risks being sued and shut down. However, if he continued to fight against his users, he still risked being sued for inadequately preventing the key's dissemination and shut down anyway, or worse, driving away his users and being left with a ghost site. The difference between both otherwise identical fates is that he'll have the support of the community he built even if he loses.

The DVD Forum (developer of the HD DVD format) was a primary sponsor of Digg.com up until the AACS revolt, and Digg.com's initial reaction to the incident did not help the perception (true or not) that they're in the DVD Forum's back pocket. I don't know whether Digg.com still runs the Forum's HD advertisements or not because I use the NoScript extension for Firefox now.

Before May First, Google revealed that fewer than two thousand Web sites contained the key. As of today, the same search returned 1.3 million Web sites. Most search engines are returning a similar number of results. Civil disobedience is alive and well on the Internet. People have participated in this civil disobedience by putting the key on t-shirts (in various forms and quality everywhere), in songs [YouTube, 1:05] [Mirrored at Archive.org] (this one I think is catchy), as presumably illegal colors, in comic strips, in a riddle, widely broadcast news reports (most broadcasting the first image on this page with ThePirateBay.org homepage), a movie [YouTube, 1:06], and even a tattoo of the key, not to mention an illegal number dot-com and an illegal number dot-ws site.

AACS-LA succeeded at least in part with what they claimed they wanted to do: remove a copy protection circumvention device from the Internet. They succeeded in part by failing in the most spectacularly miserable way possible. The key was revoked even before the revolt, rendering it largely worthless, and the widespread dissemination of the key has devalued it completely: More people now know the key than have HD DVD players. It's possible that more people now know this key than there exist HD DVD disks, let alone players. It is now and evermore a symbol of civil disobedience rather than a circumvention device.

An argument can be made that this was a genuine revolt against the rule of law, the result of which can only be mob rule or anarchy. However, the rule of law has always been predicated on the belief that the power of government descends either directly or ultimately from the consent of the governed. The governed are awakening to the fact that the DMCA usurps more rights than its proponents say it protects; we're awakening to the fact that even though our rights per sé may not be taken away, our legal ability to exercise those rights has been.

Say what you will about how unruly the event was or about how irresponsible it is to do this, but it's in the end nothing more than an act of civil disobedience. Rather than trying to silence the millions of voices, those in power, and those who merely think they have power, would be wise to listen to that message.

• AACS is unbreakable - [Google Video, 2:15] - muslix64 of forum.doom9.org.
• Hackers discover HD DVD and Blu-ray "processing key" -- all HD titles now exposed - Thomas Ricker at Engadget.
• The New HD-DVD/Blu-Ray Hack: What It Might Mean For Us - Rob Beschizza, Gadget Lab, Wired Magazine Blog Network.
• I got a DMCA take down notice - Google Blogoscoped Forum.
• AACS licensor complains of posted key - Sent by Proskauer Rose LLP on behalf of AACS LA to Google Inc. - Chilling Effects Clearinghouse.
• AACS licensing authority censors Cory Doctorow's class blog - Adrian Kingsley-Hughes, ZDNet Blogs, CNET Networks.
• Blogger: Digg Banned me for Typing a Number - Mat Honan, The Underwire, Wired Magazine Blog Network.
• HD DVD Key.com - Anonymous blog.
• AACS Plays Whack-a-Mole with Extracted Key - Ed Felten, Freedom to Tinker.
• Stickin' it to the man: the illustrated report of an epic event - Rudd-O.com.
• 09 f9: A Legal Primer - Fred von Lohmann, Electronic Frontier Foundation (EFF).
• Why the AACSLA are desperate to force the "forbidden numbers" genie back into the bottle - Adrian Kingsley-Huges, ZDNet Blogs, CNET Networks.
• Digg Users Revolt Over AACS Key - Ed Felten, Freedom to Tinker.
• Does The Number have a lesson for human rights activists? - WorldChanging.
• Why the 09ers Are So Upset - Ed Felten, Freedom to Tinker.
• DVD-decoder fiasco shows lawyers are behind the times - John C. Dvorak, MarketWatch. "I think it's time I doled out some advice for the corporate executives who can't bring themselves to admit it's not 1952 anymore."

This work is licensed under a Creative Commons Attribution-No Derivative Works 3.0 License.