May 30, 2024

Archives for March 2003

Keeping Honest People Honest

At today’s House committee hearing on the broadcast flag, Fritz Attaway of the MPAA used a popular (and revealing) argument: the purpose of the broadcast flag is “to keep honest people honest.” This phrase is one of my pet peeves, since it reflects sloppy thinking about security.

The first problem with “keeping honest people honest” is that it’s an oxymoron. The very definition of an honest person is that they can be trusted even when nobody is checking up on them. Nothing needs to be done to keep honest people honest, just as nothing needs to be done to keep tall people tall.

The second problem is more substantial. To the extent that “keeping honest people honest” involves any analytical thinking, it reflectss a choice to build a weak but conspicuous security mechanism, so that people know when they are acting outside the system designer’s desires. (Mr. Attaway essentially made this argument at today’s hearing.) The strategy, in other words, is to put a “keep out” sign on a door, rather than locking it. This strategy indeed works, if people are honest.

But this is almost never the kind of security technology that the “keeping honest people honest” crowd is advocating. In my experience, you hear this phrase almost exclusively from advocates of big, complicated, intrusive, systems that have turned out to be much weaker than planned. Having failed to build a technologically strong system, they say with cheerful revisionism that their goal all along was just to “keep honest people honest.” Then they try to sell us their elaborate, clunky, expensive system.

The problem is that it’s cheap and easy to build a “keep out” sign. If that’s all you want – if all you want is to help honest people keep track of their obligations – then simple, noncoercive technology works fine. You don’t need a big, bureaucratic initiative like the broadcast flag if that’s your goal.

The funny thing here is that the MPAA is getting out in front of the curve. Usually vendors wait until their security technology has failed before they change their sales pitch to “keeping honest people honest.”

Lexmark Opinion Available

The Court’s opinion in the Lexmark case is now available. Here’s a summary. (Caveat: I’m inferring some of the technical details, since all I have is the Court’s summary of what the expert witnesses said; but I’m fairly confident that my inferences are correct.)

Toner cartridges for certain Lexmark printers contain small computer programs that tell the printer how much toner is left in the cartridge. The Lexmark printers use cryptographic means to “authenticate” the cartridge program; if the program doesn’t pass the cryptographic test, the printer refuses to work with it.

Static Control’s cartridge chip contains a verbatim copy of the Lexmark cartridge program, a program which is about fifty bytes in length. The Court found this small program to be copyrightable. The Court also found, as a factual matter, that Static Control could have figured out by further reverse engineering how to write a different program that passed the cryptographic test. (Lexmark did not challenge Static Control’s right to reverse engineer any of the Lexmark products.) The Court therefore found that Static Control’s redistribution of Lexmark’s cartridge program was copyright infringement.

The Court also ruled that Static Control’s program was a circumvention device under the DMCA, since (the Court said) it circumvented Lexmark’s cryptographic handshake. The Court actually found that the handshake controls access to both the cartridge program and the printer’s software, therefore finding a double DMCA violation.

If the Court’s factual findings are correct, the copyright portion of the ruling seems pretty straightforward.

The DMCA portion is another story. According to the Court, the Lexmark software implements the access control measure; but the Static Control software which is completely identical to the Lexmark software is improperly circumventing the measure. In other words, circumvention is determined not by what a device does, but by whether the maker of some complementary product has approved it.

The other slightly puzzling aspect of the Court’s DMCA analysis is the finding that the cryptographic handshake controls access (by the user) to the printer’s software. Whether or not a valid toner cartridge is inserted, the printer’s software runs, and it provides services to the user. Thus the user has access to the printer software no matter what; so it’s hard to see how anything is controlling access. True, the printer software behaves differently when a conforming cartridge is inserted, but it seems like a real stretch to say that this change in behavior constitutes “access” to the printer.

It will be interesting to see what happens next. Perhaps the copyright ruling will render the DMCA issues moot; or perhaps the Court’s DMCA reasoning will be subject to review at some point.

Static Control Countersues Lexmark

Static Control, a maker of replacement toner cartridge supplies for Lexmark-brand printers, has added antitrust claims to a lawsuit against Lexmark, reports an AP story by Paul Nowell.

Lexmark had sued Static Control for copyright infringement and DMCA violations, after Static Control sold chips that allow non-Lexmark toner cartridges to work in Lexmark printers. Recently a Federal judge issued a preliminary injunction against Static Control, ordering them to stop selling the chips. (I’ll be writing more about the judge’s decision later.)

Static Control’s new countersuit apparently alleges that Lexmark’s actions constitute an illegal attempt to monopolize the market for Lexmark-compatible toner cartridges. Lexmark’s actions, in designing its technology and then in trying to stop Static Control’s chip sales, appear to have been designed to keep other companies out of the market for Lexmark-compatible toner cartridges. Whether this violates antitrust law remains to be seen.

Broadcast Flag Blues

The FCC recently accepted reply comments on its broadcast flag proposal. I submitted a written comment, pointing out that some technical claims made by the MPAA (Motion Picture Association of America) in their comments were spectacularly wrong.

[Background: The FCC, which regulates television broadcasting, asked for public comments on whether to issue “broadcast flag” regulations. It’s not clear exactly what form such regulations would take; they might be either broad or narrow. If issued, such regulations would almost certainly make it illegal to make or sell certain kinds of digital video technology.]

The MPAA told the FCC that with today’s technology, ordinary home users could capture digitally broadcast television programming and redistribute it easily on the Net via email or other means. They claim this is much easier than old-fashioned videotape infringement. Their claim is ridiculously wrong, as even the most basic technical analysis illustrates.

A digitally broadcast movie of the week takes up about 26 Gigabytes (26 billion bytes) of storage. What happens when you email a 26 Gigabyte file to a friend? Try it now and see what happens. Really. Go ahead and do it.

What’s that? You don’t have 26 Gigabytes of free space on your hard drive? Actually, you need about 80 Gigabytes of free space, or your email program will run out of space when it tries to put together the outgoing email message. No problem, a new 80 Gigabyte drive only costs $125. And don’t forget to order two drives – your friend will need one too so he can receive your email.

Oh, and when you send the message, remember that your email service probably limits message sizes to 10 Megabytes or so. No problem, you can stay under the limit by breaking up the file into 3500 pieces, and sending them as 3500 separate email messages. (Your friend won’t mind reassembling the pieces, I’m sure.)

By the way, you need to be careful not to overflow your friend’s email inbox, which can probably hold only a handful of these messages at a time. Just send the first five messages; when your friend has removed them from his inbox, he can send you an email telling you to send the next five. Repeat this 700 times, and you’re done. The whole process only takes four days if both of you work at it nonstop, day and night.

Of course, if you want to send the file to more people, it will take four extra days for each additional person.

The MPAA’s FCC filing calls this kind of piracy “instantaneous, effortless, and costless” and says that it has “no delay