New decryption code underscores DVD security weakness

MIT student Keith Winstein and alum Marc Horowitz say they're out to prove a point: Publishing code that decrypts and plays DVD movies is not a crime.

In their case, they assert it's about teaching copyright issues and is thus protected under the First Amendment.

Last week, a Web site published the pair's seven-line program, which unscrambles the protection around a DVD so quickly that a movie can play at the same time, although the film appears choppy. It's the shortest program to break DVD defenses to date.

"It is nice to have a short" program, said Winstein, an undergraduate in electrical engineering and computer science at the Massachusetts Institute of Technology. "You can write these seven lines of code on a piece of paper and give it to someone. It's ridiculous to say that that's not protected speech."

The act, however, may make the duo a target of the Motion Picture Association of America, the collection of Hollywood studios gunning for anyone who tries to break the digital fence surrounding the content on digital video discs.

The MPAA is looking into the new program, spokeswoman Emily Kutner said Wednesday.

Winstein and Horowitz created the program as part of a two-day MIT seminar that Winstein taught earlier this year on the debate surrounding the Digital Millennium Copyright Act, the controversial law that broadens copyright holders' power to protect their content online.

During the course, Winstein used the short program to illustrate that breaking DVD encryption is trivial, he said. "It was definitely not a copyright-circumvention course for DVDs."

To date, Hollywood has rigorously defended its digital turf.

A year and a half ago, several researchers broke the encryption that protects DVD movies as part of an international open-source project to allow the discs to be played on the Linux operating system. Known as the Content Scrambling System, or CSS, the encryption protecting DVD content acted as a digital defense protecting what movie studios consider to be near-perfect copies of their films.

Three months later, the movie studios and a DVD licensing group sued anyone who had posted or linked to the so-called DeCSS code-breaking program on the Internet. Many sites dropped the text file from their site, but a hacker publication called 2600 decided to fight.

In August, U.S. District Court Judge Lewis Kaplan ruled that 2600 could not post links to versions of the program even if they were stored overseas. With the case now on appeal, the National Football League, Major League Baseball, the Department of Justice and other organizations have added their voice in filings supporting Hollywood moviemakers.

Because the new program does not resemble DeCSS, the seven-line text file may not be covered by the current court cases, said Robin Gross, staff attorney for the Electronic Frontier Foundation, the digital rights organization representing 2600 in its case.

"What it really shows is how futile injunctions against individual programs are," Gross said. "The code itself doesn't violate any copyrights. They would have to bring an entirely new case against this code."

Two months ago, 17 computer scientists--including well-known encryption experts, security researchers and artificial intelligence gurus--filed arguments supporting the right of 2600 to link to the program.

Others, including Carnegie Mellon University professor David Touretzky--whose site is hosting the latest seven-line program--have also testified in defense of linking.

The new code could add another ripple to the legal waters, said Gross, underscoring the assertion that the code is instructive. In addition, Winstein said that today no one would use the program for routinely watching movies. The unscrambling takes so much processing power, he said, that even on a 933MHz processor, movies appear choppy.

"All programs are is instructions that teach you how to do something," Gross said. "Once you understand it, you can make it better. That's what these guys have done."