It's time for another battle in the war over whether law can suppress technology well enough to enforce some social purpose. The publication of an Advanced Access Content System (AACS) encryption key used for current high definition DVD (HD DVD) content set off a round of legal threats trying to inhibit the spread of cryptographic data. And those threats have been opposed by making the contraband information into a cause célèbre.
We've been here before. During the controversies over the use of strong cryptography and the program Pretty Good Privacy (PGP), people put RSA encryption code in email signatures. Note, contrary to a romantic myth, the government investigation of PGP did not arise from Orwellian reasons. It was instigated by a private company out of revenge stemming from software patent rights disputes.
Similarly, when DVD encryption was reverse engineered (not, as myth has it, by the teenage Jon Johansen, but by others, some of whom are still anonymous) the resulting code was the subject of a lawsuit that sparked an explosion of ways to express and publicise the algorithm.
Now, a certain 128-bit number is being written all over the internet and this HD DVD key is the target of many legal notices (as well as spawning new myths). Digg has been the focus of controversy - and perhaps publicity stunts - over whether that information can safely be posted, as has Wikipedia. A full-scale net storm is under way and it's all fun and games until someone gets sued. Though the key is reportedly no longer being used on new DVDs, I suspect some of the legal threats are more to try to establish an intimidating posture, perhaps in preparation for the next key leak.
Many people have been confused about the legal reasoning behind the threats. In the US, the Digital Millennium Copyright Act created a new set of regulations concerning technology which enforces copyright. One new offence is "circumvention" - a new prohibition involving technological measures that restrict the ability to manipulate a work. It has nothing to do with copyright violations such as infringement. That is, one can be making completely legitimate use (fair use) of one's own legal copy of a work, yet still be on the wrong side of the law because a company made such use technically difficult (tinyurl.com/2wlglx).
Further, algorithms and cryptographic keys are arguably "technology" within the meaning of the act and conveying such information can be an offence called trafficking. A simple way to grasp it all is to consider this akin to a draconian Official Secrets Act, applicable to restrictions related to copyright rather than national security, and usable by any corporation rather than the government. So anything having to do with the means of decrypting copyrighted material can be treated as if it were a state secret.
These extreme measures, where discussing details of DVD players could carry more legal risk than revealing military secrets, should not go unquestioned. Rather that speculate on who will win in conflicts of lawyer versus programmer, consider instead the amount of lawyering devoted to shoring up a system of rigid control over the ability to use content. That should give us pause.
As Judge Alex Kozinski has written about the immense power that can be invoked in the name even of traditional copyright: "Think about this for a moment. Congress has given courts the power to order books burned. In a legal regime as jealously protective of freedoms of speech and press as ours, this ought to give us some pause. What's that, you say? Classified documents about our Vietnam war effort have been stolen from the Pentagon and given to the newspapers? You want an injunction to avoid risking the death of soldiers, the destruction of alliances, the prolongation of war? No way, Jose; this is the land of the brave and the home of the free. But wait a minute - did you say someone drew a picture of OJ Simpson wearing a goofy stovepipe hat? Light the bonfires!"
What freedoms will we incinerate to protect a business model?
· If you'd like to comment on any aspect of Technology Guardian, send your emails to tech@theguardian.com